@actuate-media/cms-core 0.39.0 → 0.40.0

package/dist/__tests__/auth/invites.test.js

@@ -0,0 +1,181 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createInvite, cancelInvite, updateInviteRole, extendInvite, listInvites, markInviteAcceptedForEmail, } from '../../auth/invites.js';
+import { setEmailSender } from '../../email/sender.js';
+function createDB() {
+    const users = [];
+    const invites = [];
+    const tokens = [];
+    const matchEmail = (where, email) => !where?.email ||
+        (where.email.equals
+            ? String(where.email.equals).toLowerCase() === email.toLowerCase()
+            : where.email === email);
+    return {
+        users,
+        invites,
+        tokens,
+        user: {
+            findFirst: async ({ where }) => users.find((u) => matchEmail(where, u.email) &&
+                (where?.acceptedInviteAt === null ? u.acceptedInviteAt == null : true)) ?? null,
+            create: async ({ data }) => {
+                const u = { id: `u_${users.length + 1}`, isActive: true, ...data };
+                users.push(u);
+                return u;
+            },
+            update: async ({ where, data }) => {
+                const u = users.find((x) => x.id === where.id);
+                Object.assign(u, data);
+                return u;
+            },
+            updateMany: async ({ where, data }) => {
+                let n = 0;
+                for (const u of users) {
+                    if (matchEmail(where, u.email) &&
+                        (where?.acceptedInviteAt === null ? u.acceptedInviteAt == null : true)) {
+                        Object.assign(u, data);
+                        n++;
+                    }
+                }
+                return { count: n };
+            },
+        },
+        invite: {
+            findFirst: async ({ where }) => invites.find((i) => matchEmail(where, i.email) && (!where?.status || i.status === where.status)) ?? null,
+            findUnique: async ({ where }) => invites.find((i) => i.id === where.id) ?? null,
+            findMany: async ({ where } = {}) => invites.filter((i) => !where?.status || i.status === where.status),
+            create: async ({ data }) => {
+                const i = { id: `inv_${invites.length + 1}`, createdAt: new Date(), ...data };
+                invites.push(i);
+                return i;
+            },
+            update: async ({ where, data }) => {
+                const i = invites.find((x) => x.id === where.id);
+                Object.assign(i, data);
+                return i;
+            },
+            updateMany: async ({ where, data }) => {
+                let n = 0;
+                for (const i of invites) {
+                    const statusOk = !where?.status || i.status === where.status;
+                    const emailOk = matchEmail(where, i.email);
+                    const expiredOk = where?.expiresAt?.lt ? i.expiresAt < where.expiresAt.lt : true;
+                    if (statusOk && emailOk && expiredOk) {
+                        Object.assign(i, data);
+                        n++;
+                    }
+                }
+                return { count: n };
+            },
+        },
+        passwordResetToken: {
+            create: async ({ data }) => {
+                const t = { id: `rt_${tokens.length + 1}`, ...data };
+                tokens.push(t);
+                return t;
+            },
+            updateMany: async ({ where, data }) => {
+                let n = 0;
+                for (const t of tokens) {
+                    if (where?.usedAt === null ? t.usedAt == null : true) {
+                        Object.assign(t, data);
+                        n++;
+                    }
+                }
+                return { count: n };
+            },
+        },
+    };
+}
+const CONFIG = {
+    siteUrl: 'https://cms.example.com',
+    adminPath: '/admin',
+    invitedByUserId: 'admin-1',
+};
+describe('invite service', () => {
+    beforeEach(() => setEmailSender(null));
+    it('creates a placeholder user, a PENDING invite and a single-use token (hashed at rest)', async () => {
+        const db = createDB();
+        const res = await createInvite(db, { email: 'New@Example.com', role: 'editor' }, CONFIG);
+        expect(res.success).toBe(true);
+        expect(res.emailed).toBe(false);
+        expect(res.inviteUrl).toContain('/admin/reset-password?token=');
+        expect(db.invites).toHaveLength(1);
+        expect(db.invites[0].status).toBe('PENDING');
+        expect(db.invites[0].email).toBe('new@example.com');
+        expect(db.users).toHaveLength(1);
+        expect(db.users[0].isApproved).toBe(false);
+        const rawToken = res.inviteUrl.split('token=')[1];
+        expect(db.invites[0].tokenHash).not.toBe(rawToken);
+        expect(db.tokens[0].tokenHash).toBe(db.invites[0].tokenHash);
+    });
+    it('rejects a second invite to the same email (PENDING_INVITE)', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 'a@example.com', role: 'editor' }, CONFIG);
+        const res = await createInvite(db, { email: 'a@example.com', role: 'viewer' }, CONFIG);
+        expect(res.success).toBe(false);
+        expect(res.code).toBe('PENDING_INVITE');
+        expect(db.invites).toHaveLength(1);
+    });
+    it('rejects inviting an existing user (DUPLICATE_USER)', async () => {
+        const db = createDB();
+        db.users.push({ id: 'u1', email: 'taken@example.com', acceptedInviteAt: new Date() });
+        const res = await createInvite(db, { email: 'taken@example.com', role: 'editor' }, CONFIG);
+        expect(res.code).toBe('DUPLICATE_USER');
+    });
+    it('rejects invalid email and role', async () => {
+        const db = createDB();
+        expect((await createInvite(db, { email: 'nope', role: 'editor' }, CONFIG)).code).toBe('INVALID_EMAIL');
+        expect((await createInvite(db, { email: 'a@example.com', role: 'wizard' }, CONFIG)).code).toBe('INVALID_ROLE');
+    });
+    it('cancels an invite and deactivates its placeholder user', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 'c@example.com', role: 'editor' }, CONFIG);
+        const id = db.invites[0].id;
+        const res = await cancelInvite(db, id);
+        expect(res.success).toBe(true);
+        expect(db.invites[0].status).toBe('CANCELLED');
+        expect(db.users[0].isActive).toBe(false);
+    });
+    it('changes an invite role', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 'r@example.com', role: 'viewer' }, CONFIG);
+        const res = await updateInviteRole(db, db.invites[0].id, 'admin');
+        expect(res.success).toBe(true);
+        expect(db.invites[0].role).toBe('ADMIN');
+        expect(db.users[0].role).toBe('ADMIN');
+    });
+    it('extends an invite expiry', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 'e@example.com', role: 'editor' }, CONFIG);
+        const before = new Date(db.invites[0].expiresAt).getTime();
+        const res = await extendInvite(db, db.invites[0].id, 30);
+        expect(res.success).toBe(true);
+        expect(new Date(db.invites[0].expiresAt).getTime()).toBeGreaterThan(before);
+    });
+    it('marks the pending invite ACCEPTED for an email', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 'acc@example.com', role: 'editor' }, CONFIG);
+        const ok = await markInviteAcceptedForEmail(db, 'acc@example.com', 'u_1');
+        expect(ok).toBe(true);
+        expect(db.invites[0].status).toBe('ACCEPTED');
+        expect(db.invites[0].acceptedUserId).toBe('u_1');
+    });
+    it('lists invites and lazily expires stale PENDING rows', async () => {
+        const db = createDB();
+        await createInvite(db, { email: 's@example.com', role: 'editor' }, CONFIG);
+        // Force expiry into the past.
+        db.invites[0].expiresAt = new Date(Date.now() - 1000);
+        const list = await listInvites(db);
+        expect(list[0].status).toBe('EXPIRED');
+        expect(list[0].expired).toBe(true);
+    });
+    it('emails the invite when a sender is registered (no link returned)', async () => {
+        const db = createDB();
+        const sent = [];
+        setEmailSender({ send: async (o) => void sent.push(o.to) });
+        const res = await createInvite(db, { email: 'mail@example.com', role: 'editor' }, CONFIG);
+        expect(res.emailed).toBe(true);
+        expect(res.inviteUrl).toBeUndefined();
+        expect(sent).toEqual(['mail@example.com']);
+    });
+});
+//# sourceMappingURL=invites.test.js.map

package/dist/__tests__/auth/invites.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/invites.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACzD,OAAO,EACL,YAAY,EAEZ,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,0BAA0B,GAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAUtD,SAAS,QAAQ;IACf,MAAM,KAAK,GAAU,EAAE,CAAA;IACvB,MAAM,OAAO,GAAU,EAAE,CAAA;IACzB,MAAM,MAAM,GAAU,EAAE,CAAA;IAExB,MAAM,UAAU,GAAG,CAAC,KAAU,EAAE,KAAa,EAAE,EAAE,CAC/C,CAAC,KAAK,EAAE,KAAK;QACb,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IAE5B,OAAO;QACL,KAAK;QACL,OAAO;QACP,MAAM;QACN,IAAI,EAAE;YACJ,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAClC,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,CACJ,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;gBAC1B,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CACzE,IAAI,IAAI;YACX,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAA;gBAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACb,OAAO,CAAC,CAAA;YACV,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAE,CAAA;gBAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBACtB,OAAO,CAAC,CAAA;YACV,CAAC;YACD,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACzC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IACE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;wBAC1B,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EACtE,CAAC;wBACD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;wBACtB,CAAC,EAAE,CAAA;oBACL,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;YACrB,CAAC;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAClC,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CACnF,IAAI,IAAI;YACX,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI;YACpF,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,KAAU,EAAE,EAAE,EAAE,CACtC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;YACpE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACf,OAAO,CAAC,CAAA;YACV,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACrC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAE,CAAA;gBACjD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBACtB,OAAO,CAAC,CAAA;YACV,CAAC;YACD,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACzC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAA;oBAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;oBAC1C,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAChF,IAAI,QAAQ,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;wBACrC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;wBACtB,CAAC,EAAE,CAAA;oBACL,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;YACrB,CAAC;SACF;QACD,kBAAkB,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;gBACpD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,CAAA;YACV,CAAC;YACD,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAO,EAAE,EAAE;gBACzC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACvB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBACrD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;wBACtB,CAAC,EAAE,CAAA;oBACL,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;YACrB,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,MAAM,GAAG;IACb,OAAO,EAAE,yBAAyB;IAClC,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,SAAS;CAC3B,CAAA;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,UAAU,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;IAEtC,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QAC/F,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAA;QAC/D,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACpD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAA;QACnD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACjF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7F,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QACrF,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,EAAS,EACT,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC9C,MAAM,CACP,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,CAAC,CAAC,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAC1F,eAAe,CAChB,CAAA;QACD,MAAM,CACJ,CAAC,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACzF,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACjF,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QAC5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/C,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACjF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QACzE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACnF,MAAM,EAAE,GAAG,MAAM,0BAA0B,CAAC,EAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QAChF,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACjF,8BAA8B;QAC9B,EAAE,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAS,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAA;QACrB,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAS,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QAChG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/auth/roles.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=roles.test.d.ts.map

package/dist/__tests__/auth/roles.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/auth/roles.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth/roles.test.js

@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest';
+import { toDisplayRole, enumRolesForDisplay, normalizeAssignableRole, isOwnerRole, roleRank, permissionsForRole, ASSIGNABLE_ROLES, } from '../../auth/roles.js';
+describe('role display mapping', () => {
+    it('maps legacy roles to product display roles', () => {
+        expect(toDisplayRole('OWNER')).toBe('Owner');
+        expect(toDisplayRole('ADMIN')).toBe('Admin');
+        expect(toDisplayRole('EDITOR')).toBe('Editor');
+        expect(toDisplayRole('AUTHOR')).toBe('Editor');
+        expect(toDisplayRole('CLIENT')).toBe('Viewer');
+        expect(toDisplayRole('VIEWER')).toBe('Viewer');
+        expect(toDisplayRole('garbage')).toBe('Viewer');
+    });
+    it('maps a display filter to the enum values it covers', () => {
+        expect(enumRolesForDisplay('Editor')).toEqual(['EDITOR', 'AUTHOR']);
+        expect(enumRolesForDisplay('Viewer')).toEqual(['VIEWER', 'CLIENT']);
+        expect(enumRolesForDisplay('Owner')).toEqual(['OWNER']);
+        expect(enumRolesForDisplay('all')).toBeNull();
+    });
+});
+describe('assignable roles', () => {
+    it('only allows the four product roles', () => {
+        expect(ASSIGNABLE_ROLES).toEqual(['OWNER', 'ADMIN', 'EDITOR', 'VIEWER']);
+        expect(normalizeAssignableRole('admin')).toBe('ADMIN');
+        expect(normalizeAssignableRole('AUTHOR')).toBeNull();
+        expect(normalizeAssignableRole('CLIENT')).toBeNull();
+        expect(normalizeAssignableRole('nope')).toBeNull();
+    });
+});
+describe('role rank + owner check', () => {
+    it('ranks Owner above Admin above Editor above Viewer', () => {
+        expect(roleRank('OWNER')).toBeGreaterThan(roleRank('ADMIN'));
+        expect(roleRank('ADMIN')).toBeGreaterThan(roleRank('EDITOR'));
+        expect(roleRank('EDITOR')).toBeGreaterThan(roleRank('VIEWER'));
+        expect(roleRank('AUTHOR')).toBe(roleRank('EDITOR'));
+    });
+    it('detects the Owner role', () => {
+        expect(isOwnerRole('OWNER')).toBe(true);
+        expect(isOwnerRole('owner')).toBe(true);
+        expect(isOwnerRole('ADMIN')).toBe(false);
+    });
+});
+describe('permissions for role', () => {
+    it('grants Owner everything and Admin everything except owner-only scopes', () => {
+        expect(permissionsForRole('OWNER')).toContain('billing.manage');
+        expect(permissionsForRole('OWNER')).toContain('workspace.delete');
+        const admin = permissionsForRole('ADMIN');
+        expect(admin).toContain('users.invite');
+        expect(admin).not.toContain('billing.manage');
+        expect(admin).not.toContain('workspace.delete');
+    });
+    it('limits Editor to content and Viewer to read-only', () => {
+        const editor = permissionsForRole('EDITOR');
+        expect(editor).toContain('content.publish');
+        expect(editor).not.toContain('users.invite');
+        expect(editor).not.toContain('settings.manage');
+        expect(permissionsForRole('VIEWER')).toEqual(['dashboard.view', 'content.view']);
+        expect(permissionsForRole('AUTHOR')).toEqual(permissionsForRole('EDITOR'));
+    });
+});
+//# sourceMappingURL=roles.test.js.map

package/dist/__tests__/auth/roles.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/roles.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAE5B,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC/C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;QACxE,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtD,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpD,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpD,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC9D,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC/D,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC/C,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/auth/team.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=team.test.d.ts.map

package/dist/__tests__/auth/team.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/auth/team.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth/team.test.js

@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest';
+import { buildRecommendations, listTeamMembers, getUserStats, workspaceDomainFromUrl, } from '../../auth/team.js';
+const DAY = 24 * 60 * 60 * 1000;
+function member(over) {
+    return {
+        id: 'm1',
+        name: 'Test User',
+        email: 'test@actuatemedia.com',
+        initials: 'TU',
+        role: 'EDITOR',
+        roleName: 'Editor',
+        status: 'active',
+        mfaEnabled: true,
+        mfaRequired: false,
+        externalDomain: false,
+        authProvider: null,
+        lastLoginAt: new Date().toISOString(),
+        lastActiveAt: new Date().toISOString(),
+        acceptedInviteAt: new Date(Date.now() - 30 * DAY).toISOString(),
+        createdAt: new Date(Date.now() - 60 * DAY).toISOString(),
+        isCurrentUser: false,
+        ...over,
+    };
+}
+describe('buildRecommendations', () => {
+    it('flags an Owner without MFA as critical', () => {
+        const recs = buildRecommendations([member({ id: 'o1', roleName: 'Owner', role: 'OWNER', mfaEnabled: false })], [], new Set());
+        expect(recs[0].type).toBe('owner_without_mfa');
+        expect(recs[0].severity).toBe('critical');
+    });
+    it('flags an Admin without MFA as high', () => {
+        const recs = buildRecommendations([member({ id: 'a1', roleName: 'Admin', role: 'ADMIN', mfaEnabled: false })], [], new Set());
+        expect(recs[0].type).toBe('admin_without_mfa');
+        expect(recs[0].severity).toBe('high');
+    });
+    it('combines inactive + external into one high recommendation', () => {
+        const recs = buildRecommendations([
+            member({
+                id: 'x1',
+                roleName: 'Viewer',
+                role: 'VIEWER',
+                externalDomain: true,
+                lastLoginAt: new Date(Date.now() - 94 * DAY).toISOString(),
+            }),
+        ], [], new Set());
+        expect(recs[0].type).toBe('inactive_user');
+        expect(recs[0].severity).toBe('high');
+        expect(recs[0].description).toContain('94 days');
+        expect(recs[0].description).toContain('external');
+    });
+    it('flags stale pending invites and sorts highest severity first', () => {
+        const recs = buildRecommendations([member({ id: 'a1', roleName: 'Admin', role: 'ADMIN', mfaEnabled: false })], [
+            {
+                id: 'inv1',
+                email: 'old@x.com',
+                createdAt: new Date(Date.now() - 10 * DAY).toISOString(),
+            },
+        ], new Set());
+        expect(recs).toHaveLength(2);
+        expect(recs[0].severity).toBe('high'); // admin_without_mfa before stale_invite (medium)
+        expect(recs.some((r) => r.type === 'stale_invite')).toBe(true);
+    });
+    it('filters out dismissed recommendations', () => {
+        const recs = buildRecommendations([member({ id: 'o1', roleName: 'Owner', role: 'OWNER', mfaEnabled: false })], [], new Set(['owner_without_mfa:o1']));
+        expect(recs).toHaveLength(0);
+    });
+    it('does not flag a healthy active member', () => {
+        const recs = buildRecommendations([member({})], [], new Set());
+        expect(recs).toHaveLength(0);
+    });
+});
+describe('listTeamMembers + getUserStats', () => {
+    function db(users, invites) {
+        return {
+            user: { findMany: async () => users },
+            invite: {
+                findMany: async ({ where } = {}) => invites.filter((i) => !where?.status || i.status === where.status),
+                count: async ({ where } = {}) => invites.filter((i) => !where?.status || i.status === where.status).length,
+            },
+        };
+    }
+    const baseUser = (over) => ({
+        id: 'u',
+        name: 'U',
+        email: 'u@actuatemedia.com',
+        role: 'EDITOR',
+        isActive: true,
+        totpEnabled: true,
+        createdAt: new Date(),
+        ...over,
+    });
+    it('excludes users that still have a pending invite', async () => {
+        const d = db([
+            baseUser({ id: 'u1', email: 'a@actuatemedia.com' }),
+            baseUser({ id: 'u2', email: 'pending@actuatemedia.com' }),
+        ], [{ id: 'i1', email: 'pending@actuatemedia.com', status: 'PENDING' }]);
+        const members = await listTeamMembers(d, {}, { workspaceDomain: 'actuatemedia.com' });
+        expect(members.map((m) => m.email)).toEqual(['a@actuatemedia.com']);
+    });
+    it('marks external-domain members', async () => {
+        const d = db([baseUser({ id: 'u1', email: 'free@elsewhere.io' })], []);
+        const members = await listTeamMembers(d, {}, { workspaceDomain: 'actuatemedia.com' });
+        expect(members[0].externalDomain).toBe(true);
+    });
+    it('counts members, admins, pending invites and seats', async () => {
+        const d = db([
+            baseUser({ id: 'u1', role: 'OWNER', email: 'owner@actuatemedia.com' }),
+            baseUser({ id: 'u2', role: 'ADMIN', email: 'admin@actuatemedia.com' }),
+            baseUser({ id: 'u3', role: 'EDITOR', email: 'ed@actuatemedia.com' }),
+            baseUser({
+                id: 'u4',
+                role: 'EDITOR',
+                email: 'sus@actuatemedia.com',
+                suspendedAt: new Date(),
+            }),
+        ], [{ id: 'i1', email: 'p@actuatemedia.com', status: 'PENDING' }]);
+        const stats = await getUserStats(d, { seatLimit: 10 });
+        expect(stats.members).toBe(3); // suspended excluded
+        expect(stats.admins).toBe(2); // owner + admin
+        expect(stats.pendingInvites).toBe(1);
+        expect(stats.seatsUsed).toBe(4); // 3 active + 1 pending
+        expect(stats.seatsAvailable).toBe(6);
+    });
+    it('reports unlimited seats when no limit is set', async () => {
+        const d = db([baseUser({ id: 'u1' })], []);
+        const stats = await getUserStats(d, {});
+        expect(stats.seatLimit).toBeNull();
+        expect(stats.seatsAvailable).toBeNull();
+    });
+});
+describe('workspaceDomainFromUrl', () => {
+    it('strips protocol and www', () => {
+        expect(workspaceDomainFromUrl('https://www.actuatemedia.com')).toBe('actuatemedia.com');
+        expect(workspaceDomainFromUrl('https://app.actuatemedia.com/admin')).toBe('app.actuatemedia.com');
+        expect(workspaceDomainFromUrl(null)).toBeNull();
+        expect(workspaceDomainFromUrl('not a url')).toBeNull();
+    });
+});
+//# sourceMappingURL=team.test.js.map

package/dist/__tests__/auth/team.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/team.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,sBAAsB,GAEvB,MAAM,oBAAoB,CAAA;AAE3B,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE/B,SAAS,MAAM,CAAC,IAAyB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,gBAAgB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;QAC/D,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;QACxD,aAAa,EAAE,KAAK;QACpB,GAAG,IAAI;KACR,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAC/B,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAC3E,EAAE,EACF,IAAI,GAAG,EAAE,CACV,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAC3E,EAAE,EACF,IAAI,GAAG,EAAE,CACV,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,oBAAoB,CAC/B;YACE,MAAM,CAAC;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,IAAI;gBACpB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;aAC3D,CAAC;SACH,EACD,EAAE,EACF,IAAI,GAAG,EAAE,CACV,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,oBAAoB,CAC/B,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAC3E;YACE;gBACE,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE;aACzD;SACF,EACD,IAAI,GAAG,EAAE,CACV,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,iDAAiD;QACxF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,oBAAoB,CAC/B,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAC3E,EAAE,EACF,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAClC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,SAAS,EAAE,CAAC,KAAY,EAAE,OAAc;QACtC,OAAO;YACL,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE;YACrC,MAAM,EAAE;gBACN,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,KAAU,EAAE,EAAE,EAAE,CACtC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;gBACpE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,KAAU,EAAE,EAAE,EAAE,CACnC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM;aAC5E;SACF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,GAAG;QACP,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,GAAG,IAAI;KACR,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,GAAG,EAAE,CACV;YACE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACnD,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;SAC1D,EACD,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACrE,CAAA;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,CAAQ,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,CAAQ,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CAAC,GAAG,EAAE,CACV;YACE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YACtE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YACtE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YACpE,QAAQ,CAAC;gBACP,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,IAAI,IAAI,EAAE;aACxB,CAAC;SACH,EACD,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAC/D,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,qBAAqB;QACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,gBAAgB;QAC7C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,uBAAuB;QACvD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACvF,MAAM,CAAC,sBAAsB,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CACvE,sBAAsB,CACvB,CAAA;QACD,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC/C,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/auth/user-admin.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=user-admin.test.d.ts.map

package/dist/__tests__/auth/user-admin.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-admin.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/auth/user-admin.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth/user-admin.test.js

@@ -0,0 +1,162 @@
+import { describe, expect, it } from 'vitest';
+import { parseUserAgent, getUserDetail, listUserSessions, listUserActivity, getUserPermissionView, } from '../../auth/user-admin.js';
+describe('parseUserAgent', () => {
+    it('identifies common browser/OS pairs', () => {
+        expect(parseUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36')).toEqual({ browser: 'Chrome', os: 'Windows', deviceLabel: 'Chrome on Windows' });
+        expect(parseUserAgent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15')).toEqual({ browser: 'Safari', os: 'macOS', deviceLabel: 'Safari on macOS' });
+        expect(parseUserAgent('Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0')).toEqual({ browser: 'Firefox', os: 'Linux', deviceLabel: 'Firefox on Linux' });
+    });
+    it('degrades unknown agents instead of guessing', () => {
+        expect(parseUserAgent(null)).toEqual({
+            browser: 'Unknown',
+            os: 'Unknown',
+            deviceLabel: 'Unknown device',
+        });
+    });
+    it('prefers Edge over Chrome when both tokens are present', () => {
+        const r = parseUserAgent('Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 Edg/124.0');
+        expect(r.browser).toBe('Edge');
+    });
+});
+describe('getUserDetail', () => {
+    function db(overrides = {}) {
+        const user = {
+            id: 'u1',
+            name: 'Dana Chen',
+            email: 'dana@actuatemedia.com',
+            role: 'OWNER',
+            passwordHash: 'x',
+            totpEnabled: true,
+            mfaRequired: false,
+            forcePasswordReset: false,
+            failedLoginCount: 0,
+            isActive: true,
+            emailVerified: true,
+            lastLoginAt: new Date('2026-06-01T00:00:00Z'),
+            createdAt: new Date('2026-01-01T00:00:00Z'),
+            invitedById: null,
+            ...overrides,
+        };
+        return {
+            user: { findUnique: async ({ where }) => (where.id === user.id ? user : null) },
+            oAuthAccount: { findMany: async () => [] },
+            document: { count: async () => 3 },
+        };
+    }
+    it('serializes a member into the detail shape', async () => {
+        const detail = await getUserDetail(db(), 'u1', {
+            workspaceDomain: 'actuatemedia.com',
+            currentUserId: 'u1',
+        });
+        expect(detail).toMatchObject({
+            id: 'u1',
+            roleName: 'Owner',
+            status: 'active',
+            mfaEnabled: true,
+            passwordSet: true,
+            ssoOnly: false,
+            externalDomain: false,
+            contentOwnedCount: 3,
+            isCurrentUser: true,
+        });
+    });
+    it('flags external domains and SSO-only accounts', async () => {
+        const detail = await getUserDetail({
+            user: {
+                findUnique: async () => ({
+                    id: 'u2',
+                    name: 'Sara',
+                    email: 'sara@freelance.io',
+                    role: 'VIEWER',
+                    passwordHash: null,
+                    totpEnabled: false,
+                    isActive: true,
+                    createdAt: new Date(),
+                }),
+            },
+            oAuthAccount: { findMany: async () => [{ provider: 'google' }] },
+            document: { count: async () => 0 },
+        }, 'u2', { workspaceDomain: 'actuatemedia.com' });
+        expect(detail?.externalDomain).toBe(true);
+        expect(detail?.ssoOnly).toBe(true);
+        expect(detail?.oauthProviders).toEqual(['google']);
+    });
+    it('returns null for a missing user', async () => {
+        expect(await getUserDetail(db(), 'nope')).toBeNull();
+    });
+    it('derives status from lifecycle columns', async () => {
+        const suspended = await getUserDetail(db({ suspendedAt: new Date() }), 'u1');
+        expect(suspended?.status).toBe('suspended');
+        const locked = await getUserDetail(db({ lockedAt: new Date() }), 'u1');
+        expect(locked?.status).toBe('locked');
+        const gone = await getUserDetail(db({ isActive: false }), 'u1');
+        expect(gone?.status).toBe('deactivated');
+    });
+});
+describe('listUserSessions', () => {
+    it('maps sessions, marks the current one, and computes active', async () => {
+        const future = new Date(Date.now() + 86400000);
+        const past = new Date(Date.now() - 86400000);
+        const db = {
+            session: {
+                findMany: async () => [
+                    {
+                        id: 's1',
+                        userAgent: 'x Chrome/1 Safari',
+                        expiresAt: future,
+                        createdAt: new Date(),
+                        revokedAt: null,
+                    },
+                    { id: 's2', userAgent: 'x', expiresAt: past, createdAt: new Date(), revokedAt: null },
+                    {
+                        id: 's3',
+                        userAgent: 'x',
+                        expiresAt: future,
+                        createdAt: new Date(),
+                        revokedAt: new Date(),
+                    },
+                ],
+            },
+        };
+        const sessions = await listUserSessions(db, 'u1', 's1');
+        expect(sessions).toHaveLength(3);
+        expect(sessions.find((s) => s.id === 's1')?.current).toBe(true);
+        expect(sessions.find((s) => s.id === 's1')?.active).toBe(true);
+        expect(sessions.find((s) => s.id === 's2')?.active).toBe(false); // expired
+        expect(sessions.find((s) => s.id === 's3')?.active).toBe(false); // revoked
+    });
+});
+describe('listUserActivity', () => {
+    it('merges actor + target events, de-duplicates, and sorts newest first', async () => {
+        const db = {
+            auditLog: {
+                findMany: async ({ where }) => {
+                    if (where.userId === 'u1') {
+                        return [
+                            { id: 'a1', event: 'login', userId: 'u1', timestamp: new Date('2026-06-03') },
+                            { id: 'a2', event: 'role_changed', userId: 'u1', timestamp: new Date('2026-06-01') },
+                        ];
+                    }
+                    // target query
+                    return [
+                        { id: 'a2', event: 'role_changed', timestamp: new Date('2026-06-01') }, // dup id
+                        { id: 'a3', event: 'user_suspended', timestamp: new Date('2026-06-05') },
+                    ];
+                },
+            },
+        };
+        const events = await listUserActivity(db, 'u1');
+        expect(events.map((e) => e.id)).toEqual(['a3', 'a1', 'a2']);
+        expect(events.find((e) => e.id === 'a1')?.role).toBe('actor');
+        expect(events.find((e) => e.id === 'a3')?.role).toBe('target');
+    });
+});
+describe('getUserPermissionView', () => {
+    it('returns role, display label, and derived permissions', () => {
+        const view = getUserPermissionView('EDITOR');
+        expect(view.roleName).toBe('Editor');
+        expect(view.permissions).toContain('content.publish');
+        expect(view.permissions).not.toContain('users.invite');
+    });
+});
+//# sourceMappingURL=user-admin.test.js.map

package/dist/__tests__/auth/user-admin.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-admin.test.js","sourceRoot":"","sources":["../../../src/__tests__/auth/user-admin.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AAEjC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CACJ,cAAc,CACZ,6GAA6G,CAC9G,CACF,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAEjF,MAAM,CACJ,cAAc,CACZ,uHAAuH,CACxH,CACF,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAE7E,MAAM,CACJ,cAAc,CAAC,wEAAwE,CAAC,CACzF,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACnC,OAAO,EAAE,SAAS;YAClB,EAAE,EAAE,SAAS;YACb,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,cAAc,CACtB,2GAA2G,CAC5G,CAAA;QACD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,SAAS,EAAE,CAAC,YAAqC,EAAE;QACjD,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,GAAG;YACjB,WAAW,EAAE,IAAI;YACjB,WAAW,EAAE,KAAK;YAClB,kBAAkB,EAAE,KAAK;YACzB,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;YAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;YAC3C,WAAW,EAAE,IAAI;YACjB,GAAG,SAAS;SACb,CAAA;QACD,OAAO;YACL,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;YACpF,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YAC1C,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;SACnC,CAAA;IACH,CAAC;IAED,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;YAC7C,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;YAC3B,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,CAAC;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC;YACE,IAAI,EAAE;gBACJ,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBACvB,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,mBAAmB;oBAC1B,IAAI,EAAE,QAAQ;oBACd,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,KAAK;oBAClB,QAAQ,EAAE,IAAI;oBACd,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAC;aACH;YACD,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE;YAChE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;SACnC,EACD,IAAI,EACJ,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACxC,CAAA;QACD,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5E,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAA;QAC5C,MAAM,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;oBACpB;wBACE,EAAE,EAAE,IAAI;wBACR,SAAS,EAAE,mBAAmB;wBAC9B,SAAS,EAAE,MAAM;wBACjB,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,SAAS,EAAE,IAAI;qBAChB;oBACD,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;oBACrF;wBACE,EAAE,EAAE,IAAI;wBACR,SAAS,EAAE,GAAG;wBACd,SAAS,EAAE,MAAM;wBACjB,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB;iBACF;aACF;SACF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,UAAU;QAC1E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA,CAAC,UAAU;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,GAAG;YACT,QAAQ,EAAE;gBACR,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAO,EAAE,EAAE;oBACjC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;wBAC1B,OAAO;4BACL,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE;4BAC7E,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE;yBACrF,CAAA;oBACH,CAAC;oBACD,eAAe;oBACf,OAAO;wBACL,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS;wBACjF,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE;qBACzE,CAAA;gBACH,CAAC;aACF;SACF,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QACrD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAggC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAoTD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+lVzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAshC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiVD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+4WzD"}