@fonderie/workspaces 5.2.3 → 5.3.1

package/brain/signatures.md

@@ -26,6 +26,8 @@ const MESSAGE_KEYS: { readonly workspaceInvitation: "workspace-invitation"; }
 
 const EVENT_KEYS: { readonly personalWorkspaceCreated: "fonderie.workspace.personal.created"; }
 
+const DEFAULT_TEMPLATES: { "workspace-invitation": { subject: string; html: string; text: string; }; }
+
 type WorkspaceType = 'ORGANIZATION' | 'PERSONAL' | 'TEAM' | 'COMMUNITY' | 'VENDOR';
 
 type InvitationStatus = 'PENDING' | 'ACCEPTED' | 'REJECTED' | 'CANCELLED';

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DEFAULT_TEMPLATES: () => DEFAULT_TEMPLATES,
   EVENT_KEYS: () => EVENT_KEYS,
   MESSAGE_KEYS: () => MESSAGE_KEYS,
   WorkspacesModule: () => WorkspacesModule,
@@ -209,13 +210,21 @@ async function getUserRoles(userId, workspaceId, store) {
   );
 }
 async function addRoleToMember(userId, workspaceId, roleId, store) {
-  await store.query(
+  const rows = await store.query(
     `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
-		 VALUES ($1, $2, $3, true)
+		 SELECT $1, $2, $3, true
+		 WHERE EXISTS (
+		   SELECT 1 FROM fonderie_roles r
+		   WHERE r.id = $3
+		     AND r.workspace_id = $2
+		     AND r.is_system = false
+		 )
 		 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
-		 SET confirmed = true, removed = false, suspended = false`,
+		 SET confirmed = true, removed = false, suspended = false
+		 RETURNING user_id`,
     [userId, workspaceId, roleId]
   );
+  return rows.length > 0;
 }
 async function removeRoleFromMember(userId, workspaceId, roleId, store) {
   const remaining = await store.query(
@@ -547,10 +556,11 @@ async function findSystemRole(name2, store) {
   );
   return row ?? null;
 }
-async function getRoleById(id, store) {
+async function getRoleById(id, workspaceId, store) {
   const [row] = await store.query(
-    `SELECT ${SELECT_ROLE} FROM fonderie_roles WHERE id = $1`,
-    [id]
+    `SELECT ${SELECT_ROLE} FROM fonderie_roles
+		 WHERE id = $1 AND (workspace_id = $2 OR is_system = true)`,
+    [id, workspaceId]
   );
   return row ?? null;
 }
@@ -563,9 +573,9 @@ async function listWorkspaceRoles(workspaceId, store) {
     [workspaceId]
   );
 }
-async function updateRole(id, opts, store) {
+async function updateRole(id, workspaceId, opts, store) {
   const sets = [];
-  const params = [id];
+  const params = [id, workspaceId];
   if (opts.name !== void 0) {
     params.push(opts.name);
     sets.push(`name = $${params.length}`);
@@ -578,11 +588,11 @@ async function updateRole(id, opts, store) {
     params.push(opts.active);
     sets.push(`active = $${params.length}`);
   }
-  if (sets.length === 0) return getRoleById(id, store);
+  if (sets.length === 0) return getRoleById(id, workspaceId, store);
   const [row] = await store.query(
     `UPDATE fonderie_roles
 		 SET ${sets.join(", ")}
-		 WHERE id = $1 AND is_system = false
+		 WHERE id = $1 AND workspace_id = $2 AND is_system = false
 		 RETURNING ${SELECT_ROLE}`,
     params
   );
@@ -648,14 +658,14 @@ var RoleModel = class {
   findSystem(name2) {
     return findSystemRole(name2, this.store);
   }
-  findById(id) {
-    return getRoleById(id, this.store);
+  findById(id, workspaceId) {
+    return getRoleById(id, workspaceId, this.store);
   }
   list(workspaceId) {
     return listWorkspaceRoles(workspaceId, this.store);
   }
-  update(id, opts) {
-    return updateRole(id, opts, this.store);
+  update(id, workspaceId, opts) {
+    return updateRole(id, workspaceId, opts, this.store);
   }
   delete(id, workspaceId) {
     return deleteRole(id, workspaceId, this.store);
@@ -927,7 +937,14 @@ function memberController(store) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
-      await members.addRole(userId, ctx.workspace.id, roleId);
+      const assigned = await members.addRole(userId, ctx.workspace.id, roleId);
+      if (!assigned) {
+        return (0, import_core3.setApiResponse)(
+          import_core3.HTTP.UNPROCESSABLE,
+          "INVALID_ROLE",
+          "Role is not assignable in this workspace."
+        );
+      }
       return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
     },
     async removeRole(ctx) {
@@ -1000,7 +1017,7 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
-      const role = await roles.findById(roleId);
+      const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
@@ -1031,7 +1048,7 @@ function roleController(store) {
       if (typeof body?.["active"] === "boolean") {
         opts.active = body["active"];
       }
-      const role = await roles.update(roleId, opts);
+      const role = await roles.update(roleId, ctx.workspace.id, opts);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
       }
@@ -1060,7 +1077,7 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
-      const role = await roles.findById(roleId);
+      const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
@@ -1079,6 +1096,10 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
+      const target = await roles.findById(roleId, ctx.workspace.id);
+      if (!target || target.isSystem) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+      }
       const perms = body?.["permissions"];
       if (!Array.isArray(perms)) {
         return (0, import_core4.setApiResponse)(
@@ -1453,6 +1474,27 @@ var WorkspacesModule = class {
   }
 };
 
+// src/templates.ts
+var DEFAULT_TEMPLATES = {
+  // Payload carries { token, pin }; the code path is PIN-based, so the copy
+  // uses {{pin}} only — token is intentionally not surfaced.
+  [MESSAGE_KEYS.workspaceInvitation]: {
+    subject: "You've been invited to a workspace",
+    html: `<h1>You&rsquo;ve been invited</h1>
+<p>You&rsquo;ve been invited to join a workspace. Use this code to accept the invitation:</p>
+<p><span class="pin-code">{{pin}}</span></p>
+<p class="muted">Enter this code on the invitation screen to join the team.</p>`,
+    text: `You've been invited
+
+You've been invited to join a workspace. Use this code to accept the invitation: {{pin}}
+
+Enter this code on the invitation screen to join the team.`
+  }
+};
+var SAMPLE_PAYLOADS = {
+  [MESSAGE_KEYS.workspaceInvitation]: { token: "inv_abc123", pin: "123456" }
+};
+
 // src/middlewares/require-workspace.ts
 var import_core6 = require("@fonderie/core");
 var requireWorkspace = async (ctx, next) => {
@@ -1561,6 +1603,7 @@ function workspaceExportContributor(store) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_TEMPLATES,
   EVENT_KEYS,
   MESSAGE_KEYS,
   WorkspacesModule,