mnfst 0.5.143 → 0.5.145

package/lib/manifest.appwrite.auth.js

@@ -108,6 +108,20 @@ async function getAppwriteConfig() {
     // Creator role: string reference to a role in memberRoles (role creator gets by default)
     const creatorRole = appwriteConfig.auth?.creatorRole || null;
 
+    // Creator roles (plural): the custom role(s) the team creator is assigned, atomically,
+    // at team creation. Accepts string | string[] | null. An explicit null / [] means
+    // "no template role — creator holds only Appwrite's intrinsic owner". Takes precedence
+    // over the legacy singular `creatorRole`. When NEITHER is set, createTeam keeps its
+    // historical default (first defined role). Resolved to: array (configured, [] = owner-only)
+    // or null (unconfigured → use the historical default).
+    let creatorRoles = null;
+    if (appwriteConfig.auth && Object.prototype.hasOwnProperty.call(appwriteConfig.auth, 'creatorRoles')) {
+        const raw = appwriteConfig.auth.creatorRoles;
+        creatorRoles = raw == null ? [] : (Array.isArray(raw) ? raw.filter(r => typeof r === 'string') : [raw]).filter(Boolean);
+    } else if (creatorRole && memberRoles && memberRoles[creatorRole]) {
+        creatorRoles = [creatorRole];
+    }
+
     // Guest migration: id of the deployed guest-migration Appwrite Function. When set,
     // a guest's teams are carried over to the account they sign into via OTP (which
     // Appwrite can't convert in place). See templates/guest-migration-function.
@@ -135,7 +149,8 @@ async function getAppwriteConfig() {
         memberRoles: memberRoles, // Role definitions: { "RoleName": ["permission1", "permission2"] }
         permanentRoles: permanentRoles, // Object: { "RoleName": ["permission1", ...] } (cannot be deleted)
         templateRoles: templateRoles, // Object: { "RoleName": ["permission1", ...] } (can be deleted)
-        creatorRole: creatorRole // String reference to memberRoles key
+        creatorRole: creatorRole, // String reference to memberRoles key (legacy singular)
+        creatorRoles: creatorRoles // array (configured; [] = owner-only) or null (use historical default)
     };
 }
 
@@ -1402,13 +1417,14 @@ function initializeTeamsCore() {
                     // Determine initial roles for team creator
                     let creatorRoles = roles;
                     if (creatorRoles.length === 0) {
-                        // If no roles specified, use creatorRole from config
                         const memberRoles = appwriteConfig?.memberRoles;
-                        const creatorRoleName = appwriteConfig?.creatorRole;
+                        const configuredCreatorRoles = appwriteConfig?.creatorRoles; // array | null
 
-                        if (memberRoles && creatorRoleName && memberRoles[creatorRoleName]) {
-                            // Use specified creatorRole
-                            creatorRoles = [creatorRoleName];
+                        if (Array.isArray(configuredCreatorRoles)) {
+                            // Explicitly configured via auth.creatorRoles (or legacy creatorRole).
+                            // An empty array means "owner-only" — the creator holds just
+                            // Appwrite's intrinsic owner, with no template role assigned.
+                            creatorRoles = configuredCreatorRoles.length ? configuredCreatorRoles.slice() : ['owner'];
                         } else if (memberRoles && Object.keys(memberRoles).length > 0) {
                             // No creatorRole specified, find role with all owner permissions or use first
                             let foundRole = null;
@@ -5525,29 +5541,43 @@ function initializeTeamsConvenience() {
                     return userRoles.includes('owner');
                 };
 
-                // Synchronous version for Alpine.js bindings (uses permission cache)
+                // Synchronous version for Alpine.js bindings (x-show / :disabled).
+                // Resolves from the cached role definitions (allTeamRoles) so it matches
+                // the async hasTeamPermission() — including custom permission keys, not
+                // just the six built-ins the permission cache pre-computes.
                 store.hasTeamPermissionSync = function (permission) {
                     if (!this.currentTeam || !this.currentTeamMemberships || !this.user) {
                         return false;
                     }
 
-                    // Use cached permissions if available (updated by updatePermissionCache)
-                    if (this._permissionCache && typeof this._permissionCache[permission] === 'boolean') {
-                        return this._permissionCache[permission];
+                    const userRoles = this.getCurrentTeamRoles();
+                    if (!Array.isArray(userRoles)) {
+                        return false;
                     }
 
-                    // Fallback: check if user has no custom roles (should have all permissions)
-                    // This matches the logic in hasPermission: if customRoles.length === 0, return true
-                    const userRoles = this.getCurrentTeamRoles();
-                    const customRoles = userRoles.filter(role => role !== 'owner');
+                    // The merged config + user-generated role map for the current team
+                    // (same map the async path resolves against), available synchronously.
+                    const allRoles = (this.allTeamRoles && this.allTeamRoles(this.currentTeam)) || {};
 
-                    // If user has no custom roles (only "owner" or empty), grant all permissions
-                    // This handles users with "No Role" who should have all owner permissions
+                    // No custom roles defined → owner has every permission.
+                    if (!allRoles || Object.keys(allRoles).length === 0) {
+                        return userRoles.includes('owner');
+                    }
+
+                    // User holds no custom role (only "owner" / empty) → all permissions.
+                    const customRoles = userRoles.filter(role => role !== 'owner');
                     if (customRoles.length === 0) {
                         return true;
                     }
 
-                    // If user has custom roles but cache is missing, return false (shouldn't happen if cache is working)
+                    // Granted if any of the user's custom roles includes this permission
+                    // (built-in or custom key).
+                    for (const roleName of customRoles) {
+                        const rolePermissions = allRoles[roleName];
+                        if (Array.isArray(rolePermissions) && rolePermissions.includes(permission)) {
+                            return true;
+                        }
+                    }
                     return false;
                 };
 

package/lib/manifest.integrity.json

@@ -1,5 +1,5 @@
 {
-  "manifest.appwrite.auth.js": "sha384-9XC7lR7xBSDktRSQ2OVjcDOZ5NT3IPzdfmGO3Rv4x37uAvrzfi20xER0Renn5MTj",
+  "manifest.appwrite.auth.js": "sha384-1Kz/Dlerds1/7iKrEVDIRbFDyngZ0L+f81td9eW3w4t3nGFU+w4gjyGhwn+IiTRM",
   "manifest.appwrite.data.js": "sha384-00ulLT+GAIuPHA/rRT9p98vYlsyDzkyKXtg86BDQ6FGQa5vVVN+W6kuforniBAsz",
   "manifest.appwrite.presence.js": "sha384-uxRpx9/Jj0kGtklH5QmUlAzD3zdSvFRfK6bcJQqxl+Bsf5tOo4zgwqJTQgtZoHQP",
   "manifest.charts.js": "sha384-RuV7gWXt3s+JegxWgDieR/P5U99sbOYWiYHdJGe2uCJjDFU1cPp0mJ1QT55ec9uz",

package/lib/manifest.schema.json

@@ -197,7 +197,15 @@
                                 }
                             }
                         },
-                        "creatorRole": { "type": "string" }
+                        "creatorRole": { "type": "string" },
+                        "creatorRoles": {
+                            "description": "Role(s) the team creator is assigned atomically at creation. null or [] = owner-only (creator holds just Appwrite's intrinsic owner; no template role). Takes precedence over creatorRole.",
+                            "oneOf": [
+                                { "type": "string" },
+                                { "type": "array", "items": { "type": "string" } },
+                                { "type": "null" }
+                            ]
+                        }
                     }
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.143",
+    "version": "0.5.145",
     "private": false,
     "workspaces": [
         "templates/starter",