@digimuza/saas-core 0.0.2

package/dist/db/schema/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Public schema surface: `@digimuza/saas-core/db/schema`.
+ *
+ * Product applications import core tables from here and reference them from
+ * their own tables:
+ *
+ * ```ts
+ * import { workspaces } from "@digimuza/saas-core/db/schema";
+ *
+ * export const projects = pgTable("projects", {
+ *   id: uuid("id").defaultRandom().primaryKey(),
+ *   workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id),
+ *   name: text("name").notNull(),
+ * });
+ * ```
+ *
+ * Because applications reference these table objects directly, `drizzle-orm` is
+ * a **peer** dependency: two copies in one dependency tree would produce table
+ * objects that Drizzle cannot relate to each other.
+ *
+ * Export order matters. Drizzle resolves referenced table objects when a table
+ * is built, so a module may only reference tables declared before it:
+ * users -> workspaces -> authorization -> invitations -> billing -> events ->
+ * messaging -> apikeys -> webhooks -> features -> files.
+ */
+export { primaryId, timestamps } from "./_shared.ts";
+export * from "./users.ts";
+export * from "./workspaces.ts";
+export * from "./authorization.ts";
+export * from "./invitations.ts";
+export * from "./billing.ts";
+export * from "./events.ts";
+export * from "./messaging.ts";
+export * from "./apikeys.ts";
+export * from "./webhooks.ts";
+export * from "./features.ts";
+export * from "./files.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/db/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/db/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/db/schema/index.js

@@ -0,0 +1,38 @@
+/**
+ * Public schema surface: `@digimuza/saas-core/db/schema`.
+ *
+ * Product applications import core tables from here and reference them from
+ * their own tables:
+ *
+ * ```ts
+ * import { workspaces } from "@digimuza/saas-core/db/schema";
+ *
+ * export const projects = pgTable("projects", {
+ *   id: uuid("id").defaultRandom().primaryKey(),
+ *   workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id),
+ *   name: text("name").notNull(),
+ * });
+ * ```
+ *
+ * Because applications reference these table objects directly, `drizzle-orm` is
+ * a **peer** dependency: two copies in one dependency tree would produce table
+ * objects that Drizzle cannot relate to each other.
+ *
+ * Export order matters. Drizzle resolves referenced table objects when a table
+ * is built, so a module may only reference tables declared before it:
+ * users -> workspaces -> authorization -> invitations -> billing -> events ->
+ * messaging -> apikeys -> webhooks -> features -> files.
+ */
+export { primaryId, timestamps } from "./_shared.js";
+export * from "./users.js";
+export * from "./workspaces.js";
+export * from "./authorization.js";
+export * from "./invitations.js";
+export * from "./billing.js";
+export * from "./events.js";
+export * from "./messaging.js";
+export * from "./apikeys.js";
+export * from "./webhooks.js";
+export * from "./features.js";
+export * from "./files.js";
+//# sourceMappingURL=index.js.map

package/dist/db/schema/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/db/schema/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC"}

package/dist/db/schema/invitations.d.ts

@@ -0,0 +1,214 @@
+/**
+ * A pending invitation to join a workspace.
+ *
+ * Only the SHA-256 hash of the invitation token is stored. The token is shown
+ * once, in the invitation email; a database leak therefore does not let an
+ * attacker accept outstanding invitations.
+ *
+ * This lives in its own module because it references both `workspaces` and
+ * `roles`. Declaring it alongside `workspaces` would make the workspace and
+ * authorization schema modules mutually dependent, and Drizzle needs the
+ * referenced table objects to exist when the table is built.
+ */
+export declare const workspaceInvitations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspace_invitations";
+    schema: undefined;
+    columns: {
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workspace_invitations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "workspace_invitations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        email: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        invitedByUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "invited_by_user_id";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "workspace_invitations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "workspace_invitations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        acceptedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "accepted_at";
+            tableName: "workspace_invitations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "workspace_invitations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+export declare const workspaceInvitationsRelations: import("drizzle-orm").Relations<"workspace_invitations", {
+    workspace: import("drizzle-orm").One<"workspaces", true>;
+    invitedBy: import("drizzle-orm").One<"users", false>;
+    role: import("drizzle-orm").One<"roles", false>;
+}>;
+export type WorkspaceInvitation = typeof workspaceInvitations.$inferSelect;
+export type NewWorkspaceInvitation = typeof workspaceInvitations.$inferInsert;
+//# sourceMappingURL=invitations.d.ts.map

package/dist/db/schema/invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../../src/db/schema/invitations.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwDhC,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;EAavC,CAAC;AAEJ,MAAM,MAAM,mBAAmB,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC;AAC3E,MAAM,MAAM,sBAAsB,GAAG,OAAO,oBAAoB,CAAC,YAAY,CAAC"}

package/dist/db/schema/invitations.js

@@ -0,0 +1,80 @@
+import { sql } from "drizzle-orm";
+import { relations } from "drizzle-orm";
+import { foreignKey, index, pgTable, text, timestamp, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import { primaryId, timestamps } from "./_shared.js";
+import { roles } from "./authorization.js";
+import { users } from "./users.js";
+import { workspaces } from "./workspaces.js";
+/**
+ * A pending invitation to join a workspace.
+ *
+ * Only the SHA-256 hash of the invitation token is stored. The token is shown
+ * once, in the invitation email; a database leak therefore does not let an
+ * attacker accept outstanding invitations.
+ *
+ * This lives in its own module because it references both `workspaces` and
+ * `roles`. Declaring it alongside `workspaces` would make the workspace and
+ * authorization schema modules mutually dependent, and Drizzle needs the
+ * referenced table objects to exist when the table is built.
+ */
+export const workspaceInvitations = pgTable("workspace_invitations", {
+    id: primaryId(),
+    workspaceId: uuid("workspace_id")
+        .notNull()
+        .references(() => workspaces.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    /** SHA-256 of the invitation token. Never the token itself. */
+    tokenHash: text("token_hash").notNull().unique(),
+    /** Set null rather than cascade: removing a user must not erase who invited whom. */
+    invitedByUserId: uuid("invited_by_user_id").references(() => users.id, {
+        onDelete: "set null",
+    }),
+    /**
+     * Role granted on acceptance, falling back to the workspace default role.
+     *
+     * A single optional role rather than a join table: additional roles are
+     * granted after joining, and nothing yet needs an invitation to carry
+     * several. Constrained to the inviting workspace by the composite foreign
+     * key below.
+     */
+    roleId: uuid("role_id"),
+    expiresAt: timestamp("expires_at", { withTimezone: true, mode: "date" }).notNull(),
+    acceptedAt: timestamp("accepted_at", { withTimezone: true, mode: "date" }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true, mode: "date" }),
+    ...timestamps,
+}, (table) => [
+    index("workspace_invitations_workspace_id_idx").on(table.workspaceId),
+    /**
+     * At most one *outstanding* invitation per email per workspace. Accepted and
+     * revoked rows are excluded, so an address can be re-invited later and the
+     * history stays queryable.
+     */
+    uniqueIndex("workspace_invitations_pending_idx")
+        .on(table.workspaceId, sql `lower(${table.email})`)
+        .where(sql `${table.acceptedAt} is null and ${table.revokedAt} is null`),
+    /**
+     * The same cross-workspace guard applied to role assignment: an invitation
+     * cannot pre-assign a role that belongs to a different workspace, because
+     * both columns of this key are read from this row.
+     */
+    foreignKey({
+        name: "workspace_invitations_role_fk",
+        columns: [table.roleId, table.workspaceId],
+        foreignColumns: [roles.id, roles.workspaceId],
+    }).onDelete("set null"),
+]);
+export const workspaceInvitationsRelations = relations(workspaceInvitations, ({ one }) => ({
+    workspace: one(workspaces, {
+        fields: [workspaceInvitations.workspaceId],
+        references: [workspaces.id],
+    }),
+    invitedBy: one(users, {
+        fields: [workspaceInvitations.invitedByUserId],
+        references: [users.id],
+    }),
+    role: one(roles, {
+        fields: [workspaceInvitations.roleId],
+        references: [roles.id],
+    }),
+}));
+//# sourceMappingURL=invitations.js.map

package/dist/db/schema/invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../../src/db/schema/invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CACzC,uBAAuB,EACvB;IACE,EAAE,EAAE,SAAS,EAAE;IACf,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAE9B,+DAA+D;IAC/D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAEhD,qFAAqF;IACrF,eAAe,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;QACrE,QAAQ,EAAE,UAAU;KACrB,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;IAEvB,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IAClF,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1E,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAExE,GAAG,UAAU;CACd,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;IAErE;;;;OAIG;IACH,WAAW,CAAC,mCAAmC,CAAC;SAC7C,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAA,SAAS,KAAK,CAAC,KAAK,GAAG,CAAC;SACjD,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,UAAU,gBAAgB,KAAK,CAAC,SAAS,UAAU,CAAC;IAEzE;;;;OAIG;IACH,UAAU,CAAC;QACT,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QAC1C,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC;KAC9C,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;CACxB,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACzF,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE;QACzB,MAAM,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAC1C,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;KAC5B,CAAC;IACF,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE;QACpB,MAAM,EAAE,CAAC,oBAAoB,CAAC,eAAe,CAAC;QAC9C,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACvB,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE;QACf,MAAM,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACrC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACvB,CAAC;CACH,CAAC,CAAC,CAAC"}