@hexis-ai/engram-server 0.11.3 → 0.13.0

package/dist/migrations/0007-orgs.js

@@ -0,0 +1,59 @@
+export const name = "0007-orgs";
+export const sql = `
+-- ============================================================
+-- Wave G: orgs as the top-level grouping (Langfuse-style)
+--
+-- Before: cookie-auth users were members of individual workspaces
+-- (engram_workspace_members). That doesn't scale when a single
+-- dev team operates many tenant workspaces — every new tenant
+-- meant re-adding every dev. Move membership up one level so a
+-- user joins an org once and sees every workspace under it.
+--
+-- New shape:
+--   engram_orgs            top-level grouping
+--   engram_workspaces      now has org_id (NULL allowed only for
+--                          tests / legacy api-key-only rows;
+--                          cookie-auth requires the workspace's
+--                          org membership)
+--   engram_org_members     replaces engram_workspace_members
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS engram_orgs (
+  id          TEXT PRIMARY KEY,
+  name        TEXT,
+  metadata    JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+ALTER TABLE engram_workspaces ADD COLUMN IF NOT EXISTS org_id TEXT;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'engram_workspaces_org_id_fkey'
+  ) THEN
+    ALTER TABLE engram_workspaces
+      ADD CONSTRAINT engram_workspaces_org_id_fkey
+      FOREIGN KEY (org_id) REFERENCES engram_orgs(id) ON DELETE CASCADE;
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS idx_engram_workspaces_org
+  ON engram_workspaces (org_id);
+
+CREATE TABLE IF NOT EXISTS engram_org_members (
+  org_id      TEXT NOT NULL REFERENCES engram_orgs(id) ON DELETE CASCADE,
+  user_id     TEXT NOT NULL REFERENCES engram_auth_users(id) ON DELETE CASCADE,
+  role        TEXT NOT NULL DEFAULT 'member',
+  joined_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  PRIMARY KEY (org_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS idx_engram_org_members_user
+  ON engram_org_members (user_id);
+
+-- workspace_members from 0006-auth is obsolete in the org-based
+-- model. Drop it; the only path to workspace access is via org
+-- membership.
+DROP TABLE IF EXISTS engram_workspace_members;
+`;

package/dist/migrations/index.js

@@ -3,6 +3,8 @@ import * as m0002 from "./0002-aliases";
 import * as m0003 from "./0003-identities";
 import * as m0004 from "./0004-schema-completion";
 import * as m0005 from "./0005-session-updated-at";
+import * as m0006 from "./0006-auth";
+import * as m0007 from "./0007-orgs";
 /**
  * Schema migrations, applied in array order. Add a new file under
  * `migrations/NNNN-<slug>.ts` exporting `name` and `sql`, then append it
@@ -16,4 +18,6 @@ export const MIGRATIONS = [
     { name: m0003.name, sql: m0003.sql },
     { name: m0004.name, sql: m0004.sql },
     { name: m0005.name, sql: m0005.sql },
+    { name: m0006.name, sql: m0006.sql },
+    { name: m0007.name, sql: m0007.sql },
 ];

package/dist/openapi.js

@@ -18,7 +18,7 @@
  * codes stay as-is.
  */
 import { z } from "zod";
-import { createWorkspaceSchema, eventBatchSchema, issueKeySchema, personCreateSchema, personUpdateSchema, searchRequestSchema, sessionInitSchema, } from "./schemas";
+import { addMemberSchema, createOrgSchema, createWorkspaceSchema, eventBatchSchema, issueKeySchema, orgPatchSchema, personCreateSchema, personUpdateSchema, searchRequestSchema, sessionInitSchema, sessionUpdateSchema, aliasUpsertSchema, identityUpsertSchema, workspacePatchSchema, } from "./schemas";
 /** Convert a Zod schema to a JSON Schema object for an OpenAPI component. */
 function toComponent(schema) {
     const js = z.toJSONSchema(schema);
@@ -37,7 +37,7 @@ const pathParam = (name, description) => ({
     schema: { type: "string" },
     description,
 });
-const queryParam = (name, description, schema = { type: "string" }) => ({ name, in: "query", required: false, schema, description });
+const queryParam = (name, description, schema = { type: "string" }, required = false) => ({ name, in: "query", required, schema, description });
 const res = (description) => ({ description });
 /** Default security: a workspace API key. `/admin/v1` paths override this. */
 const workspaceAuth = [{ workspaceKey: [] }];
@@ -54,14 +54,23 @@ const adminAuth = [{ adminToken: [] }];
 // ---------------------------------------------------------------------
 /** Every tag, in sidebar order, with a Japanese description. */
 const TAG_DEFS = [
-    { name: "Me", description: "識別プローブ" },
+    { name: "Me", description: "識別プローブ・閲覧可能な workspace/org 一覧" },
     { name: "Sessions", description: "セッションの作成・取得・イベント追加" },
     { name: "Search", description: "ワークスペースコーパスへのスコアリング検索" },
     { name: "Persons", description: "person の作成・更新・検索" },
+    { name: "Aliases", description: "ワークスペース横断の alias 解決" },
     {
         name: "Identities",
         description: "外部 ID（slack: / email: など）の resolve と upsert",
     },
+    {
+        name: "Orgs (self-serve)",
+        description: "engram-web からの cookie 認証 + org-member ロールでの org / workspace / API キー管理",
+    },
+    {
+        name: "Orgs (admin)",
+        description: "プラットフォーム管理者トークンでの org 管理",
+    },
     {
         name: "Workspaces (admin)",
         description: "ワークスペースの管理（管理者トークン必須）",
@@ -99,6 +108,24 @@ function buildPaths() {
                 },
             },
         }),
+        "/v1/me/workspaces": tagged("Me", {
+            get: {
+                summary: "サインイン中のユーザーが閲覧できる workspace 一覧。cookie 認証専用 — workspace 選択前にも到達できるよう workspace ゲートの前段に置かれている。",
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/me/orgs": tagged("Me", {
+            get: {
+                summary: "サインイン中のユーザーが member として所属する org 一覧（自分の role 付き）。cookie 認証専用。",
+                responses: {
+                    "200": res("org 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/v1/sessions": tagged("Sessions", {
             post: {
                 summary: "セッションを作成する。",
@@ -282,6 +309,16 @@ function buildPaths() {
                 },
             },
         }),
+        "/v1/aliases": tagged("Aliases", {
+            get: {
+                summary: "ワークスペース全体で alias 名を case-insensitive に逆引き。同名の alias を持つ複数の person を `last_used` desc で返す。`persons` map も同梱。",
+                parameters: [queryParam("name", "alias 名（URL-encoded）。", { type: "string" }, true)],
+                responses: {
+                    "200": res("alias 一覧 + persons map"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/v1/identities/{ref}": tagged("Identities", {
             put: {
                 summary: "ref（例: `slack:U12345`、`email:foo@bar.com`）で identity を upsert する。",
@@ -304,6 +341,299 @@ function buildPaths() {
                 },
             },
         }),
+        // ------------------------------------------------------------------
+        // Self-service org surface (Wave G5). Cookie auth + org membership.
+        // engram-web の settings UI から呼ばれる。/admin/v1/orgs/* と同じ
+        // 操作を「自分が所属する org に絞って」叩けるエンドポイント群。
+        // ------------------------------------------------------------------
+        "/v1/orgs/{id}": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "自分が member の org を取得する（自分の role 付き）。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("org + role"),
+                    "403": res("この org の member ではない"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            patch: {
+                summary: "org の name / metadata を更新する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("OrgPatch"),
+                responses: {
+                    "200": res("更新後の org"),
+                    "403": res("権限不足（owner / admin が必要）"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/members": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "org の member 一覧。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("member 一覧"),
+                    "403": res("この org の member ではない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "member を追加する（owner / admin のみ）。`email` か `userId` のいずれかを必須で渡す。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("AddMember"),
+                responses: {
+                    "200": res("追加された membership"),
+                    "400": res("`userId` も `email` も無い、または body が不正"),
+                    "403": res("権限不足"),
+                    "404": res("email から user を解決できない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/members/{userId}": tagged("Orgs (self-serve)", {
+            delete: {
+                summary: "member を削除する（owner / admin のみ）。最後の owner は削除拒否（`cannot_remove_last_owner`）。",
+                parameters: [pathParam("id", "org id。"), pathParam("userId", "user id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "400": res("最後の owner は削除できない"),
+                    "403": res("権限不足"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "org の workspace 一覧。",
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "403": res("この org の member ではない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "workspace を作成し、（issueKey=false でなければ）初期 API キーも発行する。owner / admin のみ。",
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("CreateWorkspace"),
+                responses: {
+                    "200": res("workspace（issueKey=false でない限り key も含む）"),
+                    "400": res("body または workspace id が不正"),
+                    "403": res("権限不足"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}": tagged("Orgs (self-serve)", {
+            patch: {
+                summary: "workspace の name / metadata を更新する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("WorkspacePatch"),
+                responses: {
+                    "200": res("更新後の workspace"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない / 存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            delete: {
+                summary: "workspace を削除する（セッション・persons・identities・API キーにカスケード）。owner / admin のみ。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}/keys": tagged("Orgs (self-serve)", {
+            get: {
+                summary: "workspace の API キー一覧（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "200": res("キー一覧"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "新しい API キーを発行する（owner / admin のみ）。",
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("IssueKey", false),
+                responses: {
+                    "200": res("発行されたキー（raw は一度のみ返却）"),
+                    "403": res("権限不足"),
+                    "404": res("workspace がこの org に属さない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/v1/orgs/{id}/workspaces/{wsId}/keys/{keyId}": tagged("Orgs (self-serve)", {
+            delete: {
+                summary: "API キーを無効化する（owner / admin のみ）。",
+                parameters: [
+                    pathParam("id", "org id。"),
+                    pathParam("wsId", "workspace id。"),
+                    pathParam("keyId", "key id。"),
+                ],
+                responses: {
+                    "204": res("無効化完了"),
+                    "403": res("権限不足"),
+                    "404": res("workspace / key がこの org に属さない、または存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        // ------------------------------------------------------------------
+        // Admin org surface (Wave G1). Platform admin token.
+        // ------------------------------------------------------------------
+        "/admin/v1/orgs": tagged("Orgs (admin)", {
+            post: {
+                summary: "org を作成する。",
+                security: adminAuth,
+                requestBody: jsonBody("CreateOrg"),
+                responses: {
+                    "200": res("作成された org"),
+                    "400": res("body が不正"),
+                    "401": res("認証エラー"),
+                },
+            },
+            get: {
+                summary: "全 org を一覧取得する。",
+                security: adminAuth,
+                responses: {
+                    "200": res("org 一覧"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}": tagged("Orgs (admin)", {
+            get: {
+                summary: "単一の org を取得する。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("org"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            delete: {
+                summary: "org を削除する（member と workspace にカスケード）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/members": tagged("Orgs (admin)", {
+            get: {
+                summary: "org の member 一覧。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("member 一覧"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "member を追加する（email または userId）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("AddMember"),
+                responses: {
+                    "200": res("追加された membership"),
+                    "400": res("`userId` も `email` も無い、または body が不正"),
+                    "404": res("org または email から user を解決できない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/members/{userId}": tagged("Orgs (admin)", {
+            delete: {
+                summary: "member を削除する。最後の owner は削除拒否（`cannot_remove_last_owner`）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("userId", "user id。")],
+                responses: {
+                    "204": res("削除完了"),
+                    "400": res("最後の owner は削除できない"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces": tagged("Orgs (admin)", {
+            post: {
+                summary: "org の下に workspace を作成し、（issueKey=false でなければ）初期 API キーも発行する。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                requestBody: jsonBody("CreateWorkspace"),
+                responses: {
+                    "200": res("workspace（issueKey=false でない限り key も含む）"),
+                    "400": res("body または workspace id が不正"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+            get: {
+                summary: "org の workspace 一覧。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。")],
+                responses: {
+                    "200": res("workspace 一覧"),
+                    "404": res("org が見つからない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces/{wsId}/keys": tagged("Orgs (admin)", {
+            get: {
+                summary: "org 配下の workspace の API キー一覧（ハッシュのみ）。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                responses: {
+                    "200": res("キー一覧"),
+                    "404": res("workspace がこの org に属さない / org が無い"),
+                    "401": res("認証エラー"),
+                },
+            },
+            post: {
+                summary: "org 配下の workspace に新しい API キーを発行する。`createWorkspaceUnderOrg` 後のキー rotation に使う。",
+                security: adminAuth,
+                parameters: [pathParam("id", "org id。"), pathParam("wsId", "workspace id。")],
+                requestBody: jsonBody("IssueKey", false),
+                responses: {
+                    "200": res("発行されたキー（raw は一度のみ返却）"),
+                    "400": res("リクエストボディが不正"),
+                    "404": res("workspace がこの org に属さない / org が無い"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
+        "/admin/v1/orgs/{id}/workspaces/{wsId}/keys/{keyId}": tagged("Orgs (admin)", {
+            delete: {
+                summary: "org 配下の workspace の API キーを無効化する。",
+                security: adminAuth,
+                parameters: [
+                    pathParam("id", "org id。"),
+                    pathParam("wsId", "workspace id。"),
+                    pathParam("keyId", "key id。"),
+                ],
+                responses: {
+                    "204": res("無効化完了"),
+                    "404": res("workspace / key がこの org に属さない、または存在しない"),
+                    "401": res("認証エラー"),
+                },
+            },
+        }),
         "/admin/v1/workspaces": tagged("Workspaces (admin)", {
             post: {
                 summary: "ワークスペースを作成する（デフォルトで初期キーも発行する）。",
@@ -425,15 +755,22 @@ export function buildOpenApiDocument() {
             },
             schemas: {
                 SessionInit: toComponent(sessionInitSchema),
+                SessionUpdate: toComponent(sessionUpdateSchema),
                 // `EventBatch` inlines the per-event shape. A standalone `SessionEvent`
                 // component (cross-`$ref`'d) is a planned follow-up alongside response
                 // schemas — zod's `toJSONSchema` inlines by default.
                 EventBatch: toComponent(eventBatchSchema),
                 PersonCreate: toComponent(personCreateSchema),
                 PersonUpdate: toComponent(personUpdateSchema),
+                AliasUpsert: toComponent(aliasUpsertSchema),
+                IdentityUpsert: toComponent(identityUpsertSchema),
                 SearchRequest: toComponent(searchRequestSchema),
                 CreateWorkspace: toComponent(createWorkspaceSchema),
                 IssueKey: toComponent(issueKeySchema),
+                CreateOrg: toComponent(createOrgSchema),
+                OrgPatch: toComponent(orgPatchSchema),
+                WorkspacePatch: toComponent(workspacePatchSchema),
+                AddMember: toComponent(addMemberSchema),
             },
         },
         paths: buildPaths(),

package/dist/org-store.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Org / org-member / workspace-under-org persistence.
+ *
+ * Orgs are the top-level grouping in the cookie-auth model: a user
+ * joins an org once and gains access to every workspace owned by
+ * that org. Workspaces still exist as the data-isolation unit
+ * (sessions / persons / aliases / identities are per-workspace).
+ *
+ * Machine api-keys (api-key auth) are unaware of orgs — they
+ * continue to resolve directly to a workspace.
+ */
+export interface OrgRow {
+    id: string;
+    name: string | null;
+    metadata: Record<string, unknown>;
+    createdAt: string;
+}
+export interface OrgMembershipRow {
+    orgId: string;
+    userId: string;
+    role: string;
+    joinedAt: string;
+}
+export interface OrgStore {
+    createOrg(input: {
+        id?: string;
+        name?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<OrgRow>;
+    getOrg(id: string): Promise<OrgRow | null>;
+    listOrgs(): Promise<OrgRow[]>;
+    updateOrg(id: string, patch: {
+        name?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<OrgRow>;
+    deleteOrg(id: string): Promise<void>;
+    listMembers(orgId: string): Promise<OrgMembershipRow[]>;
+    upsertMember(input: {
+        orgId: string;
+        userId: string;
+        role?: string;
+    }): Promise<OrgMembershipRow>;
+    removeMember(orgId: string, userId: string): Promise<void>;
+    /** Look up a better-auth user by primary email. */
+    findUserByEmail(email: string): Promise<{
+        id: string;
+        email: string;
+    } | null>;
+    /** Orgs the given user is a member of. */
+    listOrgsForUser(userId: string): Promise<OrgMembershipRow[]>;
+    /**
+     * Set the org an already-existing workspace belongs to. Called
+     * by the admin endpoint that creates a workspace under an org
+     * (key issuance and engram_workspaces.org_id are written together).
+     */
+    setWorkspaceOrg(workspaceId: string, orgId: string): Promise<void>;
+    /** Workspaces in the given org. */
+    listWorkspacesForOrg(orgId: string): Promise<{
+        id: string;
+        name: string | null;
+    }[]>;
+    /** Workspaces visible to the user, aggregated across all their orgs. */
+    listWorkspacesForUser(userId: string): Promise<{
+        id: string;
+        name: string | null;
+        orgId: string;
+    }[]>;
+    /** Returns true if the user is an org-member of the workspace's org. */
+    userCanAccessWorkspace(userId: string, workspaceId: string): Promise<boolean>;
+    /** Returns true if the workspace's `org_id` matches. Admin-side check
+     *  with no user context. */
+    workspaceInOrg(orgId: string, workspaceId: string): Promise<boolean>;
+}

package/dist/org-store.js

@@ -0,0 +1,12 @@
+/**
+ * Org / org-member / workspace-under-org persistence.
+ *
+ * Orgs are the top-level grouping in the cookie-auth model: a user
+ * joins an org once and gains access to every workspace owned by
+ * that org. Workspaces still exist as the data-isolation unit
+ * (sessions / persons / aliases / identities are per-workspace).
+ *
+ * Machine api-keys (api-key auth) are unaware of orgs — they
+ * continue to resolve directly to a workspace.
+ */
+export {};

package/dist/routes/orgs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cookie-auth org self-service routes (Wave G5).
+ *
+ * Auth gating only — the underlying logic lives in services/orgs.ts so
+ * the admin-token surface (`/admin/v1/orgs/*`) can call the same code
+ * without duplicating it.
+ *
+ * Mount BEFORE the workspace gate in src/server.ts; these endpoints
+ * have their own membership check and a chosen workspace would be
+ * irrelevant noise.
+ */
+import { Hono } from "hono";
+import type { EngramAuth } from "../auth";
+import type { KeyStore } from "../key-store";
+import type { OrgStore } from "../org-store";
+export interface OrgsRouteOptions {
+    authHandler: EngramAuth;
+    orgStore: OrgStore;
+    keyStore: KeyStore;
+}
+type Env = {
+    Variables: {
+        request_id: string;
+    };
+};
+export declare function orgsRoutes(opts: OrgsRouteOptions): Hono<Env>;
+export {};