Teams and roles

authoric.orgs reaches the signed-in user's organizations, and authoric.roles the roles in them. Every call acts in the session's active organization, and the server decides who may do what: inviting, removing and assigning roles are an administrator's or an owner's, as your policies say.

Organizations

const { items } = await authoric.orgs.list(); // every org the user belongs to, the active one flagged

await authoric.orgs.switch(orgUid); // act in another one; the same as auth.switchOrg
await authoric.orgs.rename({ name: "Reyes Logistics" }); // the active org

A user can also create organizations beyond their own, when your app allows it (App settings › Sign-in, "Users can create more organizations"). They own each one they create:

const { org } = await authoric.orgs.create({ name: "Reyes Consulting" }); // { uid, name }
await authoric.orgs.switch(org.uid);

create throws ORG_CREATION_DISABLED when your app does not allow it, ORG_LIMIT_REACHED past the number per user you set, and EMAIL_NOT_VERIFIED until the user has confirmed their address. A name is 2 to 120 characters.

Members

const members = await authoric.orgs.members.list(); // the active org's members
await authoric.orgs.members.remove({ membershipUid }); // remove someone else
await authoric.orgs.members.leave(); // leave the active org

Nobody can leave, or be removed from, their home organization (the one created with their account), and the last owner or administrator cannot be removed. See Members and invitations for every rule.

Invitations

// An administrator invites by email.
await authoric.orgs.invitations.send({ inviteeEmail: "sam@example.com", expiresInDays: 14 });
await authoric.orgs.invitations.sent({ status: "pending" }); // what the active org has sent
await authoric.orgs.invitations.revoke({ invitationUid }); // withdraw one

// The invitee, signed in to their own account.
const { items } = await authoric.orgs.invitations.received({ status: "pending" });
const accepted = await authoric.orgs.invitations.accept({ invitationUid: items[0].invitationUid });
await authoric.orgs.switch(accepted.orgUid);
// or: await authoric.orgs.invitations.deny({ invitationUid })

Your app sends the invitation email, as your app. It carries no link: the invitee signs up or signs in, and finds the invitation among their received ones. Build that screen in your app: list received() after sign-in, and offer accept and deny. Accepting does not switch the session; switch into the new organization when the user wants to.

invitations.cancel({ invitationUid }) cancels a pending invitation addressed to the user.

Roles

const roles = await authoric.roles.list(); // the active org's roles
const held = await authoric.roles.forUser(userUid); // what one user holds

await authoric.roles.assign({ userUid, roleKey: "admin" }); // or { userUid, roleUid }
await authoric.roles.unassign({ userUid, roleKey: "admin" });

assign and unassign make the API's two-step call for you: a review, then a confirm of exactly what was reviewed. A binding is made in the caller's own organization. The server refuses a role that carries more than the caller holds, so a user can never hand out more than they have. See Assigning roles.

Errors you will meet

All of them: error codes.