@fonderie/workspaces 5.3.2 → 6.0.0

package/dist/index.cjs

@@ -29,6 +29,7 @@ __export(index_exports, {
   importMembership: () => importMembership,
   importRole: () => importRole,
   importWorkspace: () => importWorkspace,
+  requireManager: () => requireManager,
   requireWorkspace: () => requireWorkspace,
   schemas: () => schemas_exports,
   toInvitationDTO: () => toInvitationDTO,
@@ -51,6 +52,7 @@ var EVENT_KEYS = {
 
 // src/routes.ts
 var import_middlewares = require("@fonderie/core/middlewares");
+var import_rate_limit = require("@fonderie/rate-limit");
 
 // src/schemas.ts
 var schemas_exports = {};
@@ -107,7 +109,10 @@ var createInvitationsSchema = import_zod.z.union([
   inviteEntry,
   import_zod.z.array(inviteEntry).min(1, "at least one invite is required")
 ]);
-var acceptInvitationSchema = import_zod.z.object({ pin: import_zod.z.string().trim().min(1, "pin is required") });
+var acceptInvitationSchema = import_zod.z.union([
+  import_zod.z.object({ pin: import_zod.z.string().trim().min(1, "pin is required") }),
+  import_zod.z.object({ token: import_zod.z.string().trim().min(1, "token is required") })
+]);
 var createRoleSchema = import_zod.z.object({
   name,
   description: import_zod.z.string().max(1e3).optional()
@@ -460,8 +465,43 @@ function withWorkspace(store, ctx, next) {
   return handler;
 }
 
-// src/controllers/workspace.controller.ts
+// src/middlewares/require-manager.ts
 var import_core2 = require("@fonderie/core");
+function requireManager(store, config) {
+  return async (ctx, next) => {
+    if (config.management === "any-member") return next();
+    if (!ctx.user) {
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+    }
+    if (!ctx.workspace) return next();
+    const ownerId = ctx.workspace.ownerId;
+    if (ownerId && ownerId === ctx.user.id) return next();
+    const [row] = await store.query(
+      `SELECT 1 AS ok
+			 FROM fonderie_role_user_workspaces ruw
+			 JOIN fonderie_roles r ON r.id = ruw.role_id
+			 WHERE ruw.user_id      = $1
+			   AND ruw.workspace_id = $2
+			   AND ruw.removed      = false
+			   AND ruw.suspended    = false
+			   AND r.is_system    = true
+			   AND r.active       = true
+			 LIMIT 1`,
+      [ctx.user.id, ctx.workspace.id]
+    );
+    if (!row) {
+      return (0, import_core2.setApiResponse)(
+        import_core2.HTTP.FORBIDDEN,
+        "MANAGER_REQUIRED",
+        "This action requires the workspace owner or an admin role"
+      );
+    }
+    return next();
+  };
+}
+
+// src/controllers/workspace.controller.ts
+var import_core3 = require("@fonderie/core");
 
 // src/models/workspace.model.ts
 var WorkspaceModel = class {
@@ -739,7 +779,11 @@ function toInvitationDTO(inv) {
     workspaceId: (0, import_parser.stringOrEmpty)(inv.workspaceId),
     email: (0, import_parser.stringOrEmpty)(inv.email),
     roleId: (0, import_parser.stringOrEmpty)(inv.roleId),
-    token: (0, import_parser.stringOrEmpty)(inv.token),
+    // The accept token is a bearer credential delivered to the INVITEE by
+    // email — never expose it through the API. Listing invitations used to
+    // leak it, letting any member accept (hijack) someone else's pending
+    // invite. The field stays for DTO-shape compatibility, always empty.
+    token: "",
     status: (0, import_parser.stringOrEmpty)(inv.status),
     expiresAt: (0, import_parser.dateOrEmpty)(inv.expiresAt),
     createdAt: (0, import_parser.dateOrEmpty)(inv.createdAt)
@@ -763,9 +807,9 @@ function workspaceController(store, config) {
   return {
     async list(ctx) {
       if (!ctx.user)
-        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Authentication required");
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Authentication required");
       const list = await workspaces.findByUserId(ctx.user.id);
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACES_FETCHED", "Workspaces retrieved successfully.", {
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "WORKSPACES_FETCHED", "Workspaces retrieved successfully.", {
         workspaces: list.map(toWorkspaceDTO)
       });
     },
@@ -775,11 +819,11 @@ function workspaceController(store, config) {
       const description = body?.["description"];
       const type = body?.["type"];
       if (typeof name2 !== "string" || name2.trim().length === 0) {
-        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       if (type === "PERSONAL") {
-        return (0, import_core2.setApiResponse)(
-          import_core2.HTTP.UNPROCESSABLE,
+        return (0, import_core3.setApiResponse)(
+          import_core3.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Personal workspaces are created automatically"
         );
@@ -802,18 +846,18 @@ function workspaceController(store, config) {
         await memModel.add({ userId: ctx.user.id, workspaceId: ws.id, roleId: adminRole.id });
         return ws;
       });
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.CREATED, "WORKSPACE_CREATED", "Workspace created successfully.", {
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.CREATED, "WORKSPACE_CREATED", "Workspace created successfully.", {
         workspace: toWorkspaceDTO(workspace)
       });
     },
     async get(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_FETCHED", "Workspace retrieved successfully.", {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "WORKSPACE_FETCHED", "Workspace retrieved successfully.", {
         workspace: toWorkspaceDTO(ctx.workspace)
       });
     },
     async update(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const body = ctx.meta["body"];
       const opts = {};
       if (typeof body?.["name"] === "string") opts.name = body["name"].trim();
@@ -828,33 +872,33 @@ function workspaceController(store, config) {
       if (body?.["address"] !== void 0 && typeof body["address"] === "object")
         opts.address = body["address"] ?? null;
       const workspace = await workspaces.update(ctx.workspace.id, opts);
-      if (!workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
+      if (!workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
         workspace: toWorkspaceDTO(workspace)
       });
     },
     async archive(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return (0, import_core2.setApiResponse)(
-          import_core2.HTTP.FORBIDDEN,
+        return (0, import_core3.setApiResponse)(
+          import_core3.HTTP.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces cannot be archived"
         );
       }
       await workspaces.archive(ctx.workspace.id, ctx.user.id);
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_ARCHIVED", "Workspace archived successfully.");
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "WORKSPACE_ARCHIVED", "Workspace archived successfully.");
     },
     async restore(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       await workspaces.restore(ctx.workspace.id);
-      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_RESTORED", "Workspace restored successfully.");
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "WORKSPACE_RESTORED", "Workspace restored successfully.");
     },
     async getSettings(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const settings = await workspaces.getSettings(ctx.workspace.id);
-      return (0, import_core2.setApiResponse)(
-        import_core2.HTTP.OK,
+      return (0, import_core3.setApiResponse)(
+        import_core3.HTTP.OK,
         "SETTINGS_FETCHED",
         "Workspace settings retrieved successfully.",
         {
@@ -863,18 +907,18 @@ function workspaceController(store, config) {
       );
     },
     async updateSettings(ctx) {
-      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const body = ctx.meta["body"];
       if (!body || Object.keys(body).length === 0) {
-        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "No settings provided");
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "No settings provided");
       }
       const patch = {};
       for (const key of ["locale", "timezone", "currency", "dateFormat", "timeFormat"]) {
         if (typeof body[key] === "string") patch[key] = body[key];
       }
       const settings = await workspaces.updateSettings(ctx.workspace.id, patch);
-      return (0, import_core2.setApiResponse)(
-        import_core2.HTTP.OK,
+      return (0, import_core3.setApiResponse)(
+        import_core3.HTTP.OK,
         "SETTINGS_UPDATED",
         "Workspace settings updated successfully.",
         {
@@ -886,22 +930,22 @@ function workspaceController(store, config) {
 }
 
 // src/controllers/member.controller.ts
-var import_core3 = require("@fonderie/core");
+var import_core4 = require("@fonderie/core");
 function memberController(store) {
   const members = new MemberModel(store);
   return {
     async list(ctx) {
-      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const list = await members.list(ctx.workspace.id);
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MEMBERS_FETCHED", "Members retrieved successfully.", {
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MEMBERS_FETCHED", "Members retrieved successfully.", {
         members: list.map(toMemberDTO)
       });
     },
     async remove(ctx) {
-      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return (0, import_core3.setApiResponse)(
-          import_core3.HTTP.FORBIDDEN,
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces do not support member management"
         );
@@ -909,78 +953,86 @@ function memberController(store) {
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       if (!userId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (userId === ctx.user?.id) {
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "INVALID_OPERATION", "Cannot remove yourself");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "INVALID_OPERATION", "Cannot remove yourself");
+      }
+      const ownerId = ctx.workspace.ownerId;
+      if (ownerId && userId === ownerId) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.BAD_REQUEST,
+          "INVALID_OPERATION",
+          "Cannot remove the workspace owner"
+        );
       }
       await members.remove(userId, ctx.workspace.id);
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MEMBER_REMOVED", "Member removed successfully.");
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "MEMBER_REMOVED", "Member removed successfully.");
     },
     async getUserRoles(ctx) {
-      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       if (!userId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       const roles = await members.getUserRoles(userId, ctx.workspace.id);
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLES_FETCHED", "Member roles retrieved successfully.", {
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLES_FETCHED", "Member roles retrieved successfully.", {
         roles: roles.map(toRoleDTO)
       });
     },
     async addRole(ctx) {
-      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const userId = params?.["userId"];
       const roleId = body?.["roleId"] ?? params?.["roleId"];
       if (!userId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       const assigned = await members.addRole(userId, ctx.workspace.id, roleId);
       if (!assigned) {
-        return (0, import_core3.setApiResponse)(
-          import_core3.HTTP.UNPROCESSABLE,
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
           "INVALID_ROLE",
           "Role is not assignable in this workspace."
         );
       }
-      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
     },
     async removeRole(ctx) {
-      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       const roleId = params?.["roleId"];
       if (!userId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       try {
         await members.removeRole(userId, ctx.workspace.id, roleId);
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_REMOVED", "Role removed successfully.");
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_REMOVED", "Role removed successfully.");
       } catch (err) {
         const message = err instanceof Error ? err.message : "Failed";
-        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
       }
     }
   };
 }
 
 // src/controllers/role.controller.ts
-var import_core4 = require("@fonderie/core");
+var import_core5 = require("@fonderie/core");
 function roleController(store) {
   const roles = new RoleModel(store);
   return {
     async create(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const body = ctx.meta["body"];
       const name2 = body?.["name"];
       const description = body?.["description"];
       if (typeof name2 !== "string" || name2.trim().length === 0) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       try {
         const opts = {
@@ -991,49 +1043,49 @@ function roleController(store) {
           opts.description = description;
         }
         const role = await roles.create(opts);
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.CREATED, "ROLE_CREATED", "Role created successfully.", {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.CREATED, "ROLE_CREATED", "Role created successfully.", {
           role: toRoleDTO(role)
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "Failed to create role";
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
       }
     },
     async list(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const list = await roles.list(ctx.workspace.id);
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLES_FETCHED", "Roles retrieved successfully.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "ROLES_FETCHED", "Roles retrieved successfully.", {
         roles: list.map(toRoleDTO)
       });
     },
     async get(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_FETCHED", "Role retrieved successfully.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "ROLE_FETCHED", "Role retrieved successfully.", {
         role: toRoleDTO(role)
       });
     },
     async update(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const opts = {};
       if (typeof body?.["name"] === "string") {
@@ -1050,60 +1102,60 @@ function roleController(store) {
       }
       const role = await roles.update(roleId, ctx.workspace.id, opts);
       if (!role) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
       }
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_UPDATED", "Role updated successfully.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "ROLE_UPDATED", "Role updated successfully.", {
         role: toRoleDTO(role)
       });
     },
     async remove(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       await roles.delete(roleId, ctx.workspace.id);
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_DELETED", "Role deleted successfully.");
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "ROLE_DELETED", "Role deleted successfully.");
     },
     async getPermissions(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
       const permissions = await roles.getPermissions(roleId, ctx.workspace.id);
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "PERMISSIONS_FETCHED", "Role permissions retrieved successfully.", {
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PERMISSIONS_FETCHED", "Role permissions retrieved successfully.", {
         permissions
       });
     },
     async setPermissions(ctx) {
       if (!ctx.workspace) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const target = await roles.findById(roleId, ctx.workspace.id);
       if (!target || target.isSystem) {
-        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
       const perms = body?.["permissions"];
       if (!Array.isArray(perms)) {
-        return (0, import_core4.setApiResponse)(
-          import_core4.HTTP.UNPROCESSABLE,
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "permissions array is required"
         );
@@ -1119,13 +1171,13 @@ function roleController(store) {
         };
       }).filter((p) => p.permissionKey.length > 0);
       await roles.setPermissions(roleId, ctx.workspace.id, normalized);
-      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "PERMISSIONS_SET", "Role permissions updated successfully.");
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PERMISSIONS_SET", "Role permissions updated successfully.");
     }
   };
 }
 
 // src/controllers/invitation.controller.ts
-var import_core5 = require("@fonderie/core");
+var import_core6 = require("@fonderie/core");
 var import_events = require("@fonderie/events");
 
 // src/services/invitations.ts
@@ -1134,7 +1186,7 @@ function generateToken() {
   return (0, import_node_crypto.randomBytes)(32).toString("hex");
 }
 function generatePin() {
-  return Math.floor(1e5 + Math.random() * 9e5).toString();
+  return (0, import_node_crypto.randomInt)(1e5, 1e6).toString();
 }
 function parseTtl(ttl) {
   const units = {
@@ -1205,8 +1257,8 @@ async function acceptInvitationByPin(opts, store) {
   const [inv] = await store.query(
     `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
 		 FROM fonderie_workspace_invitations
-		 WHERE pin = $1 AND status = 'PENDING'`,
-    [opts.pin]
+		 WHERE pin = $1 AND lower(email) = lower($2) AND status = 'PENDING'`,
+    [opts.pin, opts.email]
   );
   if (!inv) throw new Error("Invalid PIN");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
@@ -1226,6 +1278,31 @@ async function acceptInvitationByPin(opts, store) {
   });
   return { workspaceId: inv.workspaceId, roleId: inv.roleId };
 }
+async function acceptInvitationByToken(token, userId, store) {
+  const [inv] = await store.query(
+    `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
+		 FROM fonderie_workspace_invitations
+		 WHERE token = $1 AND status = 'PENDING'`,
+    [token]
+  );
+  if (!inv) throw new Error("Invalid token");
+  if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await store.transaction(async (tx) => {
+    await Promise.all([
+      tx.query(
+        `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
+				 VALUES ($1, $2, $3, true)
+				 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
+				 SET confirmed = true, removed = false`,
+        [userId, inv.workspaceId, inv.roleId]
+      ),
+      tx.query(`UPDATE fonderie_workspace_invitations SET status = 'ACCEPTED' WHERE id = $1`, [
+        inv.id
+      ])
+    ]);
+  });
+  return { workspaceId: inv.workspaceId, roleId: inv.roleId };
+}
 
 // src/models/invitation.model.ts
 var InvitationModel = class {
@@ -1245,6 +1322,9 @@ var InvitationModel = class {
   acceptByPin(opts) {
     return acceptInvitationByPin(opts, this.store);
   }
+  acceptByToken(token, userId) {
+    return acceptInvitationByToken(token, userId, this.store);
+  }
 };
 
 // src/controllers/invitation.controller.ts
@@ -1258,17 +1338,17 @@ function invitationController(store, ttl, bus) {
   const invitations = new InvitationModel(store);
   return {
     async list(ctx) {
-      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const list = await invitations.list(ctx.workspace.id);
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATIONS_FETCHED", "Invitations retrieved successfully.", {
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "INVITATIONS_FETCHED", "Invitations retrieved successfully.", {
         invitations: list.map(toInvitationDTO)
       });
     },
     async invite(ctx) {
-      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return (0, import_core5.setApiResponse)(
-          import_core5.HTTP.FORBIDDEN,
+        return (0, import_core6.setApiResponse)(
+          import_core6.HTTP.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces do not support invitations"
         );
@@ -1276,11 +1356,11 @@ function invitationController(store, ttl, bus) {
       const body = ctx.meta["body"];
       const entries = Array.isArray(body) ? body : [body];
       if (!entries.length) {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "at least one invite is required");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "at least one invite is required");
       }
       for (const entry of entries) {
         if (typeof entry?.["email"] !== "string") {
-          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required for every invite");
+          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required for every invite");
         }
       }
       const seatLimit = seatLimitFromMeta(ctx);
@@ -1293,8 +1373,8 @@ function invitationController(store, ttl, bus) {
         const total = parseInt(countRow.count, 10);
         const occupied = ctx.workspace.isPersonal ? total : Math.max(0, total - 1);
         if (occupied + entries.length > seatLimit) {
-          return (0, import_core5.setApiResponse)(
-            import_core5.HTTP.PAYMENT_REQUIRED,
+          return (0, import_core6.setApiResponse)(
+            import_core6.HTTP.PAYMENT_REQUIRED,
             "SEAT_LIMIT_REACHED",
             `Your plan allows ${seatLimit} seat${seatLimit === 1 ? "" : "s"}. Upgrade to invite more members.`,
             { limit: seatLimit }
@@ -1311,7 +1391,7 @@ function invitationController(store, ttl, bus) {
         );
         defaultRoleId = row?.id;
         if (!defaultRoleId) {
-          return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
+          return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
       const results = await Promise.all(
@@ -1333,33 +1413,48 @@ function invitationController(store, ttl, bus) {
           return { invitationId: invitation.id, email: email2 };
         })
       );
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
         invitations: results
       });
     },
     async cancel(ctx) {
-      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return (0, import_core6.setApiResponse)(import_core6.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const invitationId = params?.["inviteId"];
       if (!invitationId)
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "inviteId is required");
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "inviteId is required");
       await invitations.cancel(invitationId, ctx.workspace.id);
-      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATION_CANCELLED", "Invitation cancelled successfully.");
+      return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "INVITATION_CANCELLED", "Invitation cancelled successfully.");
     },
     async accept(ctx) {
       const body = ctx.meta["body"];
       const pin = body?.["pin"];
-      if (typeof pin !== "string") {
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "pin is required");
-      }
+      const token = body?.["token"];
       try {
-        const { workspaceId } = await invitations.acceptByPin({ pin, userId: ctx.user.id });
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
+        if (typeof token === "string") {
+          const { workspaceId: workspaceId2 } = await invitations.acceptByToken(token, ctx.user.id);
+          return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
+            workspaceId: workspaceId2
+          });
+        }
+        if (typeof pin !== "string") {
+          return (0, import_core6.setApiResponse)(import_core6.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "pin or token is required");
+        }
+        const email2 = ctx.user.email;
+        if (!email2) {
+          return (0, import_core6.setApiResponse)(
+            import_core6.HTTP.BAD_REQUEST,
+            "INVITATION_FAILED",
+            "This account has no email address \u2014 use the invitation link instead of the PIN"
+          );
+        }
+        const { workspaceId } = await invitations.acceptByPin({ pin, userId: ctx.user.id, email: email2 });
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
           workspaceId
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "Invalid invitation";
-        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "INVITATION_FAILED", message);
+        return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "INVITATION_FAILED", message);
       }
     }
   };
@@ -1369,6 +1464,12 @@ function invitationController(store, ttl, bus) {
 function buildWorkspaceRoutes(store, config, bus) {
   const ttl = config.invitationTtl ?? "7d";
   const wsCtx = withWorkspace(store);
+  const manager = requireManager(store, config);
+  const acceptLimit = (0, import_rate_limit.rateLimit)({
+    store: new import_rate_limit.StoreAdapterStore(store),
+    rule: { capacity: 10, refillPerSec: 10 / (15 * 60) },
+    key: (0, import_rate_limit.byIp)("workspaces:invitation-accept")
+  });
   const workspace = workspaceController(store, config);
   const member = memberController(store);
   const role = roleController(store);
@@ -1385,34 +1486,34 @@ function buildWorkspaceRoutes(store, config, bus) {
     R("listWorkspaces", "GET", "/workspaces", import_middlewares.requireAuth, workspace.list),
     // ── Members (workspace resolved from X-Workspace-ID header)
     R("listMembers", "GET", "/workspaces/members", import_middlewares.requireAuth, wsCtx, member.list),
-    R("removeMember", "DELETE", "/workspaces/members/:userId", import_middlewares.requireAuth, wsCtx, member.remove),
+    R("removeMember", "DELETE", "/workspaces/members/:userId", import_middlewares.requireAuth, wsCtx, manager, member.remove),
     R("getMemberRoles", "GET", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, member.getUserRoles),
-    R("addMemberRole", "POST", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(addMemberRoleSchema), member.addRole),
-    R("removeMemberRole", "DELETE", "/workspaces/members/:userId/roles/:roleId", import_middlewares.requireAuth, wsCtx, member.removeRole),
+    R("addMemberRole", "POST", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(addMemberRoleSchema), member.addRole),
+    R("removeMemberRole", "DELETE", "/workspaces/members/:userId/roles/:roleId", import_middlewares.requireAuth, wsCtx, manager, member.removeRole),
     // ── Invitations
     R("listInvitations", "GET", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, invitation.list),
-    R("invite", "POST", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(createInvitationsSchema), invitation.invite),
-    R("cancelInvitation", "DELETE", "/workspaces/invitations/:inviteId", import_middlewares.requireAuth, wsCtx, invitation.cancel),
-    R("acceptInvitation", "POST", "/workspaces/invitations/accept", import_middlewares.requireAuth, (0, import_middlewares.validate)(acceptInvitationSchema), invitation.accept),
+    R("invite", "POST", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(createInvitationsSchema), invitation.invite),
+    R("cancelInvitation", "DELETE", "/workspaces/invitations/:inviteId", import_middlewares.requireAuth, wsCtx, manager, invitation.cancel),
+    R("acceptInvitation", "POST", "/workspaces/invitations/accept", acceptLimit, import_middlewares.requireAuth, (0, import_middlewares.validate)(acceptInvitationSchema), invitation.accept),
     // ── Roles
-    R("createRole", "POST", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(createRoleSchema), role.create),
+    R("createRole", "POST", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(createRoleSchema), role.create),
     R("listRoles", "GET", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, role.list),
     R("getRole", "GET", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.get),
-    R("updateRole", "PUT", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateRoleSchema), role.update),
-    R("removeRole", "DELETE", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.remove),
+    R("updateRole", "PUT", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(updateRoleSchema), role.update),
+    R("removeRole", "DELETE", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, manager, role.remove),
     R("getRolePermissions", "GET", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, role.getPermissions),
-    R("setRolePermissions", "POST", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(setRolePermissionsSchema), role.setPermissions),
+    R("setRolePermissions", "POST", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(setRolePermissionsSchema), role.setPermissions),
     // ── Workspace lifecycle
-    R("archive", "POST", "/workspaces/archive", import_middlewares.requireAuth, wsCtx, workspace.archive),
-    R("restore", "POST", "/workspaces/restore", import_middlewares.requireAuth, wsCtx, workspace.restore),
+    R("archive", "POST", "/workspaces/archive", import_middlewares.requireAuth, wsCtx, manager, workspace.archive),
+    R("restore", "POST", "/workspaces/restore", import_middlewares.requireAuth, wsCtx, manager, workspace.restore),
     R("getSettings", "GET", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, workspace.getSettings),
-    R("updateSettings", "PUT", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateSettingsSchema), workspace.updateSettings),
+    R("updateSettings", "PUT", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(updateSettingsSchema), workspace.updateSettings),
     // ── Path-based lookup by ID (admin / cross-workspace use)
     R("getWorkspace", "GET", "/workspaces/:id", import_middlewares.requireAuth, wsCtx, workspace.get),
     // ── Update current workspace — ID from :id path param (wsCtx) or the
     // X-Workspace-ID header (or personal-workspace fallback when absent). Set
     // routes.updateWorkspace = '/workspaces/:id' to match a path-id frontend.
-    R("updateWorkspace", "PUT", "/workspaces", import_middlewares.requireAuth, wsCtx, (0, import_middlewares.validate)(updateWorkspaceSchema), workspace.update)
+    R("updateWorkspace", "PUT", "/workspaces", import_middlewares.requireAuth, wsCtx, manager, (0, import_middlewares.validate)(updateWorkspaceSchema), workspace.update)
   ];
 }
 
@@ -1496,10 +1597,10 @@ var SAMPLE_PAYLOADS = {
 };
 
 // src/middlewares/require-workspace.ts
-var import_core6 = require("@fonderie/core");
+var import_core7 = require("@fonderie/core");
 var requireWorkspace = async (ctx, next) => {
   if (!ctx.workspace) {
-    return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
+    return (0, import_core7.setApiResponse)(import_core7.HTTP.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
   }
   return next();
 };
@@ -1612,6 +1713,7 @@ function workspaceExportContributor(store) {
   importMembership,
   importRole,
   importWorkspace,
+  requireManager,
   requireWorkspace,
   schemas,
   toInvitationDTO,