Organizations

// auth_organizations
schema.createTable('auth_organizations', (table) => {
  table.string('id').primary()
  table.string('name').notNullable()
  table.string('slug').notNullable().unique()
  table.string('logo_url').nullable()
  table.json('metadata').nullable()
  table.timestamps(true, true)
})

// auth_organization_members
schema.createTable('auth_organization_members', (table) => {
  table.string('id').primary()
  table.string('organization_id').notNullable()
    .references('id').inTable('auth_organizations').onDelete('CASCADE')
  table.string('account_id').notNullable()
  table.string('role').notNullable().defaultTo('member')
  table.timestamps(true, true)
  table.unique(['organization_id', 'account_id'])
})

// auth_organization_invitations
schema.createTable('auth_organization_invitations', (table) => {
  table.string('id').primary()
  table.string('organization_id').notNullable()
    .references('id').inTable('auth_organizations').onDelete('CASCADE')
  table.string('email').notNullable()
  table.string('role').notNullable().defaultTo('member')
  table.string('token_hash').notNullable().unique()
  table.string('invited_by').notNullable()  // accountId of the inviter
  table.timestamp('expires_at').notNullable()
  table.timestamp('accepted_at').nullable()
  table.timestamps(true, true)
})

defineConfig({
  // …
  organizations: {
    // enabled: true,        // default: auto (on when tables exist)
    claimStrategy: 'active', // emit claims from the session's active org (default)
  },
})

node ace authkit:settings:set organizations_policy \
  '{"allowSelfCreate":false,"invitationTtlHours":72,"roles":["owner","admin","member"]}'

import { lucidAccountStore } from '@adonis-agora/authkit-server'
import AuthOrganization from '#models/auth_organization'
import AuthOrganizationMember from '#models/auth_organization_member'
import AuthOrganizationInvitation from '#models/auth_organization_invitation'

accountStore: lucidAccountStore(AuthUser, {
  // …your existing options (mfaIssuer, password, …)…
  organizationModels: {
    OrgModel: AuthOrganization,
    MemberModel: AuthOrganizationMember,
    InvitationModel: AuthOrganizationInvitation,
  },
})

const identity = await ctx.auth.getIdentity()
identity.orgId    // 'org-9'  | null
identity.orgSlug  // 'acme'   | null
identity.orgRole  // 'owner'  | null

import { tenantFromContext } from '@adonis-agora/authz'

defineConfig({ resolveTenant: tenantFromContext })

export const middleware = router.named({
  auth: () => import('@adonis-agora/authkit-client/auth_middleware'),
  requireOrg: () => import('@adonis-agora/authkit-client/require_org_middleware'),
})

// Web: redirects to the org picker (default `/account/orgs`).
router.group(() => { /* … */ }).use([middleware.auth(), middleware.requireOrg()])

// API: 403 `no_active_organization` instead of a redirect.
router.group(() => { /* … */ }).use([middleware.auth(), middleware.requireOrg({ mode: 'api' })])

// Restrict to a known set of tenants.
router.get('/internal', [C, 'x']).use(middleware.requireOrg({ oneOf: ['org-9'] }))

GET  /account/orgs/invitations/:token/accept   → accept form (no session required)
POST /account/orgs/invitations/:token/accept   → accept the invitation

mail: {
  onOrgInvitation: async ({ email, orgName, orgSlug, role, acceptUrl }) => {
    await mailer.send((m) =>
      m.from(env.get('EMAIL_FROM')).to(email)
        .subject(`You have been invited to ${orgName}`)
        .text(`Accept your invitation as ${role}: ${acceptUrl}`)
    )
  },
}

events: {
  onEvent: async (event) => {
    if (event.type === 'organization.created') {
      await Company.create({ authOrgId: event.orgId! })
    }
  },
}

await defineAuthzProvisioning({
  store,
  on: {
    'organization.created': (event, store) =>
      store.assignRole({ type: 'user', id: event.accountId! }, 'org:owner', {
        tenantId: event.orgId!,
      }),
  },
})

# Create an organization
curl -X POST https://idp.example.com/api/authkit/v1/organizations \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Corp", "slug": "acme", "ownerAccountId": "acc-42" }'

# Invite a member
curl -X POST https://idp.example.com/api/authkit/v1/organizations/org-1/invitations \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "jane@acme.com", "role": "admin" }'

const authkit = await createAuthkit({ mode: 'remote', baseUrl, apiKey })

// List
const { data: orgs } = await authkit.organizations.list()

// Create
const org = await authkit.organizations.create({
  name: 'Acme Corp',
  slug: 'acme',
  ownerAccountId: 'acc-42',
})

// Detail (includes members + pending invitations)
const detail = await authkit.organizations.get(org.id)
detail.members     // AuthkitOrgMember[]
detail.pendingInvitations  // AuthkitOrgInvitation[]

// Members
await authkit.organizations.members.add(org.id, { accountId: 'acc-7', role: 'member' })
await authkit.organizations.members.updateRole(org.id, 'acc-7', 'admin')
await authkit.organizations.members.remove(org.id, 'acc-7')

// Invitations
const inv = await authkit.organizations.invitations.create(org.id, {
  email: 'bob@acme.com',
  role: 'member',
})
await authkit.organizations.invitations.revoke(org.id, inv.id)

// Delete
await authkit.organizations.delete(org.id)

import {
  useOrganizations,
  useOrganization,
  useSwitchOrganization,
  useOrgInvitations,
} from '@adonis-agora/authkit-react'

// List the current user's organizations + pending inbound invitations
const orgs = useOrganizations()
// orgs.data: OrgEntry[]   (id, name, slug, logoUrl, role, isActive)
// orgs.invitations: OrgInvitationEntry[]
// orgs.loading, orgs.error
// orgs.actions.create({ name, slug }), orgs.actions.leave(orgId), orgs.actions.accept(token)

// Detail of one organization (members + active invitations)
const org = useOrganization(orgId)
// org.data: ActiveOrgDetail   (includes members: OrgMemberEntry[])
// org.actions.invite({ email, role }), org.actions.removeMember(accountId), org.actions.revokeInvitation(invId)

// Switch the active organization
const switcher = useSwitchOrganization()
// switcher.activate(orgId), switcher.deactivate()
// switcher.loading

// Pending invitations for the current user
const invitations = useOrgInvitations()
// invitations.data: OrgInvitationEntry[]
// invitations.actions.accept(token), invitations.actions.refetch()

import {
  OrganizationSwitcher,
  OrganizationProfile,
} from '@adonis-agora/authkit-react'

// Dropdown to switch the active organization; optionally shows a "Create org" button
<OrganizationSwitcher
  allowCreate={false}  // default; set true when the organizations_policy.allowSelfCreate setting is on
  createLabel="New organization"
  className="my-custom-class"
/>

// Full management card: members, invitations, leave/invite controls
<OrganizationProfile
  orgId={activeOrgId}
  className="my-custom-class"
/>