@fonderie/workspaces 6.0.0 → 6.0.2

package/dist/index.d.cts

@@ -17,6 +17,7 @@ type WorkspacesEventKey = (typeof EVENT_KEYS)[keyof typeof EVENT_KEYS];
 interface IWorkspacesConfig {
     invitationTtl?: string;
     management?: 'owner-or-admin' | 'any-member';
+    managerRoles?: string[];
     personalWorkspace?: boolean;
     routes?: Partial<Record<WorkspaceRouteId, WorkspaceRouteOverride>>;
 }

package/dist/index.d.ts

@@ -17,6 +17,7 @@ type WorkspacesEventKey = (typeof EVENT_KEYS)[keyof typeof EVENT_KEYS];
 interface IWorkspacesConfig {
     invitationTtl?: string;
     management?: 'owner-or-admin' | 'any-member';
+    managerRoles?: string[];
     personalWorkspace?: boolean;
     routes?: Partial<Record<WorkspaceRouteId, WorkspaceRouteOverride>>;
 }

package/dist/index.js

@@ -430,6 +430,7 @@ function withWorkspace(store, ctx, next) {
 // src/middlewares/require-manager.ts
 import { setApiResponse as setApiResponse2, HTTP as HTTP2 } from "@fonderie/core";
 function requireManager(store, config) {
+  const managerRoles = config.managerRoles ?? ["ADMIN"];
   return async (ctx, next) => {
     if (config.management === "any-member") return next();
     if (!ctx.user) {
@@ -448,8 +449,9 @@ function requireManager(store, config) {
 			   AND ruw.suspended    = false
 			   AND r.is_system    = true
 			   AND r.active       = true
+			   AND r.name         = ANY($3)
 			 LIMIT 1`,
-      [ctx.user.id, ctx.workspace.id]
+      [ctx.user.id, ctx.workspace.id, managerRoles]
     );
     if (!row) {
       return setApiResponse2(
@@ -1356,6 +1358,25 @@ function invitationController(store, ttl, bus) {
           return setApiResponse6(HTTP6.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
         }
       }
+      const explicitRoleIds = [...new Set(
+        entries.map((e) => e["roleId"]).filter((r) => typeof r === "string")
+      )];
+      if (explicitRoleIds.length > 0) {
+        const rows = await store.query(
+          `SELECT id FROM fonderie_roles
+					 WHERE id = ANY($1) AND workspace_id = $2 AND is_system = false`,
+          [explicitRoleIds, ctx.workspace.id]
+        );
+        const assignable = new Set(rows.map((r) => r.id));
+        const bad = explicitRoleIds.find((id) => !assignable.has(id));
+        if (bad) {
+          return setApiResponse6(
+            HTTP6.UNPROCESSABLE,
+            "INVALID_ROLE",
+            "Role is not assignable in this workspace."
+          );
+        }
+      }
       const results = await Promise.all(
         entries.map(async (entry) => {
           const email2 = entry["email"];