@intelligo-dev/auth 1.0.0-beta.1 → 1.0.0-beta.13

package/src/team/service.ts

@@ -1,83 +1,17 @@
 /**
- * Team management service — the durable business rules behind
- * workspace membership and invitations, extracted from
- * the product application’s team actions (first slice of the page/registry
- * migration, section C1).
+ * Workspace membership and invitations. Each method authorizes itself and
+ * throws `TeamServiceError`; billing, email and notifications arrive as ports
+ * bound at the composition root.
  *
- * Mirrors `createExecutions(ports)` (packages/executions/src/lifecycle.ts):
- * a factory over optional ports, so this package's allowlisted
- * dependency (`@intelligo-dev/core` only — see
- * tests/architecture/dependency-direction.test.ts) never grows to
- * include billing, email, or notifications. A consumer binds those in
- * at its composition root:
- *
- *   const teamService = createTeamService({
- *     checkMemberLimit: checkTeamMemberLimit,       // @intelligo-dev/billing
- *     sendInvitationEmail: ...,                     // see note below
- *     notifyMemberJoined: triggerTeamMemberJoinedNotification, // @intelligo-dev/core/notifications
- *   });
- *
- * Authorization (`requireAuth`/`requireWorkspace`/`requireRole`) lives
- * INSIDE each method, not at the transport. Every recognized failure
- * throws `TeamServiceError` with a stable `code` — no
- * revalidatePath/Sentry/next-intl/toast here; that shaping is the
- * transport's job (a Server Action, a route handler).
- *
- * ---------------------------------------------------------------------
- * Invitation-email duplication (investigated for this extraction)
- * ---------------------------------------------------------------------
- * `packages/auth/src/server.ts` configures the Better-Auth organization
- * plugin's own `sendInvitationEmail` hook (EMAIL-06). Reading the
- * installed org plugin (`better-auth@1.6.30`,
- * `plugins/organization/routes/crud-invites.mjs`): every successful
- * `/organization/invite-member` call — both the "new invitation" path
- * and the "resend" path — unconditionally does
- * `if (ctx.context.orgOptions.sendInvitationEmail) await
- * runInBackgroundOrAwait(orgOptions.sendInvitationEmail(...))` once the
- * invitation row is created. Because `server.ts` always sets that
- * option, the hook fires on every `inviteMember()` call this service
- * makes — there is no code path where it does not.
- *
- * ignite's current `actions/team.ts` ALSO calls
- * `@intelligo-dev/core/email`'s `sendInvitationEmail` directly after the
- * same `/organization/invite-member` call. That means **two** emails
- * go out per invitation today. This is a live duplication bug, not a
- * hypothetical.
- *
- * Decision: `inviteMember` below does NOT call `ports.sendInvitationEmail`
- * by default — the org-plugin hook already covers it, so exactly one
- * email fires per invitation as long as `server.ts`'s hook stays wired.
- * The port is kept (and tested) for a consumer that disables or
- * replaces that hook (e.g. a fork of `server.ts`, or a future
- * environment where the org plugin's hook is intentionally left unset)
- * — pass `sendInvitationEmail` and this service will use it. Bumping
- * both at once will resume the duplication; do not turn the port back
- * on without also removing the hook in `server.ts`.
- *
- * ---------------------------------------------------------------------
- * Active-organization resolution (found the same way, via the
- * integration test's real DB)
- * ---------------------------------------------------------------------
- * Better-Auth's organization plugin resolves "the caller's active
- * workspace" from `session.activeOrganizationId` when a call omits an
- * explicit `organizationId`. That column does not exist on this repo's
- * Drizzle `sessions` schema (`packages/core/src/db/schema/auth.ts`), so
- * every bare `auth.api.getFullOrganization({ headers })` call —
- * ignite's original pattern in `listMembers`, `listInvitations`, and
- * the sole-owner check in `leaveWorkspace` — resolves to *no*
- * organization, regardless of what the caller most recently activated.
- * `requireWorkspace()` (packages/auth/src/helpers.ts) never hits this:
- * it has its own fallback that lists the caller's organizations and
- * fetches the first one by explicit id. This service does the same —
- * every `getFullOrganization` call below passes an explicit
- * `organizationId` sourced from `requireWorkspace`/`requireRole`'s
- * resolved `workspace.id` (or, in `acceptInvitation`, the invitation's
- * own `organizationId`) rather than relying on session state. This is
- * a behavior fix, not a stylistic change: without it, a fresh
- * single-workspace user's own membership list comes back empty.
+ * Every `getFullOrganization` call passes an explicit `organizationId`: the
+ * session's active organization is unset for a fresh user or one removed
+ * from their active workspace, and a bare call then resolves to nothing.
  */
 
-import { headers } from "next/headers";
+import { db } from "@intelligo-dev/core/db";
+import { member } from "@intelligo-dev/core/db/schema";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
+import { eq, sql } from "drizzle-orm";
 import type { ZodType } from "zod";
 import { createLogger } from "@intelligo-dev/core/logger";
 
@@ -91,19 +25,18 @@ const log = createLogger("TeamService");
 
 export type TeamServicePorts = {
   /**
-   * Plan-defined member cap for a workspace. No port ⇒ unlimited (no
-   * gate applied) — matches "no billing dependency without one bound
-   * explicitly" (ADR-0005).
+   * Plan-defined member cap for a workspace. No port ⇒ unlimited.
+   * `currentCount` is the seats already spoken for: members plus pending
+   * invitations when inviting, members when an invitation is accepted.
    */
   checkMemberLimit?: (
     workspaceId: string,
     currentCount: number
   ) => Promise<{ allowed: boolean; limit: number }>;
   /**
-   * Send the invitation email. Kept for a consumer that disables the
-   * Better-Auth org-plugin `sendInvitationEmail` hook — see the module
-   * doc comment above. `inviteMember` does not call this port unless
-   * it is explicitly bound.
+   * Send the invitation email. Bind it only when the org plugin's own
+   * `sendInvitationEmail` hook in `server.ts` is disabled: that hook fires
+   * on every invite, and binding both sends two emails.
    */
   sendInvitationEmail?: (input: {
     to: string;
@@ -112,13 +45,7 @@ export type TeamServicePorts = {
     invitationId: string;
     role: string;
   }) => Promise<void>;
-  /**
-   * Notify the workspace owner that a new member joined. `memberEmail`
-   * is included alongside the ports.md-listed fields because
-   * `triggerTeamMemberJoinedNotification` (the ignite binding) uses it
-   * to compose the notification message — dropping it would silently
-   * degrade the message text.
-   */
+  /** Notify the workspace owner that a new member joined. */
   notifyMemberJoined?: (input: {
     workspaceId: string;
     workspaceName: string;
@@ -198,12 +125,10 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     }
   }
 
-  /**
-   * List members of the caller's active workspace.
-   */
+  /** Members of the caller's active workspace. */
   async function listMembers(): Promise<OrgMember[]> {
     const { workspace } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const org = await callOrgApi("getFullOrganization", () =>
       auth.api.getFullOrganization({
@@ -215,12 +140,10 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     return (org?.members ?? []) as OrgMember[];
   }
 
-  /**
-   * List pending invitations for the caller's active workspace.
-   */
+  /** Pending invitations for the caller's active workspace. */
   async function listInvitations(): Promise<OrgInvitation[]> {
     const { workspace } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const org = await callOrgApi("getFullOrganization", () =>
       auth.api.getFullOrganization({
@@ -229,15 +152,35 @@ export function createTeamService(ports: TeamServicePorts = {}) {
       })
     );
 
-    return (org?.invitations ?? []) as OrgInvitation[];
+    // Better-Auth keeps accepted, rejected and canceled invitations on
+    // the organization; only a pending one can still be acted on.
+    return ((org?.invitations ?? []) as OrgInvitation[]).filter(
+      (invitation) => invitation.status === "pending"
+    );
+  }
+
+  async function enforceMemberLimit(
+    workspaceId: string,
+    seats: number
+  ): Promise<void> {
+    if (!ports.checkMemberLimit) return;
+    const limitCheck = await ports.checkMemberLimit(workspaceId, seats);
+    if (!limitCheck.allowed) {
+      throw new TeamServiceError(
+        "member_limit_reached",
+        `Your plan allows up to ${limitCheck.limit} team member${
+          limitCheck.limit === 1 ? "" : "s"
+        }. Upgrade to add more members.`,
+        { meta: { limit: limitCheck.limit } }
+      );
+    }
   }
 
   /**
-   * Invite a member by email. Owner/admin only (TEAM-01).
-   *
-   * The member-limit port, when bound, gates the invite before it is
-   * created. Exactly one invitation email is sent — see the module doc
-   * comment on the email-duplication finding.
+   * Invite a member by email. Owner/admin only. The member-limit port,
+   * when bound, gates the invite before it is created, counting pending
+   * invitations as seats: otherwise a workspace one seat short of its
+   * limit could send any number of invitations and have them all accepted.
    */
   async function inviteMember(input: {
     email: string;
@@ -245,9 +188,9 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }): Promise<OrgInvitation | null> {
     const { workspace, user } = await callRequireRole(["owner", "admin"]);
     const validated = parseInput(inviteMemberSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
-    // Check team member limit (FLAG-05), via port only.
+    // Member limit, via port only.
     if (ports.checkMemberLimit) {
       const org = await callOrgApi("getFullOrganization", () =>
         auth.api.getFullOrganization({
@@ -255,28 +198,23 @@ export function createTeamService(ports: TeamServicePorts = {}) {
           query: { organizationId: workspace.id },
         })
       );
-      const currentMemberCount = org?.members?.length ?? 0;
-
-      const limitCheck = await ports.checkMemberLimit(
+      const now = Date.now();
+      const pendingInvitations = (
+        (org?.invitations ?? []) as OrgInvitation[]
+      ).filter(
+        (invitation) =>
+          invitation.status === "pending" &&
+          new Date(invitation.expiresAt).getTime() > now
+      ).length;
+      await enforceMemberLimit(
         workspace.id,
-        currentMemberCount
+        (org?.members?.length ?? 0) + pendingInvitations
       );
-      if (!limitCheck.allowed) {
-        throw new TeamServiceError(
-          "member_limit_reached",
-          `Your plan allows up to ${limitCheck.limit} team member${
-            limitCheck.limit === 1 ? "" : "s"
-          }. Upgrade to add more members.`,
-          { meta: { limit: limitCheck.limit } }
-        );
-      }
     }
 
     // Better-Auth's own duplicate-pending-invite guard
     // (USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION) runs inside this
-    // call and surfaces as a provider_error if tripped — ignite's
-    // action never added a second check on top of it, so neither does
-    // this service.
+    // call and surfaces as a provider_error.
     const result = await callOrgApi("invite-member", () =>
       orgApi["/organization/invite-member"]({
         headers: hdrs,
@@ -309,20 +247,17 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }
 
   /**
-   * Accept invitation (TEAM-03).
+   * Accept an invitation.
    *
-   * Defence-in-depth against stolen-invitationId attacks: we (a)
-   * require the caller to be authenticated, (b) verify the
-   * invitationId is in the caller's pending list before forwarding it
-   * to Better-Auth, and (c) confirm the user is actually a member of
-   * the resulting org after the call. Better-Auth's accept-invitation
-   * endpoint already checks the email match, but layering these guards
-   * means a future upstream regression can't silently grant
-   * cross-tenant access.
+   * Defence in depth against a stolen invitation id: the caller must be
+   * authenticated, the id must be in the caller's pending list, and the
+   * caller must be a member of the organization afterwards. Better-Auth
+   * already checks the email match; these guards keep a regression there
+   * from granting cross-tenant access.
    */
   async function acceptInvitation(invitationId: string): Promise<void> {
     const { user } = await callRequireAuth();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (typeof invitationId !== "string" || invitationId.length === 0) {
       throw new TeamServiceError("invalid_input", "Invalid invitation id");
@@ -344,6 +279,17 @@ export function createTeamService(ports: TeamServicePorts = {}) {
       );
     }
 
+    // The plan may have shrunk, or members joined another way, since the
+    // invitation was sent. Counted from the table: the invitee cannot
+    // read an organization it is not yet a member of.
+    if (ports.checkMemberLimit) {
+      const [row] = await db
+        .select({ n: sql<number>`count(*)` })
+        .from(member)
+        .where(eq(member.organizationId, matched.organizationId));
+      await enforceMemberLimit(matched.organizationId, Number(row?.n ?? 0));
+    }
+
     await callOrgApi("accept-invitation", () =>
       orgApi["/organization/accept-invitation"]({
         headers: hdrs,
@@ -376,19 +322,9 @@ export function createTeamService(ports: TeamServicePorts = {}) {
       );
     }
 
-    // Notify the workspace owner (fire-and-forget, non-blocking —
-    // invitation acceptance has already succeeded above).
-    //
-    // Reuses `targetOrg` from the post-check above (scoped to
-    // `matched.organizationId`, the org the caller just joined) rather
-    // than re-fetching "the active org" the way ignite's original
-    // action did: Better-Auth's org plugin needs a
-    // `sessions.activeOrganizationId` column to resolve an org from
-    // headers alone, and this repo's Drizzle schema for `sessions`
-    // does not define one, so a bare `getFullOrganization({ headers })`
-    // call resolves to no organization at all — this notify lookup
-    // would silently no-op every time. `targetOrg` sidesteps that by
-    // asking for the org we already know the answer for.
+    // Notify the owner, fire-and-forget: acceptance has already succeeded.
+    // Uses `targetOrg`, the organization just joined, rather than resolving
+    // one from the session.
     if (ports.notifyMemberJoined) {
       try {
         const session = await auth.api.getSession({ headers: hdrs });
@@ -418,13 +354,13 @@ export function createTeamService(ports: TeamServicePorts = {}) {
         log.error("Notification lookup failed", {
           error: errorMessage(notifError),
         });
-        // Non-blocking — invitation acceptance still succeeds.
+        // Acceptance still succeeds.
       }
     }
   }
 
   /**
-   * Reject/decline invitation (TEAM-04).
+   * Decline an invitation.
    *
    * Same caller-side guard as acceptInvitation: require auth and
    * verify the invitationId is in the caller's pending list before
@@ -432,7 +368,7 @@ export function createTeamService(ports: TeamServicePorts = {}) {
    */
   async function rejectInvitation(invitationId: string): Promise<void> {
     await callRequireAuth();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (typeof invitationId !== "string" || invitationId.length === 0) {
       throw new TeamServiceError("invalid_input", "Invalid invitation id");
@@ -456,12 +392,10 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     );
   }
 
-  /**
-   * Cancel a pending invitation. Owner/admin only.
-   */
+  /** Cancel a pending invitation. Owner/admin only. */
   async function cancelInvitation(invitationId: string): Promise<void> {
     await callRequireRole(["owner", "admin"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("cancel-invitation", () =>
       orgApi["/organization/cancel-invitation"]({
@@ -471,12 +405,10 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     );
   }
 
-  /**
-   * Remove a member from workspace. Owner/admin only (TEAM-06).
-   */
+  /** Remove a member from the workspace. Owner/admin only. */
   async function removeMember(memberId: string): Promise<void> {
     const { workspace } = await callRequireRole(["owner", "admin"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("remove-member", () =>
       orgApi["/organization/remove-member"]({
@@ -486,16 +418,14 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     );
   }
 
-  /**
-   * Update member role. Owner/admin only (TEAM-05, TEAM-08).
-   */
+  /** Change a member's role. Owner/admin only. */
   async function updateMemberRole(input: {
     memberId: string;
     role: "admin" | "member";
   }): Promise<void> {
     const { workspace } = await callRequireRole(["owner", "admin"]);
     const validated = parseInput(updateRoleSchema, input);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     await callOrgApi("update-member-role", () =>
       orgApi["/organization/update-member-role"]({
@@ -510,12 +440,12 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }
 
   /**
-   * Leave workspace (TEAM-09). Sole owner cannot leave — must transfer
+   * Leave the workspace. The sole owner cannot leave without transferring
    * ownership first.
    */
   async function leaveWorkspace(): Promise<void> {
     const { workspace, membership } = await callRequireWorkspace();
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     if (membership.role === "owner") {
       const org = await callOrgApi("getFullOrganization", () =>
@@ -555,16 +485,13 @@ export function createTeamService(ports: TeamServicePorts = {}) {
     }
   }
 
-  /**
-   * Transfer workspace ownership to another member. Owner only (TEAM-07).
-   */
+  /** Transfer workspace ownership to another member. Owner only. */
   async function transferOwnership(targetMemberId: string): Promise<void> {
     const { workspace } = await callRequireRole(["owner"]);
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
-    // Promote target to owner. Note: Better-Auth may handle demotion of
-    // the previous owner automatically. If not, the old owner remains
-    // as co-owner, which is acceptable (ported behavior).
+    // Promotes the target to owner. If Better-Auth does not demote the
+    // previous owner, they stay a co-owner.
     await callOrgApi("update-member-role", () =>
       orgApi["/organization/update-member-role"]({
         headers: hdrs,
@@ -578,13 +505,12 @@ export function createTeamService(ports: TeamServicePorts = {}) {
   }
 
   /**
-   * Get the caller's own pending invitations (for the invitation
-   * accept page). No explicit requireAuth here — Better-Auth's
-   * list-user-invitations endpoint reads the session off `headers`
-   * itself; ported as-is from ignite's action.
+   * The caller's own pending invitations, for the accept page. No
+   * `requireAuth`: Better-Auth's list-user-invitations endpoint reads the
+   * session off `headers` itself.
    */
   async function getUserInvitations(): Promise<OrgInvitation[]> {
-    const hdrs = await headers();
+    const hdrs = await getRequestHeaders();
 
     const invitations = await callOrgApi("list-user-invitations", () =>
       orgApi["/organization/list-user-invitations"]({ headers: hdrs })

package/src/trusted-origins.ts

@@ -0,0 +1,26 @@
+/**
+ * Which origins Better-Auth's CSRF check accepts. Kept out of `server.ts`,
+ * which reaches the database and email provider at module load, so the rule
+ * can be tested alone.
+ */
+
+/**
+ * Resolve the trusted-origin list from the environment.
+ *
+ * `NEXT_PUBLIC_APP_URL` is a required variable, and when it is set it
+ * is the only origin trusted — in every environment.
+ *
+ * When it is unset, outside production any loopback port is trusted, so a
+ * fresh checkout works on whatever port Next picked (a guessed port would
+ * reject every sign-in with `403 INVALID_ORIGIN`). In production nothing is
+ * trusted: an unset variable there is a configuration error, and it fails
+ * closed.
+ */
+export function resolveTrustedOrigins(env: {
+  NEXT_PUBLIC_APP_URL?: string;
+  NODE_ENV?: string;
+}): string[] {
+  if (env.NEXT_PUBLIC_APP_URL) return [env.NEXT_PUBLIC_APP_URL];
+  if (env.NODE_ENV === "production") return [];
+  return ["http://localhost:*", "http://127.0.0.1:*"];
+}

package/src/workspace/errors.ts

@@ -1,13 +1,6 @@
 /**
- * Workspace service error type.
- *
- * Mirrors `../team/errors.ts` exactly, one directory over: the
- * workspace service (./service.ts) throws this for every failure it
- * recognizes rather than returning an ad-hoc `{ success, error }`
- * envelope — that shaping is a transport concern (a Server Action, a
- * route handler) and belongs one layer up, alongside
- * revalidatePath/Sentry/toast/i18n, none of which this package may
- * depend on.
+ * Thrown for every failure the workspace service recognizes. Shaping it for a UI
+ * (a `{ success, error }` envelope, i18n, revalidation) is the transport's job.
  */
 
 /**
@@ -50,14 +43,11 @@ export class WorkspaceServiceError extends Error {
     this.code = code;
     this.meta = options?.meta;
     if (options?.cause !== undefined) {
-      // ES2020 target predates the standard `cause` constructor option;
-      // assign it directly so `instanceof Error` consumers (and Node's
-      // own error inspection) still see it.
+      // The ES2020 target predates the `cause` constructor option.
       (this as { cause?: unknown }).cause = options.cause;
     }
 
-    // Restore prototype chain (extending built-ins across some
-    // transpilation targets loses `instanceof`).
+    // Extending built-ins loses `instanceof` on some transpilation targets.
     Object.setPrototypeOf(this, WorkspaceServiceError.prototype);
   }
 }

package/src/workspace/schemas.ts

@@ -1,19 +1,7 @@
-/**
- * Workspace Validation Schemas
- *
- * Zod schemas for workspace create/update inputs, shared by the
- * workspace service and its transports.
- *
- * (Ported from the product application's workspace validation module —
- * same semantics. Ignite's copy is retired at cutover.)
- */
+/** Workspace inputs, shared by the workspace service and its transports. */
 
 import { z } from "zod";
 
-/**
- * Create Workspace Schema
- * Name + optional slug for new workspaces
- */
 export const createWorkspaceSchema = z.object({
   name: z
     .string()
@@ -27,15 +15,11 @@ export const createWorkspaceSchema = z.object({
       /^[a-z0-9-]+$/,
       "Slug can only contain lowercase letters, numbers, and hyphens"
     )
-    .optional(), // Auto-generated from name if not provided
+    .optional(), // Generated from the name when omitted.
 });
 
 export type CreateWorkspaceInput = z.infer<typeof createWorkspaceSchema>;
 
-/**
- * Update Workspace Schema
- * Optional name, slug, and logo for workspace settings
- */
 export const updateWorkspaceSchema = z.object({
   name: z
     .string()