@antelopejs/dms-saas 0.0.2 → 0.1.1

package/README.md

@@ -32,6 +32,34 @@ workspace. From that directory run `pnpm install`,
 `pnpm test:frontend`. The frontend check generates a temporary workspace, then
 builds client, SSR, and email bundles and runs Vue typechecking.
 
+## Completing a registration that entered without a workspace
+
+An account can reach the product before it owns anything to log into: an OAuth
+sign-in for an unknown e-mail, or any entry point the core answers with
+`requires_tenant_assignment`. The `auth/no-workspace` page is where that
+account buys its way in — a workspace, a plan, a card — and
+`POST /api/saas/register/finalize` provisions it and answers with a token pair
+for the workspace it just created, so the visitor lands signed in instead of
+back on the login screen.
+
+The page never touches those tokens. It posts the call through the frontend
+loader's generic `POST /auth/establish` route, naming the endpoint to call and
+its payload; the loader calls `/api/saas/register/finalize` itself over its own
+server-to-server channel to the DMS API and writes its session cookie from what
+comes back. Because that route turns a backend endpoint into a login, it only
+calls endpoints the deployment named, so a project serving this page must
+declare the finalize endpoint in the frontend server's environment:
+
+```bash
+# .env of the frontend server
+DMS_AUTH_ESTABLISH_ENDPOINTS=/api/saas/register/finalize
+```
+
+Without it the loader answers `403` and a visitor who has paid stays signed
+out. A replacement completion screen keeps the same requirement, and can build
+its request with the auto-imported `buildSessionEstablishRequest()` helper
+rather than restating the endpoint and the payload shape.
+
 ## Tenant owner permissions
 
 The `dms-saas.plan-intersection` permissions resolver runs at order 100. For a
@@ -137,9 +165,10 @@ provider registered before dms-saas is constructed is held and replayed on
 attach, replayed again when dms-saas is reloaded, and dropped when the
 registering module is unloaded.
 
-The interface package must be released before dms-saas. During workspace
-development dms-saas uses `workspace:*`; publishing replaces that range with
-the released interface version. Release the interface package first, then
+The interface package must be released before dms-saas, which depends on it
+through `>=<interface version> <1.0.0`; during workspace development pnpm
+resolves that range to the sibling package. Release the interface package first,
+then
 release dms-saas, and update consumers to the published interface version.
 
 ### Public screens

package/frontend-vue/app/composables/useWorkspaceFinalization.ts

@@ -0,0 +1,94 @@
+/**
+ * Completing a self-service registration that entered without a workspace.
+ *
+ * The account already exists — it signed in through OAuth, or through any
+ * entry point that ends on a tenant assignment token — and everything that is
+ * still missing is bought here: a workspace, a plan, a card. The API answers
+ * with a session for the workspace it just provisioned, so the visitor lands
+ * signed in rather than back on the login screen.
+ *
+ * That session is opened by the frontend server, never in the browser: the
+ * page asks the loader's `/auth/establish` route to call the finalize endpoint
+ * on its behalf, and the loader writes its session cookie from the token pair
+ * the API returns. No access or refresh token is ever handed to the page.
+ *
+ * The deployment must name the finalize endpoint in the frontend server's
+ * `DMS_AUTH_ESTABLISH_ENDPOINTS`, otherwise `/auth/establish` answers 403:
+ * turning a backend route into a login is the operator's decision, not a
+ * module's.
+ */
+
+/** Loader route that opens a session from a backend-issued token pair. */
+export const SESSION_ESTABLISH_ENDPOINT = "/auth/establish";
+
+/** DMS API route that provisions the workspace and mints that token pair. */
+export const WORKSPACE_FINALIZE_ENDPOINT = "/api/saas/register/finalize";
+
+export interface WorkspaceFinalizationAddress {
+  country: string;
+  line1?: string;
+  postalCode?: string;
+  city?: string;
+}
+
+/** The completion form as the visitor left it, plus the confirmed card. */
+export interface WorkspaceFinalization {
+  tenantAssignmentToken: string;
+  workspaceName: string;
+  planId: string;
+  customerType: "individual" | "business";
+  companyName: string;
+  vatNumber: string;
+  address: WorkspaceFinalizationAddress;
+  paymentMethodId: string;
+}
+
+export interface WorkspaceFinalizationPayload {
+  tenant_assignment_token: string;
+  workspaceName: string;
+  planId: string;
+  customerType: "individual" | "business";
+  companyName?: string;
+  vatNumber?: string;
+  address: WorkspaceFinalizationAddress;
+  paymentMethodId: string;
+}
+
+/** What `/auth/establish` takes: an endpoint to call, and its body. */
+export interface SessionEstablishRequest {
+  endpoint: string;
+  payload: WorkspaceFinalizationPayload;
+}
+
+/**
+ * The finalize call, addressed to the frontend server instead of the API.
+ *
+ * Built in one place because two things have to stay true together: the
+ * payload is what `/api/saas/register/finalize` validates, and the endpoint
+ * named in the envelope is the one the operator allowed — a page that inlined
+ * either would drift from the other.
+ *
+ * Company fields only travel for a business customer: an individual who typed
+ * a company name and switched back would otherwise be invoiced as one.
+ *
+ * @param finalization Completion form and confirmed payment method
+ * @returns Body to POST to `/auth/establish`
+ */
+export function buildSessionEstablishRequest(
+  finalization: WorkspaceFinalization,
+): SessionEstablishRequest {
+  const isBusiness = finalization.customerType === "business";
+  return {
+    endpoint: WORKSPACE_FINALIZE_ENDPOINT,
+    payload: {
+      tenant_assignment_token: finalization.tenantAssignmentToken,
+      workspaceName: finalization.workspaceName,
+      planId: finalization.planId,
+      customerType: finalization.customerType,
+      companyName: isBusiness ? finalization.companyName : undefined,
+      vatNumber: isBusiness ? finalization.vatNumber : undefined,
+      address: finalization.address,
+      paymentMethodId: finalization.paymentMethodId,
+    },
+  };
+}

package/frontend-vue/app/custom-pages/auth/no-workspace.vue

@@ -39,7 +39,6 @@ interface PendingRegistration {
 const PLANS_ENDPOINT = "/api/saas/plans/public";
 const SETUP_INTENT_ENDPOINT = "/api/saas/register/setup-intent";
 const PENDING_ENDPOINT = "/api/saas/register/pending";
-const FINALIZE_ENDPOINT = "/auth/finalize-workspace";
 const LOGIN_REDIRECT = "/auth/login";
 const PAYMENT_ELEMENT_ID = "dms-saas-finalize-payment-element";
 const HOME_REDIRECT = "/";
@@ -68,8 +67,9 @@ const stripePublishableKey = computed<string>(
   () => dmsSaasRuntime.value?.stripePublishableKey ?? "",
 );
 
-// Only `finalize` goes through the frontend server because it opens the session
-// cookie; all other public registration endpoints live on the DMS API.
+// Only `finalize` goes through the frontend server, and only because it opens
+// the session cookie on the workspace it provisions; every other public
+// registration endpoint is called on the DMS API directly.
 const apiFetch = $fetch.create({ baseURL: dmsRuntime.value.baseURL });
 
 const { countryItems } = useBillingCountries();
@@ -225,17 +225,15 @@ async function submit(): Promise<void> {
         nuxtApp.$i18n.t("saas.register.error.no_payment");
       return;
     }
-    await $fetch(FINALIZE_ENDPOINT, {
+    await $fetch(SESSION_ESTABLISH_ENDPOINT, {
       method: "POST",
-      body: {
-        tenant_assignment_token: tenantAssignmentToken.value,
+      body: buildSessionEstablishRequest({
+        tenantAssignmentToken: tenantAssignmentToken.value,
         workspaceName: workspaceName.value,
         planId: selectedPlanId.value,
         customerType: customerType.value,
-        companyName:
-          customerType.value === "business" ? companyName.value : undefined,
-        vatNumber:
-          customerType.value === "business" ? vatNumber.value : undefined,
+        companyName: companyName.value,
+        vatNumber: vatNumber.value,
         address: {
           country: country.value,
           line1: addressLine1.value || undefined,
@@ -243,7 +241,7 @@ async function submit(): Promise<void> {
           city: city.value || undefined,
         },
         paymentMethodId: confirm.paymentMethodId,
-      },
+      }),
     });
     if (typeof window !== "undefined") {
       window.location.href = HOME_REDIRECT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-saas",
-  "version": "0.0.2",
+  "version": "0.1.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -27,25 +27,6 @@
     "provenance": true,
     "registry": "https://registry.npmjs.org/"
   },
-  "scripts": {
-    "build": "pnpm --filter @antelopejs/interface-dms-saas build && rimraf dist && tsc -p tsconfig.build.json",
-    "test:frontend": "ajs-dms verify-source --layer node_modules/@antelopejs/dms/frontend-vue --module frontend-vue",
-    "frontend:dev": "cd playground && pnpm frontend:dev",
-    "dev": "ajs project run -w -p playground",
-    "stripe:webhooks": "stripe listen --forward-to localhost:5010/api/saas/webhooks/stripe",
-    "lint:fix": "oxlint --fix --max-warnings=1000000 && oxfmt . && cd frontend-vue && pnpm lint:fix",
-    "lint": "oxlint && oxfmt --check . && cd frontend-vue && pnpm lint",
-    "typecheck": "tsc -p tsconfig.json",
-    "format": "oxfmt . && cd frontend-vue && pnpm format",
-    "check:package-contract": "node scripts/check-package-contract.mjs",
-    "verify:interface": "node scripts/verify-interface-package.cjs",
-    "test": "pnpm run build && pnpm --filter @antelopejs/interface-dms-saas run check:package-contract && pnpm run check:package-contract && pnpm run test:unit",
-    "test:unit": "vitest run",
-    "release": "pnpm --filter @antelopejs/interface-dms-saas build && pnpm --dir frontend-vue install --frozen-lockfile && pnpm run verify:interface && release-it",
-    "prepack": "pnpm run build && pnpm run check:package-contract",
-    "knip": "knip --dependencies",
-    "knip:all": "knip"
-  },
   "dependencies": {
     "@antelopejs/dms": ">=0.0.1 <1.0.0",
     "@antelopejs/interface-api": ">=0.0.13 <1.0.0",
@@ -55,7 +36,7 @@
     "@antelopejs/interface-database": ">=0.1.7 <1.0.0",
     "@antelopejs/interface-database-decorators": ">=0.1.6 <1.0.0",
     "@antelopejs/interface-dms": ">=0.0.1 <1.0.0",
-    "@antelopejs/interface-dms-saas": "workspace:*",
+    "@antelopejs/interface-dms-saas": ">=0.0.2 <1.0.0",
     "@antelopejs/interface-file-storage": ">=0.1.3 <1.0.0",
     "node-cron": "^4.2.1",
     "stripe": "^17.5.0",
@@ -83,11 +64,28 @@
   "optionalDependencies": {
     "@antelopejs/interface-dms-automation": ">=0.0.1 <1.0.0"
   },
-  "packageManager": "pnpm@10.2.0",
   "antelopeJs": {
     "baseUrl": "dist",
     "implements": [
       "@antelopejs/interface-dms-saas"
     ]
+  },
+  "scripts": {
+    "build": "pnpm --filter @antelopejs/interface-dms-saas build && rimraf dist && tsc -p tsconfig.build.json",
+    "test:frontend": "ajs-dms verify-source --layer node_modules/@antelopejs/dms/frontend-vue --module frontend-vue",
+    "frontend:dev": "cd playground && pnpm frontend:dev",
+    "dev": "ajs project run -w -p playground",
+    "stripe:webhooks": "stripe listen --forward-to localhost:5010/api/saas/webhooks/stripe",
+    "lint:fix": "oxlint --fix --max-warnings=1000000 && oxfmt . && cd frontend-vue && pnpm lint:fix",
+    "lint": "oxlint && oxfmt --check . && cd frontend-vue && pnpm lint",
+    "typecheck": "tsc -p tsconfig.json",
+    "format": "oxfmt . && cd frontend-vue && pnpm format",
+    "check:package-contract": "node scripts/check-package-contract.mjs",
+    "verify:interface": "node scripts/verify-interface-package.cjs",
+    "test": "pnpm run build && pnpm --filter @antelopejs/interface-dms-saas run check:package-contract && pnpm run check:package-contract && pnpm run test:unit",
+    "test:unit": "vitest run",
+    "release": "pnpm --filter @antelopejs/interface-dms-saas build && pnpm --dir frontend-vue install --frozen-lockfile && pnpm run verify:interface && release-it",
+    "knip": "knip --dependencies",
+    "knip:all": "knip"
   }
-}
+}

package/frontend-vue/server/routes/auth/finalize-workspace.post.ts

@@ -1,61 +0,0 @@
-interface FinalizeBody {
-  tenant_assignment_token: string;
-  workspaceName: string;
-  planId: string;
-  customerType: "individual" | "business";
-  companyName?: string;
-  vatNumber?: string;
-  address?: {
-    line1?: string;
-    line2?: string;
-    postalCode?: string;
-    city?: string;
-    state?: string;
-    country?: string;
-  };
-  paymentMethodId: string;
-}
-
-interface FinalizeResponse {
-  token_type: string;
-  access_token: string;
-  expires_in: number;
-  refresh_token: string;
-  user: {
-    _id: string;
-    email: string;
-    name: string;
-    language: string;
-    isValidated: boolean;
-    createdAt: Date;
-    updatedAt: Date;
-  };
-}
-
-export default defineEventHandler(async (event) => {
-  const config = useRuntimeConfig();
-  const baseURL = config.public.dms.baseURL;
-  const body = (await readBody(event)) as FinalizeBody;
-
-  try {
-    const response = await $fetch<FinalizeResponse>(
-      `/api/saas/register/finalize`,
-      {
-        baseURL,
-        method: "POST",
-        body,
-      },
-    );
-
-    await replaceUserSession(event, {
-      user: response.user,
-      accessToken: response.access_token,
-      refreshToken: response.refresh_token,
-      activeTenantId: decodeJwtTenantId(response.access_token),
-    });
-
-    return response.user;
-  } catch (error: unknown) {
-    throwApiError(error);
-  }
-});