Recipes: teams and organizations

​

Setup

1. Add an org column (text, indexed) to every team table.
2. Set it on create from the session: org: session.org.
3. Apply a team rule to every action.

​

Members see their organization’s records

• All of these rules pass:
  • Check a value: $auth.org is set
  • Compare values: $record.org equals $auth.org

​

Create inside your organization

• All of these rules pass:
  • Check a value: $auth.org is set
  • Compare values: $input.org equals $auth.org

​

By organization role

​

Personal and team records on one table

• Any of these rules pass:
  • Owns the record (field) owner_id
  • All of these rules pass:
    • Check a value: $auth.org is set
    • Compare values: $record.org equals $auth.org

​

Platform staff across organizations

​

Files and channels per organization

• Storage: key <org>/…, and $object.segments.0 equals$auth.org (Storage).
• Channels: name org:<slug>:… and require truthy $auth.org (Realtime).

​

Switching organizations

​

Invitations and access

​

Test the boundary

const adaAcme = await signedIn("ada@acme.com", { org: "acme" });
const bobGlobex = await signedIn("bob@globex.com", { org: "globex" });
const noOrg = await signedIn("ada@acme.com");         // no active organization

const doc = await adaAcme.from("documents").create({ org: "acme", title: "Plan" });
await expect(bobGlobex.from("documents").get(doc.id)).rejects.toBeInstanceOf(NotFoundError);
expect((await noOrg.from("documents")).data).toHaveLength(0);       // the null-equals-null trap