Organisations, roles, and invitations

Own Auth models each workspace as an organisation with members, roles, permissions, and invitations. Member, role, invitation, and organisation API-key mutations verify the acting user's membership and permission. Pass the user ID from a verified session to auth.acceptInvite; Own Auth checks that user's email against the invitation before creating the membership. Product access checks remain in application code.

Create the workspace

const { organisation } = await auth.createOrganisation({
  name: "Acme Inc",
  ownerUserId: currentUser.id,
});

Invite and authorize members

await auth.inviteMember({
  organisationId: organisation.id,
  email: "teammate@example.com",
  role: "member",
  invitedByUserId: currentUser.id,
});

auth.inviteMember checks the inviter's permission and sends a single-use invitation through the configured email provider. Pass the invitation token and verified session user ID to auth.acceptInvite; it checks the email match, consumes the token, and creates the membership.

Scope application data

• Store organisationId on records owned by a workspace.
• Resolve the acting user from a verified session.
• Call auth.requirePermission before product reads or changes that need an organisation role.
• Stop returning workspace data after membership removal.