@fonderie/workspaces 5.3.0 → 5.3.2

package/dist/index.cjs

@@ -210,13 +210,21 @@ async function getUserRoles(userId, workspaceId, store) {
   );
 }
 async function addRoleToMember(userId, workspaceId, roleId, store) {
-  await store.query(
+  const rows = await store.query(
     `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
-		 VALUES ($1, $2, $3, true)
+		 SELECT $1, $2, $3, true
+		 WHERE EXISTS (
+		   SELECT 1 FROM fonderie_roles r
+		   WHERE r.id = $3
+		     AND r.workspace_id = $2
+		     AND r.is_system = false
+		 )
 		 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
-		 SET confirmed = true, removed = false, suspended = false`,
+		 SET confirmed = true, removed = false, suspended = false
+		 RETURNING user_id`,
     [userId, workspaceId, roleId]
   );
+  return rows.length > 0;
 }
 async function removeRoleFromMember(userId, workspaceId, roleId, store) {
   const remaining = await store.query(
@@ -548,10 +556,11 @@ async function findSystemRole(name2, store) {
   );
   return row ?? null;
 }
-async function getRoleById(id, store) {
+async function getRoleById(id, workspaceId, store) {
   const [row] = await store.query(
-    `SELECT ${SELECT_ROLE} FROM fonderie_roles WHERE id = $1`,
-    [id]
+    `SELECT ${SELECT_ROLE} FROM fonderie_roles
+		 WHERE id = $1 AND (workspace_id = $2 OR is_system = true)`,
+    [id, workspaceId]
   );
   return row ?? null;
 }
@@ -564,9 +573,9 @@ async function listWorkspaceRoles(workspaceId, store) {
     [workspaceId]
   );
 }
-async function updateRole(id, opts, store) {
+async function updateRole(id, workspaceId, opts, store) {
   const sets = [];
-  const params = [id];
+  const params = [id, workspaceId];
   if (opts.name !== void 0) {
     params.push(opts.name);
     sets.push(`name = $${params.length}`);
@@ -579,11 +588,11 @@ async function updateRole(id, opts, store) {
     params.push(opts.active);
     sets.push(`active = $${params.length}`);
   }
-  if (sets.length === 0) return getRoleById(id, store);
+  if (sets.length === 0) return getRoleById(id, workspaceId, store);
   const [row] = await store.query(
     `UPDATE fonderie_roles
 		 SET ${sets.join(", ")}
-		 WHERE id = $1 AND is_system = false
+		 WHERE id = $1 AND workspace_id = $2 AND is_system = false
 		 RETURNING ${SELECT_ROLE}`,
     params
   );
@@ -649,14 +658,14 @@ var RoleModel = class {
   findSystem(name2) {
     return findSystemRole(name2, this.store);
   }
-  findById(id) {
-    return getRoleById(id, this.store);
+  findById(id, workspaceId) {
+    return getRoleById(id, workspaceId, this.store);
   }
   list(workspaceId) {
     return listWorkspaceRoles(workspaceId, this.store);
   }
-  update(id, opts) {
-    return updateRole(id, opts, this.store);
+  update(id, workspaceId, opts) {
+    return updateRole(id, workspaceId, opts, this.store);
   }
   delete(id, workspaceId) {
     return deleteRole(id, workspaceId, this.store);
@@ -928,7 +937,14 @@ function memberController(store) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
-      await members.addRole(userId, ctx.workspace.id, roleId);
+      const assigned = await members.addRole(userId, ctx.workspace.id, roleId);
+      if (!assigned) {
+        return (0, import_core3.setApiResponse)(
+          import_core3.HTTP.UNPROCESSABLE,
+          "INVALID_ROLE",
+          "Role is not assignable in this workspace."
+        );
+      }
       return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
     },
     async removeRole(ctx) {
@@ -1001,7 +1017,7 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
-      const role = await roles.findById(roleId);
+      const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
@@ -1032,7 +1048,7 @@ function roleController(store) {
       if (typeof body?.["active"] === "boolean") {
         opts.active = body["active"];
       }
-      const role = await roles.update(roleId, opts);
+      const role = await roles.update(roleId, ctx.workspace.id, opts);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
       }
@@ -1061,7 +1077,7 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
-      const role = await roles.findById(roleId);
+      const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
@@ -1080,6 +1096,10 @@ function roleController(store) {
       if (!roleId) {
         return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
+      const target = await roles.findById(roleId, ctx.workspace.id);
+      if (!target || target.isSystem) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+      }
       const perms = body?.["permissions"];
       if (!Array.isArray(perms)) {
         return (0, import_core4.setApiResponse)(