@elevasis/core 0.1.0

package/src/auth/multi-tenancy/organizations/server/transforms.ts

@@ -0,0 +1,35 @@
+import type { WorkOSOrganization } from './workos'
+import type { Organization } from '../organization'
+
+/**
+ * Transform WorkOS organization to our internal format
+ */
+export function transformWorkOSOrganization(
+  workosOrg: WorkOSOrganization
+): Organization {
+  const verifiedDomains = workosOrg.domains
+    .filter(d => d.state === 'verified' || d.state === 'legacy_verified')
+    .map(d => d.domain)
+
+  const pendingDomains = workosOrg.domains
+    .filter(d => d.state === 'pending')
+    .map(d => d.domain)
+
+  const allDomains = workosOrg.domains.map(d => d.domain)
+
+  return {
+    workosId: workosOrg.id,
+    name: workosOrg.name,
+    domains: allDomains,
+    createdAt: workosOrg.createdAt,
+    updatedAt: workosOrg.updatedAt,
+    stripeCustomerId: workosOrg.stripeCustomerId,
+    externalId: workosOrg.externalId,
+    workosMetadata: workosOrg.metadata,
+
+    // Derived fields
+    primaryDomain: verifiedDomains[0] || allDomains[0],
+    verifiedDomains,
+    pendingDomains
+  }
+}

package/src/auth/multi-tenancy/organizations/server/workos.ts

@@ -0,0 +1,20 @@
+/**
+ * WorkOS Organization API Types
+ * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
+ */
+
+import type {
+  Organization,
+  OrganizationDomain,
+  List,
+  ListOrganizationsOptions
+} from '@workos-inc/node'
+
+// Consistent naming convention for the monorepo
+export type WorkOSOrganization = Organization
+export type WorkOSOrganizationDomain = OrganizationDomain
+export type WorkOSOrganizationListResponse = List<Organization>
+export type ListWorkOSOrganizationsParams = ListOrganizationsOptions
+
+// For request types, import directly from SDK:
+// import type { CreateOrganizationOptions, UpdateOrganizationOptions } from '@workos-inc/node'

package/src/auth/multi-tenancy/types.ts

@@ -0,0 +1,89 @@
+/**
+ * Multi-tenancy configuration types
+ *
+ * Config is stored in dedicated `config` columns (NOT nested in metadata):
+ * - organizations.config: Org-level config (no feature toggles -- all features available by default)
+ * - org_memberships.config: Per-user-per-org feature overrides
+ * - users.config: User-global config
+ */
+
+/**
+ * Per-user-per-org config (stored in org_memberships.config)
+ * Controls which features a specific member can access within their org
+ * Valid feature keys: operations, monitoring, acquisition, calibration, seo
+ */
+export interface MembershipFeatureConfig {
+  features?: {
+    operations?: boolean
+    monitoring?: boolean
+    acquisition?: boolean
+    calibration?: boolean
+    seo?: boolean
+  }
+}
+
+/**
+ * User-global config (stored in users.config)
+ * Theme and onboarding are user-specific, NOT org-specific
+ */
+export interface UserConfig {
+  theme?: {
+    preset?:
+      | 'default'
+      | 'tactical'
+      | 'regal'
+      | 'cyber-volt'
+      | 'aurora'
+      | 'rose-gold'
+      | 'midnight'
+      | 'ember'
+      | 'obsidian'
+      | 'honey'
+      | 'abyss'
+      | 'canopy'
+      | 'slate'
+      | 'cyber-strike'
+      | 'cyber-chrome'
+      | 'cyber-void'
+      | 'nirvana'
+      | 'wave'
+      | 'synapse'
+      | 'cortex'
+      | 'helios'
+      | 'graphite'
+      | 'quarry'
+      | 'canyon'
+      | 'nord'
+      | 'catppuccin'
+      | 'tokyo-night'
+      | 'gruvbox'
+    colorScheme?: 'light' | 'dark' | 'auto'
+  }
+  onboarding?: {
+    completed?: boolean
+    completedAt?: string // ISO date
+    role?: string
+    primaryUseCase?: string[]
+    experienceLevel?: string
+    /** Onboarding guide system state (set by checklist/tour system) */
+    guides?: {
+      completedIds?: string[] // e.g. ["explore-dashboard", "view-workflow"]
+      dismissed?: boolean // user manually dismissed checklist
+      completedAt?: string // ISO date — all guides finished
+    }
+  }
+}
+
+/**
+ * OrgMetadata - Contains WorkOS sync data only
+ * Note: This is kept separate from config for clarity
+ */
+export interface OrgMetadata {
+  domains?: {
+    verified: string[]
+    pending: string[]
+    all: string[]
+  }
+  workos_created_at?: string
+  workos_updated_at?: string
+}

package/src/auth/multi-tenancy/users/__tests__/user.test.ts

@@ -0,0 +1,208 @@
+import { describe, it, expect } from 'vitest'
+import { transformWorkOSUser } from '../server/transforms'
+import type { WorkOSUser } from '../server/workos'
+
+describe('transformWorkOSUser', () => {
+  it('transforms complete WorkOS user with all fields', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_123',
+      email: 'john@example.com',
+      firstName: 'John',
+      lastName: 'Doe',
+      emailVerified: true,
+      profilePictureUrl: 'https://example.com/avatar.jpg',
+      lastSignInAt: '2025-01-15T10:30:00Z',
+      externalId: 'ext_user_123',
+      metadata: {
+        department: 'Engineering',
+        role: 'Senior Developer'
+      },
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-10T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result).toEqual({
+      id: 'user_123',
+      email: 'john@example.com',
+      firstName: 'John',
+      lastName: 'Doe',
+      emailVerified: true,
+      profilePictureUrl: 'https://example.com/avatar.jpg',
+      lastSignInAt: new Date('2025-01-15T10:30:00Z'),
+      externalId: 'ext_user_123',
+      metadata: {
+        department: 'Engineering',
+        role: 'Senior Developer'
+      },
+      createdAt: new Date('2025-01-01T00:00:00Z'),
+      updatedAt: new Date('2025-01-10T00:00:00Z')
+    })
+  })
+
+  it('handles null optional fields correctly', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_456',
+      email: 'jane@example.com',
+      firstName: null,
+      lastName: null,
+      emailVerified: false,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: {},
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.firstName).toBeNull()
+    expect(result.lastName).toBeNull()
+    expect(result.profilePictureUrl).toBeNull()
+    expect(result.lastSignInAt).toBeUndefined()
+    expect(result.externalId).toBeNull()
+    expect(result.metadata).toEqual({})
+  })
+
+  it('converts date strings to Date objects', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_date',
+      email: 'date@example.com',
+      firstName: 'Date',
+      lastName: 'Tester',
+      emailVerified: true,
+      profilePictureUrl: null,
+      lastSignInAt: '2025-01-20T15:45:30Z',
+      externalId: null,
+      metadata: {},
+      createdAt: '2025-01-01T08:00:00Z',
+      updatedAt: '2025-01-21T12:30:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.createdAt).toBeInstanceOf(Date)
+    expect(result.updatedAt).toBeInstanceOf(Date)
+    expect(result.lastSignInAt).toBeInstanceOf(Date)
+    expect(result.createdAt.toISOString()).toBe('2025-01-01T08:00:00.000Z')
+    expect(result.updatedAt.toISOString()).toBe('2025-01-21T12:30:00.000Z')
+    expect(result.lastSignInAt!.toISOString()).toBe('2025-01-20T15:45:30.000Z')
+  })
+
+  it('handles undefined lastSignInAt', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_no_signin',
+      email: 'new@example.com',
+      firstName: 'New',
+      lastName: 'User',
+      emailVerified: false,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: {},
+      createdAt: '2025-01-22T00:00:00Z',
+      updatedAt: '2025-01-22T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.lastSignInAt).toBeUndefined()
+  })
+
+  it('handles undefined metadata by using empty object', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_no_meta',
+      email: 'nometa@example.com',
+      firstName: 'No',
+      lastName: 'Meta',
+      emailVerified: true,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: undefined as unknown, // Simulating missing metadata
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.metadata).toEqual({})
+  })
+
+  it('preserves complex metadata structures', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_complex',
+      email: 'complex@example.com',
+      firstName: 'Complex',
+      lastName: 'User',
+      emailVerified: true,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: {
+        preferences: {
+          theme: 'dark',
+          notifications: true
+        },
+        permissions: ['read', 'write'],
+        lastActivity: '2025-01-20T00:00:00Z'
+      },
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.metadata).toEqual({
+      preferences: {
+        theme: 'dark',
+        notifications: true
+      },
+      permissions: ['read', 'write'],
+      lastActivity: '2025-01-20T00:00:00Z'
+    })
+  })
+
+  it('handles unverified email correctly', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_unverified',
+      email: 'unverified@example.com',
+      firstName: 'Unverified',
+      lastName: 'Email',
+      emailVerified: false,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: {},
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    expect(result.emailVerified).toBe(false)
+  })
+
+  it('preserves exact email address', () => {
+    const workosUser: WorkOSUser = {
+      id: 'user_email',
+      email: 'Test.User+tag@Example.COM',
+      firstName: 'Test',
+      lastName: 'User',
+      emailVerified: true,
+      profilePictureUrl: null,
+      lastSignInAt: undefined,
+      externalId: null,
+      metadata: {},
+      createdAt: '2025-01-01T00:00:00Z',
+      updatedAt: '2025-01-01T00:00:00Z'
+    }
+
+    const result = transformWorkOSUser(workosUser)
+
+    // Should preserve exact casing and format
+    expect(result.email).toBe('Test.User+tag@Example.COM')
+  })
+})

package/src/auth/multi-tenancy/users/api-schemas.ts

@@ -0,0 +1,194 @@
+/**
+ * Users Domain - Zod Validation Schemas
+ *
+ * Validation schemas for user management endpoints.
+ * Includes request bodies, query params, and path params.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - UUID validation prevents invalid references
+ * - Email validation prevents email injection attacks
+ * - emailVerified field excluded from create/update (admin-only)
+ * - String length limits prevent DoS
+ */
+
+import { z } from 'zod'
+import { EmailSchema, createStringSchema } from '../../../platform/utils/validation'
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate user ID in URL path
+ * Used by: GET/PUT/DELETE /users/:id
+ */
+export const UserIdParamSchema = z
+  .object({
+    id: z.string().min(1) // WorkOS user IDs can be UUID or 'user_' prefixed strings
+  })
+  .strict()
+
+/**
+ * Validate external ID in URL path
+ * Used by: GET /users/external/:externalId
+ */
+export const ExternalIdParamSchema = z
+  .object({
+    externalId: z.string().min(1)
+  })
+  .strict()
+
+// ============================================================================
+// Request Bodies
+// ============================================================================
+
+/**
+ * Update user profile
+ * PUT /users/:id
+ *
+ * Security:
+ * - All fields optional (partial update)
+ * - Email format validated
+ * - emailVerified NOT accepted (managed by WorkOS only)
+ * - Strict mode prevents unknown field injection
+ */
+export const UpdateUserSchema = z
+  .object({
+    email: EmailSchema.optional(),
+    firstName: createStringSchema(1, 100, 'First name').optional(),
+    lastName: createStringSchema(1, 100, 'Last name').optional()
+  })
+  .strict()
+
+// ============================================================================
+// Self-Service Profile
+// ============================================================================
+
+/**
+ * Self-service profile update (subset of admin UpdateUserSchema)
+ * PATCH /users/me
+ *
+ * Security:
+ * - All fields optional (partial update)
+ * - Server identifies user from JWT (no user ID in body)
+ * - Config restricted to theme and onboarding only
+ * - Strict mode prevents unknown field injection
+ */
+export const UpdateMyProfileSchema = z
+  .object({
+    firstName: createStringSchema(1, 100, 'First name').optional(),
+    lastName: createStringSchema(1, 100, 'Last name').optional(),
+    profilePictureUrl: z
+      .string()
+      .url()
+      .refine((url) => url.startsWith('https://'), { message: 'Only HTTPS URLs are allowed' })
+      .optional(),
+    lastVisitedOrg: z.string().uuid().optional(),
+    config: z
+      .object({
+        theme: z
+          .object({
+            // `.catch('default')` makes the write path tolerant of stale/unknown preset strings.
+            // Any value that fails enum validation silently coerces to 'default' instead of 400ing.
+            // This protects against preset renames (e.g. cyber-punk → cyber-chrome) and drift between
+            // the enum and legacy DB values. Paired with a read-path sync-back in main.tsx that
+            // persists the corrected value back to DB on next profile load.
+            preset: z
+              .enum([
+                'default',
+                'tactical',
+                'regal',
+                'cyber-volt',
+                'aurora',
+                'rose-gold',
+                'midnight',
+                'ember',
+                'obsidian',
+                'honey',
+                'abyss',
+                'canopy',
+                'slate',
+                'cyber-strike',
+                'cyber-chrome',
+                'cyber-void',
+                'nirvana',
+                'wave',
+                'synapse',
+                'cortex',
+                'helios',
+                'graphite',
+                'quarry',
+                'canyon',
+                'nord',
+                'catppuccin',
+                'tokyo-night',
+                'gruvbox'
+              ])
+              .catch('default')
+              .optional(),
+            colorScheme: z.enum(['light', 'dark', 'auto']).catch('auto').optional()
+          })
+          .strict()
+          .optional(),
+        onboarding: z
+          .object({
+            completed: z.boolean().optional(),
+            completedAt: z.string().datetime().nullable().optional(),
+            role: z.string().max(100).nullable().optional(),
+            primaryUseCase: z.array(z.string().max(100)).max(10).nullable().optional(),
+            experienceLevel: z.string().max(100).nullable().optional(),
+            guides: z
+              .object({
+                completedIds: z.array(z.string().max(100)).max(20).optional(),
+                dismissed: z.boolean().optional(),
+                completedAt: z.string().datetime().nullable().optional()
+              })
+              .strict()
+              .optional()
+          })
+          .strict()
+          .optional()
+      })
+      .strict()
+      .optional()
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters
+// ============================================================================
+
+/**
+ * List users with filters
+ * GET /users
+ *
+ * Filters:
+ * - email: Filter by email
+ * - organizationId: Filter by organization
+ * - limit: Max results (pagination handled by WorkOS)
+ *
+ * Security:
+ * - Email validated (prevents injection)
+ * - organizationId validated (UUID format)
+ */
+export const ListUsersQuerySchema = z
+  .object({
+    email: EmailSchema.optional(),
+    organizationId: z.string().optional(), // WorkOS org IDs can be UUID or 'org_' prefixed
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+    before: z.string().optional(), // WorkOS pagination cursor
+    after: z.string().optional() // WorkOS pagination cursor
+  })
+  .strict()
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type UpdateUserInput = z.infer<typeof UpdateUserSchema>
+export type UpdateMyProfileInput = z.infer<typeof UpdateMyProfileSchema>
+export type ListUsersQuery = z.infer<typeof ListUsersQuerySchema>
+export type UserIdParam = z.infer<typeof UserIdParamSchema>
+export type ExternalIdParam = z.infer<typeof ExternalIdParamSchema>

package/src/auth/multi-tenancy/users/index.ts

@@ -0,0 +1,28 @@
+/**
+ * User types - browser-safe exports only
+ * For WorkOS types and transforms, use @repo/core/server
+ */
+
+// Internal user types (browser-safe)
+export type {
+  User,
+  UserSummary,
+  CreateUserRequest,
+  UpdateUserRequest,
+  ListUsersParams,
+  ListUsersResponse
+} from './user'
+
+// User validation schemas (moved from identity/users/)
+export {
+  UpdateUserSchema,
+  UpdateMyProfileSchema,
+  ListUsersQuerySchema,
+  UserIdParamSchema,
+  ExternalIdParamSchema,
+  type UpdateUserInput,
+  type UpdateMyProfileInput,
+  type ListUsersQuery,
+  type UserIdParam,
+  type ExternalIdParam
+} from './api-schemas'

package/src/auth/multi-tenancy/users/server/index.ts

@@ -0,0 +1,19 @@
+/**
+ * Users server-only exports
+ * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
+ */
+export * from './workos'
+export * from './transforms'
+
+// Re-export browser-safe types for convenience
+export type {
+  User,
+  UserSummary,
+  CreateUserRequest,
+  UpdateUserRequest,
+  ListUsersParams,
+  ListUsersResponse
+} from '../user'
+
+// Re-export Supabase types (if needed in the future)
+// Currently no Supabase-specific user types beyond Database['public']['Tables']['users']

package/src/auth/multi-tenancy/users/server/transforms.ts

@@ -0,0 +1,21 @@
+import type { WorkOSUser } from './workos'
+import type { User } from '../user'
+
+/**
+ * Transform WorkOS User to internal User format
+ */
+export function transformWorkOSUser(workosUser: WorkOSUser): User {
+  return {
+    id: workosUser.id,
+    email: workosUser.email,
+    firstName: workosUser.firstName,
+    lastName: workosUser.lastName,
+    emailVerified: workosUser.emailVerified,
+    profilePictureUrl: workosUser.profilePictureUrl,
+    lastSignInAt: workosUser.lastSignInAt ? new Date(workosUser.lastSignInAt) : undefined,
+    externalId: workosUser.externalId,
+    metadata: workosUser.metadata || {},
+    createdAt: new Date(workosUser.createdAt),
+    updatedAt: new Date(workosUser.updatedAt)
+  }
+}

package/src/auth/multi-tenancy/users/server/workos.ts

@@ -0,0 +1,16 @@
+/**
+ * WorkOS User Management API Types
+ * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
+ */
+
+import type { User, List, ListUsersOptions, CreateUserOptions, UpdateUserOptions } from '@workos-inc/node'
+
+// Consistent naming convention for the monorepo
+export type WorkOSUser = User
+export type WorkOSUserListResponse = List<User>
+export type ListWorkOSUsersParams = ListUsersOptions
+export type CreateWorkOSUserRequest = CreateUserOptions
+export type UpdateWorkOSUserRequest = UpdateUserOptions
+
+// For additional request types, import directly from SDK:
+// import type { AuthenticateWithPasswordOptions, AuthenticateWithCodeOptions } from '@workos-inc/node'

package/src/auth/multi-tenancy/users/user.ts

@@ -0,0 +1,65 @@
+/**
+ * Internal User types - normalized from WorkOS API
+ */
+
+export interface User {
+  id: string
+  email: string
+  firstName: string | null
+  lastName: string | null
+  emailVerified: boolean
+  profilePictureUrl: string | null
+  lastSignInAt?: Date
+  externalId: string | null
+  metadata: Record<string, unknown>
+  createdAt: Date
+  updatedAt: Date
+}
+
+export interface UserSummary {
+  totalUsers: number
+  verifiedUsers: number
+  unverifiedUsers: number
+  recentSignIns: number
+}
+
+/**
+ * Request/Response types for internal API
+ */
+
+export interface CreateUserRequest {
+  email: string
+  password?: string
+  firstName?: string
+  lastName?: string
+  emailVerified?: boolean
+  externalId?: string
+  metadata?: Record<string, unknown>
+}
+
+export interface UpdateUserRequest {
+  firstName?: string
+  lastName?: string
+  email?: string
+  emailVerified?: boolean
+  password?: string
+  externalId?: string
+  metadata?: Record<string, unknown>
+}
+
+export interface ListUsersParams {
+  email?: string
+  organizationId?: string
+  limit?: number
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+export interface ListUsersResponse {
+  data: User[]
+  listMetadata: {
+    before?: string
+    after?: string
+  }
+}