@fonderie/workspaces 6.0.0 → 6.0.2

package/brain/signatures.md

@@ -15,6 +15,7 @@ new WorkspacesModule(store: IStoreAdapter, config?: IWorkspacesConfig, bus?: Eve
 interface IWorkspacesConfig {
     invitationTtl?: string;
     management?: 'owner-or-admin' | 'any-member';
+    managerRoles?: string[];
     personalWorkspace?: boolean;
     routes?: Partial<Record<WorkspaceRouteId, WorkspaceRouteOverride>>;
 }

package/dist/index.cjs

@@ -468,6 +468,7 @@ function withWorkspace(store, ctx, next) {
 // src/middlewares/require-manager.ts
 var import_core2 = require("@fonderie/core");
 function requireManager(store, config) {
+  const managerRoles = config.managerRoles ?? ["ADMIN"];
   return async (ctx, next) => {
     if (config.management === "any-member") return next();
     if (!ctx.user) {
@@ -486,8 +487,9 @@ function requireManager(store, config) {
 			   AND ruw.suspended    = false
 			   AND r.is_system    = true
 			   AND r.active       = true
+			   AND r.name         = ANY($3)
 			 LIMIT 1`,
-      [ctx.user.id, ctx.workspace.id]
+      [ctx.user.id, ctx.workspace.id, managerRoles]
     );
     if (!row) {
       return (0, import_core2.setApiResponse)(
@@ -1394,6 +1396,25 @@ function invitationController(store, ttl, bus) {
           return (0, import_core6.setApiResponse)(import_core6.HTTP.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
+      const explicitRoleIds = [...new Set(
+        entries.map((e) => e["roleId"]).filter((r) => typeof r === "string")
+      )];
+      if (explicitRoleIds.length > 0) {
+        const rows = await store.query(
+          `SELECT id FROM fonderie_roles
+					 WHERE id = ANY($1) AND workspace_id = $2 AND is_system = false`,
+          [explicitRoleIds, ctx.workspace.id]
+        );
+        const assignable = new Set(rows.map((r) => r.id));
+        const bad = explicitRoleIds.find((id) => !assignable.has(id));
+        if (bad) {
+          return (0, import_core6.setApiResponse)(
+            import_core6.HTTP.UNPROCESSABLE,
+            "INVALID_ROLE",
+            "Role is not assignable in this workspace."
+          );
+        }
+      }
       const results = await Promise.all(
         entries.map(async (entry) => {
           const email2 = entry["email"];