@goscribe/server 1.1.7 → 1.3.0

package/src/routers/members.ts

@@ -2,6 +2,14 @@ import { z } from 'zod';
 import { TRPCError } from '@trpc/server';
 import { router, publicProcedure, authedProcedure } from '../trpc.js';
 import { logger } from '../lib/logger.js';
+import { sendInvitationEmail } from '../lib/email.js';
+import PusherService from '../lib/pusher.js';
+import {
+  notifyInviteAccepted,
+  notifyInviteRecipient,
+  notifyWorkspaceMembershipRemoved,
+  notifyWorkspaceRoleChanged,
+} from '../lib/notification-service.js';
 
 /**
  * Members router for workspace member management
@@ -69,14 +77,13 @@ export const members = router({
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found or access denied' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found or access denied'
         });
       }
 
-      // Format members with roles
-      const members = [
+      const workspaceMembers = [
         {
           id: workspace.owner.id,
           name: workspace.owner.name || 'Unknown',
@@ -93,7 +100,11 @@ export const members = router({
         }))
       ];
 
-      return members;
+      logger.info(`👥 Fetched ${workspaceMembers.length} members for workspace ${input.workspaceId}`, 'WORKSPACE', {
+        memberEmails: workspaceMembers.map(m => m.email)
+      });
+
+      return workspaceMembers;
     }),
 
   /**
@@ -116,9 +127,9 @@ export const members = router({
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found'
         });
       }
 
@@ -130,9 +141,9 @@ export const members = router({
         return workspace.members[0].role as 'admin' | 'member';
       }
 
-      throw new TRPCError({ 
-        code: 'FORBIDDEN', 
-        message: 'Access denied to this workspace' 
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message: 'Access denied to this workspace'
       });
     }),
 
@@ -148,22 +159,22 @@ export const members = router({
     .mutation(async ({ ctx, input }) => {
       // Check if user is owner or admin of the workspace
       const workspace = await ctx.db.workspace.findFirst({
-        where: { 
+        where: {
           id: input.workspaceId,
           ownerId: ctx.session.user.id // Only owners can invite for now
         }
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found or insufficient permissions' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found or insufficient permissions'
         });
       }
 
       // Check if user is already a member
       const existingMember = await ctx.db.user.findFirst({
-        where: { 
+        where: {
           email: input.email,
           OR: [
             { id: workspace.ownerId },
@@ -173,9 +184,9 @@ export const members = router({
       });
 
       if (existingMember) {
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'User is already a member of this workspace' 
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'User is already a member of this workspace'
         });
       }
 
@@ -190,9 +201,9 @@ export const members = router({
       });
 
       if (existingInvitation) {
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'Invitation already sent to this email' 
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'Invitation already sent to this email'
         });
       }
 
@@ -219,6 +230,23 @@ export const members = router({
         }
       });
 
+      const invitedExistingUser = await ctx.db.user.findUnique({
+        where: { email: input.email },
+        select: { id: true, name: true },
+      });
+
+      if (invitedExistingUser) {
+        await notifyInviteRecipient(ctx.db, {
+          invitedUserId: invitedExistingUser.id,
+          inviterUserId: ctx.session.user.id,
+          workspaceId: input.workspaceId,
+          workspaceTitle: invitation.workspace.title,
+          invitationId: invitation.id,
+          invitationToken: invitation.token,
+          inviterName: invitation.workspace.owner.name || invitation.workspace.owner.email,
+        });
+      }
+
       logger.info(`🎫 Invitation created for ${input.email} to workspace ${input.workspaceId} with role ${input.role}`, 'WORKSPACE', {
         invitationId: invitation.id,
         workspaceId: input.workspaceId,
@@ -227,8 +255,14 @@ export const members = router({
         invitedBy: ctx.session.user.id
       });
 
-      // TODO: Send email notification here
-      // await sendInvitationEmail(invitation);
+      // Send email notification
+      await sendInvitationEmail({
+        email: invitation.email,
+        token: invitation.token,
+        role: invitation.role,
+        workspaceTitle: invitation.workspace.title,
+        invitedByName: invitation.workspace.owner.name || invitation.workspace.owner.email || 'Someone',
+      });
 
       return {
         invitationId: invitation.id,
@@ -270,6 +304,7 @@ export const members = router({
             select: {
               id: true,
               title: true,
+              ownerId: true,
               owner: {
                 select: {
                   name: true,
@@ -282,27 +317,31 @@ export const members = router({
       });
 
       if (!invitation) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Invalid or expired invitation' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Invalid or expired invitation'
         });
       }
 
       // Check if user is authenticated
       if (!ctx.session?.user) {
-        throw new TRPCError({ 
-          code: 'UNAUTHORIZED', 
-          message: 'Please log in to accept this invitation' 
+        throw new TRPCError({
+          code: 'UNAUTHORIZED',
+          message: 'Please log in to accept this invitation'
         });
       }
 
       const user = await ctx.db.user.findFirst({ where: { id: ctx.session.user.id } });
       if (!user || !user.email) throw new TRPCError({ code: 'NOT_FOUND' });
-      // Check if the email matches the user's email
-      if (user.email !== invitation.email) {
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'This invitation was sent to a different email address' 
+
+      logger.info(`🔍 Verification check for ${user.email} accepting invite for ${invitation.email}`, 'WORKSPACE');
+
+      // Check if the email matches the user's email (case-insensitive)
+      if (user.email.toLowerCase() !== invitation.email.toLowerCase()) {
+        logger.warn(`❌ Invitation email mismatch: user ${user.email} vs invite ${invitation.email}`, 'WORKSPACE');
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'This invitation was sent to a different email address'
         });
       }
 
@@ -318,26 +357,41 @@ export const members = router({
       });
 
       if (isAlreadyMember) {
+        logger.info(`ℹ️ User ${ctx.session.user.id} is already a member of workspace ${invitation.workspaceId}. Marking invite as accepted.`, 'WORKSPACE');
         // Mark invitation as accepted even if already a member
         await ctx.db.workspaceInvitation.update({
           where: { id: invitation.id },
           data: { acceptedAt: new Date() }
         });
 
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'You are already a member of this workspace' 
-        });
-      }
-
-      // Add user to workspace with proper role
-      await ctx.db.workspaceMember.create({
-        data: {
+        return {
           workspaceId: invitation.workspaceId,
-          userId: ctx.session.user.id,
+          workspaceTitle: invitation.workspace.title,
           role: invitation.role,
+          ownerName: invitation.workspace.owner.name || invitation.workspace.owner.email,
+          message: 'You are already a member of this workspace'
+        };
+      }
+
+      // Add user to workspace with proper role.
+      // This can race if accept is triggered twice (e.g. redirects/retries),
+      // so treat duplicate membership as a successful, idempotent accept.
+      let memberAdded = false;
+      try {
+        await ctx.db.workspaceMember.create({
+          data: {
+            workspaceId: invitation.workspaceId,
+            userId: ctx.session.user.id,
+            role: invitation.role,
+          }
+        });
+        memberAdded = true;
+      } catch (error: any) {
+        if (error?.code !== 'P2002') {
+          throw error;
         }
-      });
+        logger.info(`ℹ️ Duplicate invite accept handled for user ${ctx.session.user.id} in workspace ${invitation.workspaceId}`, 'WORKSPACE');
+      }
 
       // Mark invitation as accepted
       await ctx.db.workspaceInvitation.update({
@@ -345,18 +399,44 @@ export const members = router({
         data: { acceptedAt: new Date() }
       });
 
-      logger.info(`✅ Invitation accepted by ${ctx.session.user.id} for workspace ${invitation.workspaceId}`, 'WORKSPACE', {
+      if (memberAdded) {
+        await notifyInviteAccepted(ctx.db, {
+          recipientUserIds: [invitation.invitedById, invitation.workspace.ownerId],
+          actorUserId: ctx.session.user.id,
+          workspaceId: invitation.workspaceId,
+          workspaceTitle: invitation.workspace.title,
+          memberName: user.name || user.email,
+          invitationId: invitation.id,
+        });
+      }
+
+      logger.info(`✅ Invitation accepted by ${ctx.session.user.id} (${user.email}) for workspace ${invitation.workspaceId}`, 'WORKSPACE', {
         invitationId: invitation.id,
         workspaceId: invitation.workspaceId,
         userId: ctx.session.user.id,
         email: invitation.email
       });
 
+      // Try to emit a Pusher event if possible
+      try {
+        if (memberAdded) {
+          await PusherService.emitMemberJoined(invitation.workspaceId, {
+            id: ctx.session.user.id,
+            name: user.name || 'Member',
+            email: user.email,
+            role: invitation.role,
+          });
+        }
+      } catch (e) {
+        logger.error('Failed to emit member joined event', e);
+      }
+
       return {
         workspaceId: invitation.workspaceId,
         workspaceTitle: invitation.workspace.title,
         role: invitation.role,
         ownerName: invitation.workspace.owner.name || invitation.workspace.owner.email,
+        ...(memberAdded ? {} : { message: 'You are already a member of this workspace' }),
       };
     }),
 
@@ -372,38 +452,39 @@ export const members = router({
     .mutation(async ({ ctx, input }) => {
       // Check if user is owner of the workspace
       const workspace = await ctx.db.workspace.findFirst({
-        where: { 
+        where: {
           id: input.workspaceId,
           ownerId: ctx.session.user.id
-        }
+        },
+        select: { id: true, title: true, ownerId: true },
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found or insufficient permissions' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found or insufficient permissions'
         });
       }
 
       // Check if member exists and is not the owner
       if (input.memberId === workspace.ownerId) {
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'Cannot change owner role' 
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'Cannot change owner role'
         });
       }
 
       const member = await ctx.db.workspaceMember.findFirst({
-        where: { 
+        where: {
           workspaceId: input.workspaceId,
           userId: input.memberId
         }
       });
 
       if (!member) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Member not found in this workspace' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Member not found in this workspace'
         });
       }
 
@@ -430,6 +511,20 @@ export const members = router({
         changedBy: ctx.session.user.id
       });
 
+      const actor = await ctx.db.user.findUnique({
+        where: { id: ctx.session.user.id },
+        select: { name: true, email: true },
+      });
+      await notifyWorkspaceRoleChanged(ctx.db, {
+        memberUserId: input.memberId,
+        workspaceId: input.workspaceId,
+        workspaceTitle: workspace.title,
+        newRole: input.role,
+        oldRole: member.role,
+        actorUserId: ctx.session.user.id,
+        actorName: actor?.name || actor?.email || 'A workspace admin',
+      }).catch(() => {});
+
       return {
         memberId: input.memberId,
         role: input.role,
@@ -449,30 +544,31 @@ export const members = router({
     .mutation(async ({ ctx, input }) => {
       // Check if user is owner of the workspace
       const workspace = await ctx.db.workspace.findFirst({
-        where: { 
+        where: {
           id: input.workspaceId,
           ownerId: ctx.session.user.id
-        }
+        },
+        select: { id: true, title: true, ownerId: true },
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found or insufficient permissions' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found or insufficient permissions'
         });
       }
 
       // Check if trying to remove the owner
       if (input.memberId === workspace.ownerId) {
-        throw new TRPCError({ 
-          code: 'BAD_REQUEST', 
-          message: 'Cannot remove workspace owner' 
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'Cannot remove workspace owner'
         });
       }
 
       // Check if member exists
       const member = await ctx.db.workspaceMember.findFirst({
-        where: { 
+        where: {
           workspaceId: input.workspaceId,
           userId: input.memberId
         },
@@ -487,12 +583,24 @@ export const members = router({
       });
 
       if (!member) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Member not found in this workspace' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Member not found in this workspace'
         });
       }
 
+      const actor = await ctx.db.user.findUnique({
+        where: { id: ctx.session.user.id },
+        select: { name: true, email: true },
+      });
+      await notifyWorkspaceMembershipRemoved(ctx.db, {
+        memberUserId: input.memberId,
+        workspaceId: input.workspaceId,
+        workspaceTitle: workspace.title,
+        actorUserId: ctx.session.user.id,
+        actorName: actor?.name || actor?.email || 'A workspace admin',
+      }).catch(() => {});
+
       // Remove member from workspace
       await ctx.db.workspaceMember.delete({
         where: { id: member.id }
@@ -520,16 +628,16 @@ export const members = router({
     .query(async ({ ctx, input }) => {
       // Check if user is owner of the workspace
       const workspace = await ctx.db.workspace.findFirst({
-        where: { 
+        where: {
           id: input.workspaceId,
           ownerId: ctx.session.user.id
         }
       });
 
       if (!workspace) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Workspace not found or insufficient permissions' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Workspace not found or insufficient permissions'
         });
       }
 
@@ -571,7 +679,7 @@ export const members = router({
     .mutation(async ({ ctx, input }) => {
       // Check if user is owner of the workspace
       const invitation = await ctx.db.workspaceInvitation.findFirst({
-        where: { 
+        where: {
           id: input.invitationId,
           acceptedAt: null,
           workspace: {
@@ -581,9 +689,9 @@ export const members = router({
       });
 
       if (!invitation) {
-        throw new TRPCError({ 
-          code: 'NOT_FOUND', 
-          message: 'Invitation not found or insufficient permissions' 
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Invitation not found or insufficient permissions'
         });
       }
 
@@ -604,4 +712,96 @@ export const members = router({
         message: 'Invitation cancelled successfully'
       };
     }),
+
+  /**
+   * Resend a pending invitation (owner only)
+   */
+  resendInvitation: authedProcedure
+    .input(z.object({
+      invitationId: z.string(),
+    }))
+    .mutation(async ({ ctx, input }) => {
+      // Check if user is owner of the workspace and invitation is pending
+      const invitation = await ctx.db.workspaceInvitation.findFirst({
+        where: {
+          id: input.invitationId,
+          acceptedAt: null,
+          workspace: {
+            ownerId: ctx.session.user.id
+          }
+        },
+        include: {
+          workspace: {
+            select: {
+              title: true,
+              owner: {
+                select: {
+                  name: true,
+                  email: true,
+                }
+              }
+            }
+          }
+        }
+      });
+
+      if (!invitation) {
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Invitation not found or insufficient permissions'
+        });
+      }
+
+      // Check if expired and update expiry if needed
+      if (invitation.expiresAt < new Date()) {
+        const newExpiry = new Date();
+        newExpiry.setDate(newExpiry.getDate() + 7);
+        await ctx.db.workspaceInvitation.update({
+          where: { id: invitation.id },
+          data: { expiresAt: newExpiry }
+        });
+        invitation.expiresAt = newExpiry;
+      }
+
+      // Send email notification
+      await sendInvitationEmail({
+        email: invitation.email,
+        token: invitation.token,
+        role: invitation.role,
+        workspaceTitle: invitation.workspace.title,
+        invitedByName: invitation.workspace.owner.name || invitation.workspace.owner.email || 'Someone',
+      });
+
+      logger.info(`📧 Invitation resent to ${invitation.email} for workspace ${invitation.workspaceId}`, 'WORKSPACE', {
+        invitationId: invitation.id,
+        workspaceId: invitation.workspaceId,
+        email: invitation.email,
+        resentBy: ctx.session.user.id
+      });
+
+      return {
+        invitationId: invitation.id,
+        message: 'Invitation email resent successfully'
+      };
+    }),
+
+  /**
+   * DEBUG ONLY: Get all invitations for a workspace
+   */
+  getAllInvitationsDebug: authedProcedure
+    .input(z.object({
+      workspaceId: z.string(),
+    }))
+    .query(async ({ ctx, input }) => {
+      // Check if user is owner
+      const workspace = await ctx.db.workspace.findFirst({
+        where: { id: input.workspaceId, ownerId: ctx.session.user.id }
+      });
+      if (!workspace) throw new TRPCError({ code: 'UNAUTHORIZED' });
+
+      return ctx.db.workspaceInvitation.findMany({
+        where: { workspaceId: input.workspaceId },
+        orderBy: { createdAt: 'desc' }
+      });
+    }),
 });