@antelopejs/dms-saas 0.1.0 → 0.1.2

package/README.md

@@ -32,6 +32,34 @@ workspace. From that directory run `pnpm install`,
 `pnpm test:frontend`. The frontend check generates a temporary workspace, then
 builds client, SSR, and email bundles and runs Vue typechecking.
 
+## Completing a registration that entered without a workspace
+
+An account can reach the product before it owns anything to log into: an OAuth
+sign-in for an unknown e-mail, or any entry point the core answers with
+`requires_tenant_assignment`. The `auth/no-workspace` page is where that
+account buys its way in — a workspace, a plan, a card — and
+`POST /api/saas/register/finalize` provisions it and answers with a token pair
+for the workspace it just created, so the visitor lands signed in instead of
+back on the login screen.
+
+The page never touches those tokens. It posts the call through the frontend
+loader's generic `POST /auth/establish` route, naming the endpoint to call and
+its payload; the loader calls `/api/saas/register/finalize` itself over its own
+server-to-server channel to the DMS API and writes its session cookie from what
+comes back. Because that route turns a backend endpoint into a login, it only
+calls endpoints the deployment named, so a project serving this page must
+declare the finalize endpoint in the frontend server's environment:
+
+```bash
+# .env of the frontend server
+DMS_AUTH_ESTABLISH_ENDPOINTS=/api/saas/register/finalize
+```
+
+Without it the loader answers `403` and a visitor who has paid stays signed
+out. A replacement completion screen keeps the same requirement, and can build
+its request with the auto-imported `buildSessionEstablishRequest()` helper
+rather than restating the endpoint and the payload shape.
+
 ## Tenant owner permissions
 
 The `dms-saas.plan-intersection` permissions resolver runs at order 100. For a

package/frontend-vue/app/composables/useWorkspaceFinalization.ts

@@ -0,0 +1,94 @@
+/**
+ * Completing a self-service registration that entered without a workspace.
+ *
+ * The account already exists — it signed in through OAuth, or through any
+ * entry point that ends on a tenant assignment token — and everything that is
+ * still missing is bought here: a workspace, a plan, a card. The API answers
+ * with a session for the workspace it just provisioned, so the visitor lands
+ * signed in rather than back on the login screen.
+ *
+ * That session is opened by the frontend server, never in the browser: the
+ * page asks the loader's `/auth/establish` route to call the finalize endpoint
+ * on its behalf, and the loader writes its session cookie from the token pair
+ * the API returns. No access or refresh token is ever handed to the page.
+ *
+ * The deployment must name the finalize endpoint in the frontend server's
+ * `DMS_AUTH_ESTABLISH_ENDPOINTS`, otherwise `/auth/establish` answers 403:
+ * turning a backend route into a login is the operator's decision, not a
+ * module's.
+ */
+
+/** Loader route that opens a session from a backend-issued token pair. */
+export const SESSION_ESTABLISH_ENDPOINT = "/auth/establish";
+
+/** DMS API route that provisions the workspace and mints that token pair. */
+export const WORKSPACE_FINALIZE_ENDPOINT = "/api/saas/register/finalize";
+
+export interface WorkspaceFinalizationAddress {
+  country: string;
+  line1?: string;
+  postalCode?: string;
+  city?: string;
+}
+
+/** The completion form as the visitor left it, plus the confirmed card. */
+export interface WorkspaceFinalization {
+  tenantAssignmentToken: string;
+  workspaceName: string;
+  planId: string;
+  customerType: "individual" | "business";
+  companyName: string;
+  vatNumber: string;
+  address: WorkspaceFinalizationAddress;
+  paymentMethodId: string;
+}
+
+export interface WorkspaceFinalizationPayload {
+  tenant_assignment_token: string;
+  workspaceName: string;
+  planId: string;
+  customerType: "individual" | "business";
+  companyName?: string;
+  vatNumber?: string;
+  address: WorkspaceFinalizationAddress;
+  paymentMethodId: string;
+}
+
+/** What `/auth/establish` takes: an endpoint to call, and its body. */
+export interface SessionEstablishRequest {
+  endpoint: string;
+  payload: WorkspaceFinalizationPayload;
+}
+
+/**
+ * The finalize call, addressed to the frontend server instead of the API.
+ *
+ * Built in one place because two things have to stay true together: the
+ * payload is what `/api/saas/register/finalize` validates, and the endpoint
+ * named in the envelope is the one the operator allowed — a page that inlined
+ * either would drift from the other.
+ *
+ * Company fields only travel for a business customer: an individual who typed
+ * a company name and switched back would otherwise be invoiced as one.
+ *
+ * @param finalization Completion form and confirmed payment method
+ * @returns Body to POST to `/auth/establish`
+ */
+export function buildSessionEstablishRequest(
+  finalization: WorkspaceFinalization,
+): SessionEstablishRequest {
+  const isBusiness = finalization.customerType === "business";
+  return {
+    endpoint: WORKSPACE_FINALIZE_ENDPOINT,
+    payload: {
+      tenant_assignment_token: finalization.tenantAssignmentToken,
+      workspaceName: finalization.workspaceName,
+      planId: finalization.planId,
+      customerType: finalization.customerType,
+      companyName: isBusiness ? finalization.companyName : undefined,
+      vatNumber: isBusiness ? finalization.vatNumber : undefined,
+      address: finalization.address,
+      paymentMethodId: finalization.paymentMethodId,
+    },
+  };
+}

package/frontend-vue/app/custom-pages/auth/no-workspace.vue

@@ -39,7 +39,6 @@ interface PendingRegistration {
 const PLANS_ENDPOINT = "/api/saas/plans/public";
 const SETUP_INTENT_ENDPOINT = "/api/saas/register/setup-intent";
 const PENDING_ENDPOINT = "/api/saas/register/pending";
-const FINALIZE_ENDPOINT = "/auth/finalize-workspace";
 const LOGIN_REDIRECT = "/auth/login";
 const PAYMENT_ELEMENT_ID = "dms-saas-finalize-payment-element";
 const HOME_REDIRECT = "/";
@@ -68,8 +67,9 @@ const stripePublishableKey = computed<string>(
   () => dmsSaasRuntime.value?.stripePublishableKey ?? "",
 );
 
-// Only `finalize` goes through the frontend server because it opens the session
-// cookie; all other public registration endpoints live on the DMS API.
+// Only `finalize` goes through the frontend server, and only because it opens
+// the session cookie on the workspace it provisions; every other public
+// registration endpoint is called on the DMS API directly.
 const apiFetch = $fetch.create({ baseURL: dmsRuntime.value.baseURL });
 
 const { countryItems } = useBillingCountries();
@@ -225,17 +225,15 @@ async function submit(): Promise<void> {
         nuxtApp.$i18n.t("saas.register.error.no_payment");
       return;
     }
-    await $fetch(FINALIZE_ENDPOINT, {
+    await $fetch(SESSION_ESTABLISH_ENDPOINT, {
       method: "POST",
-      body: {
-        tenant_assignment_token: tenantAssignmentToken.value,
+      body: buildSessionEstablishRequest({
+        tenantAssignmentToken: tenantAssignmentToken.value,
         workspaceName: workspaceName.value,
         planId: selectedPlanId.value,
         customerType: customerType.value,
-        companyName:
-          customerType.value === "business" ? companyName.value : undefined,
-        vatNumber:
-          customerType.value === "business" ? vatNumber.value : undefined,
+        companyName: companyName.value,
+        vatNumber: vatNumber.value,
         address: {
           country: country.value,
           line1: addressLine1.value || undefined,
@@ -243,7 +241,7 @@ async function submit(): Promise<void> {
           city: city.value || undefined,
         },
         paymentMethodId: confirm.paymentMethodId,
-      },
+      }),
     });
     if (typeof window !== "undefined") {
       window.location.href = HOME_REDIRECT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-saas",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
     "@antelopejs/dms": ">=0.0.1 <1.0.0",
     "@antelopejs/interface-api": ">=0.0.13 <1.0.0",
     "@antelopejs/interface-api-util": ">=0.1.2 <1.0.0",
-    "@antelopejs/interface-core": "^0.0.12",
+    "@antelopejs/interface-core": ">=0.0.13 <1.0.0",
     "@antelopejs/interface-data-api": ">=0.1.9 <1.0.0",
     "@antelopejs/interface-database": ">=0.1.7 <1.0.0",
     "@antelopejs/interface-database-decorators": ">=0.1.6 <1.0.0",
@@ -47,7 +47,7 @@
     "@antelopejs/dms-frontend": ">=0.0.1 <1.0.0",
     "@antelopejs/file-storage-local": "0.1.4",
     "@antelopejs/mongodb": "1.3.0",
-    "@antelopejs/tooling-configs": "^0.0.4",
+    "@antelopejs/tooling-configs": ">=0.0.6 <1.0.0",
     "@types/node": "^24.0.0",
     "@types/node-cron": "^3.0.11",
     "knip": "^6.34.0",