@elevasis/core 0.7.1 → 0.8.0

package/src/auth/multi-tenancy/invitations/api-schemas.ts

@@ -1,107 +1,107 @@
-/**
- * Invitations Domain - Zod Validation Schemas
- *
- * Validation schemas for invitation management endpoints.
- * Includes request bodies, query params, and path params.
- *
- * Security:
- * - All schemas use .strict() to prevent mass assignment attacks
- * - Email validation prevents header injection
- * - Role enum validation prevents privilege escalation
- * - organizationId from JWT (not accepted in body for protected routes)
- */
-
-import { z } from 'zod'
-import { EmailSchema } from '../../../platform/utils/validation'
-import { MembershipRoleSchema } from '../memberships/api-schemas'
-
-// ============================================================================
-// Path Parameters
-// ============================================================================
-
-/**
- * Validate invitation ID in URL path
- * Used by: GET/DELETE /invitations/:id
- */
-export const InvitationIdParamSchema = z
-  .object({
-    id: z.string().min(1) // WorkOS invitation IDs
-  })
-  .strict()
-
-// ============================================================================
-// Request Bodies
-// ============================================================================
-
-/**
- * Send new invitation
- * POST /invitations
- *
- * Security:
- * - Email format validated (prevents header injection)
- * - Role enum prevents privilege escalation
- * - expiresInDays bounded (1-90 days)
- * - organizationId NOT in body (from JWT via requireOrganization middleware)
- */
-export const SendInvitationSchema = z
-  .object({
-    email: EmailSchema,
-    organizationId: z.string().optional(), // For WorkOS API - but typically from JWT
-    roleSlug: MembershipRoleSchema.default('member'),
-    expiresInDays: z.number().int().min(1).max(90).default(7)
-  })
-  .strict()
-
-/**
- * Accept invitation by token
- * POST /invitations/accept
- *
- * Security:
- * - Token validated (non-empty string)
- */
-export const AcceptInvitationSchema = z
-  .object({
-    invitation_token: z.string().min(1, 'Invitation token is required')
-  })
-  .strict()
-
-// ============================================================================
-// Query Parameters
-// ============================================================================
-
-/**
- * List invitations with filters
- * GET /invitations
- *
- * Filters:
- * - organizationId: Filter by organization
- * - email: Filter by email
- *
- * Security:
- * - Requires organizationId or userId filter
- * - Email validated
- */
-export const ListInvitationsQuerySchema = z
-  .object({
-    organizationId: z.string().optional(),
-    userId: z.string().optional(),
-    email: EmailSchema.optional(),
-    limit: z.coerce.number().int().min(1).max(100).optional(),
-    before: z.string().optional(), // WorkOS pagination cursor
-    after: z.string().optional()   // WorkOS pagination cursor
-  })
-  .strict()
-  .refine(
-    (data) => data.organizationId || data.userId,
-    { message: 'Either organizationId or userId must be provided' }
-  )
-
-// ============================================================================
-// TypeScript Type Exports
-// ============================================================================
-
-// Export inferred types for use in route handlers
-export type SendInvitationInput = z.infer<typeof SendInvitationSchema>
-export type AcceptInvitationInput = z.infer<typeof AcceptInvitationSchema>
-export type ListInvitationsQuery = z.infer<typeof ListInvitationsQuerySchema>
-export type InvitationIdParam = z.infer<typeof InvitationIdParamSchema>
+/**
+ * Invitations Domain - Zod Validation Schemas
+ *
+ * Validation schemas for invitation management endpoints.
+ * Includes request bodies, query params, and path params.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - Email validation prevents header injection
+ * - Role enum validation prevents privilege escalation
+ * - organizationId from JWT (not accepted in body for protected routes)
+ */
+
+import { z } from 'zod'
+import { EmailSchema } from '../../../platform/utils/validation'
+import { MembershipRoleSchema } from '../memberships/api-schemas'
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate invitation ID in URL path
+ * Used by: GET/DELETE /invitations/:id
+ */
+export const InvitationIdParamSchema = z
+  .object({
+    id: z.string().min(1) // WorkOS invitation IDs
+  })
+  .strict()
+
+// ============================================================================
+// Request Bodies
+// ============================================================================
+
+/**
+ * Send new invitation
+ * POST /invitations
+ *
+ * Security:
+ * - Email format validated (prevents header injection)
+ * - Role enum prevents privilege escalation
+ * - expiresInDays bounded (1-90 days)
+ * - organizationId NOT in body (from JWT via requireOrganization middleware)
+ */
+export const SendInvitationSchema = z
+  .object({
+    email: EmailSchema,
+    organizationId: z.string().optional(), // For WorkOS API - but typically from JWT
+    roleSlug: MembershipRoleSchema.default('member'),
+    expiresInDays: z.number().int().min(1).max(90).default(7)
+  })
+  .strict()
+
+/**
+ * Accept invitation by token
+ * POST /invitations/accept
+ *
+ * Security:
+ * - Token validated (non-empty string)
+ */
+export const AcceptInvitationSchema = z
+  .object({
+    invitation_token: z.string().min(1, 'Invitation token is required')
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters
+// ============================================================================
+
+/**
+ * List invitations with filters
+ * GET /invitations
+ *
+ * Filters:
+ * - organizationId: Filter by organization
+ * - email: Filter by email
+ *
+ * Security:
+ * - Requires organizationId or userId filter
+ * - Email validated
+ */
+export const ListInvitationsQuerySchema = z
+  .object({
+    organizationId: z.string().optional(),
+    userId: z.string().optional(),
+    email: EmailSchema.optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+    before: z.string().optional(), // WorkOS pagination cursor
+    after: z.string().optional()   // WorkOS pagination cursor
+  })
+  .strict()
+  .refine(
+    (data) => data.organizationId || data.userId,
+    { message: 'Either organizationId or userId must be provided' }
+  )
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type SendInvitationInput = z.infer<typeof SendInvitationSchema>
+export type AcceptInvitationInput = z.infer<typeof AcceptInvitationSchema>
+export type ListInvitationsQuery = z.infer<typeof ListInvitationsQuerySchema>
+export type InvitationIdParam = z.infer<typeof InvitationIdParamSchema>

package/src/auth/multi-tenancy/invitations/index.ts

@@ -1,38 +1,38 @@
-/**
- * Invitation types - browser-safe exports only
- * For WorkOS types and transforms, use @repo/core/server
- */
-
-// Core invitation types
-export type {
-  Invitation,
-  SendInvitationRequest,
-  ListInvitationsParams,
-  AcceptanceResult,
-  InvitationWithDetails,
-  AcceptInvitationRequest,
-  InvitationListQuery,
-  InvitationSummaryResponse,
-} from './invitation'
-
-// Supabase types
-export type {
-  SupabaseOrgInvitation,
-  SupabaseOrgInvitationInsert,
-  SupabaseOrgInvitationUpdate,
-  AdminOrgInvitation,
-  InvitationState,
-} from './supabase'
-export { transformSupabaseToInvitation } from './supabase'
-
-// Validation schemas
-export {
-  SendInvitationSchema,
-  AcceptInvitationSchema,
-  ListInvitationsQuerySchema,
-  InvitationIdParamSchema,
-  type SendInvitationInput,
-  type AcceptInvitationInput,
-  type ListInvitationsQuery,
-  type InvitationIdParam
+/**
+ * Invitation types - browser-safe exports only
+ * For WorkOS types and transforms, use @repo/core/server
+ */
+
+// Core invitation types
+export type {
+  Invitation,
+  SendInvitationRequest,
+  ListInvitationsParams,
+  AcceptanceResult,
+  InvitationWithDetails,
+  AcceptInvitationRequest,
+  InvitationListQuery,
+  InvitationSummaryResponse,
+} from './invitation'
+
+// Supabase types
+export type {
+  SupabaseOrgInvitation,
+  SupabaseOrgInvitationInsert,
+  SupabaseOrgInvitationUpdate,
+  AdminOrgInvitation,
+  InvitationState,
+} from './supabase'
+export { transformSupabaseToInvitation } from './supabase'
+
+// Validation schemas
+export {
+  SendInvitationSchema,
+  AcceptInvitationSchema,
+  ListInvitationsQuerySchema,
+  InvitationIdParamSchema,
+  type SendInvitationInput,
+  type AcceptInvitationInput,
+  type ListInvitationsQuery,
+  type InvitationIdParam
 } from './api-schemas'

package/src/auth/multi-tenancy/invitations/invitation.ts

@@ -1,86 +1,86 @@
-/**
- * Core Invitation Types
- * Internal types for the invitation system
- */
-
-import type { User } from '../users/user'
-import type { OrganizationMembership } from '../memberships/membership'
-
-// Core internal invitation interface
-export interface Invitation {
-  id: string
-  workosInvitationId: string
-  email: string
-  organizationId: string | null
-  inviterUserId: string | null
-  invitationState: 'pending' | 'accepted' | 'revoked' | 'expired'
-  roleSlug: string | null
-  invitationToken: string | null
-  acceptInvitationUrl: string | null
-  acceptedAt: string | null
-  revokedAt: string | null
-  expiresAt: string
-  createdAt: string | null
-  updatedAt: string | null
-}
-
-// Request/Response types for API
-export interface SendInvitationRequest {
-  email: string
-  organizationId?: string
-  roleSlug?: string
-  expiresInDays?: number
-  inviterUserId?: string
-}
-
-export interface ListInvitationsParams {
-  organizationId?: string
-  email?: string
-  limit?: number
-  before?: string
-  after?: string
-  order?: 'asc' | 'desc'
-}
-
-export interface AcceptanceResult {
-  invitation: Invitation
-  user?: User | null
-  membership?: OrganizationMembership | null
-}
-
-export interface AcceptInvitationRequest {
-  invitation_token: string
-}
-
-export interface InvitationListQuery {
-  userId?: string
-  organizationId?: string
-  email?: string
-  limit?: string
-  before?: string
-  after?: string
-  order?: 'asc' | 'desc'
-}
-
-export interface InvitationSummaryResponse {
-  totalInvitations: number
-  pendingInvitations: number
-  acceptedInvitations: number
-  expiredInvitations: number
-}
-
-// Invitation with enriched details for UI
-export interface InvitationWithDetails extends Invitation {
-  organization?: {
-    id: string
-    name: string
-    status?: string
-  }
-  inviter?: {
-    id: string
-    email: string
-    firstName?: string | null
-    lastName?: string | null
-    profilePictureUrl?: string | null
-  }
-}
+/**
+ * Core Invitation Types
+ * Internal types for the invitation system
+ */
+
+import type { User } from '../users/user'
+import type { OrganizationMembership } from '../memberships/membership'
+
+// Core internal invitation interface
+export interface Invitation {
+  id: string
+  workosInvitationId: string
+  email: string
+  organizationId: string | null
+  inviterUserId: string | null
+  invitationState: 'pending' | 'accepted' | 'revoked' | 'expired'
+  roleSlug: string | null
+  invitationToken: string | null
+  acceptInvitationUrl: string | null
+  acceptedAt: string | null
+  revokedAt: string | null
+  expiresAt: string
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+// Request/Response types for API
+export interface SendInvitationRequest {
+  email: string
+  organizationId?: string
+  roleSlug?: string
+  expiresInDays?: number
+  inviterUserId?: string
+}
+
+export interface ListInvitationsParams {
+  organizationId?: string
+  email?: string
+  limit?: number
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+export interface AcceptanceResult {
+  invitation: Invitation
+  user?: User | null
+  membership?: OrganizationMembership | null
+}
+
+export interface AcceptInvitationRequest {
+  invitation_token: string
+}
+
+export interface InvitationListQuery {
+  userId?: string
+  organizationId?: string
+  email?: string
+  limit?: string
+  before?: string
+  after?: string
+  order?: 'asc' | 'desc'
+}
+
+export interface InvitationSummaryResponse {
+  totalInvitations: number
+  pendingInvitations: number
+  acceptedInvitations: number
+  expiredInvitations: number
+}
+
+// Invitation with enriched details for UI
+export interface InvitationWithDetails extends Invitation {
+  organization?: {
+    id: string
+    name: string
+    status?: string
+  }
+  inviter?: {
+    id: string
+    email: string
+    firstName?: string | null
+    lastName?: string | null
+    profilePictureUrl?: string | null
+  }
+}

package/src/auth/multi-tenancy/invitations/server/index.ts

@@ -1,25 +1,25 @@
-/**
- * Invitations server-only exports
- * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
- */
-export * from './workos'
-export * from './transforms'
-
-// Re-export browser-safe types for convenience
-export type {
-  Invitation,
-  SendInvitationRequest,
-  ListInvitationsParams,
-  AcceptanceResult,
-  InvitationWithDetails,
-  AcceptInvitationRequest,
-  InvitationListQuery,
-  InvitationSummaryResponse
-} from '../invitation'
-export type {
-  SupabaseOrgInvitation,
-  SupabaseOrgInvitationInsert,
-  SupabaseOrgInvitationUpdate,
-  AdminOrgInvitation,
-  InvitationState
-} from '../supabase'
+/**
+ * Invitations server-only exports
+ * WARNING: Uses @workos-inc/node SDK - DO NOT import in browser code
+ */
+export * from './workos'
+export * from './transforms'
+
+// Re-export browser-safe types for convenience
+export type {
+  Invitation,
+  SendInvitationRequest,
+  ListInvitationsParams,
+  AcceptanceResult,
+  InvitationWithDetails,
+  AcceptInvitationRequest,
+  InvitationListQuery,
+  InvitationSummaryResponse
+} from '../invitation'
+export type {
+  SupabaseOrgInvitation,
+  SupabaseOrgInvitationInsert,
+  SupabaseOrgInvitationUpdate,
+  AdminOrgInvitation,
+  InvitationState
+} from '../supabase'

package/src/auth/multi-tenancy/invitations/server/transforms.ts

@@ -1,24 +1,24 @@
-import type { WorkOSInvitation } from './workos'
-import type { Invitation } from '../invitation'
-
-/**
- * Transform WorkOS invitation to internal format
- */
-export function transformWorkOSInvitation(workosInvitation: WorkOSInvitation): Invitation {
-  return {
-    id: workosInvitation.id,
-    workosInvitationId: workosInvitation.id,
-    email: workosInvitation.email,
-    organizationId: workosInvitation.organizationId,
-    inviterUserId: workosInvitation.inviterUserId,
-    invitationState: workosInvitation.state,
-    roleSlug: null, // WorkOS doesn't include role in invitation response
-    invitationToken: workosInvitation.token,
-    acceptInvitationUrl: workosInvitation.acceptInvitationUrl,
-    acceptedAt: workosInvitation.acceptedAt,
-    revokedAt: workosInvitation.revokedAt,
-    expiresAt: workosInvitation.expiresAt,
-    createdAt: workosInvitation.createdAt,
-    updatedAt: workosInvitation.updatedAt
-  }
-}
+import type { WorkOSInvitation } from './workos'
+import type { Invitation } from '../invitation'
+
+/**
+ * Transform WorkOS invitation to internal format
+ */
+export function transformWorkOSInvitation(workosInvitation: WorkOSInvitation): Invitation {
+  return {
+    id: workosInvitation.id,
+    workosInvitationId: workosInvitation.id,
+    email: workosInvitation.email,
+    organizationId: workosInvitation.organizationId,
+    inviterUserId: workosInvitation.inviterUserId,
+    invitationState: workosInvitation.state,
+    roleSlug: null, // WorkOS doesn't include role in invitation response
+    invitationToken: workosInvitation.token,
+    acceptInvitationUrl: workosInvitation.acceptInvitationUrl,
+    acceptedAt: workosInvitation.acceptedAt,
+    revokedAt: workosInvitation.revokedAt,
+    expiresAt: workosInvitation.expiresAt,
+    createdAt: workosInvitation.createdAt,
+    updatedAt: workosInvitation.updatedAt
+  }
+}

package/src/auth/multi-tenancy/invitations/server/workos.ts

@@ -1,24 +1,24 @@
-/**
- * WorkOS User Management Invitation API Types
- * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
- */
-
-import type {
-  Invitation,
-  InvitationEvent,
-  InvitationResponse,
-  ListInvitationsOptions,
-  SendInvitationOptions,
-  List
-} from '@workos-inc/node'
-
-// Consistent naming convention for the monorepo
-export type WorkOSInvitation = Invitation
-export type WorkOSInvitationEvent = InvitationEvent
-export type WorkOSInvitationResponse = InvitationResponse
-export type WorkOSInvitationListResponse = List<Invitation>
-export type ListWorkOSInvitationsParams = ListInvitationsOptions
-export type SendWorkOSInvitationRequest = SendInvitationOptions
-
-// For additional request types, import directly from SDK when needed:
-// import type { AcceptInvitationOptions } from '@workos-inc/node'
+/**
+ * WorkOS User Management Invitation API Types
+ * Re-exported from @workos-inc/node SDK v7.69.2 with consistent naming conventions
+ */
+
+import type {
+  Invitation,
+  InvitationEvent,
+  InvitationResponse,
+  ListInvitationsOptions,
+  SendInvitationOptions,
+  List
+} from '@workos-inc/node'
+
+// Consistent naming convention for the monorepo
+export type WorkOSInvitation = Invitation
+export type WorkOSInvitationEvent = InvitationEvent
+export type WorkOSInvitationResponse = InvitationResponse
+export type WorkOSInvitationListResponse = List<Invitation>
+export type ListWorkOSInvitationsParams = ListInvitationsOptions
+export type SendWorkOSInvitationRequest = SendInvitationOptions
+
+// For additional request types, import directly from SDK when needed:
+// import type { AcceptInvitationOptions } from '@workos-inc/node'