@brightweblabs/module-orgs 0.5.7 → 0.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@brightweblabs/module-orgs",
   "private": false,
-  "version": "0.5.7",
+  "version": "0.6.0",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "files": [
@@ -25,10 +25,10 @@
     "@supabase/supabase-js": "^2.110.8",
     "lucide-react": "^1.26.0",
     "server-only": "^0.0.1",
-    "@brightweblabs/app-shell": "0.15.7",
-    "@brightweblabs/core-auth": "0.10.9",
+    "@brightweblabs/app-shell": "0.15.8",
+    "@brightweblabs/core-auth": "0.10.10",
     "@brightweblabs/infra": "0.7.0",
-    "@brightweblabs/ui": "1.5.1"
+    "@brightweblabs/ui": "1.5.2"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/data.ts

@@ -288,3 +288,61 @@ export async function setOrganizationMemberRole(
   if (data.role !== "admin" && data.role !== "member") throw new Error("Invalid organization member role.");
   return data as OrganizationMember;
 }
+
+async function requireSafeOrganizationMemberMutation(
+  supabase: SupabaseClient,
+  organizationId: string,
+  profileId: string,
+): Promise<OrganizationMember> {
+  const { data: member, error } = await supabase
+    .from("organization_members")
+    .select("id, organization_id, profile_id, role, joined_at")
+    .eq("organization_id", organizationId)
+    .eq("profile_id", profileId)
+    .maybeSingle<OrganizationMember>();
+  if (error) throw new Error(error.message);
+  if (!member) throw new Error("Membro da organização não encontrado.");
+  return member;
+}
+
+async function assertOrganizationKeepsAdmin(
+  supabase: SupabaseClient,
+  organizationId: string,
+  member: OrganizationMember,
+): Promise<void> {
+  if (member.role !== "admin") return;
+  const { count, error } = await supabase
+    .from("organization_members")
+    .select("id", { count: "exact", head: true })
+    .eq("organization_id", organizationId)
+    .eq("role", "admin");
+  if (error) throw new Error(error.message);
+  if ((count ?? 0) <= 1) throw new Error("A organização deve manter pelo menos um Administrador.");
+}
+
+export async function updateOrganizationMemberRole(
+  supabase: SupabaseClient,
+  organizationId: string,
+  profileId: string,
+  role: OrganizationMemberRole,
+): Promise<OrganizationMember> {
+  const member = await requireSafeOrganizationMemberMutation(supabase, organizationId, profileId);
+  if (member.role === role) return member;
+  if (role === "member") await assertOrganizationKeepsAdmin(supabase, organizationId, member);
+  return setOrganizationMemberRole(supabase, organizationId, profileId, role);
+}
+
+export async function removeOrganizationMember(
+  supabase: SupabaseClient,
+  organizationId: string,
+  profileId: string,
+): Promise<void> {
+  const member = await requireSafeOrganizationMemberMutation(supabase, organizationId, profileId);
+  await assertOrganizationKeepsAdmin(supabase, organizationId, member);
+  const { error } = await supabase
+    .from("organization_members")
+    .delete()
+    .eq("organization_id", organizationId)
+    .eq("profile_id", profileId);
+  if (error) throw new Error(error.message);
+}

package/src/handlers.ts

@@ -1,5 +1,11 @@
 import { requireOrganizationManageAccess, requireOrganizationsStaffAccess } from "./access";
-import { createOrganization, deleteOrganization, updateOrganization } from "./data";
+import {
+  createOrganization,
+  deleteOrganization,
+  removeOrganizationMember,
+  updateOrganization,
+  updateOrganizationMemberRole,
+} from "./data";
 import {
   inviteOrganizationMembers,
   logOrganizationActivity,
@@ -11,6 +17,7 @@ import {
   createOrganizationInvitationDeleteHandler,
   createOrganizationDeleteHandler,
   createOrganizationInvitationsHandler,
+  createOrganizationMemberMutationHandlers,
   createOrganizationPatchHandler,
   createOrganizationsPostHandler,
 } from "./http";
@@ -43,3 +50,12 @@ export const handleOrganizationInvitationsGetRequest = invitationHandlers.GET;
 export const handleOrganizationInvitationsPostRequest = invitationHandlers.POST;
 export const handleOrganizationInvitationDeleteRequest =
   createOrganizationInvitationDeleteHandler(invitationDependencies);
+
+const memberMutationHandlers = createOrganizationMemberMutationHandlers({
+  getManageAccess: requireOrganizationManageAccess,
+  updateMemberRole: updateOrganizationMemberRole,
+  removeMember: removeOrganizationMember,
+  logActivity: logOrganizationActivity,
+});
+export const handleOrganizationMemberPatchRequest = memberMutationHandlers.PATCH;
+export const handleOrganizationMemberDeleteRequest = memberMutationHandlers.DELETE;

package/src/http.ts

@@ -200,15 +200,16 @@ export function createOrganizationDeleteHandler(dependencies: OrganizationWriteD
 
 export function createOrganizationInvitationsHandler(dependencies: OrganizationInvitationDependencies) {
   return {
-    GET: async (_request: Request, context: { params: Promise<{ id: string }> }): Promise<Response> => {
+    GET: async (request: Request, context: { params: Promise<{ id: string }> }): Promise<Response> => {
       const { id } = await context.params;
       if (!id) return json({ error: "id é obrigatório." }, { status: 400 });
       const access = await dependencies.getManageAccess(id);
       if (!access.ok) return json({ error: access.error }, { status: access.status });
       try {
+        const includeHistory = new URL(request.url).searchParams.get("status") === "all";
         const [members, invitations] = await Promise.all([
           dependencies.listMembers(access.serviceSupabase, id),
-          dependencies.listInvitations(access.serviceSupabase, id, { status: "pending" }),
+          dependencies.listInvitations(access.serviceSupabase, id, includeHistory ? undefined : { status: "pending" }),
         ]);
         return json({ data: { members, invitations } });
       } catch (error) {
@@ -254,6 +255,64 @@ export function createOrganizationInvitationsHandler(dependencies: OrganizationI
   };
 }
 
+type OrganizationMemberMutationDependencies = {
+  getManageAccess: OrganizationInvitationDependencies["getManageAccess"];
+  updateMemberRole: (
+    supabase: SupabaseClient,
+    organizationId: string,
+    profileId: string,
+    role: "admin" | "member",
+  ) => Promise<unknown>;
+  removeMember: (supabase: SupabaseClient, organizationId: string, profileId: string) => Promise<void>;
+  logActivity: OrganizationInvitationDependencies["logActivity"];
+};
+
+export function createOrganizationMemberMutationHandlers(dependencies: OrganizationMemberMutationDependencies) {
+  return {
+    PATCH: async (request: Request, context: { params: Promise<{ id: string; profileId: string }> }): Promise<Response> => {
+      const { id, profileId } = await context.params;
+      if (!id || !profileId) return json({ error: "id e profileId são obrigatórios." }, { status: 400 });
+      const access = await dependencies.getManageAccess(id);
+      if (!access.ok) return json({ error: access.error }, { status: access.status });
+      const body = await readJsonObject(request);
+      const role = body?.role === "admin" ? "admin" : body?.role === "member" ? "member" : null;
+      if (!role) return json({ error: "Função inválida." }, { status: 400 });
+      try {
+        const member = await dependencies.updateMemberRole(access.serviceSupabase, id, profileId, role);
+        await dependencies.logActivity(access.serviceSupabase, {
+          actorProfileId: access.profileId,
+          organizationId: id,
+          eventType: "crm_organization_member_role_updated",
+          summary: "Função de membro da organização atualizada.",
+          payload: { organization_id: id, profile_id: profileId, role },
+        });
+        return json({ data: { member } });
+      } catch (error) {
+        return organizationError(error);
+      }
+    },
+    DELETE: async (_request: Request, context: { params: Promise<{ id: string; profileId: string }> }): Promise<Response> => {
+      const { id, profileId } = await context.params;
+      if (!id || !profileId) return json({ error: "id e profileId são obrigatórios." }, { status: 400 });
+      const access = await dependencies.getManageAccess(id);
+      if (!access.ok) return json({ error: access.error }, { status: access.status });
+      try {
+        await dependencies.removeMember(access.serviceSupabase, id, profileId);
+        await dependencies.logActivity(access.serviceSupabase, {
+          actorProfileId: access.profileId,
+          organizationId: id,
+          eventType: "crm_organization_member_removed",
+          summary: "Acesso à organização removido.",
+          payload: { organization_id: id, profile_id: profileId },
+        });
+        return json({ data: { success: true } });
+      } catch (error) {
+        return organizationError(error);
+      }
+    },
+  };
+}
+
 export function createOrganizationInvitationDeleteHandler(dependencies: OrganizationInvitationDependencies) {
   return async function handleOrganizationInvitationDeleteRequest(
     _request: Request,

package/src/index.ts

@@ -5,7 +5,9 @@ export {
   deleteOrganization,
   listOrganizationMembers,
   listOrganizations,
+  removeOrganizationMember,
   setOrganizationMemberRole,
+  updateOrganizationMemberRole,
   updateOrganization,
   type CreateOrganizationInput,
   type Organization,
@@ -21,6 +23,8 @@ export {
   handleOrganizationDeleteRequest,
   handleOrganizationInvitationsGetRequest,
   handleOrganizationInvitationsPostRequest,
+  handleOrganizationMemberDeleteRequest,
+  handleOrganizationMemberPatchRequest,
   handleOrganizationPatchRequest,
   handleOrganizationsPostRequest,
 } from "./handlers";

package/src/invitations.ts

@@ -55,7 +55,7 @@ export type OrganizationMemberView = {
 
 export type EnsureCrmContact = (
   profileId: string,
-  options: { source: string; serviceClient: SupabaseClient },
+  options: { source: string; organizationId?: string | null; serviceClient: SupabaseClient },
 ) => Promise<{ success: boolean; contactId?: string; error?: string }>;
 
 export async function logOrganizationActivity(
@@ -296,12 +296,14 @@ export async function inviteOrganizationMembers(
   }
 
   const pendingRows: Array<Record<string, unknown>> = [];
+  const resolvedProfilesByEmail = new Map<string, string>();
   let directAssignments = 0;
   let updatedExistingMembers = 0;
   let unchangedExistingMembers = 0;
   for (const invite of normalized) {
     const member = memberByEmail.get(invite.email);
     if (member) {
+      resolvedProfilesByEmail.set(invite.email, member.profileId);
       if (member.role === invite.role) unchangedExistingMembers += 1;
       else {
         const { error } = await supabase.from("organization_members").update({ role: invite.role })
@@ -319,6 +321,7 @@ export async function inviteOrganizationMembers(
         role: invite.role,
       }, { onConflict: "organization_id,profile_id" });
       if (error) throw new Error(error.message);
+      resolvedProfilesByEmail.set(invite.email, profileId);
       directAssignments += 1;
       continue;
     }
@@ -339,6 +342,17 @@ export async function inviteOrganizationMembers(
   if (directAssignments > 0 || updatedExistingMembers > 0) {
     await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId);
   }
+  if (resolvedProfilesByEmail.size > 0) {
+    const acceptedAt = new Date().toISOString();
+    await Promise.all(Array.from(resolvedProfilesByEmail, async ([email, profileId]) => {
+      const { error } = await supabase.from("organization_invitations").update({
+        status: "accepted",
+        accepted_at: acceptedAt,
+        accepted_by_profile_id: profileId,
+      }).eq("organization_id", organizationId).eq("invited_email", email).eq("status", "pending");
+      if (error) throw new Error(error.message);
+    }));
+  }
   if (pendingRows.length > 0) {
     const { error } = await supabase.from("organization_invitations").upsert(pendingRows, {
       onConflict: "organization_id,invited_email",
@@ -347,7 +361,7 @@ export async function inviteOrganizationMembers(
     if (error) throw new Error(error.message);
     const { data: inserted, error: selectError } = await supabase
       .from("organization_invitations")
-      .select("id, invited_email, role")
+      .select("id, invited_email, role, expires_at")
       .eq("organization_id", organizationId)
       .in("invited_email", pendingRows.map((row) => String(row.invited_email)))
       .eq("status", "pending");
@@ -359,6 +373,7 @@ export async function inviteOrganizationMembers(
         organizationName,
         invitedEmail: String(invitation.invited_email),
         role: invitation.role === "admin" ? "admin" : "member",
+        expiresAt: typeof invitation.expires_at === "string" ? invitation.expires_at : undefined,
       }),
     })));
     const failedIds = deliveries.filter((result) => !result.delivered).map((result) => result.id);
@@ -426,6 +441,7 @@ export async function acceptOrganizationInvitation(
 
   const acceptedContact = await params.ensureCrmContactForProfile(params.profileId, {
     source: "organization_invitation_accept",
+    organizationId: invitation.organization_id,
     serviceClient: supabase,
   });
   if (!acceptedContact.success) {

package/src/invite-email.ts

@@ -6,6 +6,11 @@ import {
   ResendConfigError,
 } from "@brightweblabs/infra/server";
 import { getAuthBaseUrl } from "@brightweblabs/core-auth/shared";
+import {
+  buildInvitationEmail,
+  emailBrandNameFromSender,
+  transactionalEmailPaletteFromEnv,
+} from "@brightweblabs/ui/email/invitation";
 import type { OrganizationMemberRole } from "./data";
 
 type SendOrganizationInviteEmailParams = {
@@ -13,17 +18,9 @@ type SendOrganizationInviteEmailParams = {
   organizationName: string;
   invitedEmail: string;
   role: OrganizationMemberRole;
+  expiresAt?: string;
 };
 
-function escapeHtml(value: string): string {
-  return value
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 function buildSignupUrl(invitationId: string): string {
   return new URL(`invite/${invitationId}`, `${getAuthBaseUrl()}/`).toString();
 }
@@ -34,17 +31,41 @@ export async function sendOrganizationInviteEmail(
   try {
     const signupUrl = buildSignupUrl(params.invitationId);
     const roleLabel = params.role === "admin" ? "Administrador" : "Membro";
-    const safeOrganization = escapeHtml(params.organizationName);
-    const safeUrl = escapeHtml(signupUrl);
+    const sender = getTransactionalSender();
+    const brandName = process.env.EMAIL_BRAND_NAME?.trim() || emailBrandNameFromSender(sender);
+    const logoPath = process.env.EMAIL_BRAND_LOGO_URL?.trim();
+    const logoUrl = logoPath ? new URL(logoPath, `${getAuthBaseUrl()}/`).toString() : null;
+    const expiryDate = params.expiresAt ? new Date(params.expiresAt) : null;
+    const expiresLabel = expiryDate && !Number.isNaN(expiryDate.getTime())
+      ? new Intl.DateTimeFormat("pt-PT", { dateStyle: "long" }).format(expiryDate)
+      : null;
+    const email = buildInvitationEmail({
+      brandName,
+      logoUrl,
+      logoAlt: brandName,
+      preheader: `Foi convidado para colaborar com ${params.organizationName}.`,
+      eyebrow: "Convite para uma organização",
+      title: "Há uma equipa à sua espera",
+      introduction: `Aceite o convite para colaborar com ${params.organizationName} através do ${brandName}.`,
+      details: [
+        { label: "Organização", value: params.organizationName },
+        { label: "Nível de acesso", value: roleLabel },
+      ],
+      actionLabel: "Aceitar convite",
+      actionUrl: signupUrl,
+      expiresLabel,
+      recipientEmail: params.invitedEmail,
+      palette: transactionalEmailPaletteFromEnv(process.env),
+    });
 
     await resendApiRequest<{ id?: string }>("/emails", {
       method: "POST",
       body: JSON.stringify({
-        from: getTransactionalSender(),
+        from: sender,
         to: [params.invitedEmail],
-        subject: `Convite para a organização ${params.organizationName}`,
-        html: `<p>Foi convidado(a) para <strong>${safeOrganization}</strong> como ${roleLabel}.</p><p><a href="${safeUrl}">Aceitar convite</a></p>`,
-        text: `Convite para ${params.organizationName} (${roleLabel})\n\n${signupUrl}`,
+        subject: `${brandName}: convite para ${params.organizationName}`,
+        html: email.html,
+        text: email.text,
         tags: [
           { name: "flow", value: "organization_invite" },
           { name: "org_role", value: params.role },