Organizations Plugin

Overview

The Organizations plugin provides multi-tenancy and team management capabilities. It enables users to create organizations, manage members with roles, organize members into teams, and send email-based invitations.

Core Entities

• Organizations: Owner-based organizational units
• Invitations: Email-based invitations for joining organizations
• Members: Users assigned to organizations with roles
• Teams: Group members into teams within organizations
• Team Members: Users assigned to teams within organizations

Features

• Multi-tenant organization management
• Role-based member management within organizations
• Team organization and management within organizations
• Email-based member invitations with configurable expiration
• Team member management
• Full lifecycle management (create, read, update, delete operations)

Configuration

Standalone Mode:

[organizations]
enabled = true
organizations_limit = 10 # Optional limit on number of organizations (set to 0 for unlimited)
members_limit = 100 # Optional limit on number of members per organization (set to 0 for unlimited)
invitations_limit = 100 # Optional limit on number of invitations sent to a user (100 by default)
invitation_expires_in = "24h" # Expiration time for organization invitations (24h = 1 day by default)
require_email_verified_on_invitation = true # Whether to require the invited user's email to be verified before accepting or rejecting an organization invitation (false by default)

Library Mode:

import (
  "time"

  organizationsplugin "github.com/authula/authula/plugins/organizations"
  organizationsplugintypes "github.com/authula/authula/plugins/organizations/types"
)

organizationsplugin.New(&organizationsplugintypes.OrganizationsPluginConfig{
  Enabled:             true,
  OrganizationsLimit:  10,
  MembersLimit:        100,
  InvitationsLimit:    100,
  InvitationExpiresIn: 24 * time.Hour,
  RequireEmailVerifiedOnInvitation: true,
  DatabaseHooks: &organizationsplugintypes.OrganizationsDatabaseHooksConfig{
    // Optional database hooks for custom logic on organization lifecycle events
  },
})

API Reference

Organizations

Invitations

Members

Teams

Team Members

Database Schema

This plugin creates the following database tables:

Table: organizations

Table: organization_invitations

Table: organization_members

Table: organization_teams

Table: organization_team_members

Migrations are automatically handled when the plugin is initialized.

Database Hooks

This plugin supports the following database hooks:

Organizations:

• BeforeCreate: Before an organization is created
• AfterCreate: After an organization is created
• BeforeUpdate: Before an organization is updated
• AfterUpdate: After an organization is updated
• BeforeDelete: Before an organization is deleted
• AfterDelete: After an organization is deleted

Invitations:

• BeforeCreate: Before an invitation is created
• AfterCreate: After an invitation is created
• BeforeUpdate: Before an invitation is updated
• AfterUpdate: After an invitation is updated
• BeforeDelete: Before an invitation is deleted
• AfterDelete: After an invitation is deleted

Members:

• BeforeCreate: Before a member is created
• AfterCreate: After a member is created
• BeforeUpdate: Before a member is updated
• AfterUpdate: After a member is updated
• BeforeDelete: Before a member is deleted
• AfterDelete: After a member is deleted

Teams:

• BeforeCreate: Before a team is created
• AfterCreate: After a team is created
• BeforeUpdate: Before a team is updated
• AfterUpdate: After a team is updated
• BeforeDelete: Before a team is deleted
• AfterDelete: After a team is deleted

Team Members:

• BeforeCreate: Before a team member is created
• AfterCreate: After a team member is created
• BeforeDelete: Before a team member is deleted
• AfterDelete: After a team member is deleted

Plugin Capabilities

This plugin doesn't provide any hooks and capabilities.

Security Recommendations

• Ensure that the Access Control plugin is properly configured to manage permissions for organization-related actions.
• Regularly review organization members and their roles to maintain proper access control.
• Make sure to always require authentication for all organization-related API routes and enforce role-based access control for certain routes.

Client Plugin

If you're using the Authula SDK, add the plugin to the client instance as follows:

import { createClient } from "authula";
import { OrganizationsPlugin } from "authula/plugins";

export const authulaClient = createClient({
  url: "http://localhost:8080/auth",
  plugins: [new OrganizationsPlugin()],
});