@fonderie/workspaces 5.3.2 → 6.0.0

package/dist/index.js

@@ -14,6 +14,7 @@ var EVENT_KEYS = {
 
 // src/routes.ts
 import { requireAuth, validate } from "@fonderie/core/middlewares";
+import { byIp, rateLimit, StoreAdapterStore } from "@fonderie/rate-limit";
 
 // src/schemas.ts
 var schemas_exports = {};
@@ -70,7 +71,10 @@ var createInvitationsSchema = z.union([
   inviteEntry,
   z.array(inviteEntry).min(1, "at least one invite is required")
 ]);
-var acceptInvitationSchema = z.object({ pin: z.string().trim().min(1, "pin is required") });
+var acceptInvitationSchema = z.union([
+  z.object({ pin: z.string().trim().min(1, "pin is required") }),
+  z.object({ token: z.string().trim().min(1, "token is required") })
+]);
 var createRoleSchema = z.object({
   name,
   description: z.string().max(1e3).optional()
@@ -423,8 +427,43 @@ function withWorkspace(store, ctx, next) {
   return handler;
 }
 
-// src/controllers/workspace.controller.ts
+// src/middlewares/require-manager.ts
 import { setApiResponse as setApiResponse2, HTTP as HTTP2 } from "@fonderie/core";
+function requireManager(store, config) {
+  return async (ctx, next) => {
+    if (config.management === "any-member") return next();
+    if (!ctx.user) {
+      return setApiResponse2(HTTP2.UNAUTHORIZED, "UNAUTHORIZED", "Unauthorized");
+    }
+    if (!ctx.workspace) return next();
+    const ownerId = ctx.workspace.ownerId;
+    if (ownerId && ownerId === ctx.user.id) return next();
+    const [row] = await store.query(
+      `SELECT 1 AS ok
+			 FROM fonderie_role_user_workspaces ruw
+			 JOIN fonderie_roles r ON r.id = ruw.role_id
+			 WHERE ruw.user_id      = $1
+			   AND ruw.workspace_id = $2
+			   AND ruw.removed      = false
+			   AND ruw.suspended    = false
+			   AND r.is_system    = true
+			   AND r.active       = true
+			 LIMIT 1`,
+      [ctx.user.id, ctx.workspace.id]
+    );
+    if (!row) {
+      return setApiResponse2(
+        HTTP2.FORBIDDEN,
+        "MANAGER_REQUIRED",
+        "This action requires the workspace owner or an admin role"
+      );
+    }
+    return next();
+  };
+}
+
+// src/controllers/workspace.controller.ts
+import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
 
 // src/models/workspace.model.ts
 var WorkspaceModel = class {
@@ -702,7 +741,11 @@ function toInvitationDTO(inv) {
     workspaceId: stringOrEmpty(inv.workspaceId),
     email: stringOrEmpty(inv.email),
     roleId: stringOrEmpty(inv.roleId),
-    token: stringOrEmpty(inv.token),
+    // The accept token is a bearer credential delivered to the INVITEE by
+    // email — never expose it through the API. Listing invitations used to
+    // leak it, letting any member accept (hijack) someone else's pending
+    // invite. The field stays for DTO-shape compatibility, always empty.
+    token: "",
     status: stringOrEmpty(inv.status),
     expiresAt: dateOrEmpty(inv.expiresAt),
     createdAt: dateOrEmpty(inv.createdAt)
@@ -726,9 +769,9 @@ function workspaceController(store, config) {
   return {
     async list(ctx) {
       if (!ctx.user)
-        return setApiResponse2(HTTP2.UNAUTHORIZED, "UNAUTHORIZED", "Authentication required");
+        return setApiResponse3(HTTP3.UNAUTHORIZED, "UNAUTHORIZED", "Authentication required");
       const list = await workspaces.findByUserId(ctx.user.id);
-      return setApiResponse2(HTTP2.OK, "WORKSPACES_FETCHED", "Workspaces retrieved successfully.", {
+      return setApiResponse3(HTTP3.OK, "WORKSPACES_FETCHED", "Workspaces retrieved successfully.", {
         workspaces: list.map(toWorkspaceDTO)
       });
     },
@@ -738,11 +781,11 @@ function workspaceController(store, config) {
       const description = body?.["description"];
       const type = body?.["type"];
       if (typeof name2 !== "string" || name2.trim().length === 0) {
-        return setApiResponse2(HTTP2.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       if (type === "PERSONAL") {
-        return setApiResponse2(
-          HTTP2.UNPROCESSABLE,
+        return setApiResponse3(
+          HTTP3.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "Personal workspaces are created automatically"
         );
@@ -765,18 +808,18 @@ function workspaceController(store, config) {
         await memModel.add({ userId: ctx.user.id, workspaceId: ws.id, roleId: adminRole.id });
         return ws;
       });
-      return setApiResponse2(HTTP2.CREATED, "WORKSPACE_CREATED", "Workspace created successfully.", {
+      return setApiResponse3(HTTP3.CREATED, "WORKSPACE_CREATED", "Workspace created successfully.", {
         workspace: toWorkspaceDTO(workspace)
       });
     },
     async get(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
-      return setApiResponse2(HTTP2.OK, "WORKSPACE_FETCHED", "Workspace retrieved successfully.", {
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return setApiResponse3(HTTP3.OK, "WORKSPACE_FETCHED", "Workspace retrieved successfully.", {
         workspace: toWorkspaceDTO(ctx.workspace)
       });
     },
     async update(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const body = ctx.meta["body"];
       const opts = {};
       if (typeof body?.["name"] === "string") opts.name = body["name"].trim();
@@ -791,33 +834,33 @@ function workspaceController(store, config) {
       if (body?.["address"] !== void 0 && typeof body["address"] === "object")
         opts.address = body["address"] ?? null;
       const workspace = await workspaces.update(ctx.workspace.id, opts);
-      if (!workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
-      return setApiResponse2(HTTP2.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
+      if (!workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return setApiResponse3(HTTP3.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
         workspace: toWorkspaceDTO(workspace)
       });
     },
     async archive(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return setApiResponse2(
-          HTTP2.FORBIDDEN,
+        return setApiResponse3(
+          HTTP3.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces cannot be archived"
         );
       }
       await workspaces.archive(ctx.workspace.id, ctx.user.id);
-      return setApiResponse2(HTTP2.OK, "WORKSPACE_ARCHIVED", "Workspace archived successfully.");
+      return setApiResponse3(HTTP3.OK, "WORKSPACE_ARCHIVED", "Workspace archived successfully.");
     },
     async restore(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       await workspaces.restore(ctx.workspace.id);
-      return setApiResponse2(HTTP2.OK, "WORKSPACE_RESTORED", "Workspace restored successfully.");
+      return setApiResponse3(HTTP3.OK, "WORKSPACE_RESTORED", "Workspace restored successfully.");
     },
     async getSettings(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const settings = await workspaces.getSettings(ctx.workspace.id);
-      return setApiResponse2(
-        HTTP2.OK,
+      return setApiResponse3(
+        HTTP3.OK,
         "SETTINGS_FETCHED",
         "Workspace settings retrieved successfully.",
         {
@@ -826,18 +869,18 @@ function workspaceController(store, config) {
       );
     },
     async updateSettings(ctx) {
-      if (!ctx.workspace) return setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const body = ctx.meta["body"];
       if (!body || Object.keys(body).length === 0) {
-        return setApiResponse2(HTTP2.UNPROCESSABLE, "INVALID_PARAMETER", "No settings provided");
+        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "No settings provided");
       }
       const patch = {};
       for (const key of ["locale", "timezone", "currency", "dateFormat", "timeFormat"]) {
         if (typeof body[key] === "string") patch[key] = body[key];
       }
       const settings = await workspaces.updateSettings(ctx.workspace.id, patch);
-      return setApiResponse2(
-        HTTP2.OK,
+      return setApiResponse3(
+        HTTP3.OK,
         "SETTINGS_UPDATED",
         "Workspace settings updated successfully.",
         {
@@ -849,22 +892,22 @@ function workspaceController(store, config) {
 }
 
 // src/controllers/member.controller.ts
-import { setApiResponse as setApiResponse3, HTTP as HTTP3 } from "@fonderie/core";
+import { setApiResponse as setApiResponse4, HTTP as HTTP4 } from "@fonderie/core";
 function memberController(store) {
   const members = new MemberModel(store);
   return {
     async list(ctx) {
-      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const list = await members.list(ctx.workspace.id);
-      return setApiResponse3(HTTP3.OK, "MEMBERS_FETCHED", "Members retrieved successfully.", {
+      return setApiResponse4(HTTP4.OK, "MEMBERS_FETCHED", "Members retrieved successfully.", {
         members: list.map(toMemberDTO)
       });
     },
     async remove(ctx) {
-      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return setApiResponse3(
-          HTTP3.FORBIDDEN,
+        return setApiResponse4(
+          HTTP4.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces do not support member management"
         );
@@ -872,78 +915,86 @@ function memberController(store) {
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       if (!userId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (userId === ctx.user?.id) {
-        return setApiResponse3(HTTP3.BAD_REQUEST, "INVALID_OPERATION", "Cannot remove yourself");
+        return setApiResponse4(HTTP4.BAD_REQUEST, "INVALID_OPERATION", "Cannot remove yourself");
+      }
+      const ownerId = ctx.workspace.ownerId;
+      if (ownerId && userId === ownerId) {
+        return setApiResponse4(
+          HTTP4.BAD_REQUEST,
+          "INVALID_OPERATION",
+          "Cannot remove the workspace owner"
+        );
       }
       await members.remove(userId, ctx.workspace.id);
-      return setApiResponse3(HTTP3.OK, "MEMBER_REMOVED", "Member removed successfully.");
+      return setApiResponse4(HTTP4.OK, "MEMBER_REMOVED", "Member removed successfully.");
     },
     async getUserRoles(ctx) {
-      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       if (!userId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       const roles = await members.getUserRoles(userId, ctx.workspace.id);
-      return setApiResponse3(HTTP3.OK, "ROLES_FETCHED", "Member roles retrieved successfully.", {
+      return setApiResponse4(HTTP4.OK, "ROLES_FETCHED", "Member roles retrieved successfully.", {
         roles: roles.map(toRoleDTO)
       });
     },
     async addRole(ctx) {
-      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const userId = params?.["userId"];
       const roleId = body?.["roleId"] ?? params?.["roleId"];
       if (!userId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       const assigned = await members.addRole(userId, ctx.workspace.id, roleId);
       if (!assigned) {
-        return setApiResponse3(
-          HTTP3.UNPROCESSABLE,
+        return setApiResponse4(
+          HTTP4.UNPROCESSABLE,
           "INVALID_ROLE",
           "Role is not assignable in this workspace."
         );
       }
-      return setApiResponse3(HTTP3.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
+      return setApiResponse4(HTTP4.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
     },
     async removeRole(ctx) {
-      if (!ctx.workspace) return setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const userId = params?.["userId"];
       const roleId = params?.["roleId"];
       if (!userId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
       if (!roleId)
-        return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       try {
         await members.removeRole(userId, ctx.workspace.id, roleId);
-        return setApiResponse3(HTTP3.OK, "ROLE_REMOVED", "Role removed successfully.");
+        return setApiResponse4(HTTP4.OK, "ROLE_REMOVED", "Role removed successfully.");
       } catch (err) {
         const message = err instanceof Error ? err.message : "Failed";
-        return setApiResponse3(HTTP3.BAD_REQUEST, "OPERATION_FAILED", message);
+        return setApiResponse4(HTTP4.BAD_REQUEST, "OPERATION_FAILED", message);
       }
     }
   };
 }
 
 // src/controllers/role.controller.ts
-import { setApiResponse as setApiResponse4, HTTP as HTTP4 } from "@fonderie/core";
+import { setApiResponse as setApiResponse5, HTTP as HTTP5 } from "@fonderie/core";
 function roleController(store) {
   const roles = new RoleModel(store);
   return {
     async create(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const body = ctx.meta["body"];
       const name2 = body?.["name"];
       const description = body?.["description"];
       if (typeof name2 !== "string" || name2.trim().length === 0) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
       }
       try {
         const opts = {
@@ -954,49 +1005,49 @@ function roleController(store) {
           opts.description = description;
         }
         const role = await roles.create(opts);
-        return setApiResponse4(HTTP4.CREATED, "ROLE_CREATED", "Role created successfully.", {
+        return setApiResponse5(HTTP5.CREATED, "ROLE_CREATED", "Role created successfully.", {
           role: toRoleDTO(role)
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "Failed to create role";
-        return setApiResponse4(HTTP4.BAD_REQUEST, "OPERATION_FAILED", message);
+        return setApiResponse5(HTTP5.BAD_REQUEST, "OPERATION_FAILED", message);
       }
     },
     async list(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const list = await roles.list(ctx.workspace.id);
-      return setApiResponse4(HTTP4.OK, "ROLES_FETCHED", "Roles retrieved successfully.", {
+      return setApiResponse5(HTTP5.OK, "ROLES_FETCHED", "Roles retrieved successfully.", {
         roles: list.map(toRoleDTO)
       });
     },
     async get(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
-      return setApiResponse4(HTTP4.OK, "ROLE_FETCHED", "Role retrieved successfully.", {
+      return setApiResponse5(HTTP5.OK, "ROLE_FETCHED", "Role retrieved successfully.", {
         role: toRoleDTO(role)
       });
     },
     async update(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const opts = {};
       if (typeof body?.["name"] === "string") {
@@ -1013,60 +1064,60 @@ function roleController(store) {
       }
       const role = await roles.update(roleId, ctx.workspace.id, opts);
       if (!role) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
       }
-      return setApiResponse4(HTTP4.OK, "ROLE_UPDATED", "Role updated successfully.", {
+      return setApiResponse5(HTTP5.OK, "ROLE_UPDATED", "Role updated successfully.", {
         role: toRoleDTO(role)
       });
     },
     async remove(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       await roles.delete(roleId, ctx.workspace.id);
-      return setApiResponse4(HTTP4.OK, "ROLE_DELETED", "Role deleted successfully.");
+      return setApiResponse5(HTTP5.OK, "ROLE_DELETED", "Role deleted successfully.");
     },
     async getPermissions(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const role = await roles.findById(roleId, ctx.workspace.id);
       if (!role) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
       const permissions = await roles.getPermissions(roleId, ctx.workspace.id);
-      return setApiResponse4(HTTP4.OK, "PERMISSIONS_FETCHED", "Role permissions retrieved successfully.", {
+      return setApiResponse5(HTTP5.OK, "PERMISSIONS_FETCHED", "Role permissions retrieved successfully.", {
         permissions
       });
     },
     async setPermissions(ctx) {
       if (!ctx.workspace) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       }
       const params = ctx.meta["params"];
       const body = ctx.meta["body"];
       const roleId = params?.["roleId"];
       if (!roleId) {
-        return setApiResponse4(HTTP4.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
       }
       const target = await roles.findById(roleId, ctx.workspace.id);
       if (!target || target.isSystem) {
-        return setApiResponse4(HTTP4.NOT_FOUND, "NOT_FOUND", "Role not found");
+        return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Role not found");
       }
       const perms = body?.["permissions"];
       if (!Array.isArray(perms)) {
-        return setApiResponse4(
-          HTTP4.UNPROCESSABLE,
+        return setApiResponse5(
+          HTTP5.UNPROCESSABLE,
           "INVALID_PARAMETER",
           "permissions array is required"
         );
@@ -1082,22 +1133,22 @@ function roleController(store) {
         };
       }).filter((p) => p.permissionKey.length > 0);
       await roles.setPermissions(roleId, ctx.workspace.id, normalized);
-      return setApiResponse4(HTTP4.OK, "PERMISSIONS_SET", "Role permissions updated successfully.");
+      return setApiResponse5(HTTP5.OK, "PERMISSIONS_SET", "Role permissions updated successfully.");
     }
   };
 }
 
 // src/controllers/invitation.controller.ts
-import { setApiResponse as setApiResponse5, HTTP as HTTP5 } from "@fonderie/core";
+import { setApiResponse as setApiResponse6, HTTP as HTTP6 } from "@fonderie/core";
 import { NOTIFICATION_EVENT } from "@fonderie/events";
 
 // src/services/invitations.ts
-import { randomBytes } from "crypto";
+import { randomBytes, randomInt } from "crypto";
 function generateToken() {
   return randomBytes(32).toString("hex");
 }
 function generatePin() {
-  return Math.floor(1e5 + Math.random() * 9e5).toString();
+  return randomInt(1e5, 1e6).toString();
 }
 function parseTtl(ttl) {
   const units = {
@@ -1168,8 +1219,8 @@ async function acceptInvitationByPin(opts, store) {
   const [inv] = await store.query(
     `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
 		 FROM fonderie_workspace_invitations
-		 WHERE pin = $1 AND status = 'PENDING'`,
-    [opts.pin]
+		 WHERE pin = $1 AND lower(email) = lower($2) AND status = 'PENDING'`,
+    [opts.pin, opts.email]
   );
   if (!inv) throw new Error("Invalid PIN");
   if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
@@ -1189,6 +1240,31 @@ async function acceptInvitationByPin(opts, store) {
   });
   return { workspaceId: inv.workspaceId, roleId: inv.roleId };
 }
+async function acceptInvitationByToken(token, userId, store) {
+  const [inv] = await store.query(
+    `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
+		 FROM fonderie_workspace_invitations
+		 WHERE token = $1 AND status = 'PENDING'`,
+    [token]
+  );
+  if (!inv) throw new Error("Invalid token");
+  if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await store.transaction(async (tx) => {
+    await Promise.all([
+      tx.query(
+        `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
+				 VALUES ($1, $2, $3, true)
+				 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
+				 SET confirmed = true, removed = false`,
+        [userId, inv.workspaceId, inv.roleId]
+      ),
+      tx.query(`UPDATE fonderie_workspace_invitations SET status = 'ACCEPTED' WHERE id = $1`, [
+        inv.id
+      ])
+    ]);
+  });
+  return { workspaceId: inv.workspaceId, roleId: inv.roleId };
+}
 
 // src/models/invitation.model.ts
 var InvitationModel = class {
@@ -1208,6 +1284,9 @@ var InvitationModel = class {
   acceptByPin(opts) {
     return acceptInvitationByPin(opts, this.store);
   }
+  acceptByToken(token, userId) {
+    return acceptInvitationByToken(token, userId, this.store);
+  }
 };
 
 // src/controllers/invitation.controller.ts
@@ -1221,17 +1300,17 @@ function invitationController(store, ttl, bus) {
   const invitations = new InvitationModel(store);
   return {
     async list(ctx) {
-      if (!ctx.workspace) return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse6(HTTP6.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const list = await invitations.list(ctx.workspace.id);
-      return setApiResponse5(HTTP5.OK, "INVITATIONS_FETCHED", "Invitations retrieved successfully.", {
+      return setApiResponse6(HTTP6.OK, "INVITATIONS_FETCHED", "Invitations retrieved successfully.", {
         invitations: list.map(toInvitationDTO)
       });
     },
     async invite(ctx) {
-      if (!ctx.workspace) return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse6(HTTP6.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       if (ctx.workspace.isPersonal) {
-        return setApiResponse5(
-          HTTP5.FORBIDDEN,
+        return setApiResponse6(
+          HTTP6.FORBIDDEN,
           "FORBIDDEN",
           "Personal workspaces do not support invitations"
         );
@@ -1239,11 +1318,11 @@ function invitationController(store, ttl, bus) {
       const body = ctx.meta["body"];
       const entries = Array.isArray(body) ? body : [body];
       if (!entries.length) {
-        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "at least one invite is required");
+        return setApiResponse6(HTTP6.UNPROCESSABLE, "INVALID_PARAMETER", "at least one invite is required");
       }
       for (const entry of entries) {
         if (typeof entry?.["email"] !== "string") {
-          return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "email is required for every invite");
+          return setApiResponse6(HTTP6.UNPROCESSABLE, "INVALID_PARAMETER", "email is required for every invite");
         }
       }
       const seatLimit = seatLimitFromMeta(ctx);
@@ -1256,8 +1335,8 @@ function invitationController(store, ttl, bus) {
         const total = parseInt(countRow.count, 10);
         const occupied = ctx.workspace.isPersonal ? total : Math.max(0, total - 1);
         if (occupied + entries.length > seatLimit) {
-          return setApiResponse5(
-            HTTP5.PAYMENT_REQUIRED,
+          return setApiResponse6(
+            HTTP6.PAYMENT_REQUIRED,
             "SEAT_LIMIT_REACHED",
             `Your plan allows ${seatLimit} seat${seatLimit === 1 ? "" : "s"}. Upgrade to invite more members.`,
             { limit: seatLimit }
@@ -1274,7 +1353,7 @@ function invitationController(store, ttl, bus) {
         );
         defaultRoleId = row?.id;
         if (!defaultRoleId) {
-          return setApiResponse5(HTTP5.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
+          return setApiResponse6(HTTP6.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
       const results = await Promise.all(
@@ -1296,33 +1375,48 @@ function invitationController(store, ttl, bus) {
           return { invitationId: invitation.id, email: email2 };
         })
       );
-      return setApiResponse5(HTTP5.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
+      return setApiResponse6(HTTP6.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
         invitations: results
       });
     },
     async cancel(ctx) {
-      if (!ctx.workspace) return setApiResponse5(HTTP5.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (!ctx.workspace) return setApiResponse6(HTTP6.NOT_FOUND, "NOT_FOUND", "Workspace not found");
       const params = ctx.meta["params"];
       const invitationId = params?.["inviteId"];
       if (!invitationId)
-        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "inviteId is required");
+        return setApiResponse6(HTTP6.UNPROCESSABLE, "INVALID_PARAMETER", "inviteId is required");
       await invitations.cancel(invitationId, ctx.workspace.id);
-      return setApiResponse5(HTTP5.OK, "INVITATION_CANCELLED", "Invitation cancelled successfully.");
+      return setApiResponse6(HTTP6.OK, "INVITATION_CANCELLED", "Invitation cancelled successfully.");
     },
     async accept(ctx) {
       const body = ctx.meta["body"];
       const pin = body?.["pin"];
-      if (typeof pin !== "string") {
-        return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "pin is required");
-      }
+      const token = body?.["token"];
       try {
-        const { workspaceId } = await invitations.acceptByPin({ pin, userId: ctx.user.id });
-        return setApiResponse5(HTTP5.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
+        if (typeof token === "string") {
+          const { workspaceId: workspaceId2 } = await invitations.acceptByToken(token, ctx.user.id);
+          return setApiResponse6(HTTP6.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
+            workspaceId: workspaceId2
+          });
+        }
+        if (typeof pin !== "string") {
+          return setApiResponse6(HTTP6.UNPROCESSABLE, "INVALID_PARAMETER", "pin or token is required");
+        }
+        const email2 = ctx.user.email;
+        if (!email2) {
+          return setApiResponse6(
+            HTTP6.BAD_REQUEST,
+            "INVITATION_FAILED",
+            "This account has no email address \u2014 use the invitation link instead of the PIN"
+          );
+        }
+        const { workspaceId } = await invitations.acceptByPin({ pin, userId: ctx.user.id, email: email2 });
+        return setApiResponse6(HTTP6.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
           workspaceId
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "Invalid invitation";
-        return setApiResponse5(HTTP5.BAD_REQUEST, "INVITATION_FAILED", message);
+        return setApiResponse6(HTTP6.BAD_REQUEST, "INVITATION_FAILED", message);
       }
     }
   };
@@ -1332,6 +1426,12 @@ function invitationController(store, ttl, bus) {
 function buildWorkspaceRoutes(store, config, bus) {
   const ttl = config.invitationTtl ?? "7d";
   const wsCtx = withWorkspace(store);
+  const manager = requireManager(store, config);
+  const acceptLimit = rateLimit({
+    store: new StoreAdapterStore(store),
+    rule: { capacity: 10, refillPerSec: 10 / (15 * 60) },
+    key: byIp("workspaces:invitation-accept")
+  });
   const workspace = workspaceController(store, config);
   const member = memberController(store);
   const role = roleController(store);
@@ -1348,34 +1448,34 @@ function buildWorkspaceRoutes(store, config, bus) {
     R("listWorkspaces", "GET", "/workspaces", requireAuth, workspace.list),
     // ── Members (workspace resolved from X-Workspace-ID header)
     R("listMembers", "GET", "/workspaces/members", requireAuth, wsCtx, member.list),
-    R("removeMember", "DELETE", "/workspaces/members/:userId", requireAuth, wsCtx, member.remove),
+    R("removeMember", "DELETE", "/workspaces/members/:userId", requireAuth, wsCtx, manager, member.remove),
     R("getMemberRoles", "GET", "/workspaces/members/:userId/roles", requireAuth, wsCtx, member.getUserRoles),
-    R("addMemberRole", "POST", "/workspaces/members/:userId/roles", requireAuth, wsCtx, validate(addMemberRoleSchema), member.addRole),
-    R("removeMemberRole", "DELETE", "/workspaces/members/:userId/roles/:roleId", requireAuth, wsCtx, member.removeRole),
+    R("addMemberRole", "POST", "/workspaces/members/:userId/roles", requireAuth, wsCtx, manager, validate(addMemberRoleSchema), member.addRole),
+    R("removeMemberRole", "DELETE", "/workspaces/members/:userId/roles/:roleId", requireAuth, wsCtx, manager, member.removeRole),
     // ── Invitations
     R("listInvitations", "GET", "/workspaces/invitations", requireAuth, wsCtx, invitation.list),
-    R("invite", "POST", "/workspaces/invitations", requireAuth, wsCtx, validate(createInvitationsSchema), invitation.invite),
-    R("cancelInvitation", "DELETE", "/workspaces/invitations/:inviteId", requireAuth, wsCtx, invitation.cancel),
-    R("acceptInvitation", "POST", "/workspaces/invitations/accept", requireAuth, validate(acceptInvitationSchema), invitation.accept),
+    R("invite", "POST", "/workspaces/invitations", requireAuth, wsCtx, manager, validate(createInvitationsSchema), invitation.invite),
+    R("cancelInvitation", "DELETE", "/workspaces/invitations/:inviteId", requireAuth, wsCtx, manager, invitation.cancel),
+    R("acceptInvitation", "POST", "/workspaces/invitations/accept", acceptLimit, requireAuth, validate(acceptInvitationSchema), invitation.accept),
     // ── Roles
-    R("createRole", "POST", "/workspaces/roles", requireAuth, wsCtx, validate(createRoleSchema), role.create),
+    R("createRole", "POST", "/workspaces/roles", requireAuth, wsCtx, manager, validate(createRoleSchema), role.create),
     R("listRoles", "GET", "/workspaces/roles", requireAuth, wsCtx, role.list),
     R("getRole", "GET", "/workspaces/roles/:roleId", requireAuth, wsCtx, role.get),
-    R("updateRole", "PUT", "/workspaces/roles/:roleId", requireAuth, wsCtx, validate(updateRoleSchema), role.update),
-    R("removeRole", "DELETE", "/workspaces/roles/:roleId", requireAuth, wsCtx, role.remove),
+    R("updateRole", "PUT", "/workspaces/roles/:roleId", requireAuth, wsCtx, manager, validate(updateRoleSchema), role.update),
+    R("removeRole", "DELETE", "/workspaces/roles/:roleId", requireAuth, wsCtx, manager, role.remove),
     R("getRolePermissions", "GET", "/workspaces/roles/:roleId/permissions", requireAuth, wsCtx, role.getPermissions),
-    R("setRolePermissions", "POST", "/workspaces/roles/:roleId/permissions", requireAuth, wsCtx, validate(setRolePermissionsSchema), role.setPermissions),
+    R("setRolePermissions", "POST", "/workspaces/roles/:roleId/permissions", requireAuth, wsCtx, manager, validate(setRolePermissionsSchema), role.setPermissions),
     // ── Workspace lifecycle
-    R("archive", "POST", "/workspaces/archive", requireAuth, wsCtx, workspace.archive),
-    R("restore", "POST", "/workspaces/restore", requireAuth, wsCtx, workspace.restore),
+    R("archive", "POST", "/workspaces/archive", requireAuth, wsCtx, manager, workspace.archive),
+    R("restore", "POST", "/workspaces/restore", requireAuth, wsCtx, manager, workspace.restore),
     R("getSettings", "GET", "/workspaces/settings", requireAuth, wsCtx, workspace.getSettings),
-    R("updateSettings", "PUT", "/workspaces/settings", requireAuth, wsCtx, validate(updateSettingsSchema), workspace.updateSettings),
+    R("updateSettings", "PUT", "/workspaces/settings", requireAuth, wsCtx, manager, validate(updateSettingsSchema), workspace.updateSettings),
     // ── Path-based lookup by ID (admin / cross-workspace use)
     R("getWorkspace", "GET", "/workspaces/:id", requireAuth, wsCtx, workspace.get),
     // ── Update current workspace — ID from :id path param (wsCtx) or the
     // X-Workspace-ID header (or personal-workspace fallback when absent). Set
     // routes.updateWorkspace = '/workspaces/:id' to match a path-id frontend.
-    R("updateWorkspace", "PUT", "/workspaces", requireAuth, wsCtx, validate(updateWorkspaceSchema), workspace.update)
+    R("updateWorkspace", "PUT", "/workspaces", requireAuth, wsCtx, manager, validate(updateWorkspaceSchema), workspace.update)
   ];
 }
 
@@ -1459,10 +1559,10 @@ var SAMPLE_PAYLOADS = {
 };
 
 // src/middlewares/require-workspace.ts
-import { setApiResponse as setApiResponse6, HTTP as HTTP6 } from "@fonderie/core";
+import { setApiResponse as setApiResponse7, HTTP as HTTP7 } from "@fonderie/core";
 var requireWorkspace = async (ctx, next) => {
   if (!ctx.workspace) {
-    return setApiResponse6(HTTP6.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
+    return setApiResponse7(HTTP7.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
   }
   return next();
 };
@@ -1574,6 +1674,7 @@ export {
   importMembership,
   importRole,
   importWorkspace,
+  requireManager,
   requireWorkspace,
   schemas_exports as schemas,
   toInvitationDTO,