// ---------------------------------------------------------------------------// Self-host admin users API — the shared, provider-neutral `AdminUsersHandlers`// backed by a Better-Auth-authorized platform view, mounted at// `/api/admin/users*` beside the existing invite-code admin routes.//// AUTH: an owner/admin member of the single org, resolved by the shared// `requireInstanceAdmin` — the SAME gate the invite-code admin API uses// (`admin/handlers.ts`), not a new permission concept. Membership is resolved// against the INSTANCE's organization id, never the caller's// `session.activeOrganizationId`: see require-admin.ts for the privilege// escalation that distinction refuses. Self-host has no// organization-OWNED api key (Better Auth keys always belong to the user who// created one), so there is no machine-credential path here; the operator's own// admin session is the credential. That asymmetry with cloud is deliberate and// is why `AdminUsersProvider` is a seam rather than one shared implementation.//// The READ half is identical to cloud's: a subject-less, tenant-reach executor// from `makePlatformExecutor`, projected by the shared `admin/reads`. Self-host// is single-tenant, so the tenant is always the boot-seeded org.// --------------------------------------------------------------------------- import { HttpRouter } from "effect/unstable/http";import { Effect, Layer } from "effect"; import {  AdminUsersProvider,  DbProvider,  HostConfig,  PluginsProvider,  getAdminUser,  listAdminUserConnections,  listAdminUsers,  listAdminUsersWithConnections,  makeAdminUsersApiLayer,  makePlatformExecutor,  normalizeAdminUserEmail,  platformViewOf,  requestScopedMiddleware,  type AdminUserDirectory,  type AdminUserIdentity,  type AdminUsersHeaders,} from "@executor-js/api/server";import {  AdminUserNotFound,  AdminUsersError,  AdminUsersForbidden,  AdminUsersUnauthorized,} from "@executor-js/api";import type { Executor } from "@executor-js/sdk"; import { BetterAuth, type BetterAuthHandle } from "../auth/better-auth";import { requireInstanceAdmin } from "./require-admin";import { SelfHostDb, SelfHostDbProvider, type SelfHostDbHandle } from "../db/self-host-db";import { SelfHostHostConfig, SelfHostPluginsProvider } from "../execution"; /** * The SAME gate the invite-code admin API applies — literally the same * function, not a second copy of the same idea, which is how the two planes * came to share a bypass. A plain member session is refused, and so is an owner * of some OTHER organization: this plane reports every user in the instance, so * the org it authorizes against is the instance's own (see require-admin.ts). */const requireAdmin = (headers: AdminUsersHeaders) =>  requireInstanceAdmin(new Headers(headers)).pipe(    Effect.mapError((denial) =>      denial === "unauthorized" ? new AdminUsersUnauthorized() : new AdminUsersForbidden(),    ),  ); /** * Self-host's member directory: `externalId` → email/name. * * THE JOIN KEY is `member.userId`, the Better Auth `user.id` — precisely what * `auth/identity.ts` binds as `accountId` and therefore what the subject table * records in `external_id`. `member.id` is the organization `member` ROW id and * joins to nothing; the two look alike, so the choice is pinned here and in the * node test rather than left to a reader. * * One `listMembers` call per request: Better Auth's organization plugin already * attaches the `user` row to each member, so email and name arrive with the * membership and no per-user lookup is needed. The requested ids are not passed * to the call — the plugin offers no id filter, and a single-instance member * list is small — but the caller only reads the ids it asked for. * * Runs as the CALLER, using their own admin headers, so this reads exactly the * directory that session is already entitled to on `/account/members`. */const listMembers = (auth: BetterAuthHandle["auth"], headers: AdminUsersHeaders) =>  Effect.tryPromise(() => auth.api.listMembers({ headers: new Headers(headers) })); /** * Both directions of self-host's directory, over the SAME single `listMembers` * read. * * The reverse (email → `user.id`) needs no extra call and no new permission: * the organization plugin already attaches the `user` row to each member, so * the email is sitting beside the id the forward join uses. Better Auth * lower-cases every email it writes, but the directory value is normalized * anyway so this host cannot answer differently from cloud if that ever * changes. * * A member with no `user.email` cannot match — `null` is not an address, and * coercing it to "" would let an empty `?email=` select an arbitrary row. */const userDirectory = (  auth: BetterAuthHandle["auth"],  headers: AdminUsersHeaders,): AdminUserDirectory => ({  identities: () =>    listMembers(auth, headers).pipe(      Effect.map((result) => {        const identities = new Map<string, AdminUserIdentity>();        for (const member of result.members) {          identities.set(member.userId, {            email: member.user?.email ?? null,            displayName: member.user?.name ?? null,          });        }        return identities;      }),    ),  resolveEmail: (email) =>    listMembers(auth, headers).pipe(      Effect.map(        (result) =>          result.members.find((member) => {            const stored = member.user?.email;            return stored != null && normalizeAdminUserEmail(stored) === email;          })?.userId ?? null,      ),    ),}); const withPlatformView = <A, E extends AdminUsersError | AdminUserNotFound = AdminUsersError>(  headers: AdminUsersHeaders,  organizationId: string,  body: (executor: Executor) => Effect.Effect<A, E>,): Effect.Effect<  A,  // `AdminUsersError` unconditionally: opening the platform view can fail that  // way regardless of what `body` itself raises.  E | AdminUsersError | AdminUsersUnauthorized | AdminUsersForbidden,  BetterAuth | DbProvider | PluginsProvider | HostConfig> =>  Effect.gen(function* () {    yield* requireAdmin(headers);    const executor = yield* makePlatformExecutor(organizationId).pipe(      Effect.mapError(() => new AdminUsersError({ message: "Failed to open the platform view" })),    );    return yield* Effect.ensuring(body(executor), executor.close().pipe(Effect.ignore));  }); export const betterAuthAdminUsersProvider: Layer.Layer<  AdminUsersProvider,  never,  BetterAuth | DbProvider | PluginsProvider | HostConfig> = Layer.effect(AdminUsersProvider)(  Effect.gen(function* () {    const context = yield* Effect.context<BetterAuth | DbProvider | PluginsProvider | HostConfig>();    const { auth, organizationId } = yield* BetterAuth;    return AdminUsersProvider.of({      listUsers: (headers, options) =>        withPlatformView(headers, organizationId, (executor) =>          platformViewOf(executor).pipe(            Effect.flatMap((admin) => listAdminUsers(admin, options, userDirectory(auth, headers))),          ),        ).pipe(Effect.provideContext(context)),      listUsersWithConnections: (headers, options) =>        withPlatformView(headers, organizationId, (executor) =>          platformViewOf(executor).pipe(            Effect.flatMap((admin) =>              listAdminUsersWithConnections(admin, options, userDirectory(auth, headers)),            ),          ),        ).pipe(Effect.provideContext(context)),      listUserConnections: (headers, externalId) =>        withPlatformView(headers, organizationId, (executor) =>          platformViewOf(executor).pipe(            Effect.flatMap((admin) => listAdminUserConnections(admin, externalId)),          ),        ).pipe(Effect.provideContext(context)),      getUser: (headers, identifier) =>        withPlatformView(headers, organizationId, (executor) =>          platformViewOf(executor).pipe(            Effect.flatMap((admin) =>              getAdminUser(admin, identifier, userDirectory(auth, headers)),            ),          ),        ).pipe(Effect.provideContext(context)),    });  }),); export interface SelfHostAdminUsersApiDeps {  readonly betterAuth: BetterAuthHandle;  readonly db: SelfHostDbHandle;  readonly mountPrefix: `/${string}`;} /** * The mountable extension route layer for `/api/admin/users*`. Self-host's DB * handle and Better Auth are app singletons, so the provider is self-contained * (no per-request socket to close over, unlike cloud) — but it still goes * through `requestScopedMiddleware`, because an HttpApi handler's service * requirement is not erased by a plain `Layer.provide` on the builder layer. */export const makeSelfHostAdminUsersApiLayer = ({  betterAuth,  db,  mountPrefix,}: SelfHostAdminUsersApiDeps) => {  const prefixedRouter = Layer.effect(HttpRouter.HttpRouter)(    Effect.map(HttpRouter.HttpRouter.asEffect(), (router) => router.prefixed(mountPrefix)),  );  const provider = betterAuthAdminUsersProvider.pipe(    Layer.provide(Layer.succeed(BetterAuth)(betterAuth)),    Layer.provide(SelfHostDbProvider),    Layer.provide(SelfHostPluginsProvider),    Layer.provide(SelfHostHostConfig),    Layer.provide(Layer.succeed(SelfHostDb)(db)),  );  return makeAdminUsersApiLayer(requestScopedMiddleware(provider).layer, {    router: prefixedRouter,  });};