@aphexcms/cms-core 3.0.0 → 5.0.0

package/dist/{lib → server/api}/routes/organizations-invitations.js

@@ -1,84 +1,81 @@
-// Aphex CMS Organization Invitations API Handlers
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { inviteMemberRequest, cancelInvitationRequest } from '../api/schemas/organizations.js';
-import { hasCapability } from '../types/capabilities.js';
-// POST /api/organizations/invitations - Create/send an invitation
-export const POST = async ({ request, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { inviteMemberRequest, cancelInvitationRequest } from '../../../api/schemas/organizations.js';
+import { hasCapability } from '../../../types/capabilities.js';
+/**
+ * Note: in studio, invitations are wrapped by a SvelteKit `+server.ts`
+ * that adds email sending after the invite row is created. While that
+ * shim exists, this Hono router sits dormant (specific SK routes win
+ * over the catch-all). Phase 5 moves the wrapper into `config.api`.
+ */
+export const organizationsInvitationsRouter = new Hono()
+    .post('/invitations', zValidator('json', inviteMemberRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'email and role are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.invite')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to invite members'
-            }, { status: 403 });
-        }
-        const rawBody = await request.json();
-        const parsed = inviteMemberRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                message: 'email and role are required',
-                issues: parsed.error.issues
-            }, { status: 400 });
+            }, 403);
         }
-        const body = parsed.data;
-        // Verify the role exists in this organization. Defends against
-        // clients sending a role name that was deleted between page load
-        // and submit, or against typos slipping past the format regex.
+        const body = c.req.valid('json');
         const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
         if (!roleRow) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unknown role',
                 message: `No role named "${body.role}" in this organization`
-            }, { status: 400 });
+            }, 400);
         }
-        // Reject self-invitation
         if (body.email.toLowerCase() === auth.user.email.toLowerCase()) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid invitation',
                 message: 'You cannot invite yourself'
-            }, { status: 400 });
+            }, 400);
         }
-        // Reject if the invitee is already a member of the organization
-        if (locals.aphexCMS.auth) {
-            const existingUser = await locals.aphexCMS.auth.getUserByEmail(body.email);
+        if (c.var.aphexCMS.auth) {
+            const existingUser = await c.var.aphexCMS.auth.getUserByEmail(body.email);
             if (existingUser) {
                 const existingMembership = await databaseAdapter.findUserMembership(existingUser.id, auth.organizationId);
                 if (existingMembership) {
-                    return json({
+                    return c.json({
                         success: false,
                         error: 'Already a member',
                         message: 'This user is already a member of the organization'
-                    }, { status: 400 });
+                    }, 400);
                 }
             }
         }
-        // Check if there's already a pending invitation for this email
         const existingInvitations = await databaseAdapter.findOrganizationInvitations(auth.organizationId);
         const pendingInvitation = existingInvitations.find((inv) => inv.email.toLowerCase() === body.email.toLowerCase() && inv.acceptedAt === null);
         if (pendingInvitation) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Already invited',
                 message: 'This email has already been invited to the organization'
-            }, { status: 400 });
+            }, 400);
         }
-        // Generate a unique invitation token
         const token = crypto.randomUUID();
-        // Create invitation - email sending is handled by the app layer
         const invitation = await databaseAdapter.createInvitation({
             organizationId: auth.organizationId,
             email: body.email.toLowerCase(),
@@ -87,71 +84,61 @@ export const POST = async ({ request, locals }) => {
             token,
             expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
         });
-        return json({
+        return c.json({
             success: true,
             data: invitation,
             message: 'Invitation created successfully.'
-        }, { status: 201 });
+        }, 201);
     }
     catch (error) {
         cmsLogger.error('Failed to create invitation:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to create invitation',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
+    }
+})
+    .delete('/invitations', zValidator('json', cancelInvitationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'invitationId is required',
+            issues: result.error.issues
+        }, 400);
     }
-};
-// DELETE /api/organizations/invitations - Cancel an invitation
-export const DELETE = async ({ request, locals }) => {
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.invite')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to cancel invitations'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = cancelInvitationRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Missing required field',
-                message: 'invitationId is required',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Delete the invitation
+        const body = c.req.valid('json');
         const deleted = await databaseAdapter.deleteInvitation(body.invitationId);
         if (!deleted) {
-            return json({
-                success: false,
-                error: 'Invitation not found'
-            }, { status: 404 });
+            return c.json({ success: false, error: 'Invitation not found' }, 404);
         }
-        return json({
-            success: true,
-            message: 'Invitation canceled successfully'
-        });
+        return c.json({ success: true, message: 'Invitation canceled successfully' });
     }
     catch (error) {
         cmsLogger.error('Failed to cancel invitation:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to cancel invitation',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-//# sourceMappingURL=organizations-invitations.js.map
+});

package/dist/server/api/routes/organizations-members.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const organizationsMembersRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-members.d.ts.map

package/dist/server/api/routes/organizations-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-members.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CAgRpD,CAAC"}

package/dist/{lib → server/api}/routes/organizations-members.js

@@ -1,214 +1,180 @@
-// Aphex CMS Organization Members API Handlers
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { removeMemberRequest, updateMemberRoleRequest } from '../api/schemas/organizations.js';
-import { hasCapability } from '../types/capabilities.js';
-// GET /api/organizations/members - List organization members
-export const GET = async ({ locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { removeMemberRequest, updateMemberRoleRequest } from '../../../api/schemas/organizations.js';
+import { hasCapability } from '../../../types/capabilities.js';
+export const organizationsMembersRouter = new Hono()
+    .get('/members', async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
-        // Get members of the current active organization
         const members = await databaseAdapter.findOrganizationMembers(auth.organizationId);
-        return json({
-            success: true,
-            data: members
-        });
+        return c.json({ success: true, data: members });
     }
     catch (error) {
         cmsLogger.error('Failed to fetch organization members:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to fetch members',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-// DELETE /api/organizations/members - Remove a member
-export const DELETE = async ({ request, locals }) => {
+})
+    .delete('/members', zValidator('json', removeMemberRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'userId is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.remove')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to remove members'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = removeMemberRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Missing required field',
-                message: 'userId is required',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Prevent removing yourself
+        const body = c.req.valid('json');
         if (body.userId === auth.user.id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid operation',
                 message: 'You cannot remove yourself from the organization'
-            }, { status: 400 });
+            }, 400);
         }
-        // Get the target member's role
         const targetMember = await databaseAdapter.findUserMembership(body.userId, auth.organizationId);
         if (!targetMember) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Member not found',
                 message: 'User is not a member of this organization'
-            }, { status: 404 });
+            }, 404);
         }
-        // Admins cannot remove owners
         if (auth.organizationRole === 'admin' && targetMember.role === 'owner') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'Admins cannot remove owners'
-            }, { status: 403 });
+            }, 403);
         }
-        // Remove the member
         const removed = await databaseAdapter.removeMember(auth.organizationId, body.userId);
         if (!removed) {
-            return json({
-                success: false,
-                error: 'Failed to remove member'
-            }, { status: 500 });
+            return c.json({ success: false, error: 'Failed to remove member' }, 500);
         }
-        // Clear the user's session if their active org is the one they were removed from
         const userSession = await databaseAdapter.findUserSession(body.userId);
         if (userSession?.activeOrganizationId === auth.organizationId) {
             cmsLogger.debug(`[Organizations]: Clearing user session for ${body.userId} - removed from active org ${auth.organizationId}`);
-            // Check if user has other organizations
             const otherOrgs = await databaseAdapter.findUserOrganizations(body.userId);
             if (otherOrgs.length > 0 && otherOrgs[0]) {
-                // Set their first remaining org as active
                 await databaseAdapter.updateUserSession(body.userId, otherOrgs[0].organization.id);
                 cmsLogger.debug(`[Organizations]: Set org ${otherOrgs[0].organization.id} as new active org for ${body.userId}`);
             }
             else {
-                // No other orgs - delete the session so invitations can be processed on next login
                 await databaseAdapter.deleteUserSession(body.userId);
                 cmsLogger.debug(`[Organizations]: Deleted user session for ${body.userId} - no remaining organizations`);
             }
         }
-        return json({
-            success: true,
-            message: 'Member removed successfully'
-        });
+        return c.json({ success: true, message: 'Member removed successfully' });
     }
     catch (error) {
         cmsLogger.error('Failed to remove member:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to remove member',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-// PATCH /api/organizations/members - Update member role
-export const PATCH = async ({ request, locals }) => {
+})
+    .patch('/members', zValidator('json', updateMemberRoleRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            message: 'userId and role are required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type !== 'session') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unauthorized',
                 message: 'Session authentication required'
-            }, { status: 401 });
+            }, 401);
         }
         if (!hasCapability(auth, 'member.changeRole')) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'You do not have permission to change member roles'
-            }, { status: 403 });
+            }, 403);
         }
-        const rawBody = await request.json();
-        const parsed = updateMemberRoleRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'Invalid request body',
-                message: 'userId and role are required',
-                issues: parsed.error.issues
-            }, { status: 400 });
-        }
-        const body = parsed.data;
-        // Verify the target role exists in this organization.
+        const body = c.req.valid('json');
         const roleRow = await databaseAdapter.findRoleByName(auth.organizationId, body.role);
         if (!roleRow) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Unknown role',
                 message: `No role named "${body.role}" in this organization`
-            }, { status: 400 });
+            }, 400);
         }
-        // Prevent changing your own role
         if (body.userId === auth.user.id) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Invalid operation',
                 message: 'You cannot change your own role'
-            }, { status: 400 });
+            }, 400);
         }
-        // Get the target member's current role
         const targetMember = await databaseAdapter.findUserMembership(body.userId, auth.organizationId);
         if (!targetMember) {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Member not found',
                 message: 'User is not a member of this organization'
-            }, { status: 404 });
+            }, 404);
         }
-        // Admins cannot modify owners
         if (auth.organizationRole === 'admin' && targetMember.role === 'owner') {
-            return json({
+            return c.json({
                 success: false,
                 error: 'Forbidden',
                 message: 'Admins cannot modify owner roles'
-            }, { status: 403 });
+            }, 403);
         }
-        // Update the role
         const updatedMember = await databaseAdapter.updateMemberRole(auth.organizationId, body.userId, body.role);
         if (!updatedMember) {
-            return json({
-                success: false,
-                error: 'Failed to update role'
-            }, { status: 500 });
+            return c.json({ success: false, error: 'Failed to update role' }, 500);
         }
-        return json({
-            success: true,
-            data: updatedMember
-        });
+        return c.json({ success: true, data: updatedMember });
     }
     catch (error) {
         cmsLogger.error('Failed to update member role:', error);
-        return json({
+        return c.json({
             success: false,
             error: 'Failed to update role',
             message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
+        }, 500);
     }
-};
-//# sourceMappingURL=organizations-members.js.map
+});

package/dist/server/api/routes/organizations-switch.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const organizationsSwitchRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations-switch.d.ts.map

package/dist/server/api/routes/organizations-switch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations-switch.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations-switch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAwEpD,CAAC"}

package/dist/server/api/routes/organizations-switch.js

@@ -0,0 +1,53 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { switchOrganizationRequest } from '../../../api/schemas/organizations.js';
+export const organizationsSwitchRouter = new Hono().post('/switch', zValidator('json', switchOrganizationRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Missing required field',
+            message: 'organizationId is required',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type !== 'session') {
+            return c.json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'Session authentication required'
+            }, 401);
+        }
+        const body = c.req.valid('json');
+        const membership = await databaseAdapter.findUserMembership(auth.user.id, body.organizationId);
+        if (!membership) {
+            return c.json({
+                success: false,
+                error: 'Access denied',
+                message: 'You are not a member of this organization'
+            }, 403);
+        }
+        await databaseAdapter.updateUserSession(auth.user.id, body.organizationId);
+        const organization = await databaseAdapter.findOrganizationById(body.organizationId);
+        return c.json({
+            success: true,
+            data: {
+                organizationId: body.organizationId,
+                organizationName: organization?.name,
+                role: membership.role
+            }
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to switch organization:', error);
+        return c.json({
+            success: false,
+            error: 'Failed to switch organization',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, 500);
+    }
+});

package/dist/server/api/routes/organizations.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const organizationsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=organizations.d.ts.map

package/dist/server/api/routes/organizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CA8H7C,CAAC"}