@elevasis/core 0.1.0

package/src/auth/multi-tenancy/memberships/membership.ts

@@ -0,0 +1,138 @@
+import type { MembershipFeatureConfig } from '../types'
+import { type MembershipStatus } from './api-schemas.js'
+
+export type { MembershipStatus }
+
+/**
+ * Organization Membership types based on WorkOS API
+ */
+
+export interface OrganizationMembership {
+  object: 'organization_membership'
+  id: string
+  userId: string
+  organizationId: string
+  role: {
+    slug: string
+  }
+  status: 'active' | 'inactive'
+  createdAt: string
+  updatedAt: string
+}
+
+/**
+ * Request interfaces for membership operations
+ */
+export interface CreateMembershipRequest {
+  userId: string
+  organizationId: string
+  roleSlug?: string
+}
+
+export interface UpdateMembershipRequest {
+  roleSlug: string
+}
+
+export interface ListMembershipsParams {
+  userId?: string
+  organizationId?: string
+  statuses?: MembershipStatus[]
+  limit?: number
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+/**
+ * Response interfaces
+ */
+export interface ListMembershipsResponse {
+  data: OrganizationMembership[]
+  listMetadata?: {
+    before?: string | null
+    after?: string | null
+  }
+}
+
+/**
+ * Extended membership with user and organization details for UI
+ */
+export interface MembershipWithDetails extends OrganizationMembership {
+  user?: {
+    id: string
+    email: string
+    firstName?: string
+    lastName?: string
+    profilePictureUrl?: string
+  }
+  organization?: {
+    id: string
+    name: string
+    workos_org_id: string
+    primaryDomain?: string
+    is_test?: boolean
+    status?: string
+    metadata?: Record<string, unknown>
+    config?: Record<string, unknown>
+  }
+  config?: MembershipFeatureConfig
+}
+
+/**
+ * UI-specific membership table row data
+ */
+export interface MembershipTableRow {
+  id: string
+  userId: string
+  organizationId: string
+  userEmail: string
+  userFullName: string
+  organizationName: string
+  role: string
+  status: MembershipStatus
+  statusBadge: 'active' | 'inactive'
+  joinedAt: Date
+  updatedAt: Date
+  canEdit: boolean
+  canRemove: boolean
+}
+
+/**
+ * Transform membership to table row format
+ */
+export function transformMembershipToTableRow(membership: MembershipWithDetails): MembershipTableRow {
+  return {
+    id: membership.id,
+    userId: membership.userId,
+    organizationId: membership.organizationId,
+    userEmail: membership.user?.email || 'Unknown',
+    userFullName:
+      membership.user?.firstName && membership.user?.lastName
+        ? `${membership.user.firstName} ${membership.user.lastName}`
+        : membership.user?.email || 'Unknown User',
+    organizationName: membership.organization?.name || 'Unknown Organization',
+    role: membership.role.slug,
+    status: membership.status,
+    statusBadge: membership.status,
+    joinedAt: new Date(membership.createdAt),
+    updatedAt: new Date(membership.updatedAt),
+    canEdit: membership.status === 'active',
+    canRemove: true
+  }
+}
+
+/**
+ * Membership status color mapping for UI
+ */
+export const MEMBERSHIP_STATUS_COLORS = {
+  active: 'green',
+  inactive: 'gray'
+} as const
+
+/**
+ * Membership role options (can be extended)
+ */
+export const DEFAULT_MEMBERSHIP_ROLES = [
+  { value: 'admin', label: 'Admin' },
+  { value: 'member', label: 'Member' }
+] as const

package/src/auth/multi-tenancy/memberships/server/index.ts

@@ -0,0 +1,15 @@
+/**
+ * Memberships server-only exports
+ * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
+ */
+export * from './workos'
+export * from './transforms'
+
+// Re-export browser-safe types for convenience
+export type { OrganizationMembership, MembershipWithDetails } from '../membership'
+export type {
+  SupabaseOrgMembership,
+  SupabaseOrgMembershipInsert,
+  SupabaseOrgMembershipUpdate
+} from '../supabase'
+export type { SupabaseMembershipWithOrganization } from '../../../../supabase'

package/src/auth/multi-tenancy/memberships/server/transforms.ts

@@ -0,0 +1,32 @@
+import type { WorkOSOrganizationMembership } from './workos'
+import type { OrganizationMembership, MembershipStatus } from '../membership'
+
+/**
+ * Map WorkOS status to internal status.
+ * WorkOS may return 'pending' but our system only uses 'active' | 'inactive'.
+ * Pending memberships from WorkOS are treated as inactive until fully provisioned.
+ */
+function mapWorkOSStatus(workosStatus: string): MembershipStatus {
+  if (workosStatus === 'active') return 'active'
+  return 'inactive'
+}
+
+/**
+ * Transform WorkOS membership to internal format
+ */
+export function transformWorkOSMembership(
+  workosData: WorkOSOrganizationMembership
+): OrganizationMembership {
+  return {
+    object: 'organization_membership',
+    id: workosData.id,
+    userId: workosData.userId,
+    organizationId: workosData.organizationId,
+    role: {
+      slug: workosData.role.slug
+    },
+    status: mapWorkOSStatus(workosData.status),
+    createdAt: workosData.createdAt,
+    updatedAt: workosData.updatedAt
+  }
+}

package/src/auth/multi-tenancy/memberships/server/workos.ts

@@ -0,0 +1,21 @@
+/**
+ * WorkOS User Management Membership API Types
+ * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
+ */
+
+import type {
+  OrganizationMembership,
+  OrganizationMembershipStatus,
+  CreateOrganizationMembershipOptions,
+  UpdateOrganizationMembershipOptions,
+  ListOrganizationMembershipsOptions,
+  List
+} from '@workos-inc/node'
+
+// Consistent naming convention for the monorepo
+export type WorkOSOrganizationMembership = OrganizationMembership
+export type WorkOSOrganizationMembershipStatus = OrganizationMembershipStatus
+export type WorkOSMembershipListResponse = List<OrganizationMembership>
+export type CreateWorkOSMembershipRequest = CreateOrganizationMembershipOptions
+export type UpdateWorkOSMembershipRequest = UpdateOrganizationMembershipOptions
+export type ListWorkOSMembershipsParams = ListOrganizationMembershipsOptions

package/src/auth/multi-tenancy/memberships/supabase.ts

@@ -0,0 +1,46 @@
+// Use generated Supabase types from packages/core/src/types/supabase/database.types.ts
+import type { TablesInsert, TablesUpdate } from '../../../supabase/database.types'
+import type { OrganizationMembership } from './membership'
+import type { SupabaseOrgMembership } from '../../../supabase'
+
+// Re-export from centralized location for backward compatibility
+export type { SupabaseOrgMembership } from '../../../supabase'
+
+// Supabase org_memberships table types (auto-generated)
+export type SupabaseOrgMembershipInsert = TablesInsert<'org_memberships'>
+export type SupabaseOrgMembershipUpdate = TablesUpdate<'org_memberships'>
+
+// Available fields from generated types:
+// {
+//   id: string
+//   user_id: string
+//   organization_id: string
+//   workos_membership_id: string
+//   membership_status: string | null (default: 'active')
+//   role_slug: string | null (default: 'member')
+//   created_at: string | null
+//   updated_at: string | null
+// }
+
+/**
+ * Map Supabase status to internal status.
+ * Database constraint only allows 'active' | 'inactive'.
+ */
+function mapSupabaseStatus(status: string | null): 'active' | 'inactive' {
+  if (status === 'active') return 'active'
+  return 'inactive'
+}
+
+// Transform Supabase to internal format
+export function transformSupabaseToMembership(supabaseData: SupabaseOrgMembership): OrganizationMembership {
+  return {
+    object: 'organization_membership',
+    id: supabaseData.workos_membership_id ?? supabaseData.id,
+    userId: supabaseData.user_id,  // Always use Supabase user_id
+    organizationId: supabaseData.organization_id,  // Always use Supabase organization_id
+    role: { slug: supabaseData.role_slug || 'member' },
+    status: mapSupabaseStatus(supabaseData.membership_status),
+    createdAt: supabaseData.created_at || new Date().toISOString(),
+    updatedAt: supabaseData.updated_at || new Date().toISOString()
+  }
+}

package/src/auth/multi-tenancy/organizations/__tests__/organization.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect } from 'vitest'
+import { transformWorkOSOrganization } from '../server/transforms'
+import type { WorkOSOrganization } from '../server/workos'
+
+describe('transformWorkOSOrganization', () => {
+  it('transforms WorkOS organization with verified domains', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_123',
+      name: 'Acme Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-02T00:00:00Z',
+      stripeCustomerId: 'cus_123',
+      externalId: 'ext_123',
+      metadata: { foo: 'bar' },
+      domains: [
+        {
+          id: 'domain_1',
+          domain: 'acme.com',
+          state: 'verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token1'
+        },
+        {
+          id: 'domain_2',
+          domain: 'acme.io',
+          state: 'verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token2'
+        }
+      ]
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result).toEqual({
+      workosId: 'org_123',
+      name: 'Acme Corp',
+      domains: ['acme.com', 'acme.io'],
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-02T00:00:00Z',
+      stripeCustomerId: 'cus_123',
+      externalId: 'ext_123',
+      workosMetadata: { foo: 'bar' },
+      primaryDomain: 'acme.com',
+      verifiedDomains: ['acme.com', 'acme.io'],
+      pendingDomains: []
+    })
+  })
+
+  it('transforms organization with pending domains', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_456',
+      name: 'Beta Inc',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: [
+        {
+          id: 'domain_1',
+          domain: 'beta.com',
+          state: 'pending',
+          verificationStrategy: 'dns',
+          verificationToken: 'token1'
+        }
+      ]
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.verifiedDomains).toEqual([])
+    expect(result.pendingDomains).toEqual(['beta.com'])
+    expect(result.primaryDomain).toBe('beta.com') // Falls back to first domain
+  })
+
+  it('handles legacy_verified domain state', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_789',
+      name: 'Legacy Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: [
+        {
+          id: 'domain_1',
+          domain: 'legacy.com',
+          state: 'legacy_verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token1'
+        }
+      ]
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.verifiedDomains).toEqual(['legacy.com'])
+    expect(result.primaryDomain).toBe('legacy.com')
+  })
+
+  it('handles mixed verified and pending domains', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_mixed',
+      name: 'Mixed Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: [
+        {
+          id: 'domain_1',
+          domain: 'verified.com',
+          state: 'verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token1'
+        },
+        {
+          id: 'domain_2',
+          domain: 'pending.com',
+          state: 'pending',
+          verificationStrategy: 'dns',
+          verificationToken: 'token2'
+        },
+        {
+          id: 'domain_3',
+          domain: 'legacy.com',
+          state: 'legacy_verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token3'
+        }
+      ]
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.domains).toEqual(['verified.com', 'pending.com', 'legacy.com'])
+    expect(result.verifiedDomains).toEqual(['verified.com', 'legacy.com'])
+    expect(result.pendingDomains).toEqual(['pending.com'])
+    expect(result.primaryDomain).toBe('verified.com') // First verified domain
+  })
+
+  it('handles organization with no domains', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_empty',
+      name: 'Empty Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: []
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.domains).toEqual([])
+    expect(result.verifiedDomains).toEqual([])
+    expect(result.pendingDomains).toEqual([])
+    expect(result.primaryDomain).toBeUndefined()
+  })
+
+  it('preserves all WorkOS metadata', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_meta',
+      name: 'Metadata Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: 'cus_stripe',
+      externalId: 'external_id_123',
+      metadata: {
+        customField1: 'value1',
+        customField2: 'value2',
+        tier: 'enterprise'
+      },
+      domains: []
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.workosMetadata).toEqual({
+      customField1: 'value1',
+      customField2: 'value2',
+      tier: 'enterprise'
+    })
+    expect(result.stripeCustomerId).toBe('cus_stripe')
+    expect(result.externalId).toBe('external_id_123')
+  })
+
+  it('handles null externalId correctly', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_null',
+      name: 'Null External',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: []
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    expect(result.externalId).toBeNull()
+  })
+
+  it('prioritizes verified domains over pending for primaryDomain', () => {
+    const workosOrg: WorkOSOrganization = {
+      id: 'org_priority',
+      name: 'Priority Corp',
+      allowProfilesOutsideOrganization: false,
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z',
+      stripeCustomerId: undefined,
+      externalId: null,
+      metadata: {},
+      domains: [
+        {
+          id: 'domain_1',
+          domain: 'pending-first.com',
+          state: 'pending',
+          verificationStrategy: 'dns',
+          verificationToken: 'token1'
+        },
+        {
+          id: 'domain_2',
+          domain: 'verified-second.com',
+          state: 'verified',
+          verificationStrategy: 'dns',
+          verificationToken: 'token2'
+        }
+      ]
+    }
+
+    const result = transformWorkOSOrganization(workosOrg)
+
+    // Should use verified domain as primary, not the first domain in array
+    expect(result.primaryDomain).toBe('verified-second.com')
+  })
+})

package/src/auth/multi-tenancy/organizations/api-schemas.ts

@@ -0,0 +1,128 @@
+/**
+ * Organizations Domain - Zod Validation Schemas
+ *
+ * Validation schemas for organization management endpoints.
+ * Includes request bodies, query params, and path params.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - UUID/WorkOS ID validation prevents invalid references
+ * - String length limits prevent DoS
+ * - Domain and metadata size limits
+ */
+
+import { z } from 'zod'
+import { UuidSchema } from '../../../platform/utils/validation'
+
+// ============================================================================
+// Shared Schemas
+// ============================================================================
+
+/**
+ * Organization name validation
+ * - Alphanumeric, spaces, hyphens, underscores only
+ * - 2-100 characters
+ *
+ * Security: Prevents injection, DoS via long names
+ */
+export const OrganizationNameSchema = z.string()
+  .min(2, 'Organization name must be at least 2 characters')
+  .max(100, 'Organization name must be at most 100 characters')
+  .trim()
+  .regex(/^[a-zA-Z0-9\s\-_]+$/, 'Organization name must contain only letters, numbers, spaces, hyphens, and underscores')
+
+/**
+ * Organization ID validation
+ * Supports both UUID and WorkOS org_ prefixed IDs
+ */
+export const OrganizationIdSchema = z.union([
+  UuidSchema,
+  z.string().regex(/^org_[a-zA-Z0-9]+$/, 'Invalid WorkOS organization ID')
+])
+
+/**
+ * Organization domain data schema
+ */
+export const OrganizationDomainSchema = z.object({
+  domain: z.string().min(3).max(255),
+  state: z.enum(['verified', 'pending', 'failed']).optional()
+})
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate organization ID in URL path
+ * Used by: GET/PUT/DELETE /organizations/:id
+ */
+export const OrganizationIdParamSchema = z
+  .object({
+    id: OrganizationIdSchema
+  })
+  .strict()
+
+// ============================================================================
+// Request Bodies
+// ============================================================================
+
+/**
+ * Create new organization
+ * POST /organizations
+ *
+ * Security:
+ * - Name format validated (alphanumeric + spaces + hyphens + underscores)
+ * - Domain array size limited (max 10)
+ * - Metadata size limited (10KB)
+ * - Strict mode prevents unknown field injection
+ */
+export const CreateOrganizationSchema = z
+  .object({
+    name: OrganizationNameSchema,
+    domainData: z.array(OrganizationDomainSchema).max(10).optional(),
+    metadata: z.record(z.string(), z.unknown())
+      .refine(
+        val => JSON.stringify(val).length <= 10240,
+        'Metadata must be under 10KB'
+      )
+      .optional()
+  })
+  .strict()
+
+/**
+ * Update organization
+ * PUT /organizations/:id
+ *
+ * Security:
+ * - All fields optional (partial update)
+ * - Same validation as create
+ */
+export const UpdateOrganizationSchema = CreateOrganizationSchema.partial().strict()
+
+// ============================================================================
+// Query Parameters
+// ============================================================================
+
+/**
+ * List organizations with filters
+ * GET /organizations
+ *
+ * Security:
+ * - Limit bounded (prevents DoS)
+ * - WorkOS pagination cursors
+ */
+export const ListOrganizationsQuerySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(20),
+  before: z.string().optional(), // WorkOS pagination cursor
+  after: z.string().optional()   // WorkOS pagination cursor
+})
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type CreateOrganizationInput = z.infer<typeof CreateOrganizationSchema>
+export type UpdateOrganizationInput = z.infer<typeof UpdateOrganizationSchema>
+export type ListOrganizationsQuery = z.infer<typeof ListOrganizationsQuerySchema>
+export type OrganizationIdParam = z.infer<typeof OrganizationIdParamSchema>

package/src/auth/multi-tenancy/organizations/index.ts

@@ -0,0 +1,23 @@
+/**
+ * Organization types - browser-safe exports only
+ * For WorkOS types and transforms, use @repo/core/server
+ */
+
+// Core organization types (browser-safe)
+export type { Organization, OrganizationSummary } from './organization'
+
+// Validation schemas
+export {
+  CreateOrganizationSchema,
+  UpdateOrganizationSchema,
+  ListOrganizationsQuerySchema,
+  OrganizationIdParamSchema,
+  OrganizationNameSchema,
+  OrganizationDomainSchema,
+  type CreateOrganizationInput,
+  type UpdateOrganizationInput,
+  type ListOrganizationsQuery,
+  type OrganizationIdParam
+} from './api-schemas'
+
+// Note: WorkOS types and transforms available via @repo/core/server

package/src/auth/multi-tenancy/organizations/organization.ts

@@ -0,0 +1,25 @@
+/**
+ * Organization representation using WorkOS data only
+ */
+export interface Organization {
+  // WorkOS Organization Data
+  workosId: string
+  name: string
+  domains: string[]
+  createdAt: string
+  updatedAt: string
+  stripeCustomerId?: string
+  externalId: string | null
+  workosMetadata: Record<string, string>
+
+  // Calculated/Derived Fields
+  primaryDomain?: string
+  verifiedDomains: string[]
+  pendingDomains: string[]
+}
+
+export interface OrganizationSummary {
+  totalOrganizations: number
+  verifiedOrganizations: number
+  pendingOrganizations: number
+}

package/src/auth/multi-tenancy/organizations/server/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Organizations server-only exports
+ * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
+ */
+export * from './workos'
+export * from './transforms'
+
+// Re-export browser-safe types for convenience
+export type { Organization, OrganizationSummary } from '../organization'
+export type { SupabaseOrganization, SupabaseOrganizationInsert, SupabaseOrganizationUpdate } from '../../../../supabase'