nestjs-slightly-better-auth 1.0.0

package/dist/organization.cjs

@@ -0,0 +1,191 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_errors = require("./auth-errors-CsERBNWI.cjs");
+const require_auth_decorators = require("./auth-decorators-CwW5JY4y.cjs");
+let better_auth_api = require("better-auth/api");
+//#region src/organization.ts
+const ACTIVE_ORGANIZATION_ID = Symbol.for("nestjs-slightly-better-auth:org:active-organization-id");
+const ACTIVE_MEMBER_ROLE = Symbol.for("nestjs-slightly-better-auth:org:active-member-role");
+const ActiveOrganizationId = require_auth_decorators.defineInvocationParam(ACTIVE_ORGANIZATION_ID, { missing: "ORGANIZATION_REQUIRED" });
+const ActiveMemberRole = require_auth_decorators.defineInvocationParam(ACTIVE_MEMBER_ROLE, { missing: "MEMBER_ROLE_REQUIRED" });
+const REF = Symbol.for("nestjs-slightly-better-auth:org:ref");
+function organizationRef(resolve, options = {}) {
+	return Object.assign((ctx) => resolve(ctx), options);
+}
+function activeOrganization() {
+	return Object.assign(organizationRef(async (ctx) => {
+		const value = ctx.principal.session.session?.activeOrganizationId;
+		if (value !== void 0) return value;
+		if (!await ctx.auth.hasPlugin("custom-session")) return;
+		try {
+			return (await ctx.memo(JSON.stringify(["org:activeMember"]), () => ctx.auth.run({
+				cookies: ctx.cookies,
+				inbound: () => ctx.headers,
+				internal: true
+			}, () => ctx.auth.api.getActiveMember({ headers: ctx.headers }))))?.organizationId;
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.statusCode === 400 && (error.body?.code === "NO_ACTIVE_ORGANIZATION" || error.body?.code === "MEMBER_NOT_FOUND")) return;
+			throw error;
+		}
+	}, { missingReason: "NO_ACTIVE_ORGANIZATION" }), { [REF]: { kind: "active" } });
+}
+function fromParam(name) {
+	return Object.assign(organizationRef((ctx) => ctx.param(name)), { [REF]: {
+		kind: "param",
+		name
+	} });
+}
+function fromHeader(name) {
+	return organizationRef((ctx) => ctx.headers.get(name));
+}
+function requirements(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirements(expression.anyOf) : "allOf" in expression ? requirements(expression.allOf) : [expression]);
+}
+function advise(ctx, policy) {
+	const advice = [];
+	for (const handler of ctx.handlers) for (const requirement of requirements(handler.plan.requirements)) {
+		if (requirement.policy !== policy) continue;
+		const marker = requirement.params.organization[REF];
+		if (marker?.kind === "active") {
+			const input = handler.inputs.find((name) => [
+				"orgId",
+				"organizationId",
+				"organization",
+				"orgSlug"
+			].includes(name));
+			if (input) advice.push({
+				level: "warn",
+				code: "W_ORG_PARAM_IGNORED",
+				message: `${handler.plan.site} checks the active organization but accepts ${input}.`,
+				hint: input === "orgSlug" ? "Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers })." : `Use fromParam('${input}').`
+			});
+		} else if (marker?.kind === "param" && !handler.inputs.includes(marker.name)) advice.push({
+			level: "warn",
+			code: "W_ORG_PARAM_MISSING",
+			message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(", ") || "none"}.`,
+			hint: "Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement."
+		});
+	}
+	return advice;
+}
+const requires = {
+	plugins: ["organization"],
+	principals: ["session"],
+	presentsCredentials: true
+};
+const orgPermissionPolicy = {
+	id: "better-auth:organization/permission",
+	requires,
+	advise: (ctx) => advise(ctx, orgPermissionPolicy),
+	validate({ permissions }) {
+		if (!Object.keys(permissions).length || Object.values(permissions).some((actions) => !Array.isArray(actions) || !actions.length)) throw new require_auth_errors.BetterAuthConfigurationError("EMPTY_PERMISSIONS", "Organization permissions must contain a resource and actions.");
+	},
+	async evaluate({ permissions, organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		const stable = Object.entries(permissions).sort(([a], [b]) => a.localeCompare(b)).map(([resource, actions]) => [resource, [...actions].sort()]);
+		try {
+			if (!(await context.memo(JSON.stringify([
+				"org:hasPermission",
+				organizationId,
+				stable
+			]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.hasPermission({
+				headers: context.headers,
+				body: {
+					organizationId,
+					permissions
+				}
+			})))).success) return {
+				effect: "deny",
+				reason: "MISSING_PERMISSION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			return { effect: "allow" };
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.body?.code === "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION") return {
+				effect: "deny",
+				reason: "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+const orgMemberPolicy = {
+	id: "better-auth:organization/member",
+	requires,
+	advise: (ctx) => advise(ctx, orgMemberPolicy),
+	async evaluate({ organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		try {
+			const result = await context.memo(JSON.stringify(["org:activeMemberRole", organizationId]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.getActiveMemberRole({
+				headers: context.headers,
+				query: { organizationId }
+			})));
+			if (typeof result.role !== "string" || !result.role.trim()) return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			context.provide(ACTIVE_MEMBER_ROLE, result.role);
+			return { effect: "allow" };
+		} catch (error) {
+			if ((0, better_auth_api.isAPIError)(error) && error.body?.code === "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION") return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+function orgPermission(permissions, options = {}) {
+	return {
+		policy: orgPermissionPolicy,
+		params: {
+			permissions,
+			organization: options.organization ?? activeOrganization()
+		}
+	};
+}
+function RequireOrgPermission(permissions, options) {
+	return require_auth_decorators.Require(orgPermission(permissions, options));
+}
+function orgMember(options = {}) {
+	return {
+		policy: orgMemberPolicy,
+		params: { organization: options.organization ?? activeOrganization() }
+	};
+}
+function RequireOrgMember(options) {
+	return require_auth_decorators.Require(orgMember(options));
+}
+//#endregion
+exports.ACTIVE_MEMBER_ROLE = ACTIVE_MEMBER_ROLE;
+exports.ACTIVE_ORGANIZATION_ID = ACTIVE_ORGANIZATION_ID;
+exports.ActiveMemberRole = ActiveMemberRole;
+exports.ActiveOrganizationId = ActiveOrganizationId;
+exports.RequireOrgMember = RequireOrgMember;
+exports.RequireOrgPermission = RequireOrgPermission;
+exports.activeOrganization = activeOrganization;
+exports.fromHeader = fromHeader;
+exports.fromParam = fromParam;
+exports.orgMember = orgMember;
+exports.orgMemberPolicy = orgMemberPolicy;
+exports.orgPermission = orgPermission;
+exports.orgPermissionPolicy = orgPermissionPolicy;
+exports.organizationRef = organizationRef;
+
+//# sourceMappingURL=organization.cjs.map

package/dist/organization.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.cjs","names":["defineInvocationParam","isAPIError","BetterAuthConfigurationError","Require"],"sources":["../src/organization.ts"],"sourcesContent":["import { isAPIError } from \"better-auth/api\";\nimport type {\n  AuthorizationContext,\n  AuthorizationPolicy,\n  BootAdvice,\n  BootAdviceContext,\n  Requirement,\n  RequirementExpr,\n} from \"./auth-contracts.js\";\nimport { defineInvocationParam, Require } from \"./auth-decorators.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { OrgPermissions, SessionPrincipal } from \"./auth-types.js\";\nexport type { OrgPermissions } from \"./auth-types.js\";\nexport interface OrganizationRef {\n  (ctx: AuthorizationContext): unknown | Promise<unknown>;\n  readonly missingReason?: string;\n}\nexport interface OrgPermissionParams {\n  readonly permissions: OrgPermissions;\n  readonly organization: OrganizationRef;\n}\nexport interface OrgMemberParams {\n  readonly organization: OrganizationRef;\n}\nexport const ACTIVE_ORGANIZATION_ID = Symbol.for(\n  \"nestjs-slightly-better-auth:org:active-organization-id\",\n);\nexport const ACTIVE_MEMBER_ROLE = Symbol.for(\n  \"nestjs-slightly-better-auth:org:active-member-role\",\n);\nexport const ActiveOrganizationId = defineInvocationParam(\n  ACTIVE_ORGANIZATION_ID,\n  { missing: \"ORGANIZATION_REQUIRED\" },\n);\nexport const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, {\n  missing: \"MEMBER_ROLE_REQUIRED\",\n});\nconst REF = Symbol.for(\"nestjs-slightly-better-auth:org:ref\");\ntype MarkedRef = OrganizationRef & {\n  readonly [REF]?: { kind: \"active\" } | { kind: \"param\"; name: string };\n};\ninterface OrgApi {\n  hasPermission(input: {\n    headers: Headers;\n    body: { organizationId: string; permissions: OrgPermissions };\n  }): Promise<{ success: boolean }>;\n  getActiveMemberRole(input: {\n    headers: Headers;\n    query: { organizationId: string };\n  }): Promise<{ role?: string | null }>;\n  getActiveMember(input: {\n    headers: Headers;\n  }): Promise<{ organizationId?: string }>;\n}\nexport function organizationRef(\n  resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>,\n  options: { missingReason?: string } = {},\n): OrganizationRef {\n  return Object.assign((ctx: AuthorizationContext) => resolve(ctx), options);\n}\nexport function activeOrganization(): OrganizationRef {\n  return Object.assign(\n    organizationRef(\n      async (ctx) => {\n        const session = (ctx.principal as SessionPrincipal).session as {\n          session?: { activeOrganizationId?: unknown };\n        };\n        const value = session.session?.activeOrganizationId;\n        if (value !== undefined) {\n          return value;\n        }\n        if (!(await ctx.auth.hasPlugin(\"custom-session\"))) {\n          return undefined;\n        }\n        try {\n          const member = await ctx.memo(\n            JSON.stringify([\"org:activeMember\"]),\n            () =>\n              ctx.auth.run(\n                {\n                  cookies: ctx.cookies,\n                  inbound: () => ctx.headers,\n                  internal: true,\n                },\n                () =>\n                  (ctx.auth.api as unknown as OrgApi).getActiveMember({\n                    headers: ctx.headers,\n                  }),\n              ),\n          );\n          return member?.organizationId;\n        } catch (error) {\n          if (\n            isAPIError(error) &&\n            error.statusCode === 400 &&\n            (error.body?.code === \"NO_ACTIVE_ORGANIZATION\" ||\n              error.body?.code === \"MEMBER_NOT_FOUND\")\n          ) {\n            return undefined;\n          }\n          throw error;\n        }\n      },\n      { missingReason: \"NO_ACTIVE_ORGANIZATION\" },\n    ),\n    { [REF]: { kind: \"active\" as const } },\n  );\n}\nexport function fromParam(name: string): OrganizationRef {\n  return Object.assign(\n    organizationRef((ctx) => ctx.param(name)),\n    { [REF]: { kind: \"param\" as const, name } },\n  );\n}\nexport function fromHeader(name: string): OrganizationRef {\n  return organizationRef((ctx) => ctx.headers.get(name));\n}\nfunction requirements(expressions: readonly RequirementExpr[]): Requirement[] {\n  return expressions.flatMap((expression) =>\n    \"anyOf\" in expression\n      ? requirements(expression.anyOf)\n      : \"allOf\" in expression\n        ? requirements(expression.allOf)\n        : [expression],\n  );\n}\nfunction advise(\n  ctx: BootAdviceContext,\n  policy: AuthorizationPolicy<any, any>,\n): BootAdvice[] {\n  const advice: BootAdvice[] = [];\n  for (const handler of ctx.handlers) {\n    for (const requirement of requirements(handler.plan.requirements)) {\n      if (requirement.policy !== policy) {\n        continue;\n      }\n      const ref = (requirement.params as OrgMemberParams)\n        .organization as MarkedRef;\n      const marker = ref[REF];\n      if (marker?.kind === \"active\") {\n        const input = handler.inputs.find((name) =>\n          [\"orgId\", \"organizationId\", \"organization\", \"orgSlug\"].includes(name),\n        );\n        if (input) {\n          advice.push({\n            level: \"warn\",\n            code: \"W_ORG_PARAM_IGNORED\",\n            message: `${handler.plan.site} checks the active organization but accepts ${input}.`,\n            hint:\n              input === \"orgSlug\"\n                ? \"Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers }).\"\n                : `Use fromParam('${input}').`,\n          });\n        }\n      } else if (\n        marker?.kind === \"param\" &&\n        !handler.inputs.includes(marker.name)\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_ORG_PARAM_MISSING\",\n          message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(\", \") || \"none\"}.`,\n          hint: \"Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement.\",\n        });\n      }\n    }\n  }\n  return advice;\n}\nconst requires = {\n  plugins: [\"organization\"],\n  principals: [\"session\" as const],\n  presentsCredentials: true,\n};\nexport const orgPermissionPolicy: AuthorizationPolicy<\n  OrgPermissionParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/permission\", // gitleaks:allow: public policy identifier\n  requires,\n  advise: (ctx) => advise(ctx, orgPermissionPolicy),\n  validate({ permissions }) {\n    if (\n      !Object.keys(permissions).length ||\n      Object.values(permissions).some(\n        (actions) => !Array.isArray(actions) || !actions.length,\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"EMPTY_PERMISSIONS\",\n        \"Organization permissions must contain a resource and actions.\",\n      );\n    }\n  },\n  async evaluate({ permissions, organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    const stable = Object.entries(permissions)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([resource, actions]) => [resource, [...actions].sort()]);\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:hasPermission\", organizationId, stable]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).hasPermission({\n                headers: context.headers,\n                body: { organizationId, permissions },\n              }),\n          ),\n      );\n      if (!result.success) {\n        return { effect: \"deny\", reason: \"MISSING_PERMISSION\" };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport const orgMemberPolicy: AuthorizationPolicy<\n  OrgMemberParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/member\",\n  requires,\n  advise: (ctx) => advise(ctx, orgMemberPolicy),\n  async evaluate({ organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:activeMemberRole\", organizationId]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).getActiveMemberRole({\n                headers: context.headers,\n                query: { organizationId },\n              }),\n          ),\n      );\n      if (typeof result.role !== \"string\" || !result.role.trim()) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      context.provide(ACTIVE_MEMBER_ROLE, result.role);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport function orgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgPermissionParams> {\n  return {\n    policy: orgPermissionPolicy,\n    params: {\n      permissions: permissions as OrgPermissions,\n      organization: options.organization ?? activeOrganization(),\n    },\n  };\n}\nexport function RequireOrgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options?: { organization?: OrganizationRef },\n): ClassDecorator & MethodDecorator {\n  return Require(orgPermission<N>(permissions, options));\n}\nexport function orgMember(\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgMemberParams> {\n  return {\n    policy: orgMemberPolicy,\n    params: { organization: options.organization ?? activeOrganization() },\n  };\n}\nexport function RequireOrgMember(options?: {\n  organization?: OrganizationRef;\n}): ClassDecorator & MethodDecorator {\n  return Require(orgMember(options));\n}\n"],"mappings":";;;;;AAwBA,MAAa,yBAAyB,OAAO,IAC3C,wDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,oDACF;AACA,MAAa,uBAAuBA,wBAAAA,sBAClC,wBACA,EAAE,SAAS,wBAAwB,CACrC;AACA,MAAa,mBAAmBA,wBAAAA,sBAAsB,oBAAoB,EACxE,SAAS,uBACX,CAAC;AACD,MAAM,MAAM,OAAO,IAAI,qCAAqC;AAiB5D,SAAgB,gBACd,SACA,UAAsC,CAAC,GACtB;CACjB,OAAO,OAAO,QAAQ,QAA8B,QAAQ,GAAG,GAAG,OAAO;AAC3E;AACA,SAAgB,qBAAsC;CACpD,OAAO,OAAO,OACZ,gBACE,OAAO,QAAQ;EAIb,MAAM,QAHW,IAAI,UAA+B,QAG9B,SAAS;EAC/B,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,IAAI,CAAE,MAAM,IAAI,KAAK,UAAU,gBAAgB,GAC7C;EAEF,IAAI;GAgBF,QAAO,MAfc,IAAI,KACvB,KAAK,UAAU,CAAC,kBAAkB,CAAC,SAEjC,IAAI,KAAK,IACP;IACE,SAAS,IAAI;IACb,eAAe,IAAI;IACnB,UAAU;GACZ,SAEG,IAAI,KAAK,IAA0B,gBAAgB,EAClD,SAAS,IAAI,QACf,CAAC,CACL,CACJ,EAAA,EACe;EACjB,SAAS,OAAO;GACd,KAAA,GACEC,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,eAAe,QACpB,MAAM,MAAM,SAAS,4BACpB,MAAM,MAAM,SAAS,qBAEvB;GAEF,MAAM;EACR;CACF,GACA,EAAE,eAAe,yBAAyB,CAC5C,GACA,GAAG,MAAM,EAAE,MAAM,SAAkB,EAAE,CACvC;AACF;AACA,SAAgB,UAAU,MAA+B;CACvD,OAAO,OAAO,OACZ,iBAAiB,QAAQ,IAAI,MAAM,IAAI,CAAC,GACxC,GAAG,MAAM;EAAE,MAAM;EAAkB;CAAK,EAAE,CAC5C;AACF;AACA,SAAgB,WAAW,MAA+B;CACxD,OAAO,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC;AACvD;AACA,SAAS,aAAa,aAAwD;CAC5E,OAAO,YAAY,SAAS,eAC1B,WAAW,aACP,aAAa,WAAW,KAAK,IAC7B,WAAW,aACT,aAAa,WAAW,KAAK,IAC7B,CAAC,UAAU,CACnB;AACF;AACA,SAAS,OACP,KACA,QACc;CACd,MAAM,SAAuB,CAAC;CAC9B,KAAK,MAAM,WAAW,IAAI,UACxB,KAAK,MAAM,eAAe,aAAa,QAAQ,KAAK,YAAY,GAAG;EACjE,IAAI,YAAY,WAAW,QACzB;EAIF,MAAM,SAFO,YAAY,OACtB,aACgB;EACnB,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,QAAQ,OAAO,MAAM,SACjC;IAAC;IAAS;IAAkB;IAAgB;GAAS,CAAC,CAAC,SAAS,IAAI,CACtE;GACA,IAAI,OACF,OAAO,KAAK;IACV,OAAO;IACP,MAAM;IACN,SAAS,GAAG,QAAQ,KAAK,KAAK,8CAA8C,MAAM;IAClF,MACE,UAAU,YACN,4FACA,kBAAkB,MAAM;GAChC,CAAC;EAEL,OAAO,IACL,QAAQ,SAAS,WACjB,CAAC,QAAQ,OAAO,SAAS,OAAO,IAAI,GAEpC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,QAAQ,KAAK,KAAK,SAAS,OAAO,KAAK,gCAAgC,QAAQ,OAAO,KAAK,IAAI,KAAK,OAAO;GACvH,MAAM;EACR,CAAC;CAEL;CAEF,OAAO;AACT;AACA,MAAM,WAAW;CACf,SAAS,CAAC,cAAc;CACxB,YAAY,CAAC,SAAkB;CAC/B,qBAAqB;AACvB;AACA,MAAa,sBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,mBAAmB;CAChD,SAAS,EAAE,eAAe;EACxB,IACE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,UAC1B,OAAO,OAAO,WAAW,CAAC,CAAC,MACxB,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,MACnD,GAEA,MAAM,IAAIC,oBAAAA,6BACR,qBACA,+DACF;CAEJ;CACA,MAAM,SAAS,EAAE,aAAa,gBAAgB,SAAS;EACrD,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,MAAM,SAAS,OAAO,QAAQ,WAAW,CAAC,CACvC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EAC/D,IAAI;GAiBF,IAAI,EAAC,MAhBgB,QAAQ,KAC3B,KAAK,UAAU;IAAC;IAAqB;IAAgB;GAAM,CAAC,SAE1D,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,cAAc;IACpD,SAAS,QAAQ;IACjB,MAAM;KAAE;KAAgB;IAAY;GACtC,CAAC,CACL,CACJ,EAAA,CACY,SACV,OAAO;IAAE,QAAQ;IAAQ,QAAQ;GAAqB;GAExD,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,KAAA,GACED,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,MAAM,SAAS,4CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,MAAa,kBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,eAAe;CAC5C,MAAM,SAAS,EAAE,gBAAgB,SAAS;EACxC,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,KAC3B,KAAK,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAErD,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,oBAAoB;IAC1D,SAAS,QAAQ;IACjB,OAAO,EAAE,eAAe;GAC1B,CAAC,CACL,CACJ;GACA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,KAAK,KAAK,GACvD,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,QAAQ,QAAQ,oBAAoB,OAAO,IAAI;GAC/C,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,KAAA,GACEA,gBAAAA,WAAAA,CAAW,KAAK,KAChB,MAAM,MAAM,SAAS,6CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,SAAgB,cACd,aACA,UAA8C,CAAC,GACb;CAClC,OAAO;EACL,QAAQ;EACR,QAAQ;GACO;GACb,cAAc,QAAQ,gBAAgB,mBAAmB;EAC3D;CACF;AACF;AACA,SAAgB,qBACd,aACA,SACkC;CAClC,OAAOE,wBAAAA,QAAQ,cAAiB,aAAa,OAAO,CAAC;AACvD;AACA,SAAgB,UACd,UAA8C,CAAC,GACjB;CAC9B,OAAO;EACL,QAAQ;EACR,QAAQ,EAAE,cAAc,QAAQ,gBAAgB,mBAAmB,EAAE;CACvE;AACF;AACA,SAAgB,iBAAiB,SAEI;CACnC,OAAOA,wBAAAA,QAAQ,UAAU,OAAO,CAAC;AACnC"}

package/dist/organization.d.cts

@@ -0,0 +1,40 @@
+import { Ft as SessionPrincipal, Ot as OrgPermissions, f as AuthorizationPolicy, l as AuthorizationContext, nt as Requirement } from "./auth-contracts-BBA1C1gj.cjs";
+//#region src/organization.d.ts
+export interface OrganizationRef {
+  (ctx: AuthorizationContext): unknown | Promise<unknown>;
+  readonly missingReason?: string;
+}
+export interface OrgPermissionParams {
+  readonly permissions: OrgPermissions;
+  readonly organization: OrganizationRef;
+}
+export interface OrgMemberParams {
+  readonly organization: OrganizationRef;
+}
+export declare const ACTIVE_ORGANIZATION_ID: unique symbol;
+export declare const ACTIVE_MEMBER_ROLE: unique symbol;
+export declare const ActiveOrganizationId: () => ParameterDecorator;
+export declare const ActiveMemberRole: () => ParameterDecorator;
+export declare function organizationRef(resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>, options?: {
+  missingReason?: string;
+}): OrganizationRef;
+export declare function activeOrganization(): OrganizationRef;
+export declare function fromParam(name: string): OrganizationRef;
+export declare function fromHeader(name: string): OrganizationRef;
+export declare const orgPermissionPolicy: AuthorizationPolicy<OrgPermissionParams, SessionPrincipal>;
+export declare const orgMemberPolicy: AuthorizationPolicy<OrgMemberParams, SessionPrincipal>;
+export declare function orgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgPermissionParams>;
+export declare function RequireOrgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+export declare function orgMember(options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgMemberParams>;
+export declare function RequireOrgMember(options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+//#endregion
+export type { OrgPermissions };
+//# sourceMappingURL=organization.d.cts.map

package/dist/organization.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.cts","names":[],"sources":["../src/organization.ts"],"mappings":";;iBAaiB;GACd,KAAK,iCAAiC;WAC9B;;iBAEM;WACN,aAAa;WACb,cAAc;;iBAER;WACN,cAAc;;qBAEZ;qBAGA;qBAGA,4BAAoB;qBAIpB,wBAAgB;wBAoBb,gBACd,UAAU,KAAK,mCAAmC,kBAClD;EAAW;IACV;wBAGa,sBAAsB;wBAgDtB,UAAU,eAAe;wBAMzB,WAAW,eAAe;qBA4D7B,qBAAqB,oBAChC,qBACA;qBAiEW,iBAAiB,oBAC5B,iBACA;wBAqDc,cAAc,8BAC5B,aAAa,eAAe,IAC5B;EAAW,eAAe;IACzB,YAAY;wBASC,qBAAqB,8BACnC,aAAa,eAAe,IAC5B;EAAY,eAAe;IAC1B,iBAAiB;wBAGJ,UACd;EAAW,eAAe;IACzB,YAAY;wBAMC,iBAAiB;EAC/B,eAAe;IACb,iBAAiB"}

package/dist/organization.d.mts

@@ -0,0 +1,40 @@
+import { Ft as SessionPrincipal, Ot as OrgPermissions, f as AuthorizationPolicy, l as AuthorizationContext, nt as Requirement } from "./auth-contracts-tqsfBZ8B.mjs";
+//#region src/organization.d.ts
+export interface OrganizationRef {
+  (ctx: AuthorizationContext): unknown | Promise<unknown>;
+  readonly missingReason?: string;
+}
+export interface OrgPermissionParams {
+  readonly permissions: OrgPermissions;
+  readonly organization: OrganizationRef;
+}
+export interface OrgMemberParams {
+  readonly organization: OrganizationRef;
+}
+export declare const ACTIVE_ORGANIZATION_ID: unique symbol;
+export declare const ACTIVE_MEMBER_ROLE: unique symbol;
+export declare const ActiveOrganizationId: () => ParameterDecorator;
+export declare const ActiveMemberRole: () => ParameterDecorator;
+export declare function organizationRef(resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>, options?: {
+  missingReason?: string;
+}): OrganizationRef;
+export declare function activeOrganization(): OrganizationRef;
+export declare function fromParam(name: string): OrganizationRef;
+export declare function fromHeader(name: string): OrganizationRef;
+export declare const orgPermissionPolicy: AuthorizationPolicy<OrgPermissionParams, SessionPrincipal>;
+export declare const orgMemberPolicy: AuthorizationPolicy<OrgMemberParams, SessionPrincipal>;
+export declare function orgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgPermissionParams>;
+export declare function RequireOrgPermission<N extends string = "default">(permissions: OrgPermissions<N>, options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+export declare function orgMember(options?: {
+  organization?: OrganizationRef;
+}): Requirement<OrgMemberParams>;
+export declare function RequireOrgMember(options?: {
+  organization?: OrganizationRef;
+}): ClassDecorator & MethodDecorator;
+//#endregion
+export type { OrgPermissions };
+//# sourceMappingURL=organization.d.mts.map

package/dist/organization.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.mts","names":[],"sources":["../src/organization.ts"],"mappings":";;iBAaiB;GACd,KAAK,iCAAiC;WAC9B;;iBAEM;WACN,aAAa;WACb,cAAc;;iBAER;WACN,cAAc;;qBAEZ;qBAGA;qBAGA,4BAAoB;qBAIpB,wBAAgB;wBAoBb,gBACd,UAAU,KAAK,mCAAmC,kBAClD;EAAW;IACV;wBAGa,sBAAsB;wBAgDtB,UAAU,eAAe;wBAMzB,WAAW,eAAe;qBA4D7B,qBAAqB,oBAChC,qBACA;qBAiEW,iBAAiB,oBAC5B,iBACA;wBAqDc,cAAc,8BAC5B,aAAa,eAAe,IAC5B;EAAW,eAAe;IACzB,YAAY;wBASC,qBAAqB,8BACnC,aAAa,eAAe,IAC5B;EAAY,eAAe;IAC1B,iBAAiB;wBAGJ,UACd;EAAW,eAAe;IACzB,YAAY;wBAMC,iBAAiB;EAC/B,eAAe;IACb,iBAAiB"}

package/dist/organization.mjs

@@ -0,0 +1,177 @@
+import { n as BetterAuthConfigurationError } from "./auth-errors-CQjfgjaO.mjs";
+import { u as Require, v as defineInvocationParam } from "./auth-decorators-DfAJbHar.mjs";
+import { isAPIError } from "better-auth/api";
+//#region src/organization.ts
+const ACTIVE_ORGANIZATION_ID = Symbol.for("nestjs-slightly-better-auth:org:active-organization-id");
+const ACTIVE_MEMBER_ROLE = Symbol.for("nestjs-slightly-better-auth:org:active-member-role");
+const ActiveOrganizationId = defineInvocationParam(ACTIVE_ORGANIZATION_ID, { missing: "ORGANIZATION_REQUIRED" });
+const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, { missing: "MEMBER_ROLE_REQUIRED" });
+const REF = Symbol.for("nestjs-slightly-better-auth:org:ref");
+function organizationRef(resolve, options = {}) {
+	return Object.assign((ctx) => resolve(ctx), options);
+}
+function activeOrganization() {
+	return Object.assign(organizationRef(async (ctx) => {
+		const value = ctx.principal.session.session?.activeOrganizationId;
+		if (value !== void 0) return value;
+		if (!await ctx.auth.hasPlugin("custom-session")) return;
+		try {
+			return (await ctx.memo(JSON.stringify(["org:activeMember"]), () => ctx.auth.run({
+				cookies: ctx.cookies,
+				inbound: () => ctx.headers,
+				internal: true
+			}, () => ctx.auth.api.getActiveMember({ headers: ctx.headers }))))?.organizationId;
+		} catch (error) {
+			if (isAPIError(error) && error.statusCode === 400 && (error.body?.code === "NO_ACTIVE_ORGANIZATION" || error.body?.code === "MEMBER_NOT_FOUND")) return;
+			throw error;
+		}
+	}, { missingReason: "NO_ACTIVE_ORGANIZATION" }), { [REF]: { kind: "active" } });
+}
+function fromParam(name) {
+	return Object.assign(organizationRef((ctx) => ctx.param(name)), { [REF]: {
+		kind: "param",
+		name
+	} });
+}
+function fromHeader(name) {
+	return organizationRef((ctx) => ctx.headers.get(name));
+}
+function requirements(expressions) {
+	return expressions.flatMap((expression) => "anyOf" in expression ? requirements(expression.anyOf) : "allOf" in expression ? requirements(expression.allOf) : [expression]);
+}
+function advise(ctx, policy) {
+	const advice = [];
+	for (const handler of ctx.handlers) for (const requirement of requirements(handler.plan.requirements)) {
+		if (requirement.policy !== policy) continue;
+		const marker = requirement.params.organization[REF];
+		if (marker?.kind === "active") {
+			const input = handler.inputs.find((name) => [
+				"orgId",
+				"organizationId",
+				"organization",
+				"orgSlug"
+			].includes(name));
+			if (input) advice.push({
+				level: "warn",
+				code: "W_ORG_PARAM_IGNORED",
+				message: `${handler.plan.site} checks the active organization but accepts ${input}.`,
+				hint: input === "orgSlug" ? "Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers })." : `Use fromParam('${input}').`
+			});
+		} else if (marker?.kind === "param" && !handler.inputs.includes(marker.name)) advice.push({
+			level: "warn",
+			code: "W_ORG_PARAM_MISSING",
+			message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(", ") || "none"}.`,
+			hint: "Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement."
+		});
+	}
+	return advice;
+}
+const requires = {
+	plugins: ["organization"],
+	principals: ["session"],
+	presentsCredentials: true
+};
+const orgPermissionPolicy = {
+	id: "better-auth:organization/permission",
+	requires,
+	advise: (ctx) => advise(ctx, orgPermissionPolicy),
+	validate({ permissions }) {
+		if (!Object.keys(permissions).length || Object.values(permissions).some((actions) => !Array.isArray(actions) || !actions.length)) throw new BetterAuthConfigurationError("EMPTY_PERMISSIONS", "Organization permissions must contain a resource and actions.");
+	},
+	async evaluate({ permissions, organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		const stable = Object.entries(permissions).sort(([a], [b]) => a.localeCompare(b)).map(([resource, actions]) => [resource, [...actions].sort()]);
+		try {
+			if (!(await context.memo(JSON.stringify([
+				"org:hasPermission",
+				organizationId,
+				stable
+			]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.hasPermission({
+				headers: context.headers,
+				body: {
+					organizationId,
+					permissions
+				}
+			})))).success) return {
+				effect: "deny",
+				reason: "MISSING_PERMISSION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			return { effect: "allow" };
+		} catch (error) {
+			if (isAPIError(error) && error.body?.code === "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION") return {
+				effect: "deny",
+				reason: "USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+const orgMemberPolicy = {
+	id: "better-auth:organization/member",
+	requires,
+	advise: (ctx) => advise(ctx, orgMemberPolicy),
+	async evaluate({ organization }, context) {
+		const organizationId = await organization(context);
+		if (typeof organizationId !== "string" || !organizationId.trim()) return {
+			effect: "deny",
+			reason: organization.missingReason ?? "ORGANIZATION_REQUIRED"
+		};
+		try {
+			const result = await context.memo(JSON.stringify(["org:activeMemberRole", organizationId]), () => context.auth.run({
+				cookies: context.cookies,
+				inbound: () => context.headers,
+				internal: true
+			}, () => context.auth.api.getActiveMemberRole({
+				headers: context.headers,
+				query: { organizationId }
+			})));
+			if (typeof result.role !== "string" || !result.role.trim()) return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			context.provide(ACTIVE_ORGANIZATION_ID, organizationId);
+			context.provide(ACTIVE_MEMBER_ROLE, result.role);
+			return { effect: "allow" };
+		} catch (error) {
+			if (isAPIError(error) && error.body?.code === "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION") return {
+				effect: "deny",
+				reason: "YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION"
+			};
+			throw error;
+		}
+	}
+};
+function orgPermission(permissions, options = {}) {
+	return {
+		policy: orgPermissionPolicy,
+		params: {
+			permissions,
+			organization: options.organization ?? activeOrganization()
+		}
+	};
+}
+function RequireOrgPermission(permissions, options) {
+	return Require(orgPermission(permissions, options));
+}
+function orgMember(options = {}) {
+	return {
+		policy: orgMemberPolicy,
+		params: { organization: options.organization ?? activeOrganization() }
+	};
+}
+function RequireOrgMember(options) {
+	return Require(orgMember(options));
+}
+//#endregion
+export { ACTIVE_MEMBER_ROLE, ACTIVE_ORGANIZATION_ID, ActiveMemberRole, ActiveOrganizationId, RequireOrgMember, RequireOrgPermission, activeOrganization, fromHeader, fromParam, orgMember, orgMemberPolicy, orgPermission, orgPermissionPolicy, organizationRef };
+
+//# sourceMappingURL=organization.mjs.map

package/dist/organization.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.mjs","names":[],"sources":["../src/organization.ts"],"sourcesContent":["import { isAPIError } from \"better-auth/api\";\nimport type {\n  AuthorizationContext,\n  AuthorizationPolicy,\n  BootAdvice,\n  BootAdviceContext,\n  Requirement,\n  RequirementExpr,\n} from \"./auth-contracts.js\";\nimport { defineInvocationParam, Require } from \"./auth-decorators.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { OrgPermissions, SessionPrincipal } from \"./auth-types.js\";\nexport type { OrgPermissions } from \"./auth-types.js\";\nexport interface OrganizationRef {\n  (ctx: AuthorizationContext): unknown | Promise<unknown>;\n  readonly missingReason?: string;\n}\nexport interface OrgPermissionParams {\n  readonly permissions: OrgPermissions;\n  readonly organization: OrganizationRef;\n}\nexport interface OrgMemberParams {\n  readonly organization: OrganizationRef;\n}\nexport const ACTIVE_ORGANIZATION_ID = Symbol.for(\n  \"nestjs-slightly-better-auth:org:active-organization-id\",\n);\nexport const ACTIVE_MEMBER_ROLE = Symbol.for(\n  \"nestjs-slightly-better-auth:org:active-member-role\",\n);\nexport const ActiveOrganizationId = defineInvocationParam(\n  ACTIVE_ORGANIZATION_ID,\n  { missing: \"ORGANIZATION_REQUIRED\" },\n);\nexport const ActiveMemberRole = defineInvocationParam(ACTIVE_MEMBER_ROLE, {\n  missing: \"MEMBER_ROLE_REQUIRED\",\n});\nconst REF = Symbol.for(\"nestjs-slightly-better-auth:org:ref\");\ntype MarkedRef = OrganizationRef & {\n  readonly [REF]?: { kind: \"active\" } | { kind: \"param\"; name: string };\n};\ninterface OrgApi {\n  hasPermission(input: {\n    headers: Headers;\n    body: { organizationId: string; permissions: OrgPermissions };\n  }): Promise<{ success: boolean }>;\n  getActiveMemberRole(input: {\n    headers: Headers;\n    query: { organizationId: string };\n  }): Promise<{ role?: string | null }>;\n  getActiveMember(input: {\n    headers: Headers;\n  }): Promise<{ organizationId?: string }>;\n}\nexport function organizationRef(\n  resolve: (ctx: AuthorizationContext) => unknown | Promise<unknown>,\n  options: { missingReason?: string } = {},\n): OrganizationRef {\n  return Object.assign((ctx: AuthorizationContext) => resolve(ctx), options);\n}\nexport function activeOrganization(): OrganizationRef {\n  return Object.assign(\n    organizationRef(\n      async (ctx) => {\n        const session = (ctx.principal as SessionPrincipal).session as {\n          session?: { activeOrganizationId?: unknown };\n        };\n        const value = session.session?.activeOrganizationId;\n        if (value !== undefined) {\n          return value;\n        }\n        if (!(await ctx.auth.hasPlugin(\"custom-session\"))) {\n          return undefined;\n        }\n        try {\n          const member = await ctx.memo(\n            JSON.stringify([\"org:activeMember\"]),\n            () =>\n              ctx.auth.run(\n                {\n                  cookies: ctx.cookies,\n                  inbound: () => ctx.headers,\n                  internal: true,\n                },\n                () =>\n                  (ctx.auth.api as unknown as OrgApi).getActiveMember({\n                    headers: ctx.headers,\n                  }),\n              ),\n          );\n          return member?.organizationId;\n        } catch (error) {\n          if (\n            isAPIError(error) &&\n            error.statusCode === 400 &&\n            (error.body?.code === \"NO_ACTIVE_ORGANIZATION\" ||\n              error.body?.code === \"MEMBER_NOT_FOUND\")\n          ) {\n            return undefined;\n          }\n          throw error;\n        }\n      },\n      { missingReason: \"NO_ACTIVE_ORGANIZATION\" },\n    ),\n    { [REF]: { kind: \"active\" as const } },\n  );\n}\nexport function fromParam(name: string): OrganizationRef {\n  return Object.assign(\n    organizationRef((ctx) => ctx.param(name)),\n    { [REF]: { kind: \"param\" as const, name } },\n  );\n}\nexport function fromHeader(name: string): OrganizationRef {\n  return organizationRef((ctx) => ctx.headers.get(name));\n}\nfunction requirements(expressions: readonly RequirementExpr[]): Requirement[] {\n  return expressions.flatMap((expression) =>\n    \"anyOf\" in expression\n      ? requirements(expression.anyOf)\n      : \"allOf\" in expression\n        ? requirements(expression.allOf)\n        : [expression],\n  );\n}\nfunction advise(\n  ctx: BootAdviceContext,\n  policy: AuthorizationPolicy<any, any>,\n): BootAdvice[] {\n  const advice: BootAdvice[] = [];\n  for (const handler of ctx.handlers) {\n    for (const requirement of requirements(handler.plan.requirements)) {\n      if (requirement.policy !== policy) {\n        continue;\n      }\n      const ref = (requirement.params as OrgMemberParams)\n        .organization as MarkedRef;\n      const marker = ref[REF];\n      if (marker?.kind === \"active\") {\n        const input = handler.inputs.find((name) =>\n          [\"orgId\", \"organizationId\", \"organization\", \"orgSlug\"].includes(name),\n        );\n        if (input) {\n          advice.push({\n            level: \"warn\",\n            code: \"W_ORG_PARAM_IGNORED\",\n            message: `${handler.plan.site} checks the active organization but accepts ${input}.`,\n            hint:\n              input === \"orgSlug\"\n                ? \"Map the slug to an ID with organizationRef and auth.api.listOrganizations({ headers }).\"\n                : `Use fromParam('${input}').`,\n          });\n        }\n      } else if (\n        marker?.kind === \"param\" &&\n        !handler.inputs.includes(marker.name)\n      ) {\n        advice.push({\n          level: \"warn\",\n          code: \"W_ORG_PARAM_MISSING\",\n          message: `${handler.plan.site} reads ${marker.name}, absent from claimed inputs: ${handler.inputs.join(\", \") || \"none\"}.`,\n          hint: \"Use the correct input name, a method-level organizationRef, or SkipDefaultRequirements with a method-level requirement.\",\n        });\n      }\n    }\n  }\n  return advice;\n}\nconst requires = {\n  plugins: [\"organization\"],\n  principals: [\"session\" as const],\n  presentsCredentials: true,\n};\nexport const orgPermissionPolicy: AuthorizationPolicy<\n  OrgPermissionParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/permission\", // gitleaks:allow: public policy identifier\n  requires,\n  advise: (ctx) => advise(ctx, orgPermissionPolicy),\n  validate({ permissions }) {\n    if (\n      !Object.keys(permissions).length ||\n      Object.values(permissions).some(\n        (actions) => !Array.isArray(actions) || !actions.length,\n      )\n    ) {\n      throw new BetterAuthConfigurationError(\n        \"EMPTY_PERMISSIONS\",\n        \"Organization permissions must contain a resource and actions.\",\n      );\n    }\n  },\n  async evaluate({ permissions, organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    const stable = Object.entries(permissions)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([resource, actions]) => [resource, [...actions].sort()]);\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:hasPermission\", organizationId, stable]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).hasPermission({\n                headers: context.headers,\n                body: { organizationId, permissions },\n              }),\n          ),\n      );\n      if (!result.success) {\n        return { effect: \"deny\", reason: \"MISSING_PERMISSION\" };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport const orgMemberPolicy: AuthorizationPolicy<\n  OrgMemberParams,\n  SessionPrincipal\n> = {\n  id: \"better-auth:organization/member\",\n  requires,\n  advise: (ctx) => advise(ctx, orgMemberPolicy),\n  async evaluate({ organization }, context) {\n    const organizationId = await organization(context);\n    if (typeof organizationId !== \"string\" || !organizationId.trim()) {\n      return {\n        effect: \"deny\",\n        reason: organization.missingReason ?? \"ORGANIZATION_REQUIRED\",\n      };\n    }\n    try {\n      const result = await context.memo(\n        JSON.stringify([\"org:activeMemberRole\", organizationId]),\n        () =>\n          context.auth.run(\n            {\n              cookies: context.cookies,\n              inbound: () => context.headers,\n              internal: true,\n            },\n            () =>\n              (context.auth.api as unknown as OrgApi).getActiveMemberRole({\n                headers: context.headers,\n                query: { organizationId },\n              }),\n          ),\n      );\n      if (typeof result.role !== \"string\" || !result.role.trim()) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      context.provide(ACTIVE_ORGANIZATION_ID, organizationId);\n      context.provide(ACTIVE_MEMBER_ROLE, result.role);\n      return { effect: \"allow\" };\n    } catch (error) {\n      if (\n        isAPIError(error) &&\n        error.body?.code === \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\"\n      ) {\n        return {\n          effect: \"deny\",\n          reason: \"YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION\",\n        };\n      }\n      throw error;\n    }\n  },\n};\nexport function orgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgPermissionParams> {\n  return {\n    policy: orgPermissionPolicy,\n    params: {\n      permissions: permissions as OrgPermissions,\n      organization: options.organization ?? activeOrganization(),\n    },\n  };\n}\nexport function RequireOrgPermission<N extends string = \"default\">(\n  permissions: OrgPermissions<N>,\n  options?: { organization?: OrganizationRef },\n): ClassDecorator & MethodDecorator {\n  return Require(orgPermission<N>(permissions, options));\n}\nexport function orgMember(\n  options: { organization?: OrganizationRef } = {},\n): Requirement<OrgMemberParams> {\n  return {\n    policy: orgMemberPolicy,\n    params: { organization: options.organization ?? activeOrganization() },\n  };\n}\nexport function RequireOrgMember(options?: {\n  organization?: OrganizationRef;\n}): ClassDecorator & MethodDecorator {\n  return Require(orgMember(options));\n}\n"],"mappings":";;;;AAwBA,MAAa,yBAAyB,OAAO,IAC3C,wDACF;AACA,MAAa,qBAAqB,OAAO,IACvC,oDACF;AACA,MAAa,uBAAuB,sBAClC,wBACA,EAAE,SAAS,wBAAwB,CACrC;AACA,MAAa,mBAAmB,sBAAsB,oBAAoB,EACxE,SAAS,uBACX,CAAC;AACD,MAAM,MAAM,OAAO,IAAI,qCAAqC;AAiB5D,SAAgB,gBACd,SACA,UAAsC,CAAC,GACtB;CACjB,OAAO,OAAO,QAAQ,QAA8B,QAAQ,GAAG,GAAG,OAAO;AAC3E;AACA,SAAgB,qBAAsC;CACpD,OAAO,OAAO,OACZ,gBACE,OAAO,QAAQ;EAIb,MAAM,QAHW,IAAI,UAA+B,QAG9B,SAAS;EAC/B,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,IAAI,CAAE,MAAM,IAAI,KAAK,UAAU,gBAAgB,GAC7C;EAEF,IAAI;GAgBF,QAAO,MAfc,IAAI,KACvB,KAAK,UAAU,CAAC,kBAAkB,CAAC,SAEjC,IAAI,KAAK,IACP;IACE,SAAS,IAAI;IACb,eAAe,IAAI;IACnB,UAAU;GACZ,SAEG,IAAI,KAAK,IAA0B,gBAAgB,EAClD,SAAS,IAAI,QACf,CAAC,CACL,CACJ,EAAA,EACe;EACjB,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,eAAe,QACpB,MAAM,MAAM,SAAS,4BACpB,MAAM,MAAM,SAAS,qBAEvB;GAEF,MAAM;EACR;CACF,GACA,EAAE,eAAe,yBAAyB,CAC5C,GACA,GAAG,MAAM,EAAE,MAAM,SAAkB,EAAE,CACvC;AACF;AACA,SAAgB,UAAU,MAA+B;CACvD,OAAO,OAAO,OACZ,iBAAiB,QAAQ,IAAI,MAAM,IAAI,CAAC,GACxC,GAAG,MAAM;EAAE,MAAM;EAAkB;CAAK,EAAE,CAC5C;AACF;AACA,SAAgB,WAAW,MAA+B;CACxD,OAAO,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC;AACvD;AACA,SAAS,aAAa,aAAwD;CAC5E,OAAO,YAAY,SAAS,eAC1B,WAAW,aACP,aAAa,WAAW,KAAK,IAC7B,WAAW,aACT,aAAa,WAAW,KAAK,IAC7B,CAAC,UAAU,CACnB;AACF;AACA,SAAS,OACP,KACA,QACc;CACd,MAAM,SAAuB,CAAC;CAC9B,KAAK,MAAM,WAAW,IAAI,UACxB,KAAK,MAAM,eAAe,aAAa,QAAQ,KAAK,YAAY,GAAG;EACjE,IAAI,YAAY,WAAW,QACzB;EAIF,MAAM,SAFO,YAAY,OACtB,aACgB;EACnB,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,QAAQ,OAAO,MAAM,SACjC;IAAC;IAAS;IAAkB;IAAgB;GAAS,CAAC,CAAC,SAAS,IAAI,CACtE;GACA,IAAI,OACF,OAAO,KAAK;IACV,OAAO;IACP,MAAM;IACN,SAAS,GAAG,QAAQ,KAAK,KAAK,8CAA8C,MAAM;IAClF,MACE,UAAU,YACN,4FACA,kBAAkB,MAAM;GAChC,CAAC;EAEL,OAAO,IACL,QAAQ,SAAS,WACjB,CAAC,QAAQ,OAAO,SAAS,OAAO,IAAI,GAEpC,OAAO,KAAK;GACV,OAAO;GACP,MAAM;GACN,SAAS,GAAG,QAAQ,KAAK,KAAK,SAAS,OAAO,KAAK,gCAAgC,QAAQ,OAAO,KAAK,IAAI,KAAK,OAAO;GACvH,MAAM;EACR,CAAC;CAEL;CAEF,OAAO;AACT;AACA,MAAM,WAAW;CACf,SAAS,CAAC,cAAc;CACxB,YAAY,CAAC,SAAkB;CAC/B,qBAAqB;AACvB;AACA,MAAa,sBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,mBAAmB;CAChD,SAAS,EAAE,eAAe;EACxB,IACE,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,UAC1B,OAAO,OAAO,WAAW,CAAC,CAAC,MACxB,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,CAAC,QAAQ,MACnD,GAEA,MAAM,IAAI,6BACR,qBACA,+DACF;CAEJ;CACA,MAAM,SAAS,EAAE,aAAa,gBAAgB,SAAS;EACrD,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,MAAM,SAAS,OAAO,QAAQ,WAAW,CAAC,CACvC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,UAAU,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EAC/D,IAAI;GAiBF,IAAI,EAAC,MAhBgB,QAAQ,KAC3B,KAAK,UAAU;IAAC;IAAqB;IAAgB;GAAM,CAAC,SAE1D,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,cAAc;IACpD,SAAS,QAAQ;IACjB,MAAM;KAAE;KAAgB;IAAY;GACtC,CAAC,CACL,CACJ,EAAA,CACY,SACV,OAAO;IAAE,QAAQ;IAAQ,QAAQ;GAAqB;GAExD,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,MAAM,SAAS,4CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,MAAa,kBAGT;CACF,IAAI;CACJ;CACA,SAAS,QAAQ,OAAO,KAAK,eAAe;CAC5C,MAAM,SAAS,EAAE,gBAAgB,SAAS;EACxC,MAAM,iBAAiB,MAAM,aAAa,OAAO;EACjD,IAAI,OAAO,mBAAmB,YAAY,CAAC,eAAe,KAAK,GAC7D,OAAO;GACL,QAAQ;GACR,QAAQ,aAAa,iBAAiB;EACxC;EAEF,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,KAC3B,KAAK,UAAU,CAAC,wBAAwB,cAAc,CAAC,SAErD,QAAQ,KAAK,IACX;IACE,SAAS,QAAQ;IACjB,eAAe,QAAQ;IACvB,UAAU;GACZ,SAEG,QAAQ,KAAK,IAA0B,oBAAoB;IAC1D,SAAS,QAAQ;IACjB,OAAO,EAAE,eAAe;GAC1B,CAAC,CACL,CACJ;GACA,IAAI,OAAO,OAAO,SAAS,YAAY,CAAC,OAAO,KAAK,KAAK,GACvD,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,QAAQ,QAAQ,wBAAwB,cAAc;GACtD,QAAQ,QAAQ,oBAAoB,OAAO,IAAI;GAC/C,OAAO,EAAE,QAAQ,QAAQ;EAC3B,SAAS,OAAO;GACd,IACE,WAAW,KAAK,KAChB,MAAM,MAAM,SAAS,6CAErB,OAAO;IACL,QAAQ;IACR,QAAQ;GACV;GAEF,MAAM;EACR;CACF;AACF;AACA,SAAgB,cACd,aACA,UAA8C,CAAC,GACb;CAClC,OAAO;EACL,QAAQ;EACR,QAAQ;GACO;GACb,cAAc,QAAQ,gBAAgB,mBAAmB;EAC3D;CACF;AACF;AACA,SAAgB,qBACd,aACA,SACkC;CAClC,OAAO,QAAQ,cAAiB,aAAa,OAAO,CAAC;AACvD;AACA,SAAgB,UACd,UAA8C,CAAC,GACjB;CAC9B,OAAO;EACL,QAAQ;EACR,QAAQ,EAAE,cAAc,QAAQ,gBAAgB,mBAAmB,EAAE;CACvE;AACF;AACA,SAAgB,iBAAiB,SAEI;CACnC,OAAO,QAAQ,UAAU,OAAO,CAAC;AACnC"}