@elevasis/core 0.1.0

package/src/auth/multi-tenancy/invitations/__tests__/invitation.test.ts

@@ -0,0 +1,237 @@
+import { describe, it, expect } from 'vitest'
+import { transformWorkOSInvitation } from '../server/transforms'
+import type { WorkOSInvitation } from '../server/workos'
+
+describe('transformWorkOSInvitation', () => {
+  it('transforms pending WorkOS invitation with all fields', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_123',
+      email: 'newuser@example.com',
+      organizationId: 'org_456',
+      inviterUserId: 'user_789',
+      state: 'pending',
+      token: 'token_abc123',
+      acceptInvitationUrl: 'https://example.com/accept/token_abc123',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result).toEqual({
+      id: 'inv_123',
+      workosInvitationId: 'inv_123',
+      email: 'newuser@example.com',
+      organizationId: 'org_456',
+      inviterUserId: 'user_789',
+      invitationState: 'pending',
+      roleSlug: null, // WorkOS doesn't include role in invitation response
+      invitationToken: 'token_abc123',
+      acceptInvitationUrl: 'https://example.com/accept/token_abc123',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    })
+  })
+
+  it('transforms accepted invitation with acceptedAt timestamp', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_accepted',
+      email: 'accepted@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'accepted',
+      token: 'token_accepted',
+      acceptInvitationUrl: 'https://example.com/accept/token_accepted',
+      acceptedAt: '2025-01-20T14:30:00Z',
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-20T14:30:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.invitationState).toBe('accepted')
+    expect(result.acceptedAt).toBe('2025-01-20T14:30:00Z')
+    expect(result.revokedAt).toBeNull()
+  })
+
+  it('transforms revoked invitation with revokedAt timestamp', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_revoked',
+      email: 'revoked@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'revoked',
+      token: 'token_revoked',
+      acceptInvitationUrl: 'https://example.com/accept/token_revoked',
+      acceptedAt: null,
+      revokedAt: '2025-01-18T09:15:00Z',
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-18T09:15:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.invitationState).toBe('revoked')
+    expect(result.acceptedAt).toBeNull()
+    expect(result.revokedAt).toBe('2025-01-18T09:15:00Z')
+  })
+
+  it('transforms expired invitation', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_expired',
+      email: 'expired@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'expired',
+      token: 'token_expired',
+      acceptInvitationUrl: 'https://example.com/accept/token_expired',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-01-01T00:00:00Z', // Past date
+      createdAt: '2024-12-15T10:00:00Z',
+      updatedAt: '2025-01-02T00:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.invitationState).toBe('expired')
+    expect(result.expiresAt).toBe('2025-01-01T00:00:00Z')
+  })
+
+  it('sets roleSlug to null (not provided by WorkOS)', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_no_role',
+      email: 'test@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'pending',
+      token: 'token_123',
+      acceptInvitationUrl: 'https://example.com/accept',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.roleSlug).toBeNull()
+  })
+
+  it('preserves email address exactly', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_email',
+      email: 'Test.User+Tag@Example.COM',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'pending',
+      token: 'token_123',
+      acceptInvitationUrl: 'https://example.com/accept',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.email).toBe('Test.User+Tag@Example.COM')
+  })
+
+  it('duplicates id to workosInvitationId', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_duplicate_id',
+      email: 'test@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'pending',
+      token: 'token_123',
+      acceptInvitationUrl: 'https://example.com/accept',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.id).toBe('inv_duplicate_id')
+    expect(result.workosInvitationId).toBe('inv_duplicate_id')
+  })
+
+  it('preserves invitation token and URL', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_token_test',
+      email: 'test@example.com',
+      organizationId: 'org_123',
+      inviterUserId: 'user_456',
+      state: 'pending',
+      token: 'super_secret_token_xyz',
+      acceptInvitationUrl: 'https://app.example.com/invitations/accept?token=super_secret_token_xyz',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.invitationToken).toBe('super_secret_token_xyz')
+    expect(result.acceptInvitationUrl).toBe('https://app.example.com/invitations/accept?token=super_secret_token_xyz')
+  })
+
+  it('handles null organizationId', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_no_org',
+      email: 'test@example.com',
+      organizationId: null,
+      inviterUserId: 'user_456',
+      state: 'pending',
+      token: 'token_123',
+      acceptInvitationUrl: 'https://example.com/accept',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.organizationId).toBeNull()
+  })
+
+  it('handles null inviterUserId', () => {
+    const workosInvitation: WorkOSInvitation = {
+      id: 'inv_no_inviter',
+      email: 'test@example.com',
+      organizationId: 'org_123',
+      inviterUserId: null,
+      state: 'pending',
+      token: 'token_123',
+      acceptInvitationUrl: 'https://example.com/accept',
+      acceptedAt: null,
+      revokedAt: null,
+      expiresAt: '2025-12-31T23:59:59Z',
+      createdAt: '2025-01-15T10:00:00Z',
+      updatedAt: '2025-01-15T10:00:00Z'
+    }
+
+    const result = transformWorkOSInvitation(workosInvitation)
+
+    expect(result.inviterUserId).toBeNull()
+  })
+})

package/src/auth/multi-tenancy/invitations/api-schemas.ts

@@ -0,0 +1,107 @@
+/**
+ * Invitations Domain - Zod Validation Schemas
+ *
+ * Validation schemas for invitation management endpoints.
+ * Includes request bodies, query params, and path params.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - Email validation prevents header injection
+ * - Role enum validation prevents privilege escalation
+ * - organizationId from JWT (not accepted in body for protected routes)
+ */
+
+import { z } from 'zod'
+import { EmailSchema } from '../../../platform/utils/validation'
+import { MembershipRoleSchema } from '../memberships/api-schemas'
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate invitation ID in URL path
+ * Used by: GET/DELETE /invitations/:id
+ */
+export const InvitationIdParamSchema = z
+  .object({
+    id: z.string().min(1) // WorkOS invitation IDs
+  })
+  .strict()
+
+// ============================================================================
+// Request Bodies
+// ============================================================================
+
+/**
+ * Send new invitation
+ * POST /invitations
+ *
+ * Security:
+ * - Email format validated (prevents header injection)
+ * - Role enum prevents privilege escalation
+ * - expiresInDays bounded (1-90 days)
+ * - organizationId NOT in body (from JWT via requireOrganization middleware)
+ */
+export const SendInvitationSchema = z
+  .object({
+    email: EmailSchema,
+    organizationId: z.string().optional(), // For WorkOS API - but typically from JWT
+    roleSlug: MembershipRoleSchema.default('member'),
+    expiresInDays: z.number().int().min(1).max(90).default(7)
+  })
+  .strict()
+
+/**
+ * Accept invitation by token
+ * POST /invitations/accept
+ *
+ * Security:
+ * - Token validated (non-empty string)
+ */
+export const AcceptInvitationSchema = z
+  .object({
+    invitation_token: z.string().min(1, 'Invitation token is required')
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters
+// ============================================================================
+
+/**
+ * List invitations with filters
+ * GET /invitations
+ *
+ * Filters:
+ * - organizationId: Filter by organization
+ * - email: Filter by email
+ *
+ * Security:
+ * - Requires organizationId or userId filter
+ * - Email validated
+ */
+export const ListInvitationsQuerySchema = z
+  .object({
+    organizationId: z.string().optional(),
+    userId: z.string().optional(),
+    email: EmailSchema.optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+    before: z.string().optional(), // WorkOS pagination cursor
+    after: z.string().optional()   // WorkOS pagination cursor
+  })
+  .strict()
+  .refine(
+    (data) => data.organizationId || data.userId,
+    { message: 'Either organizationId or userId must be provided' }
+  )
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type SendInvitationInput = z.infer<typeof SendInvitationSchema>
+export type AcceptInvitationInput = z.infer<typeof AcceptInvitationSchema>
+export type ListInvitationsQuery = z.infer<typeof ListInvitationsQuerySchema>
+export type InvitationIdParam = z.infer<typeof InvitationIdParamSchema>

package/src/auth/multi-tenancy/invitations/index.ts

@@ -0,0 +1,38 @@
+/**
+ * Invitation types - browser-safe exports only
+ * For WorkOS types and transforms, use @repo/core/server
+ */
+
+// Core invitation types
+export type {
+  Invitation,
+  SendInvitationRequest,
+  ListInvitationsParams,
+  AcceptanceResult,
+  InvitationWithDetails,
+  AcceptInvitationRequest,
+  InvitationListQuery,
+  InvitationSummaryResponse,
+} from './invitation'
+
+// Supabase types
+export type {
+  SupabaseOrgInvitation,
+  SupabaseOrgInvitationInsert,
+  SupabaseOrgInvitationUpdate,
+  AdminOrgInvitation,
+  InvitationState,
+} from './supabase'
+export { transformSupabaseToInvitation } from './supabase'
+
+// Validation schemas
+export {
+  SendInvitationSchema,
+  AcceptInvitationSchema,
+  ListInvitationsQuerySchema,
+  InvitationIdParamSchema,
+  type SendInvitationInput,
+  type AcceptInvitationInput,
+  type ListInvitationsQuery,
+  type InvitationIdParam
+} from './api-schemas'

package/src/auth/multi-tenancy/invitations/invitation.ts

@@ -0,0 +1,86 @@
+/**
+ * Core Invitation Types
+ * Internal types for the invitation system
+ */
+
+import type { User } from '../users/user'
+import type { OrganizationMembership } from '../memberships/membership'
+
+// Core internal invitation interface
+export interface Invitation {
+  id: string
+  workosInvitationId: string
+  email: string
+  organizationId: string | null
+  inviterUserId: string | null
+  invitationState: 'pending' | 'accepted' | 'revoked' | 'expired'
+  roleSlug: string | null
+  invitationToken: string | null
+  acceptInvitationUrl: string | null
+  acceptedAt: string | null
+  revokedAt: string | null
+  expiresAt: string
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+// Request/Response types for API
+export interface SendInvitationRequest {
+  email: string
+  organizationId?: string
+  roleSlug?: string
+  expiresInDays?: number
+  inviterUserId?: string
+}
+
+export interface ListInvitationsParams {
+  organizationId?: string
+  email?: string
+  limit?: number
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+export interface AcceptanceResult {
+  invitation: Invitation
+  user?: User | null
+  membership?: OrganizationMembership | null
+}
+
+export interface AcceptInvitationRequest {
+  invitation_token: string
+}
+
+export interface InvitationListQuery {
+  userId?: string
+  organizationId?: string
+  email?: string
+  limit?: string
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+export interface InvitationSummaryResponse {
+  totalInvitations: number
+  pendingInvitations: number
+  acceptedInvitations: number
+  expiredInvitations: number
+}
+
+// Invitation with enriched details for UI
+export interface InvitationWithDetails extends Invitation {
+  organization?: {
+    id: string
+    name: string
+    status?: string
+  }
+  inviter?: {
+    id: string
+    email: string
+    firstName?: string | null
+    lastName?: string | null
+    profilePictureUrl?: string | null
+  }
+}

package/src/auth/multi-tenancy/invitations/server/index.ts

@@ -0,0 +1,25 @@
+/**
+ * Invitations server-only exports
+ * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
+ */
+export * from './workos'
+export * from './transforms'
+
+// Re-export browser-safe types for convenience
+export type {
+  Invitation,
+  SendInvitationRequest,
+  ListInvitationsParams,
+  AcceptanceResult,
+  InvitationWithDetails,
+  AcceptInvitationRequest,
+  InvitationListQuery,
+  InvitationSummaryResponse
+} from '../invitation'
+export type {
+  SupabaseOrgInvitation,
+  SupabaseOrgInvitationInsert,
+  SupabaseOrgInvitationUpdate,
+  AdminOrgInvitation,
+  InvitationState
+} from '../supabase'

package/src/auth/multi-tenancy/invitations/server/transforms.ts

@@ -0,0 +1,24 @@
+import type { WorkOSInvitation } from './workos'
+import type { Invitation } from '../invitation'
+
+/**
+ * Transform WorkOS invitation to internal format
+ */
+export function transformWorkOSInvitation(workosInvitation: WorkOSInvitation): Invitation {
+  return {
+    id: workosInvitation.id,
+    workosInvitationId: workosInvitation.id,
+    email: workosInvitation.email,
+    organizationId: workosInvitation.organizationId,
+    inviterUserId: workosInvitation.inviterUserId,
+    invitationState: workosInvitation.state,
+    roleSlug: null, // WorkOS doesn't include role in invitation response
+    invitationToken: workosInvitation.token,
+    acceptInvitationUrl: workosInvitation.acceptInvitationUrl,
+    acceptedAt: workosInvitation.acceptedAt,
+    revokedAt: workosInvitation.revokedAt,
+    expiresAt: workosInvitation.expiresAt,
+    createdAt: workosInvitation.createdAt,
+    updatedAt: workosInvitation.updatedAt
+  }
+}

package/src/auth/multi-tenancy/invitations/server/workos.ts

@@ -0,0 +1,24 @@
+/**
+ * WorkOS User Management Invitation API Types
+ * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
+ */
+
+import type {
+  Invitation,
+  InvitationEvent,
+  InvitationResponse,
+  ListInvitationsOptions,
+  SendInvitationOptions,
+  List
+} from '@workos-inc/node'
+
+// Consistent naming convention for the monorepo
+export type WorkOSInvitation = Invitation
+export type WorkOSInvitationEvent = InvitationEvent
+export type WorkOSInvitationResponse = InvitationResponse
+export type WorkOSInvitationListResponse = List<Invitation>
+export type ListWorkOSInvitationsParams = ListInvitationsOptions
+export type SendWorkOSInvitationRequest = SendInvitationOptions
+
+// For additional request types, import directly from SDK when needed:
+// import type { AcceptInvitationOptions } from '@workos-inc/node'

package/src/auth/multi-tenancy/invitations/supabase.ts

@@ -0,0 +1,50 @@
+/**
+ * Supabase Invitation Types
+ * Generated from database schema with type aliases for consistent naming
+ */
+
+import type { Database } from '../../../supabase/database.types'
+
+// Type aliases for org_invitations table
+export type SupabaseOrgInvitation = Database['public']['Tables']['org_invitations']['Row']
+export type SupabaseOrgInvitationInsert = Database['public']['Tables']['org_invitations']['Insert']
+export type SupabaseOrgInvitationUpdate = Database['public']['Tables']['org_invitations']['Update']
+
+// Extended type with computed fields for UI
+export interface AdminOrgInvitation extends SupabaseOrgInvitation {
+  organizations?: {
+    id: string
+    name: string
+    status?: string
+  }
+  users?: {
+    id: string
+    email: string
+    first_name?: string | null
+    last_name?: string | null
+    profile_picture_url?: string | null
+  }
+}
+
+// Invitation states from database constraint
+export type InvitationState = 'pending' | 'accepted' | 'revoked' | 'expired'
+
+// Helper function to transform Supabase data to internal format
+export function transformSupabaseToInvitation(supabaseInvitation: SupabaseOrgInvitation) {
+  return {
+    id: supabaseInvitation.id,
+    workosInvitationId: supabaseInvitation.workos_invitation_id,
+    email: supabaseInvitation.email,
+    organizationId: supabaseInvitation.organization_id,
+    inviterUserId: supabaseInvitation.inviter_user_id,
+    invitationState: supabaseInvitation.invitation_state as InvitationState | null,
+    roleSlug: supabaseInvitation.role_slug,
+    invitationToken: supabaseInvitation.invitation_token,
+    acceptInvitationUrl: supabaseInvitation.accept_invitation_url,
+    acceptedAt: supabaseInvitation.accepted_at,
+    revokedAt: supabaseInvitation.revoked_at,
+    expiresAt: supabaseInvitation.expires_at,
+    createdAt: supabaseInvitation.created_at,
+    updatedAt: supabaseInvitation.updated_at
+  }
+}