@aphexcms/cms-core 0.1.10 → 0.1.11

package/src/lib/routes/organizations-invitations.ts

@@ -0,0 +1,183 @@
+// Aphex CMS Organization Invitations API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+
+// POST /api/organizations/invitations - Create/send an invitation
+export const POST: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Only owners and admins can invite members
+		if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Only owners and admins can invite members'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const body = await request.json();
+
+		if (!body.email || !body.role) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required fields',
+					message: 'email and role are required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Validate role
+		const validRoles = ['admin', 'editor', 'viewer'];
+		if (!validRoles.includes(body.role)) {
+			return json(
+				{
+					success: false,
+					error: 'Invalid role',
+					message: 'Role must be one of: admin, editor, viewer'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Check if there's already a pending invitation for this email
+		const existingInvitations = await databaseAdapter.findOrganizationInvitations(
+			auth.organizationId
+		);
+		const pendingInvitation = existingInvitations.find(
+			(inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null
+		);
+
+		if (pendingInvitation) {
+			return json(
+				{
+					success: false,
+					error: 'Already invited',
+					message: 'This email has already been invited to the organization'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Generate a unique invitation token
+		const token = crypto.randomUUID();
+
+		// Create invitation - will auto-join when user signs up
+		const invitation = await databaseAdapter.createInvitation({
+			organizationId: auth.organizationId,
+			email: body.email.toLowerCase(),
+			role: body.role,
+			invitedBy: auth.user.id,
+			token,
+			expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
+		});
+
+		return json(
+			{
+				success: true,
+				data: invitation,
+				message: 'Invitation sent successfully. User will automatically join when they sign up.'
+			},
+			{ status: 201 }
+		);
+	} catch (error) {
+		console.error('Failed to create invitation:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to create invitation',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// DELETE /api/organizations/invitations - Cancel an invitation
+export const DELETE: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Only owners and admins can cancel invitations
+		if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Only owners and admins can cancel invitations'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const body = await request.json();
+
+		if (!body.invitationId) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required field',
+					message: 'invitationId is required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Delete the invitation
+		const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
+
+		if (!deleted) {
+			return json(
+				{
+					success: false,
+					error: 'Invitation not found'
+				},
+				{ status: 404 }
+			);
+		}
+
+		return json({
+			success: true,
+			message: 'Invitation canceled successfully'
+		});
+	} catch (error) {
+		console.error('Failed to cancel invitation:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to cancel invitation',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};

package/src/lib/routes/organizations-members.ts

@@ -0,0 +1,301 @@
+// Aphex CMS Organization Members API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+
+// GET /api/organizations/members - List organization members
+export const GET: RequestHandler = async ({ locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Get members of the current active organization
+		const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
+
+		return json({
+			success: true,
+			data: members
+		});
+	} catch (error) {
+		console.error('Failed to fetch organization members:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to fetch members',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// DELETE /api/organizations/members - Remove a member
+export const DELETE: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Only owners and admins can remove members
+		if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Only owners and admins can remove members'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const body = await request.json();
+
+		if (!body.userId) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required field',
+					message: 'userId is required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Prevent removing yourself
+		if (body.userId === auth.user.id) {
+			return json(
+				{
+					success: false,
+					error: 'Invalid operation',
+					message: 'You cannot remove yourself from the organization'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Get the target member's role
+		const targetMember = await databaseAdapter.findUserMembership(body.userId, auth.organizationId);
+
+		if (!targetMember) {
+			return json(
+				{
+					success: false,
+					error: 'Member not found',
+					message: 'User is not a member of this organization'
+				},
+				{ status: 404 }
+			);
+		}
+
+		// Admins cannot remove owners
+		if (auth.organizationRole === 'admin' && targetMember.role === 'owner') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Admins cannot remove owners'
+				},
+				{ status: 403 }
+			);
+		}
+
+		// Remove the member
+		const removed = await databaseAdapter.removeMember(auth.organizationId, body.userId);
+
+		if (!removed) {
+			return json(
+				{
+					success: false,
+					error: 'Failed to remove member'
+				},
+				{ status: 500 }
+			);
+		}
+
+		// Clear the user's session if their active org is the one they were removed from
+		const userSession = await databaseAdapter.findUserSession(body.userId);
+		if (userSession?.activeOrganizationId === auth.organizationId) {
+			console.log(
+				`[Organizations]: Clearing user session for ${body.userId} - removed from active org ${auth.organizationId}`
+			);
+
+			// Check if user has other organizations
+			const otherOrgs = await databaseAdapter.findUserOrganizations(body.userId);
+			if (otherOrgs.length > 0 && otherOrgs[0]) {
+				// Set their first remaining org as active
+				await databaseAdapter.updateUserSession(body.userId, otherOrgs[0].organization.id);
+				console.log(
+					`[Organizations]: Set org ${otherOrgs[0].organization.id} as new active org for ${body.userId}`
+				);
+			} else {
+				// No other orgs - delete the session so invitations can be processed on next login
+				await databaseAdapter.deleteUserSession(body.userId);
+				console.log(
+					`[Organizations]: Deleted user session for ${body.userId} - no remaining organizations`
+				);
+			}
+		}
+
+		return json({
+			success: true,
+			message: 'Member removed successfully'
+		});
+	} catch (error) {
+		console.error('Failed to remove member:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to remove member',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// PATCH /api/organizations/members - Update member role
+export const PATCH: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Only owners and admins can update roles
+		if (auth.organizationRole !== 'owner' && auth.organizationRole !== 'admin') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Only owners and admins can update member roles'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const body = await request.json();
+
+		if (!body.userId || !body.role) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required fields',
+					message: 'userId and role are required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Validate role
+		const validRoles = ['owner', 'admin', 'editor', 'viewer'];
+		if (!validRoles.includes(body.role)) {
+			return json(
+				{
+					success: false,
+					error: 'Invalid role',
+					message: 'Role must be one of: owner, admin, editor, viewer'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Prevent changing your own role
+		if (body.userId === auth.user.id) {
+			return json(
+				{
+					success: false,
+					error: 'Invalid operation',
+					message: 'You cannot change your own role'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Get the target member's current role
+		const targetMember = await databaseAdapter.findUserMembership(body.userId, auth.organizationId);
+
+		if (!targetMember) {
+			return json(
+				{
+					success: false,
+					error: 'Member not found',
+					message: 'User is not a member of this organization'
+				},
+				{ status: 404 }
+			);
+		}
+
+		// Admins cannot modify owners
+		if (auth.organizationRole === 'admin' && targetMember.role === 'owner') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Admins cannot modify owner roles'
+				},
+				{ status: 403 }
+			);
+		}
+
+		// Update the role
+		const updatedMember = await databaseAdapter.updateMemberRole(
+			auth.organizationId,
+			body.userId,
+			body.role
+		);
+
+		if (!updatedMember) {
+			return json(
+				{
+					success: false,
+					error: 'Failed to update role'
+				},
+				{ status: 500 }
+			);
+		}
+
+		return json({
+			success: true,
+			data: updatedMember
+		});
+	} catch (error) {
+		console.error('Failed to update member role:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to update role',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};

package/src/lib/routes/organizations-switch.ts

@@ -0,0 +1,74 @@
+// Aphex CMS Organization Switch API Handler
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+
+// POST /api/organizations/switch - Switch active organization
+export const POST: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		const body = await request.json();
+
+		if (!body.organizationId) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required field',
+					message: 'organizationId is required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Verify user is a member of the target organization
+		const membership = await databaseAdapter.findUserMembership(auth.user.id, body.organizationId);
+
+		if (!membership) {
+			return json(
+				{
+					success: false,
+					error: 'Access denied',
+					message: 'You are not a member of this organization'
+				},
+				{ status: 403 }
+			);
+		}
+
+		// Update user's active organization
+		await databaseAdapter.updateUserSession(auth.user.id, body.organizationId);
+
+		// Get the organization details
+		const organization = await databaseAdapter.findOrganizationById(body.organizationId);
+
+		return json({
+			success: true,
+			data: {
+				organizationId: body.organizationId,
+				organizationName: organization?.name,
+				role: membership.role
+			}
+		});
+	} catch (error) {
+		console.error('Failed to switch organization:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to switch organization',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};

package/src/lib/routes/organizations.ts

@@ -0,0 +1,147 @@
+// Aphex CMS Organization API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+
+// GET /api/organizations - List user's organizations
+export const GET: RequestHandler = async ({ locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Get all organizations the user belongs to
+		const memberships = await databaseAdapter.findUserOrganizations(auth.user.id);
+
+		// Map to a cleaner format with organization details and user's role
+		const organizations = memberships.map((membership) => ({
+			id: membership.organization.id,
+			name: membership.organization.name,
+			slug: membership.organization.slug,
+			metadata: membership.organization.metadata,
+			role: membership.member.role,
+			joinedAt: membership.member.createdAt,
+			isActive: membership.organization.id === auth.organizationId
+		}));
+
+		return json({
+			success: true,
+			data: organizations
+		});
+	} catch (error) {
+		console.error('Failed to fetch organizations:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to fetch organizations',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// POST /api/organizations - Create new organization
+export const POST: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth || auth.type !== 'session') {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Session authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Only SUPER_ADMIN can create organizations
+		if (auth.user.role !== 'super_admin') {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'Only super admins can create organizations'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const body = await request.json();
+
+		// Validate required fields
+		if (!body.name || !body.slug) {
+			return json(
+				{
+					success: false,
+					error: 'Missing required fields',
+					message: 'Organization name and slug are required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Check if slug is already taken
+		const existingOrg = await databaseAdapter.findOrganizationBySlug(body.slug);
+		if (existingOrg) {
+			return json(
+				{
+					success: false,
+					error: 'Slug already exists',
+					message: `Organization with slug '${body.slug}' already exists`
+				},
+				{ status: 409 }
+			);
+		}
+
+		// Create the organization with current active org as parent
+		// Note: Only supports 1-level hierarchy for performance
+		const newOrganization = await databaseAdapter.createOrganization({
+			name: body.name,
+			slug: body.slug,
+			metadata: body.metadata || null,
+			parentOrganizationId: auth.organizationId, // Current active org becomes parent
+			createdBy: auth.user.id
+		});
+
+		// Add the creator as owner
+		await databaseAdapter.addMember({
+			organizationId: newOrganization.id,
+			userId: auth.user.id,
+			role: 'owner'
+		});
+
+		// Set as active organization for this user
+		await databaseAdapter.updateUserSession(auth.user.id, newOrganization.id);
+
+		return json(
+			{
+				success: true,
+				data: newOrganization
+			},
+			{ status: 201 }
+		);
+	} catch (error) {
+		console.error('Failed to create organization:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to create organization',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};