hazo_auth 9.1.1 → 10.0.0

package/dist/lib/schema/sqlite_schema.d.ts

@@ -1,2 +1,2 @@
-export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified BOOLEAN DEFAULT false,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\n-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on\n-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.\n-- The plaintext \"token\" column is retained nullable for legacy compatibility\n-- but new writes only set token_hash.\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT UNIQUE,\n  token_hash TEXT,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Super admin scope\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000000', NULL, 'Super Admin', 'system', datetime('now'), datetime('now'));\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress BOOLEAN DEFAULT true,\n  can_edit_profile BOOLEAN DEFAULT true,\n  can_delete BOOLEAN DEFAULT false,\n  is_self BOOLEAN DEFAULT false,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n";
+export declare const SQLITE_SCHEMA = "\n-- hazo_auth canonical SQLite schema\n-- This schema creates all tables required by hazo_auth\n\n-- Users table (from migration 011)\nCREATE TABLE IF NOT EXISTS hazo_users (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL UNIQUE,\n  password_hash TEXT,\n  name TEXT,\n  email_verified BOOLEAN DEFAULT false,\n  login_attempts INTEGER DEFAULT 0,\n  last_logon TEXT,\n  profile_picture_url TEXT,\n  profile_source TEXT CHECK(profile_source IN ('gravatar', 'custom', 'predefined')),\n  mfa_secret TEXT,\n  url_on_logon TEXT,\n  google_id TEXT UNIQUE,\n  auth_providers TEXT DEFAULT 'email',\n  user_type TEXT,\n  app_user_data TEXT,\n  status TEXT DEFAULT 'ACTIVE' CHECK(status IN ('PENDING', 'ACTIVE', 'BLOCKED')),\n  managed_by_user_id TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  pin_hash TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_email ON hazo_users(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_google_id ON hazo_users(google_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_users_status ON hazo_users(status);\n\n-- Refresh tokens table\n-- Note: runtime (token_service.ts) writes token_hash (argon2-hashed value) on\n-- insert and verifies via argon2.verify(token_hash, plaintext_token) on read.\n-- The plaintext \"token\" column is retained nullable for legacy compatibility\n-- but new writes only set token_hash.\nCREATE TABLE IF NOT EXISTS hazo_refresh_tokens (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  token TEXT UNIQUE,\n  token_hash TEXT,\n  token_type TEXT DEFAULT 'refresh',\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_user ON hazo_refresh_tokens(user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token ON hazo_refresh_tokens(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_refresh_tokens_token_hash ON hazo_refresh_tokens(token_hash);\n\n-- Roles table\nCREATE TABLE IF NOT EXISTS hazo_roles (\n  id TEXT PRIMARY KEY,\n  role_name TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Permissions table\nCREATE TABLE IF NOT EXISTS hazo_permissions (\n  id TEXT PRIMARY KEY,\n  permission_name TEXT NOT NULL UNIQUE,\n  description TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\n-- Role-permission assignments (composite PK, no id column)\nCREATE TABLE IF NOT EXISTS hazo_role_permissions (\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  permission_id TEXT NOT NULL REFERENCES hazo_permissions(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (role_id, permission_id)\n);\n\n-- Unified scopes table (hierarchical multi-tenancy)\nCREATE TABLE IF NOT EXISTS hazo_scopes (\n  id TEXT PRIMARY KEY,\n  parent_id TEXT REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  level TEXT NOT NULL,\n  logo_url TEXT,\n  primary_color TEXT,\n  secondary_color TEXT,\n  tagline TEXT,\n  slug TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);\nCREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);\n\n-- Default system scope (for non-multi-tenancy mode)\nINSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)\nVALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));\n\n-- User-scope assignments (membership model with scope-specific roles)\nCREATE TABLE IF NOT EXISTS hazo_user_scopes (\n  user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  status TEXT DEFAULT 'ACTIVE' CHECK (status IN ('INVITED', 'ACTIVE', 'SUSPENDED', 'DEPARTED')),\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now')),\n  PRIMARY KEY (user_id, scope_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_scope ON hazo_user_scopes(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_root ON hazo_user_scopes(root_scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_scopes_role ON hazo_user_scopes(role_id);\n\n-- Invitations table\nCREATE TABLE IF NOT EXISTS hazo_invitations (\n  id TEXT PRIMARY KEY,\n  email_address TEXT NOT NULL,\n  token TEXT NOT NULL UNIQUE,\n  scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  root_scope_id TEXT NOT NULL REFERENCES hazo_scopes(id) ON DELETE CASCADE,\n  role_id TEXT NOT NULL REFERENCES hazo_roles(id) ON DELETE CASCADE,\n  invited_by TEXT REFERENCES hazo_users(id) ON DELETE SET NULL,\n  status TEXT NOT NULL DEFAULT 'PENDING' CHECK(status IN ('PENDING', 'ACCEPTED', 'EXPIRED', 'REVOKED')),\n  expires_at TEXT NOT NULL,\n  accepted_at TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  changed_at TEXT NOT NULL DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_email ON hazo_invitations(email_address);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_token ON hazo_invitations(token);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_scope ON hazo_invitations(scope_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_status ON hazo_invitations(status);\nCREATE INDEX IF NOT EXISTS idx_hazo_invitations_expires ON hazo_invitations(expires_at);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_users_managed_by ON hazo_users(managed_by_user_id);\n\n-- Relationships table\nCREATE TABLE IF NOT EXISTS hazo_user_relationships (\n  id TEXT PRIMARY KEY,\n  parent_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  child_user_id TEXT NOT NULL REFERENCES hazo_users(id) ON DELETE CASCADE,\n  relationship_type TEXT NOT NULL DEFAULT 'parent',\n  can_view_progress BOOLEAN DEFAULT true,\n  can_edit_profile BOOLEAN DEFAULT true,\n  can_delete BOOLEAN DEFAULT false,\n  is_self BOOLEAN DEFAULT false,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  UNIQUE(parent_user_id, child_user_id)\n);\n\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_parent ON hazo_user_relationships(parent_user_id);\nCREATE INDEX IF NOT EXISTS idx_hazo_user_relationships_child ON hazo_user_relationships(child_user_id);\n\n-- Firm admin role (for firm creators)\nINSERT OR IGNORE INTO hazo_roles (id, role_name, created_at, changed_at)\nVALUES (lower(hex(randomblob(4)) || '-' || hex(randomblob(2)) || '-4' || substr(hex(randomblob(2)),2) || '-' || substr('89ab',abs(random()) % 4 + 1, 1) || substr(hex(randomblob(2)),2) || '-' || hex(randomblob(6))), 'firm_admin', datetime('now'), datetime('now'));\n";
 //# sourceMappingURL=sqlite_schema.d.ts.map

package/dist/lib/schema/sqlite_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,uuOAmKzB,CAAC"}
+{"version":3,"file":"sqlite_schema.d.ts","sourceRoot":"","sources":["../../../src/lib/schema/sqlite_schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,ogOA+JzB,CAAC"}

package/dist/lib/schema/sqlite_schema.js

@@ -96,10 +96,6 @@ CREATE INDEX IF NOT EXISTS idx_hazo_scopes_parent ON hazo_scopes(parent_id);
 CREATE INDEX IF NOT EXISTS idx_hazo_scopes_level ON hazo_scopes(level);
 CREATE INDEX IF NOT EXISTS idx_hazo_scopes_slug ON hazo_scopes(slug);
 
--- Super admin scope
-INSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)
-VALUES ('00000000-0000-0000-0000-000000000000', NULL, 'Super Admin', 'system', datetime('now'), datetime('now'));
-
 -- Default system scope (for non-multi-tenancy mode)
 INSERT OR IGNORE INTO hazo_scopes (id, parent_id, name, level, created_at, changed_at)
 VALUES ('00000000-0000-0000-0000-000000000001', NULL, 'System', 'default', datetime('now'), datetime('now'));

package/dist/lib/scope_hierarchy_config.server.d.ts

@@ -10,8 +10,6 @@ export type ScopeHierarchyConfig = {
     scope_cache_ttl_minutes: number;
     /** Maximum entries in scope cache (default: 5000) */
     scope_cache_max_entries: number;
-    /** Super admin scope ID */
-    super_admin_scope_id: string;
     /** Default system scope ID (for non-multi-tenancy mode) */
     default_system_scope_id: string;
 };

package/dist/lib/scope_hierarchy_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope_hierarchy_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/scope_hierarchy_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAYrB;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,gDAAgD;IAChD,YAAY,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,uBAAuB,EAAE,MAAM,CAAC;IAChC,2BAA2B;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,oBAAoB,CAmCjE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C"}
+{"version":3,"file":"scope_hierarchy_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/scope_hierarchy_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAYrB;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,gDAAgD;IAChD,YAAY,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,uBAAuB,EAAE,MAAM,CAAC;IAChC,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAC;CACjC,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,oBAAoB,CA6BjE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C"}

package/dist/lib/scope_hierarchy_config.server.js

@@ -3,7 +3,7 @@
 import "server-only";
 // section: imports
 import { get_config_value, get_config_number, get_config_boolean, } from "./config/config_loader.server.js";
-import { SUPER_ADMIN_SCOPE_ID, DEFAULT_SYSTEM_SCOPE_ID } from "./services/scope_service.js";
+import { DEFAULT_SYSTEM_SCOPE_ID } from "./services/scope_service.js";
 // section: constants
 const SECTION_NAME = "hazo_auth__scope_hierarchy";
 // section: helpers
@@ -19,13 +19,11 @@ export function get_scope_hierarchy_config() {
     const scope_cache_ttl_minutes = get_config_number(SECTION_NAME, "scope_cache_ttl_minutes", 15);
     const scope_cache_max_entries = get_config_number(SECTION_NAME, "scope_cache_max_entries", 5000);
     // Scope IDs (with defaults)
-    const super_admin_scope_id = get_config_value(SECTION_NAME, "super_admin_scope_id", SUPER_ADMIN_SCOPE_ID);
     const default_system_scope_id = get_config_value(SECTION_NAME, "default_system_scope_id", DEFAULT_SYSTEM_SCOPE_ID);
     return {
         enable_hrbac,
         scope_cache_ttl_minutes,
         scope_cache_max_entries,
-        super_admin_scope_id,
         default_system_scope_id,
     };
 }

package/dist/lib/services/invitation_service.d.ts

@@ -53,7 +53,7 @@ export declare function revoke_invitation(adapter: HazoConnectAdapter, invitatio
  */
 export declare function list_invitations_by_scope(adapter: HazoConnectAdapter, scope_id: string, status?: InvitationStatus): Promise<InvitationServiceResult>;
 /**
- * Lists all invitations (for super admin)
+ * Lists all invitations (for global admins)
  */
 export declare function list_all_invitations(adapter: HazoConnectAdapter, status?: InvitationStatus): Promise<InvitationServiceResult>;
 /**

package/dist/lib/services/invitation_service.js

@@ -365,7 +365,7 @@ export async function list_invitations_by_scope(adapter, scope_id, status) {
     }
 }
 /**
- * Lists all invitations (for super admin)
+ * Lists all invitations (for global admins)
  */
 export async function list_all_invitations(adapter, status) {
     try {

package/dist/lib/services/scope_service.d.ts

@@ -1,9 +1,4 @@
 import type { HazoConnectAdapter } from "hazo_connect";
-/**
- * Super admin scope ID - special UUID for system-level administrators
- * Users assigned to this scope have global access
- */
-export declare const SUPER_ADMIN_SCOPE_ID = "00000000-0000-0000-0000-000000000000";
 /**
  * Default system scope ID - for non-multi-tenancy mode
  * All users are assigned to this scope when multi-tenancy is disabled
@@ -67,16 +62,12 @@ export declare function extract_branding(scope: ScopeRecord): FirmBranding | nul
  * Checks if a scope has any branding set
  */
 export declare function has_branding(scope: ScopeRecord): boolean;
-/**
- * Checks if the given scope_id is the super admin scope
- */
-export declare function is_super_admin_scope(scope_id: string): boolean;
 /**
  * Checks if the given scope_id is the default system scope
  */
 export declare function is_default_system_scope(scope_id: string): boolean;
 /**
- * Checks if the given scope_id is a system scope (super admin or default system)
+ * Checks if the given scope_id is a system scope (default system)
  */
 export declare function is_system_scope(scope_id: string): boolean;
 /**
@@ -133,10 +124,6 @@ export declare function get_scope_tree(adapter: HazoConnectAdapter, root_scope_i
     tree?: ScopeTreeNode[];
     error?: string;
 }>;
-/**
- * Ensures the super admin scope exists
- */
-export declare function ensure_super_admin_scope(adapter: HazoConnectAdapter): Promise<ScopeServiceResult>;
 /**
  * Ensures the default system scope exists
  */

package/dist/lib/services/scope_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/scope_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAI9E;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG;IACxC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;CAC5B,CAAC;AAsBF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,IAAI,CAOxE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA4D7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAiH7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CA2C7B;AAID;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAgD7B;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,EAC3B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoEvE;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAsD7B;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAsD7B"}
+{"version":3,"file":"scope_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/scope_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOvD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,yCAAyC,CAAC;AAI9E;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG;IACxC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;CAC5B,CAAC;AAsBF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,GAAG,IAAI,CAOxE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CAmC7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA4D7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAiH7B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CA2C7B;AAID;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAgD7B;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,EAC3B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoEvE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAsD7B"}

package/dist/lib/services/scope_service.js

@@ -2,11 +2,6 @@ import { createCrudService } from "hazo_connect/server";
 import { create_app_logger } from "../app_logger.js";
 import { sanitize_error_for_user } from "../utils/error_sanitizer.js";
 // section: constants
-/**
- * Super admin scope ID - special UUID for system-level administrators
- * Users assigned to this scope have global access
- */
-export const SUPER_ADMIN_SCOPE_ID = "00000000-0000-0000-0000-000000000000";
 /**
  * Default system scope ID - for non-multi-tenancy mode
  * All users are assigned to this scope when multi-tenancy is disabled
@@ -52,12 +47,6 @@ export function extract_branding(scope) {
 export function has_branding(scope) {
     return !!(scope.logo_url || scope.primary_color || scope.secondary_color || scope.tagline);
 }
-/**
- * Checks if the given scope_id is the super admin scope
- */
-export function is_super_admin_scope(scope_id) {
-    return scope_id === SUPER_ADMIN_SCOPE_ID;
-}
 /**
  * Checks if the given scope_id is the default system scope
  */
@@ -65,10 +54,10 @@ export function is_default_system_scope(scope_id) {
     return scope_id === DEFAULT_SYSTEM_SCOPE_ID;
 }
 /**
- * Checks if the given scope_id is a system scope (super admin or default system)
+ * Checks if the given scope_id is a system scope (default system)
  */
 export function is_system_scope(scope_id) {
-    return is_super_admin_scope(scope_id) || is_default_system_scope(scope_id);
+    return is_default_system_scope(scope_id);
 }
 // section: crud operations
 /**
@@ -605,60 +594,6 @@ export async function get_scope_tree(adapter, root_scope_id) {
         };
     }
 }
-/**
- * Ensures the super admin scope exists
- */
-export async function ensure_super_admin_scope(adapter) {
-    try {
-        // Check if already exists
-        const existing = await get_scope_by_id(adapter, SUPER_ADMIN_SCOPE_ID);
-        if (existing.success && existing.scope) {
-            return existing;
-        }
-        // Create it
-        const scope_service = createCrudService(adapter, "hazo_scopes");
-        const now = new Date().toISOString();
-        const inserted = await scope_service.insert({
-            id: SUPER_ADMIN_SCOPE_ID,
-            name: "Super Admin",
-            level: "system",
-            parent_id: null,
-            logo_url: null,
-            primary_color: null,
-            secondary_color: null,
-            tagline: null,
-            created_at: now,
-            changed_at: now,
-        });
-        if (!Array.isArray(inserted) || inserted.length === 0) {
-            return {
-                success: false,
-                error: "Failed to create super admin scope",
-            };
-        }
-        return {
-            success: true,
-            scope: normalize_scope_record(inserted[0]),
-        };
-    }
-    catch (error) {
-        const logger = create_app_logger();
-        const error_message = sanitize_error_for_user(error, {
-            logToConsole: true,
-            logToLogger: true,
-            logger,
-            context: {
-                filename: "scope_service.ts",
-                line_number: 0,
-                operation: "ensure_super_admin_scope",
-            },
-        });
-        return {
-            success: false,
-            error: error_message,
-        };
-    }
-}
 /**
  * Ensures the default system scope exists
  */

package/dist/lib/services/user_scope_service.d.ts

@@ -20,7 +20,6 @@ export type ScopeAccessCheckResult = {
         scope_name?: string;
     };
     user_scopes?: UserScope[];
-    is_super_admin?: boolean;
 };
 export type AssignUserScopeData = {
     user_id: string;
@@ -52,10 +51,6 @@ export declare function update_user_scopes(adapter: HazoConnectAdapter, user_id:
     scope_id: string;
     role_id: string;
 }>): Promise<UserScopeResult>;
-/**
- * Checks if a user is a super admin (has super admin scope assigned)
- */
-export declare function is_user_super_admin(adapter: HazoConnectAdapter, user_id: string): Promise<boolean>;
 /**
  * Checks if a user has any scope assigned
  */
@@ -63,9 +58,11 @@ export declare function user_has_any_scope(adapter: HazoConnectAdapter, user_id:
 /**
  * Checks if a user has access to a specific scope
  * Access is granted if:
- * 1. User is a super admin (has super admin scope)
- * 2. User has the exact scope assigned
- * 3. User has access to an ancestor scope (inherited access)
+ * 1. User has the exact scope assigned
+ * 2. User has access to an ancestor scope (inherited access)
+ *
+ * Global admin access (hazo_org_global_admin permission) is handled upstream
+ * in hazo_get_auth before this function is called.
  *
  * @param adapter - HazoConnect adapter
  * @param user_id - User ID to check
@@ -85,8 +82,4 @@ export declare function get_user_direct_scopes(adapter: HazoConnectAdapter, user
     }>;
     error?: string;
 }>;
-/**
- * Assigns super admin scope to a user
- */
-export declare function assign_super_admin_scope(adapter: HazoConnectAdapter, user_id: string, role_id: string): Promise<UserScopeResult>;
 //# sourceMappingURL=user_scope_service.d.ts.map

package/dist/lib/services/user_scope_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user_scope_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user_scope_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAyBvD,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAIF;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACvD,OAAO,CAAC,eAAe,CAAC,CAwD1B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAqFjC;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA4CD;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CAO1B"}
+{"version":3,"file":"user_scope_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user_scope_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAuBvD,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAIF;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CA2E1B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GACvD,OAAO,CAAC,eAAe,CAAC,CAwD1B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAoEjC;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CA4CD"}

package/dist/lib/services/user_scope_service.js

@@ -1,7 +1,7 @@
 import { createCrudService } from "hazo_connect/server";
 import { create_app_logger } from "../app_logger.js";
 import { sanitize_error_for_user } from "../utils/error_sanitizer.js";
-import { get_scope_by_id, get_scope_ancestors, get_root_scope_id, SUPER_ADMIN_SCOPE_ID, is_super_admin_scope, } from "./scope_service.js";
+import { get_scope_by_id, get_scope_ancestors, get_root_scope_id, } from "./scope_service.js";
 // section: constants
 /**
  * CRUD service options for hazo_user_scopes table
@@ -274,21 +274,6 @@ export async function update_user_scopes(adapter, user_id, new_scopes) {
         };
     }
 }
-/**
- * Checks if a user is a super admin (has super admin scope assigned)
- */
-export async function is_user_super_admin(adapter, user_id) {
-    try {
-        const user_scopes_result = await get_user_scopes(adapter, user_id);
-        if (!user_scopes_result.success || !user_scopes_result.scopes) {
-            return false;
-        }
-        return user_scopes_result.scopes.some((scope) => is_super_admin_scope(scope.scope_id));
-    }
-    catch (_a) {
-        return false;
-    }
-}
 /**
  * Checks if a user has any scope assigned
  */
@@ -306,9 +291,11 @@ export async function user_has_any_scope(adapter, user_id) {
 /**
  * Checks if a user has access to a specific scope
  * Access is granted if:
- * 1. User is a super admin (has super admin scope)
- * 2. User has the exact scope assigned
- * 3. User has access to an ancestor scope (inherited access)
+ * 1. User has the exact scope assigned
+ * 2. User has access to an ancestor scope (inherited access)
+ *
+ * Global admin access (hazo_org_global_admin permission) is handled upstream
+ * in hazo_get_auth before this function is called.
  *
  * @param adapter - HazoConnect adapter
  * @param user_id - User ID to check
@@ -323,20 +310,7 @@ export async function check_user_scope_access(adapter, user_id, target_scope_id)
             return { has_access: false };
         }
         const user_scopes = user_scopes_result.scopes;
-        // Check 1: Is user a super admin?
-        const has_super_admin = user_scopes.some((scope) => is_super_admin_scope(scope.scope_id));
-        if (has_super_admin) {
-            return {
-                has_access: true,
-                access_via: {
-                    scope_id: SUPER_ADMIN_SCOPE_ID,
-                    scope_name: "Super Admin",
-                },
-                user_scopes,
-                is_super_admin: true,
-            };
-        }
-        // Check 2: Does user have exact scope assigned?
+        // Check 1: Does user have exact scope assigned?
         for (const user_scope of user_scopes) {
             if (user_scope.scope_id === target_scope_id) {
                 const scope_result = await get_scope_by_id(adapter, target_scope_id);
@@ -352,7 +326,7 @@ export async function check_user_scope_access(adapter, user_id, target_scope_id)
                 };
             }
         }
-        // Check 3: Does user have access via an ancestor scope?
+        // Check 2: Does user have access via an ancestor scope?
         const ancestors_result = await get_scope_ancestors(adapter, target_scope_id);
         if (ancestors_result.success && ancestors_result.scopes) {
             for (const ancestor of ancestors_result.scopes) {
@@ -436,14 +410,3 @@ export async function get_user_direct_scopes(adapter, user_id) {
         };
     }
 }
-/**
- * Assigns super admin scope to a user
- */
-export async function assign_super_admin_scope(adapter, user_id, role_id) {
-    return assign_user_scope(adapter, {
-        user_id,
-        scope_id: SUPER_ADMIN_SCOPE_ID,
-        root_scope_id: SUPER_ADMIN_SCOPE_ID,
-        role_id,
-    });
-}

package/dist/server/routes/invitations.d.ts

@@ -5,7 +5,7 @@ export declare const dynamic = "force-dynamic";
  * Query params:
  *   - scope_id: Filter by scope (optional, required for non-super-admins)
  *   - status: Filter by status (optional: PENDING, ACCEPTED, EXPIRED, REVOKED)
- * Super admins can see all invitations, others can only see invitations for their scopes
+ * Global admins can see all invitations, others can only see invitations for their scopes
  */
 export declare function GET(request: NextRequest): Promise<NextResponse<{
     error: string;

package/dist/server/routes/invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../../src/server/routes/invitations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmBxD,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAGvC;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW;;;;;IAqH7C;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW;;;;;IAoG9C;AAED;;;GAGG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,WAAW;;;;;IAkG/C;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,WAAW;;;;IA2FhD"}
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../../src/server/routes/invitations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiBxD,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAGvC;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW;;;;;IAqH7C;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW;;;;;IAoG9C;AAED;;;GAGG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,WAAW;;;;;IAkG/C;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,WAAW;;;;IA2FhD"}

package/dist/server/routes/invitations.js

@@ -6,7 +6,8 @@ import { create_app_logger } from "../../lib/app_logger.js";
 import { get_filename, get_line_number } from "../../lib/utils/api_route_helpers.js";
 import { hazo_get_auth } from "../../lib/auth/hazo_get_auth.server.js";
 import { create_invitation, list_invitations_by_scope, list_all_invitations, revoke_invitation, get_invitation_by_id, } from "../../lib/services/invitation_service.js";
-import { is_user_super_admin, get_user_scopes, } from "../../lib/services/user_scope_service.js";
+import { get_user_scopes } from "../../lib/services/user_scope_service.js";
+import { GLOBAL_ADMIN_PERMISSION } from "../../lib/constants.js";
 // section: route_config
 export const dynamic = "force-dynamic";
 // section: api_handler
@@ -15,7 +16,7 @@ export const dynamic = "force-dynamic";
  * Query params:
  *   - scope_id: Filter by scope (optional, required for non-super-admins)
  *   - status: Filter by status (optional: PENDING, ACCEPTED, EXPIRED, REVOKED)
- * Super admins can see all invitations, others can only see invitations for their scopes
+ * Global admins can see all invitations, others can only see invitations for their scopes
  */
 export async function GET(request) {
     var _a, _b;
@@ -34,11 +35,11 @@ export async function GET(request) {
         const status_param = searchParams.get("status");
         const status = status_param;
         const hazoConnect = get_hazo_connect_instance();
-        // Check if user is super admin
-        const is_super = await is_user_super_admin(hazoConnect, auth.user.id);
+        // Check if user is a global admin
+        const is_super = auth.permissions.includes(GLOBAL_ADMIN_PERMISSION);
         let result;
         if (is_super) {
-            // Super admin can see all invitations
+            // Global admin can see all invitations
             if (scope_id) {
                 result = await list_invitations_by_scope(hazoConnect, scope_id, status);
             }
@@ -124,8 +125,8 @@ export async function POST(request) {
             return NextResponse.json({ error: "Invalid email address format" }, { status: 400 });
         }
         const hazoConnect = get_hazo_connect_instance();
-        // Check if user is super admin or has access to the scope
-        const is_super = await is_user_super_admin(hazoConnect, auth.user.id);
+        // Check if user is a global admin or has access to the scope
+        const is_super = auth.permissions.includes(GLOBAL_ADMIN_PERMISSION);
         if (!is_super) {
             const user_scopes = await get_user_scopes(hazoConnect, auth.user.id);
             const has_scope_access = (_a = user_scopes.scopes) === null || _a === void 0 ? void 0 : _a.some((s) => s.scope_id === scope_id);
@@ -196,8 +197,8 @@ export async function PATCH(request) {
         if (!invitation_result.success || !invitation_result.invitation) {
             return NextResponse.json({ error: "Invitation not found" }, { status: 404 });
         }
-        // Check if user is super admin or has access to the invitation's scope
-        const is_super = await is_user_super_admin(hazoConnect, auth.user.id);
+        // Check if user is a global admin or has access to the invitation's scope
+        const is_super = auth.permissions.includes(GLOBAL_ADMIN_PERMISSION);
         if (!is_super) {
             const user_scopes = await get_user_scopes(hazoConnect, auth.user.id);
             const has_scope_access = (_a = user_scopes.scopes) === null || _a === void 0 ? void 0 : _a.some((s) => { var _a; return s.scope_id === ((_a = invitation_result.invitation) === null || _a === void 0 ? void 0 : _a.scope_id); });
@@ -257,8 +258,8 @@ export async function DELETE(request) {
         if (!invitation_result.success || !invitation_result.invitation) {
             return NextResponse.json({ error: "Invitation not found" }, { status: 404 });
         }
-        // Check if user is super admin or has access to the invitation's scope
-        const is_super = await is_user_super_admin(hazoConnect, auth.user.id);
+        // Check if user is a global admin or has access to the invitation's scope
+        const is_super = auth.permissions.includes(GLOBAL_ADMIN_PERMISSION);
         if (!is_super) {
             const user_scopes = await get_user_scopes(hazoConnect, auth.user.id);
             const has_scope_access = (_a = user_scopes.scopes) === null || _a === void 0 ? void 0 : _a.some((s) => { var _a; return s.scope_id === ((_a = invitation_result.invitation) === null || _a === void 0 ? void 0 : _a.scope_id); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_auth",
-  "version": "9.1.1",
+  "version": "10.0.0",
   "description": "Zero-config authentication UI components for Next.js with RBAC, OAuth, scope-based multi-tenancy, and invitations",
   "keywords": [
     "authentication",
@@ -252,13 +252,13 @@
     "@radix-ui/react-switch": "^1.2.0",
     "@radix-ui/react-tabs": "^1.1.0",
     "@radix-ui/react-tooltip": "^1.2.0",
-    "hazo_api": "^2.1.0",
-    "hazo_config": "^2.1.6",
-    "hazo_connect": "^3.2.0",
-    "hazo_core": "^1.0.0",
-    "hazo_logs": "^2.0.2",
-    "hazo_notify": "^6.1.0",
-    "hazo_ui": "^3.1.3",
+    "hazo_api": "^2.3.1",
+    "hazo_config": "^2.1.10",
+    "hazo_connect": "^3.4.1",
+    "hazo_core": "^1.1.0",
+    "hazo_logs": "^2.0.3",
+    "hazo_notify": "^6.1.3",
+    "hazo_ui": "^3.2.1",
     "input-otp": "^1.4.0",
     "lucide-react": "^0.553.0",
     "next": "^14.0.0",
@@ -388,10 +388,10 @@
     "eslint": "^9.39.1",
     "eslint-config-next": "^16.0.4",
     "eslint-plugin-storybook": "^10.0.6",
-    "hazo_api": "^2.3.0",
-    "hazo_config": "^2.1.9",
-    "hazo_connect": "^3.2.0",
-    "hazo_core": "^1.0.3",
+    "hazo_api": "^2.3.1",
+    "hazo_config": "^2.1.10",
+    "hazo_connect": "^3.4.1",
+    "hazo_core": "^1.1.0",
     "hazo_logs": "^2.0.3",
     "hazo_notify": "^6.1.3",
     "hazo_ui": "^3.2.1",