@ftisindia/create-app 0.1.2 → 0.1.4

package/template/src/modules/memberships/application/services/memberships.service.ts

@@ -3,12 +3,18 @@ import {
   ForbiddenException,
   Injectable,
   NotFoundException,
-} from "@nestjs/common";
-import { MembershipStatus, Prisma } from "@prisma/client";
-import { PrismaService } from "../../../../database/prisma/prisma.service";
-import { RbacCacheService } from "../../../access-control/application/services/rbac-cache.service";
-import { AuthenticatedUser } from "../../../auth/types/authenticated-user";
-import { RequestContextService } from "../../../request-context/application/services/request-context.service";
+} from '@nestjs/common';
+import { MembershipStatus, Prisma } from '@prisma/client';
+import {
+  PaginationQueryDto,
+  resolvePageLimit,
+  toPage,
+} from '../../../../common/dto/pagination-query.dto';
+import { PrismaService } from '../../../../database/prisma/prisma.service';
+import { assertRoleWithinActorPermissions } from '../../../access-control/application/role-permission-policy';
+import { RbacCacheService } from '../../../access-control/application/services/rbac-cache.service';
+import { AuthenticatedUser } from '../../../auth/types/authenticated-user';
+import { RequestContextService } from '../../../request-context/application/services/request-context.service';
 
 const membershipDetailInclude = {
   user: {
@@ -47,14 +53,24 @@ export class MembershipsService {
     return this.assertActiveMembership(currentUser.id, orgId);
   }
 
-  async listMemberships(currentUser: AuthenticatedUser, orgId: string) {
+  async listMemberships(currentUser: AuthenticatedUser, orgId: string, query: PaginationQueryDto) {
     await this.assertActiveMembership(currentUser.id, orgId);
+    const limit = resolvePageLimit(query.limit);
 
-    return this.prisma.membership.findMany({
+    const rows = await this.prisma.membership.findMany({
       where: { orgId },
       include: membershipDetailInclude,
-      orderBy: [{ isOwner: "desc" }, { createdAt: "asc" }],
+      orderBy: [{ isOwner: 'desc' }, { createdAt: 'asc' }],
+      take: limit + 1,
+      ...(query.cursor
+        ? {
+            cursor: { id: query.cursor },
+            skip: 1,
+          }
+        : {}),
     });
+
+    return toPage(rows, limit);
   }
 
   async updateStatus(
@@ -87,7 +103,7 @@ export class MembershipsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "membership.status.update",
+        action: 'membership.status.update',
         targetId: target.id,
         metadata: {
           previousStatus: target.status,
@@ -102,9 +118,7 @@ export class MembershipsService {
       };
     });
 
-    this.rbacCache.invalidateMany(
-      result.affectedUserIds.map((userId) => ({ userId, orgId })),
-    );
+    this.rbacCache.invalidateMany(result.affectedUserIds.map((userId) => ({ userId, orgId })));
     return result.updated;
   }
 
@@ -127,13 +141,28 @@ export class MembershipsService {
             orgId,
           },
         },
-        select: { id: true, name: true },
+        select: {
+          id: true,
+          name: true,
+          permissions: {
+            select: { permission: { select: { key: true } } },
+          },
+        },
       });
 
       if (!role) {
-        throw new NotFoundException("Role was not found in this organisation.");
+        throw new NotFoundException('Role was not found in this organisation.');
       }
 
+      // Prevent privilege self-elevation: a non-owner actor may only assign a
+      // role whose permissions are a subset of their own effective permissions.
+      const actorContext = await this.rbacCache.getContext(currentUser.id, orgId);
+      assertRoleWithinActorPermissions({
+        actorIsOwner: actorContext.isOwner,
+        actorPermissionKeys: actorContext.permissionKeys,
+        rolePermissionKeys: role.permissions.map((rolePermission) => rolePermission.permission.key),
+      });
+
       const updated = await tx.membership.update({
         where: { id: target.id },
         data: { roleId },
@@ -143,7 +172,7 @@ export class MembershipsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "membership.role.update",
+        action: 'membership.role.update',
         targetId: target.id,
         metadata: {
           previousRoleId: target.roleId,
@@ -159,9 +188,7 @@ export class MembershipsService {
       };
     });
 
-    this.rbacCache.invalidateMany(
-      result.affectedUserIds.map((userId) => ({ userId, orgId })),
-    );
+    this.rbacCache.invalidateMany(result.affectedUserIds.map((userId) => ({ userId, orgId })));
     return result.updated;
   }
 
@@ -178,16 +205,10 @@ export class MembershipsService {
       this.assertMembershipCanBeModified(target);
 
       if (isOwner && target.status !== MembershipStatus.ACTIVE) {
-        throw new ConflictException(
-          "Only active memberships can be made owners.",
-        );
+        throw new ConflictException('Only active memberships can be made owners.');
       }
 
-      if (
-        !isOwner &&
-        target.isOwner &&
-        target.status === MembershipStatus.ACTIVE
-      ) {
+      if (!isOwner && target.isOwner && target.status === MembershipStatus.ACTIVE) {
         await this.ensureOtherActiveOwner(tx, orgId, target.id);
       }
 
@@ -200,7 +221,7 @@ export class MembershipsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "membership.owner.update",
+        action: 'membership.owner.update',
         targetId: target.id,
         metadata: {
           previousIsOwner: target.isOwner,
@@ -215,9 +236,7 @@ export class MembershipsService {
       };
     });
 
-    this.rbacCache.invalidateMany(
-      result.affectedUserIds.map((userId) => ({ userId, orgId })),
-    );
+    this.rbacCache.invalidateMany(result.affectedUserIds.map((userId) => ({ userId, orgId })));
     return result.updated;
   }
 
@@ -242,7 +261,7 @@ export class MembershipsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "membership.billing_contact.update",
+        action: 'membership.billing_contact.update',
         targetId: target.id,
         metadata: {
           previousIsBillingContact: target.isBillingContact,
@@ -257,29 +276,17 @@ export class MembershipsService {
       };
     });
 
-    this.rbacCache.invalidateMany(
-      result.affectedUserIds.map((userId) => ({ userId, orgId })),
-    );
+    this.rbacCache.invalidateMany(result.affectedUserIds.map((userId) => ({ userId, orgId })));
     return result.updated;
   }
 
-  async transferOwner(
-    currentUser: AuthenticatedUser,
-    orgId: string,
-    toMembershipId: string,
-  ) {
+  async transferOwner(currentUser: AuthenticatedUser, orgId: string, toMembershipId: string) {
     const result = await this.prisma.$transaction(async (tx) => {
-      const actorMembership = await this.assertActiveOwner(
-        currentUser.id,
-        orgId,
-        tx,
-      );
+      const actorMembership = await this.assertActiveOwner(currentUser.id, orgId, tx);
       const target = await this.findMembershipInOrg(tx, orgId, toMembershipId);
 
       if (target.status !== MembershipStatus.ACTIVE) {
-        throw new ConflictException(
-          "Ownership can only be transferred to an active membership.",
-        );
+        throw new ConflictException('Ownership can only be transferred to an active membership.');
       }
 
       if (actorMembership.id === target.id) {
@@ -302,7 +309,7 @@ export class MembershipsService {
       await this.writeAudit(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "membership.owner.transfer",
+        action: 'membership.owner.transfer',
         targetId: target.id,
         metadata: {
           fromMembershipId: actorMembership.id,
@@ -322,17 +329,11 @@ export class MembershipsService {
       };
     });
 
-    this.rbacCache.invalidateMany(
-      result.affectedUserIds.map((userId) => ({ userId, orgId })),
-    );
+    this.rbacCache.invalidateMany(result.affectedUserIds.map((userId) => ({ userId, orgId })));
     return result.updated;
   }
 
-  async assertActiveMembership(
-    userId: string,
-    orgId: string,
-    client: PrismaClient = this.prisma,
-  ) {
+  async assertActiveMembership(userId: string, orgId: string, client: PrismaClient = this.prisma) {
     this.requestContext.assertOrgScope(orgId);
 
     const membership = await client.membership.findUnique({
@@ -346,33 +347,23 @@ export class MembershipsService {
     });
 
     if (!membership || membership.status !== MembershipStatus.ACTIVE) {
-      throw new ForbiddenException(
-        "Active organisation membership is required.",
-      );
+      throw new ForbiddenException('Active organisation membership is required.');
     }
 
     return membership;
   }
 
-  async assertActiveOwner(
-    userId: string,
-    orgId: string,
-    client: PrismaClient = this.prisma,
-  ) {
+  async assertActiveOwner(userId: string, orgId: string, client: PrismaClient = this.prisma) {
     const membership = await this.assertActiveMembership(userId, orgId, client);
 
     if (!membership.isOwner) {
-      throw new ForbiddenException("Organisation owner access is required.");
+      throw new ForbiddenException('Organisation owner access is required.');
     }
 
     return membership;
   }
 
-  private async findMembershipInOrg(
-    client: PrismaClient,
-    orgId: string,
-    membershipId: string,
-  ) {
+  private async findMembershipInOrg(client: PrismaClient, orgId: string, membershipId: string) {
     const membership = await client.membership.findFirst({
       where: {
         id: membershipId,
@@ -382,9 +373,7 @@ export class MembershipsService {
     });
 
     if (!membership) {
-      throw new NotFoundException(
-        "Membership was not found in this organisation.",
-      );
+      throw new NotFoundException('Membership was not found in this organisation.');
     }
 
     return membership;
@@ -394,19 +383,14 @@ export class MembershipsService {
     membership: MembershipDetail,
     nextStatus: MembershipStatus,
   ) {
-    if (
-      membership.status === MembershipStatus.REVOKED &&
-      nextStatus !== MembershipStatus.REVOKED
-    ) {
-      throw new ConflictException(
-        "Revoked memberships cannot be reactivated or reused.",
-      );
+    if (membership.status === MembershipStatus.REVOKED && nextStatus !== MembershipStatus.REVOKED) {
+      throw new ConflictException('Revoked memberships cannot be reactivated or reused.');
     }
   }
 
   private assertMembershipCanBeModified(membership: MembershipDetail) {
     if (membership.status === MembershipStatus.REVOKED) {
-      throw new ConflictException("Revoked memberships cannot be modified.");
+      throw new ConflictException('Revoked memberships cannot be modified.');
     }
   }
 
@@ -426,7 +410,7 @@ export class MembershipsService {
 
     if (!activeOwners.some((owner) => owner.id !== targetMembershipId)) {
       throw new ConflictException(
-        "The last active owner cannot be removed, suspended, or demoted.",
+        'The last active owner cannot be removed, suspended, or demoted.',
       );
     }
   }
@@ -446,9 +430,11 @@ export class MembershipsService {
         orgId: data.orgId,
         actorUserId: data.actorUserId,
         action: data.action,
-        targetType: "Membership",
+        targetType: 'Membership',
         targetId: data.targetId,
         metadata: data.metadata,
+        ipAddress: this.requestContext.getIpAddress(),
+        userAgent: this.requestContext.getUserAgent(),
       },
     });
   }

package/template/src/modules/memberships/dto/transfer-owner.dto.ts

@@ -1,10 +1,10 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsUUID } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsUUID } from 'class-validator';
 
 export class TransferOwnerDto {
   @ApiProperty({
-    example: "0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3",
-    format: "uuid",
+    example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
+    format: 'uuid',
   })
   @IsUUID()
   toMembershipId!: string;

package/template/src/modules/memberships/dto/update-billing-contact.dto.ts

@@ -1,5 +1,5 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsBoolean } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsBoolean } from 'class-validator';
 
 export class UpdateBillingContactDto {
   @ApiProperty({ example: true })

package/template/src/modules/memberships/dto/update-membership-owner.dto.ts

@@ -1,5 +1,5 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsBoolean } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsBoolean } from 'class-validator';
 
 export class UpdateMembershipOwnerDto {
   @ApiProperty({ example: true })

package/template/src/modules/memberships/dto/update-membership-role.dto.ts

@@ -1,10 +1,10 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsUUID } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsUUID } from 'class-validator';
 
 export class UpdateMembershipRoleDto {
   @ApiProperty({
-    example: "f602c057-04f4-4ef8-8c84-1b7c62fbf8c5",
-    format: "uuid",
+    example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
+    format: 'uuid',
   })
   @IsUUID()
   roleId!: string;

package/template/src/modules/memberships/dto/update-membership-status.dto.ts

@@ -1,6 +1,6 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { MembershipStatus } from "@prisma/client";
-import { IsEnum } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { MembershipStatus } from '@prisma/client';
+import { IsEnum } from 'class-validator';
 
 export class UpdateMembershipStatusDto {
   @ApiProperty({ enum: MembershipStatus, example: MembershipStatus.SUSPENDED })

package/template/src/modules/memberships/memberships.module.ts

@@ -1,7 +1,7 @@
-import { Module } from "@nestjs/common";
-import { AuthModule } from "../auth/auth.module";
-import { MembershipsService } from "./application/services/memberships.service";
-import { MembershipsController } from "./presentation/memberships.controller";
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { MembershipsService } from './application/services/memberships.service';
+import { MembershipsController } from './presentation/memberships.controller';
 
 @Module({
   imports: [AuthModule],

package/template/src/modules/memberships/presentation/memberships.controller.ts

@@ -6,159 +6,147 @@ import {
   Param,
   Patch,
   Post,
+  Query,
   UseGuards,
-} from "@nestjs/common";
+} from '@nestjs/common';
+import { ApiBearerAuth, ApiOkResponse, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
 import {
-  ApiBearerAuth,
-  ApiOkResponse,
-  ApiOperation,
-  ApiParam,
-  ApiTags,
-} from "@nestjs/swagger";
-import { MembershipResponseDto } from "../../../common/dto/membership-response.dto";
-import { ApiProtectedErrorResponses } from "../../../common/swagger/api-error-responses";
-import { PermissionGuard } from "../../access-control/application/services/permission.guard";
-import { RequirePermissions } from "../../access-control/presentation/permissions.decorator";
-import { JwtAuthGuard } from "../../auth/infrastructure/passport/jwt-auth.guard";
-import { CurrentUser } from "../../auth/presentation/current-user.decorator";
-import { AuthenticatedUser } from "../../auth/types/authenticated-user";
-import { OrgScopeGuard } from "../../request-context/presentation/org-scope.guard";
-import { MembershipsService } from "../application/services/memberships.service";
-import { TransferOwnerDto } from "../dto/transfer-owner.dto";
-import { UpdateBillingContactDto } from "../dto/update-billing-contact.dto";
-import { UpdateMembershipOwnerDto } from "../dto/update-membership-owner.dto";
-import { UpdateMembershipRoleDto } from "../dto/update-membership-role.dto";
-import { UpdateMembershipStatusDto } from "../dto/update-membership-status.dto";
+  MembershipListResponseDto,
+  MembershipResponseDto,
+} from '../../../common/dto/membership-response.dto';
+import { PaginationQueryDto } from '../../../common/dto/pagination-query.dto';
+import { ApiProtectedErrorResponses } from '../../../common/swagger/api-error-responses';
+import { PermissionGuard } from '../../access-control/application/services/permission.guard';
+import { RequirePermissions } from '../../access-control/presentation/permissions.decorator';
+import { JwtAuthGuard } from '../../auth/infrastructure/passport/jwt-auth.guard';
+import { CurrentUser } from '../../auth/presentation/current-user.decorator';
+import { AuthenticatedUser } from '../../auth/types/authenticated-user';
+import { OrgScopeGuard } from '../../request-context/presentation/org-scope.guard';
+import { MembershipsService } from '../application/services/memberships.service';
+import { TransferOwnerDto } from '../dto/transfer-owner.dto';
+import { UpdateBillingContactDto } from '../dto/update-billing-contact.dto';
+import { UpdateMembershipOwnerDto } from '../dto/update-membership-owner.dto';
+import { UpdateMembershipRoleDto } from '../dto/update-membership-role.dto';
+import { UpdateMembershipStatusDto } from '../dto/update-membership-status.dto';
 
-@ApiTags("Memberships")
+@ApiTags('Memberships')
 @ApiBearerAuth()
-@ApiParam({ name: "orgId", description: "Organisation ID.", format: "uuid" })
+@ApiParam({ name: 'orgId', description: 'Organisation ID.', format: 'uuid' })
 @ApiProtectedErrorResponses(404, 409)
-@Controller("organisations/:orgId/memberships")
+@Controller('organisations/:orgId/memberships')
 @UseGuards(JwtAuthGuard, OrgScopeGuard, PermissionGuard)
 export class MembershipsController {
   constructor(private readonly membershipsService: MembershipsService) {}
 
-  @Get("me")
-  @RequirePermissions("memberships.read")
+  @Get('me')
+  @RequirePermissions('memberships.read')
   @ApiOperation({
-    summary: "Return the current user membership in the organisation.",
+    summary: 'Return the current user membership in the organisation.',
   })
   @ApiOkResponse({
-    description: "Current membership.",
+    description: 'Current membership.',
     type: MembershipResponseDto,
   })
-  me(@CurrentUser() user: AuthenticatedUser, @Param("orgId") orgId: string) {
+  me(@CurrentUser() user: AuthenticatedUser, @Param('orgId') orgId: string) {
     return this.membershipsService.getCurrentMembership(user, orgId);
   }
 
   @Get()
-  @RequirePermissions("memberships.read")
-  @ApiOperation({ summary: "List organisation memberships." })
+  @RequirePermissions('memberships.read')
+  @ApiOperation({ summary: 'List organisation memberships.' })
   @ApiOkResponse({
-    description: "Organisation memberships.",
-    type: [MembershipResponseDto],
+    description: 'Organisation memberships.',
+    type: MembershipListResponseDto,
   })
-  list(@CurrentUser() user: AuthenticatedUser, @Param("orgId") orgId: string) {
-    return this.membershipsService.listMemberships(user, orgId);
+  list(
+    @CurrentUser() user: AuthenticatedUser,
+    @Param('orgId') orgId: string,
+    @Query() query: PaginationQueryDto,
+  ) {
+    return this.membershipsService.listMemberships(user, orgId, query);
   }
 
-  @Patch(":membershipId/status")
-  @RequirePermissions("memberships.revoke")
+  @Patch(':membershipId/status')
+  @RequirePermissions('memberships.revoke')
   @ApiParam({
-    name: "membershipId",
-    description: "Membership ID.",
-    format: "uuid",
+    name: 'membershipId',
+    description: 'Membership ID.',
+    format: 'uuid',
   })
-  @ApiOperation({ summary: "Update membership status." })
+  @ApiOperation({ summary: 'Update membership status.' })
   @ApiOkResponse({
-    description: "Updated membership.",
+    description: 'Updated membership.',
     type: MembershipResponseDto,
   })
   updateStatus(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
-    @Param("membershipId") membershipId: string,
+    @Param('orgId') orgId: string,
+    @Param('membershipId') membershipId: string,
     @Body() dto: UpdateMembershipStatusDto,
   ) {
-    return this.membershipsService.updateStatus(
-      user,
-      orgId,
-      membershipId,
-      dto.status,
-    );
+    return this.membershipsService.updateStatus(user, orgId, membershipId, dto.status);
   }
 
-  @Patch(":membershipId/role")
-  @RequirePermissions("roles.manage")
+  @Patch(':membershipId/role')
+  @RequirePermissions('roles.manage')
   @ApiParam({
-    name: "membershipId",
-    description: "Membership ID.",
-    format: "uuid",
+    name: 'membershipId',
+    description: 'Membership ID.',
+    format: 'uuid',
   })
-  @ApiOperation({ summary: "Assign a role to a membership." })
+  @ApiOperation({ summary: 'Assign a role to a membership.' })
   @ApiOkResponse({
-    description: "Updated membership.",
+    description: 'Updated membership.',
     type: MembershipResponseDto,
   })
   updateRole(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
-    @Param("membershipId") membershipId: string,
+    @Param('orgId') orgId: string,
+    @Param('membershipId') membershipId: string,
     @Body() dto: UpdateMembershipRoleDto,
   ) {
-    return this.membershipsService.assignRole(
-      user,
-      orgId,
-      membershipId,
-      dto.roleId,
-    );
+    return this.membershipsService.assignRole(user, orgId, membershipId, dto.roleId);
   }
 
-  @Patch(":membershipId/owner")
-  @RequirePermissions("roles.manage")
+  @Patch(':membershipId/owner')
+  @RequirePermissions('roles.manage')
   @ApiParam({
-    name: "membershipId",
-    description: "Membership ID.",
-    format: "uuid",
+    name: 'membershipId',
+    description: 'Membership ID.',
+    format: 'uuid',
   })
-  @ApiOperation({ summary: "Grant or remove owner status on a membership." })
+  @ApiOperation({ summary: 'Grant or remove owner status on a membership.' })
   @ApiOkResponse({
-    description: "Updated membership.",
+    description: 'Updated membership.',
     type: MembershipResponseDto,
   })
   updateOwner(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
-    @Param("membershipId") membershipId: string,
+    @Param('orgId') orgId: string,
+    @Param('membershipId') membershipId: string,
     @Body() dto: UpdateMembershipOwnerDto,
   ) {
-    return this.membershipsService.updateOwner(
-      user,
-      orgId,
-      membershipId,
-      dto.isOwner,
-    );
+    return this.membershipsService.updateOwner(user, orgId, membershipId, dto.isOwner);
   }
 
-  @Patch(":membershipId/billing-contact")
-  @RequirePermissions("billing.manage")
+  @Patch(':membershipId/billing-contact')
+  @RequirePermissions('billing.manage')
   @ApiParam({
-    name: "membershipId",
-    description: "Membership ID.",
-    format: "uuid",
+    name: 'membershipId',
+    description: 'Membership ID.',
+    format: 'uuid',
   })
   @ApiOperation({
-    summary: "Grant or remove billing contact status on a membership.",
+    summary: 'Grant or remove billing contact status on a membership.',
   })
   @ApiOkResponse({
-    description: "Updated membership.",
+    description: 'Updated membership.',
     type: MembershipResponseDto,
   })
   updateBillingContact(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
-    @Param("membershipId") membershipId: string,
+    @Param('orgId') orgId: string,
+    @Param('membershipId') membershipId: string,
     @Body() dto: UpdateBillingContactDto,
   ) {
     return this.membershipsService.updateBillingContact(
@@ -169,25 +157,21 @@ export class MembershipsController {
     );
   }
 
-  @Post("transfer-owner")
+  @Post('transfer-owner')
   @HttpCode(200)
-  @RequirePermissions("roles.manage")
+  @RequirePermissions('roles.manage')
   @ApiOperation({
-    summary: "Transfer organisation ownership to another active membership.",
+    summary: 'Transfer organisation ownership to another active membership.',
   })
   @ApiOkResponse({
-    description: "New owner membership.",
+    description: 'New owner membership.',
     type: MembershipResponseDto,
   })
   transferOwner(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
+    @Param('orgId') orgId: string,
     @Body() dto: TransferOwnerDto,
   ) {
-    return this.membershipsService.transferOwner(
-      user,
-      orgId,
-      dto.toMembershipId,
-    );
+    return this.membershipsService.transferOwner(user, orgId, dto.toMembershipId);
   }
 }