@fonderie/workspaces 1.0.0 → 1.1.1

package/dist/index.cjs

@@ -4,8 +4,8 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -24,6 +24,7 @@ __export(index_exports, {
   MESSAGE_KEYS: () => MESSAGE_KEYS,
   WorkspacesModule: () => WorkspacesModule,
   requireWorkspace: () => requireWorkspace,
+  schemas: () => schemas_exports,
   toInvitationDTO: () => toInvitationDTO,
   toMemberDTO: () => toMemberDTO,
   toRoleDTO: () => toRoleDTO,
@@ -44,6 +45,83 @@ var EVENT_KEYS = {
 // src/routes.ts
 var import_middlewares = require("@fonderie/core/middlewares");
 
+// src/schemas.ts
+var schemas_exports = {};
+__export(schemas_exports, {
+  acceptInvitationSchema: () => acceptInvitationSchema,
+  addMemberRoleSchema: () => addMemberRoleSchema,
+  createInvitationsSchema: () => createInvitationsSchema,
+  createRoleSchema: () => createRoleSchema,
+  createWorkspaceSchema: () => createWorkspaceSchema,
+  setRolePermissionsSchema: () => setRolePermissionsSchema,
+  updateRoleSchema: () => updateRoleSchema,
+  updateSettingsSchema: () => updateSettingsSchema,
+  updateWorkspaceSchema: () => updateWorkspaceSchema
+});
+var import_zod = require("zod");
+var name = import_zod.z.string().trim().min(1, "name is required").max(200);
+var email = import_zod.z.string().trim().pipe(import_zod.z.email());
+var createWorkspaceSchema = import_zod.z.object({
+  name,
+  description: import_zod.z.string().max(2e3).optional(),
+  // PERSONAL workspaces are created automatically by the module; the
+  // controller enforces the rule — schema just types the field.
+  type: import_zod.z.string().max(40).optional()
+});
+var addressSchema = import_zod.z.object({
+  line1: import_zod.z.string().max(200).optional(),
+  line2: import_zod.z.string().max(200).optional(),
+  city: import_zod.z.string().max(100).optional(),
+  region: import_zod.z.string().max(100).optional(),
+  postalCode: import_zod.z.string().max(20).optional(),
+  country: import_zod.z.string().max(60).optional()
+}).passthrough();
+var updateWorkspaceSchema = import_zod.z.object({
+  name: import_zod.z.string().trim().min(1).max(200).optional(),
+  description: import_zod.z.string().max(2e3).nullable().optional(),
+  motto: import_zod.z.string().max(300).nullable().optional(),
+  phone: import_zod.z.string().max(32).nullable().optional(),
+  businessType: import_zod.z.string().max(100).nullable().optional(),
+  address: addressSchema.nullable().optional()
+}).refine((o) => Object.values(o).some((v) => v !== void 0), "Provide at least one field");
+var updateSettingsSchema = import_zod.z.object({
+  locale: import_zod.z.string().max(35).optional(),
+  timezone: import_zod.z.string().max(64).optional(),
+  currency: import_zod.z.string().max(8).optional(),
+  dateFormat: import_zod.z.string().max(32).optional(),
+  timeFormat: import_zod.z.string().max(32).optional()
+}).refine((o) => Object.values(o).some((v) => v !== void 0), "No settings provided");
+var addMemberRoleSchema = import_zod.z.object({ roleId: import_zod.z.string().min(1, "roleId is required") });
+var inviteEntry = import_zod.z.object({
+  email,
+  roleId: import_zod.z.string().min(1).optional()
+});
+var createInvitationsSchema = import_zod.z.union([
+  inviteEntry,
+  import_zod.z.array(inviteEntry).min(1, "at least one invite is required")
+]);
+var acceptInvitationSchema = import_zod.z.object({ pin: import_zod.z.string().trim().min(1, "pin is required") });
+var createRoleSchema = import_zod.z.object({
+  name,
+  description: import_zod.z.string().max(1e3).optional()
+});
+var updateRoleSchema = import_zod.z.object({
+  name: import_zod.z.string().trim().min(1).max(200).optional(),
+  description: import_zod.z.string().max(1e3).nullable().optional(),
+  active: import_zod.z.boolean().optional()
+}).refine((o) => Object.values(o).some((v) => v !== void 0), "Provide at least one field");
+var setRolePermissionsSchema = import_zod.z.object({
+  permissions: import_zod.z.array(
+    import_zod.z.object({
+      permissionKey: import_zod.z.string().min(1),
+      canCreate: import_zod.z.boolean().optional(),
+      canRead: import_zod.z.boolean().optional(),
+      canUpdate: import_zod.z.boolean().optional(),
+      canDelete: import_zod.z.boolean().optional()
+    })
+  )
+});
+
 // src/middlewares/workspace-context.ts
 var import_core = require("@fonderie/core");
 
@@ -456,10 +534,10 @@ async function createRole(opts, store) {
   if (!role) throw new Error("Failed to create role");
   return role;
 }
-async function findSystemRole(name, store) {
+async function findSystemRole(name2, store) {
   const [row] = await store.query(
     `SELECT ${SELECT_ROLE} FROM fonderie_roles WHERE name = $1 AND is_system = true LIMIT 1`,
-    [name]
+    [name2]
   );
   return row ?? null;
 }
@@ -548,8 +626,8 @@ var RoleModel = class {
   create(opts) {
     return createRole(opts, this.store);
   }
-  findSystem(name) {
-    return findSystemRole(name, this.store);
+  findSystem(name2) {
+    return findSystemRole(name2, this.store);
   }
   findById(id) {
     return getRoleById(id, this.store);
@@ -656,10 +734,10 @@ function workspaceController(store, config) {
     },
     async create(ctx) {
       const body = ctx.meta["body"];
-      const name = body?.["name"];
+      const name2 = body?.["name"];
       const description = body?.["description"];
       const type = body?.["type"];
-      if (typeof name !== "string" || name.trim().length === 0) {
+      if (typeof name2 !== "string" || name2.trim().length === 0) {
         return (0, import_core2.setApiResponse)(import_core2.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       if (type === "PERSONAL") {
@@ -669,10 +747,10 @@ function workspaceController(store, config) {
           "Personal workspaces are created automatically"
         );
       }
-      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+      const slug = name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
       const workspace = await store.transaction(async (tx) => {
         const wsOpts = {
-          name: name.trim(),
+          name: name2.trim(),
           slug,
           ownerId: ctx.user.id,
           type: typeof type === "string" ? type : "ORGANIZATION"
@@ -711,7 +789,7 @@ function workspaceController(store, config) {
       if (body?.["businessType"] !== void 0)
         opts.businessType = typeof body["businessType"] === "string" ? body["businessType"] : null;
       if (body?.["address"] !== void 0 && typeof body["address"] === "object")
-        opts.address = body["address"];
+        opts.address = body["address"] ?? null;
       const workspace = await workspaces.update(ctx.workspace.id, opts);
       if (!workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
@@ -855,14 +933,14 @@ function roleController(store) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const body = ctx.meta["body"];
-      const name = body?.["name"];
+      const name2 = body?.["name"];
       const description = body?.["description"];
-      if (typeof name !== "string" || name.trim().length === 0) {
+      if (typeof name2 !== "string" || name2.trim().length === 0) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       try {
         const opts = {
-          name: name.trim(),
+          name: name2.trim(),
           workspaceId: ctx.workspace.id
         };
         if (typeof description === "string") {
@@ -1157,8 +1235,8 @@ function invitationController(store, ttl, bus) {
       if (needsDefault) {
         const [row] = await store.query(
           `SELECT id FROM fonderie_roles
-					 WHERE name = 'ADMIN' AND workspace_id = $1 LIMIT 1`,
-          [ctx.workspace.id]
+					 WHERE name = 'GUEST' AND workspace_id IS NULL AND is_system = true
+					 LIMIT 1`
         );
         defaultRoleId = row?.id;
         if (!defaultRoleId) {
@@ -1167,21 +1245,21 @@ function invitationController(store, ttl, bus) {
       }
       const results = await Promise.all(
         entries.map(async (entry) => {
-          const email = entry["email"];
+          const email2 = entry["email"];
           const resolvedRoleId = entry["roleId"] ?? defaultRoleId;
           const invitation = await invitations.create({
             workspaceId: ctx.workspace.id,
-            email,
+            email: email2,
             roleId: resolvedRoleId,
             ttl
           });
           bus?.emit(import_events.NOTIFICATION_EVENT, {
             type: MESSAGE_KEYS.workspaceInvitation,
-            recipient: { email, phone: null, deviceToken: null },
+            recipient: { email: email2, phone: null, deviceToken: null },
             data: { token: invitation.token, pin: invitation.pin }
           }).catch(() => {
           });
-          return { invitationId: invitation.id, email };
+          return { invitationId: invitation.id, email: email2 };
         })
       );
       return (0, import_core5.setApiResponse)(import_core5.HTTP.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
@@ -1226,36 +1304,36 @@ function buildWorkspaceRoutes(store, config, bus) {
   const invitation = invitationController(store, ttl, bus);
   return [
     // ── Workspace creation + listing (no workspace context required)
-    ["POST", "/workspaces", import_middlewares.requireAuth, workspace.create],
+    ["POST", "/workspaces", import_middlewares.requireAuth, (0, import_middlewares.validate)(createWorkspaceSchema), workspace.create],
     ["GET", "/workspaces", import_middlewares.requireAuth, workspace.list],
     // ── Members (workspace resolved from X-Workspace-ID header)
     ["GET", "/workspaces/members", import_middlewares.requireAuth, wsCtx, member.list],
     ["DELETE", "/workspaces/members/:userId", import_middlewares.requireAuth, wsCtx, member.remove],
     ["GET", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, member.getUserRoles],
-    ["POST", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, member.addRole],
+    ["POST", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(addMemberRoleSchema), member.addRole],
     ["DELETE", "/workspaces/members/:userId/roles/:roleId", import_middlewares.requireAuth, wsCtx, member.removeRole],
     // ── Invitations
     ["GET", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, invitation.list],
-    ["POST", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, invitation.invite],
+    ["POST", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(createInvitationsSchema), invitation.invite],
     ["DELETE", "/workspaces/invitations/:inviteId", import_middlewares.requireAuth, wsCtx, invitation.cancel],
-    ["POST", "/workspaces/invitations/accept", import_middlewares.requireAuth, invitation.accept],
+    ["POST", "/workspaces/invitations/accept", import_middlewares.requireAuth, (0, import_middlewares.validate)(acceptInvitationSchema), invitation.accept],
     // ── Roles
-    ["POST", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, role.create],
+    ["POST", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(createRoleSchema), role.create],
     ["GET", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, role.list],
     ["GET", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.get],
-    ["PUT", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.update],
+    ["PUT", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateRoleSchema), role.update],
     ["DELETE", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.remove],
-    ["POST", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, role.setPermissions],
+    ["POST", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(setRolePermissionsSchema), role.setPermissions],
     // ── Workspace lifecycle
     ["POST", "/workspaces/archive", import_middlewares.requireAuth, wsCtx, workspace.archive],
     ["POST", "/workspaces/restore", import_middlewares.requireAuth, wsCtx, workspace.restore],
     ["GET", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, workspace.getSettings],
-    ["PUT", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, workspace.updateSettings],
+    ["PUT", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateSettingsSchema), workspace.updateSettings],
     // ── Path-based lookup by ID (admin / cross-workspace use)
     ["GET", "/workspaces/:id", import_middlewares.requireAuth, wsCtx, workspace.get],
     // ── Update current workspace — ID resolved from X-Workspace-ID header
     // (or personal workspace fallback when header is absent)
-    ["PUT", "/workspaces", import_middlewares.requireAuth, wsCtx, workspace.update]
+    ["PUT", "/workspaces", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateWorkspaceSchema), workspace.update]
   ];
 }
 
@@ -1286,14 +1364,14 @@ var WorkspacesModule = class {
     }
   }
   async provisionPersonalWorkspace(payload) {
-    const name = "My Workspace";
+    const name2 = "My Workspace";
     const slug = `${payload.userId}-personal`;
     let workspaceId;
     await this.store.transaction(async (tx) => {
       const wsModel = new WorkspaceModel(tx);
       const roleModel = new RoleModel(tx);
       const memModel = new MemberModel(tx);
-      const ws = await wsModel.createPersonal({ name, slug, ownerId: payload.userId });
+      const ws = await wsModel.createPersonal({ name: name2, slug, ownerId: payload.userId });
       if (!ws) return;
       workspaceId = ws.id;
       const adminRole = await roleModel.findSystem("ADMIN");
@@ -1329,6 +1407,7 @@ var requireWorkspace = async (ctx, next) => {
   MESSAGE_KEYS,
   WorkspacesModule,
   requireWorkspace,
+  schemas,
   toInvitationDTO,
   toMemberDTO,
   toRoleDTO,