@elevasis/core 0.1.0

package/src/auth/multi-tenancy/memberships/__tests__/membership.test.ts

@@ -0,0 +1,227 @@
+import { describe, it, expect } from 'vitest'
+import { transformMembershipToTableRow } from '../membership'
+import type { MembershipWithDetails } from '../membership'
+
+describe('transformMembershipToTableRow', () => {
+  it('transforms complete membership with all user and org details', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_123',
+      userId: 'user_456',
+      organizationId: 'org_789',
+      role: { slug: 'admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-10T00:00:00Z',
+      user: {
+        id: 'user_456',
+        email: 'john@example.com',
+        firstName: 'John',
+        lastName: 'Doe',
+        profilePictureUrl: 'https://example.com/avatar.jpg'
+      },
+      organization: {
+        id: 'org_789',
+        name: 'Acme Corp',
+        workos_org_id: 'org_workos_123',
+        primaryDomain: 'acme.com'
+      }
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result).toEqual({
+      id: 'mem_123',
+      userId: 'user_456',
+      organizationId: 'org_789',
+      userEmail: 'john@example.com',
+      userFullName: 'John Doe',
+      organizationName: 'Acme Corp',
+      role: 'admin',
+      status: 'active',
+      statusBadge: 'active',
+      joinedAt: new Date('2025-01-01T00:00:00Z'),
+      updatedAt: new Date('2025-01-10T00:00:00Z'),
+      canEdit: true,
+      canRemove: true
+    })
+  })
+
+  it('handles missing user details with fallbacks', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_no_user',
+      userId: 'user_unknown',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.userEmail).toBe('Unknown')
+    expect(result.userFullName).toBe('Unknown User')
+  })
+
+  it('uses email as fallback when firstName or lastName missing', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_partial',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      user: {
+        id: 'user_123',
+        email: 'jane@example.com',
+        firstName: 'Jane'
+        // lastName missing
+      }
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.userFullName).toBe('jane@example.com')
+  })
+
+  it('handles missing organization details', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_no_org',
+      userId: 'user_123',
+      organizationId: 'org_unknown',
+      role: { slug: 'admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      user: {
+        id: 'user_123',
+        email: 'test@example.com'
+      }
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.organizationName).toBe('Unknown Organization')
+  })
+
+  it('converts date strings to Date objects', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_dates',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-15T10:30:00Z',
+      updatedAt: '2025-01-20T15:45:00Z'
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.joinedAt).toBeInstanceOf(Date)
+    expect(result.updatedAt).toBeInstanceOf(Date)
+    expect(result.joinedAt.toISOString()).toBe('2025-01-15T10:30:00.000Z')
+    expect(result.updatedAt.toISOString()).toBe('2025-01-20T15:45:00.000Z')
+  })
+
+  it('sets canEdit to true only for active memberships', () => {
+    const activeMembership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_active',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const inactiveMembership: MembershipWithDetails = {
+      ...activeMembership,
+      id: 'mem_inactive',
+      status: 'inactive'
+    }
+
+    expect(transformMembershipToTableRow(activeMembership).canEdit).toBe(true)
+    expect(transformMembershipToTableRow(inactiveMembership).canEdit).toBe(false)
+  })
+
+  it('always sets canRemove to true', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_remove',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'admin' },
+      status: 'inactive',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.canRemove).toBe(true)
+  })
+
+  it('preserves role slug exactly', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_role',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'custom-role-name' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.role).toBe('custom-role-name')
+  })
+
+  it('sets statusBadge same as status', () => {
+    const activeM: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_1',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const inactiveM: MembershipWithDetails = { ...activeM, id: 'mem_2', status: 'inactive' }
+
+    expect(transformMembershipToTableRow(activeM).statusBadge).toBe('active')
+    expect(transformMembershipToTableRow(inactiveM).statusBadge).toBe('inactive')
+  })
+
+  it('handles user with only email (no names)', () => {
+    const membership: MembershipWithDetails = {
+      object: 'organization_membership',
+      id: 'mem_email_only',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      user: {
+        id: 'user_123',
+        email: 'emailonly@example.com'
+      }
+    }
+
+    const result = transformMembershipToTableRow(membership)
+
+    expect(result.userEmail).toBe('emailonly@example.com')
+    expect(result.userFullName).toBe('emailonly@example.com')
+  })
+})

package/src/auth/multi-tenancy/memberships/__tests__/supabase-transforms.test.ts

@@ -0,0 +1,88 @@
+/**
+ * Supabase Transform Tests
+ * Tests transformSupabaseToMembership for pre-provisioned membership scenarios
+ */
+
+import { describe, it, expect } from 'vitest'
+import { transformSupabaseToMembership } from '../supabase'
+import type { SupabaseOrgMembership } from '../../../../supabase'
+
+describe('transformSupabaseToMembership', () => {
+  it('transforms membership with workos_membership_id (normal case)', () => {
+    const supabaseData: SupabaseOrgMembership = {
+      id: 'supabase-uuid-123',
+      user_id: 'user-uuid-456',
+      organization_id: 'org-uuid-789',
+      workos_membership_id: 'om_workos_abc',
+      membership_status: 'active',
+      role_slug: 'admin',
+      created_at: '2024-01-01T00:00:00Z',
+      updated_at: '2024-01-01T00:00:00Z'
+    }
+
+    const result = transformSupabaseToMembership(supabaseData)
+
+    expect(result.object).toBe('organization_membership')
+    expect(result.id).toBe('om_workos_abc')  // Uses WorkOS ID when available
+    expect(result.userId).toBe('user-uuid-456')  // Always Supabase user_id
+    expect(result.organizationId).toBe('org-uuid-789')  // Always Supabase org_id
+    expect(result.status).toBe('active')
+    expect(result.role.slug).toBe('admin')
+  })
+
+  it('transforms pre-provisioned membership with NULL workos_membership_id', () => {
+    const supabaseData: SupabaseOrgMembership = {
+      id: 'supabase-uuid-123',
+      user_id: 'user-uuid-456',
+      organization_id: 'org-uuid-789',
+      workos_membership_id: null,  // Pre-provisioned - not linked yet
+      membership_status: 'active',
+      role_slug: 'member',
+      created_at: '2024-01-01T00:00:00Z',
+      updated_at: '2024-01-01T00:00:00Z'
+    }
+
+    const result = transformSupabaseToMembership(supabaseData)
+
+    expect(result.object).toBe('organization_membership')
+    expect(result.id).toBe('supabase-uuid-123')  // Falls back to Supabase ID
+    expect(result.userId).toBe('user-uuid-456')  // CRITICAL: Must be user_id, not null
+    expect(result.organizationId).toBe('org-uuid-789')  // CRITICAL: Must be org_id, not null
+    expect(result.status).toBe('active')
+    expect(result.role.slug).toBe('member')
+  })
+
+  it('defaults role_slug to member when null', () => {
+    const supabaseData: SupabaseOrgMembership = {
+      id: 'supabase-uuid-123',
+      user_id: 'user-uuid-456',
+      organization_id: 'org-uuid-789',
+      workos_membership_id: null,
+      membership_status: 'active',
+      role_slug: null,
+      created_at: null,
+      updated_at: null
+    }
+
+    const result = transformSupabaseToMembership(supabaseData)
+
+    expect(result.role.slug).toBe('member')
+  })
+
+  it('maps inactive status correctly', () => {
+    const supabaseData: SupabaseOrgMembership = {
+      id: 'supabase-uuid-123',
+      user_id: 'user-uuid-456',
+      organization_id: 'org-uuid-789',
+      workos_membership_id: null,
+      membership_status: 'inactive',
+      role_slug: 'member',
+      created_at: null,
+      updated_at: null
+    }
+
+    const result = transformSupabaseToMembership(supabaseData)
+
+    expect(result.status).toBe('inactive')
+  })
+})

package/src/auth/multi-tenancy/memberships/__tests__/workos-transforms.test.ts

@@ -0,0 +1,139 @@
+import { describe, it, expect } from 'vitest'
+import { transformWorkOSMembership } from '../server/transforms'
+import type { WorkOSOrganizationMembership } from '../server/workos'
+
+describe('transformWorkOSMembership', () => {
+  it('transforms WorkOS membership with all fields', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_123',
+      userId: 'user_456',
+      organizationId: 'org_789',
+      role: { slug: 'admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-10T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result).toEqual({
+      object: 'organization_membership',
+      id: 'mem_123',
+      userId: 'user_456',
+      organizationId: 'org_789',
+      role: { slug: 'admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-10T00:00:00Z'
+    })
+  })
+
+  it('handles inactive status', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_inactive',
+      userId: 'user_123',
+      organizationId: 'org_456',
+      role: { slug: 'member' },
+      status: 'inactive',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-15T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result.status).toBe('inactive')
+    expect(result.id).toBe('mem_inactive')
+  })
+
+  it('maps pending status to inactive (pending not supported in our system)', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_pending',
+      userId: 'user_789',
+      organizationId: 'org_123',
+      role: { slug: 'guest' },
+      status: 'pending',
+      createdAt: '2025-01-20T00:00:00Z',
+      updatedAt: '2025-01-20T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    // WorkOS 'pending' is mapped to 'inactive' in our system
+    expect(result.status).toBe('inactive')
+    expect(result.role.slug).toBe('guest')
+  })
+
+  it('preserves role slug exactly', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_custom_role',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'custom-billing-admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result.role.slug).toBe('custom-billing-admin')
+  })
+
+  it('preserves all ID fields correctly', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_abc123',
+      userId: 'user_xyz789',
+      organizationId: 'org_def456',
+      role: { slug: 'owner' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-05T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result.id).toBe('mem_abc123')
+    expect(result.userId).toBe('user_xyz789')
+    expect(result.organizationId).toBe('org_def456')
+  })
+
+  it('preserves timestamps as ISO strings', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_dates',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'member' },
+      status: 'active',
+      createdAt: '2025-01-15T14:30:00.000Z',
+      updatedAt: '2025-01-20T18:45:30.000Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result.createdAt).toBe('2025-01-15T14:30:00.000Z')
+    expect(result.updatedAt).toBe('2025-01-20T18:45:30.000Z')
+  })
+
+  it('preserves object type', () => {
+    const workosData: WorkOSOrganizationMembership = {
+      object: 'organization_membership',
+      id: 'mem_obj',
+      userId: 'user_123',
+      organizationId: 'org_123',
+      role: { slug: 'admin' },
+      status: 'active',
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSMembership(workosData)
+
+    expect(result.object).toBe('organization_membership')
+  })
+})

package/src/auth/multi-tenancy/memberships/api-schemas.ts

@@ -0,0 +1,126 @@
+/**
+ * Memberships Domain - Zod Validation Schemas
+ *
+ * Validation schemas for membership management endpoints.
+ * Includes request bodies, query params, and path params.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - UUID validation prevents invalid references
+ * - Role enum validation prevents privilege escalation
+ * - organizationId never accepted in body (from JWT when needed)
+ */
+
+import { z } from 'zod'
+
+// ============================================================================
+// Shared Schemas
+// ============================================================================
+
+/**
+ * Membership role validation
+ * Restricts to valid role slugs only
+ *
+ * Security: Prevents privilege escalation by limiting role values
+ */
+export const MembershipRoleSchema = z.enum(['admin', 'member'])
+
+/**
+ * Membership status validation
+ * Note: Database constraint only allows 'active' | 'inactive'
+ */
+export const MembershipStatusSchema = z.enum(['active', 'inactive'])
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate membership ID in URL path
+ * Used by: GET/PUT/DELETE /memberships/:id
+ */
+export const MembershipIdParamSchema = z
+  .object({
+    id: z.string().min(1) // WorkOS membership IDs can be various formats
+  })
+  .strict()
+
+// ============================================================================
+// Request Bodies
+// ============================================================================
+
+/**
+ * Create new membership
+ * POST /memberships
+ *
+ * Security:
+ * - userId must be valid (string format for WorkOS)
+ * - organizationId must be valid (string format for WorkOS)
+ * - roleSlug enum prevents privilege escalation
+ * - Strict mode prevents injection
+ */
+export const CreateMembershipSchema = z
+  .object({
+    userId: z.string().min(1),
+    organizationId: z.string().min(1),
+    roleSlug: MembershipRoleSchema.default('member')
+  })
+  .strict()
+
+/**
+ * Update membership role
+ * PUT /memberships/:id
+ *
+ * Security:
+ * - Only roleSlug can be updated
+ * - Enum validation prevents privilege escalation
+ */
+export const UpdateMembershipSchema = z
+  .object({
+    roleSlug: MembershipRoleSchema
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters
+// ============================================================================
+
+/**
+ * List memberships with filters
+ * GET /memberships
+ *
+ * Filters:
+ * - userId: Filter by user
+ * - organizationId: Filter by organization
+ *
+ * Security:
+ * - Requires at least one filter parameter
+ * - String IDs validated for WorkOS format
+ */
+export const ListMembershipsQuerySchema = z
+  .object({
+    userId: z.string().optional(),
+    organizationId: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+    before: z.string().optional(), // WorkOS pagination cursor
+    after: z.string().optional()   // WorkOS pagination cursor
+  })
+  .strict()
+  .refine(
+    (data) => data.userId || data.organizationId,
+    {
+      message: 'Either userId or organizationId must be provided'
+    }
+  )
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type CreateMembershipInput = z.infer<typeof CreateMembershipSchema>
+export type UpdateMembershipInput = z.infer<typeof UpdateMembershipSchema>
+export type ListMembershipsQuery = z.infer<typeof ListMembershipsQuerySchema>
+export type MembershipIdParam = z.infer<typeof MembershipIdParamSchema>
+export type MembershipRole = z.infer<typeof MembershipRoleSchema>
+export type MembershipStatus = z.infer<typeof MembershipStatusSchema>

package/src/auth/multi-tenancy/memberships/index.ts

@@ -0,0 +1,22 @@
+/**
+ * Membership types - browser-safe exports only
+ * For WorkOS types and transforms, use @repo/core/server
+ */
+export * from './membership'
+export * from './supabase'
+
+// Validation schemas
+export {
+  CreateMembershipSchema,
+  UpdateMembershipSchema,
+  ListMembershipsQuerySchema,
+  MembershipIdParamSchema,
+  MembershipRoleSchema,
+  MembershipStatusSchema,
+  type CreateMembershipInput,
+  type UpdateMembershipInput,
+  type ListMembershipsQuery,
+  type MembershipIdParam,
+  type MembershipRole,
+  type MembershipStatus
+} from './api-schemas'