@intelligo-dev/auth 1.0.0-beta.3 → 1.0.0-beta.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -0
- package/dist/helpers.js +6 -6
- package/dist/helpers.js.map +1 -1
- package/dist/impersonation.js +3 -3
- package/dist/impersonation.js.map +1 -1
- package/dist/onboarding/schemas.js +4 -5
- package/dist/onboarding/schemas.js.map +1 -1
- package/dist/onboarding/service.js +3 -3
- package/dist/org-api.js +9 -9
- package/dist/profile/schemas.js +2 -3
- package/dist/profile/schemas.js.map +1 -1
- package/dist/profile/service.js +5 -5
- package/dist/profile/service.js.map +1 -1
- package/dist/server.js +22 -6
- package/dist/server.js.map +1 -1
- package/dist/team/schemas.js +2 -2
- package/dist/team/service.js +19 -19
- package/dist/team/service.js.map +1 -1
- package/dist/trusted-origins.js +31 -0
- package/dist/trusted-origins.js.map +1 -0
- package/dist/workspace/schemas.js +2 -2
- package/dist/workspace/service.js +13 -13
- package/dist/workspace/service.js.map +1 -1
- package/package.json +16 -9
- package/src/helpers.ts +6 -6
- package/src/impersonation.ts +3 -3
- package/src/onboarding/schemas.ts +4 -5
- package/src/onboarding/service.ts +3 -3
- package/src/org-api.ts +9 -9
- package/src/profile/schemas.ts +2 -3
- package/src/profile/service.ts +5 -5
- package/src/server.ts +24 -7
- package/src/team/schemas.ts +2 -2
- package/src/team/service.ts +20 -20
- package/src/trusted-origins.ts +32 -0
- package/src/workspace/schemas.ts +2 -2
- package/src/workspace/service.ts +13 -13
package/README.md
ADDED
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
# @intelligo-dev/auth
|
|
2
|
+
|
|
3
|
+
Multi-tenant authentication, workspaces and RBAC on Better-Auth.
|
|
4
|
+
|
|
5
|
+
Part of [Intelligo](https://github.com/intelligo-mn/framework), an application
|
|
6
|
+
framework and operational platform for vertical AI SaaS products. This package
|
|
7
|
+
is published from that repository and is not meant to be used on its own.
|
|
8
|
+
|
|
9
|
+
## Install
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
pnpm add @intelligo-dev/auth
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
## What it owns
|
|
16
|
+
|
|
17
|
+
Sessions and accounts, organizations as workspaces, membership roles
|
|
18
|
+
(`owner` / `admin` / `member`), invitations, platform-admin impersonation, and
|
|
19
|
+
the guards every transport starts with: `requireAuth`, `requireWorkspace`,
|
|
20
|
+
`requireRole`, `requirePlatformAdmin`.
|
|
21
|
+
|
|
22
|
+
The team, workspace, profile and onboarding services live here too, behind
|
|
23
|
+
ports the composition root binds — auth never imports billing.
|
|
24
|
+
|
|
25
|
+
## Use
|
|
26
|
+
|
|
27
|
+
```ts
|
|
28
|
+
import { requireWorkspace } from "@intelligo-dev/auth";
|
|
29
|
+
|
|
30
|
+
const { user, workspace, membership } = await requireWorkspace();
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
Platform admin is a row (`users.role`), not an environment variable. The
|
|
34
|
+
allowlist in `PLATFORM_ADMIN_EMAILS` is promoted into that column on first use,
|
|
35
|
+
so the plugin and the guard cannot disagree.
|
|
36
|
+
|
|
37
|
+
## Licence
|
|
38
|
+
|
|
39
|
+
Apache-2.0
|
package/dist/helpers.js
CHANGED
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* }
|
|
13
13
|
* ```
|
|
14
14
|
*/
|
|
15
|
-
import {
|
|
15
|
+
import { getRequestHeaders } from "@intelligo-dev/core/request-context";
|
|
16
16
|
import { auth } from "./server.js";
|
|
17
17
|
import { createLogger } from "@intelligo-dev/core/logger";
|
|
18
18
|
import { db } from "@intelligo-dev/core/db";
|
|
@@ -28,7 +28,7 @@ const log = createLogger("Auth");
|
|
|
28
28
|
*/
|
|
29
29
|
export async function getAuthSession() {
|
|
30
30
|
const session = await auth.api.getSession({
|
|
31
|
-
headers: await
|
|
31
|
+
headers: await getRequestHeaders(),
|
|
32
32
|
});
|
|
33
33
|
if (!session?.user) {
|
|
34
34
|
return null;
|
|
@@ -68,7 +68,7 @@ export async function getWorkspaceContextById(organizationId) {
|
|
|
68
68
|
log.debug("getWorkspaceContextById: fetching org");
|
|
69
69
|
// Get organization by ID directly (not from session)
|
|
70
70
|
const org = await auth.api.getFullOrganization({
|
|
71
|
-
headers: await
|
|
71
|
+
headers: await getRequestHeaders(),
|
|
72
72
|
query: { organizationId },
|
|
73
73
|
});
|
|
74
74
|
if (!org) {
|
|
@@ -116,7 +116,7 @@ export async function getWorkspaceContext() {
|
|
|
116
116
|
// "no active workspace" so the fallback below runs instead of the
|
|
117
117
|
// provider error escaping as an unexplained failure.
|
|
118
118
|
let activeOrg = await auth.api
|
|
119
|
-
.getFullOrganization({ headers: await
|
|
119
|
+
.getFullOrganization({ headers: await getRequestHeaders() })
|
|
120
120
|
.catch((error) => {
|
|
121
121
|
log.debug("getWorkspaceContext: active org not readable", {
|
|
122
122
|
error: error instanceof Error ? error.message : String(error),
|
|
@@ -128,7 +128,7 @@ export async function getWorkspaceContext() {
|
|
|
128
128
|
if (!activeOrg) {
|
|
129
129
|
log.debug("getWorkspaceContext: no active org, checking workspaces");
|
|
130
130
|
const orgs = await auth.api.listOrganizations({
|
|
131
|
-
headers: await
|
|
131
|
+
headers: await getRequestHeaders(),
|
|
132
132
|
});
|
|
133
133
|
if (orgs && orgs.length > 0) {
|
|
134
134
|
log.debug("getWorkspaceContext: found workspaces", {
|
|
@@ -136,7 +136,7 @@ export async function getWorkspaceContext() {
|
|
|
136
136
|
});
|
|
137
137
|
// Fetch full organization details for the first workspace
|
|
138
138
|
activeOrg = await auth.api.getFullOrganization({
|
|
139
|
-
headers: await
|
|
139
|
+
headers: await getRequestHeaders(),
|
|
140
140
|
query: { organizationId: orgs[0].id },
|
|
141
141
|
});
|
|
142
142
|
}
|
package/dist/helpers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAK9C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAIlC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,OAAO,EAAE,MAAM,iBAAiB,EAAE;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAI/B,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,cAAsB;IAMlE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAEnD,qDAAqD;IACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC7C,OAAO,EAAE,MAAM,iBAAiB,EAAE;QAClC,KAAK,EAAE,EAAE,cAAc,EAAE;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf;QACD,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAMvC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEhD,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG;SAC3B,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC;SAC3D,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;YACxD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,+EAA+E;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACrE,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACjD,OAAO,EAAE,MAAM,iBAAiB,EAAE;SACnC,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC3B,CAAC,CAAC;YACH,0DAA0D;YAC1D,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC7C,OAAO,EAAE,MAAM,iBAAiB,EAAE;gBAClC,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2CAA2C;IAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CACzC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,CAC5C,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;QACjD,aAAa,EAAE,CAAC,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB;QACD,UAAU,EAAE;YACV,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IAMpC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAA6B;IAM7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACzC,oEAAoE;IACpE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;SACzC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAoB,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IAIxC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IAE9C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAE,IAAiC,CAAC,IAAI,IAAI,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,qEAAqE;IACrE,+DAA+D;IAC/D,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}
|
package/dist/impersonation.js
CHANGED
|
@@ -13,7 +13,7 @@ import "server-only";
|
|
|
13
13
|
* which is the mistake that put cross-tenant analytics behind a
|
|
14
14
|
* workspace role.
|
|
15
15
|
*/
|
|
16
|
-
import {
|
|
16
|
+
import { getRequestHeaders } from "@intelligo-dev/core/request-context";
|
|
17
17
|
import { auth } from "./server.js";
|
|
18
18
|
/** Default matching `impersonationSessionDuration` in server.ts. */
|
|
19
19
|
const FALLBACK_DURATION_MS = 30 * 60000;
|
|
@@ -25,7 +25,7 @@ const FALLBACK_DURATION_MS = 30 * 60000;
|
|
|
25
25
|
export async function impersonateUser(targetUserId) {
|
|
26
26
|
const result = (await auth.api.impersonateUser({
|
|
27
27
|
body: { userId: targetUserId },
|
|
28
|
-
headers: await
|
|
28
|
+
headers: await getRequestHeaders(),
|
|
29
29
|
}));
|
|
30
30
|
const expiresAt = result.session?.expiresAt;
|
|
31
31
|
return {
|
|
@@ -37,6 +37,6 @@ export async function impersonateUser(targetUserId) {
|
|
|
37
37
|
}
|
|
38
38
|
/** Restore the admin's own session. */
|
|
39
39
|
export async function stopImpersonating() {
|
|
40
|
-
await auth.api.stopImpersonating({ headers: await
|
|
40
|
+
await auth.api.stopImpersonating({ headers: await getRequestHeaders() });
|
|
41
41
|
}
|
|
42
42
|
//# sourceMappingURL=impersonation.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"impersonation.js","sourceRoot":"","sources":["../src/impersonation.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAQhC,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,EAAE,GAAG,KAAM,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;QAC9B,OAAO,EAAE,MAAM,iBAAiB,EAAE;KACnC,CAAC,CAAgD,CAAC;IAEnD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;IAE5C,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,SAAS;YAClB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC"}
|
|
@@ -3,17 +3,16 @@
|
|
|
3
3
|
*
|
|
4
4
|
* A single generic step-id validator — see the module doc comment on
|
|
5
5
|
* `./service.ts` for why this is a bare, bounded string rather than a
|
|
6
|
-
* product-specific enum.
|
|
6
|
+
* product-specific enum. The first product's original
|
|
7
7
|
* `lib/validations/onboarding.ts` pinned this to
|
|
8
|
-
* `z.enum(["role", "profile", "complete"])`,
|
|
8
|
+
* `z.enum(["role", "profile", "complete"])`, its own 3-step wizard
|
|
9
9
|
* shape. The `users.onboarding_step` column itself is untyped `text`,
|
|
10
10
|
* so that enum was a product-level constraint bolted onto a generic
|
|
11
11
|
* column, not something this shared contract should require. A
|
|
12
12
|
* consumer defines its own step ids (typically the `id` field of a
|
|
13
13
|
* steps-config array it owns) and passes them straight through;
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
* bounded string".
|
|
14
|
+
* A consumer keeps its own enum-shaped schema at the transport layer
|
|
15
|
+
* if it wants stricter validation than "non-empty, bounded string".
|
|
17
16
|
*/
|
|
18
17
|
import { z } from "zod";
|
|
19
18
|
export const setStepSchema = z
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/onboarding/schemas.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/onboarding/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,EAAE,qBAAqB,CAAC;KAC7B,GAAG,CAAC,EAAE,EAAE,uCAAuC,CAAC,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Onboarding service — the durable business rules behind a user's
|
|
3
|
-
* first-run onboarding flow,
|
|
3
|
+
* first-run onboarding flow, lifted out of the first product's
|
|
4
4
|
* onboarding actions (page/registry migration, `onboarding` family,
|
|
5
5
|
* roadmap item 11).
|
|
6
6
|
*
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* No ports: `complete()` and `skip()` only flip those two columns and
|
|
13
13
|
* return the resulting state — they do NOT provision trial credits,
|
|
14
14
|
* record referrals, or perform any other first-workspace bootstrapping.
|
|
15
|
-
*
|
|
15
|
+
* The product's original `completeOnboarding()` action did exactly that
|
|
16
16
|
* (`provisionTrialCredits`/`recordReferralSignup`/`grantReferralUpgrade`
|
|
17
17
|
* inline), but that work belongs to the consumer's own
|
|
18
18
|
* `onWorkspaceCreated` binding instead — see `../workspace-init.ts`'s
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
* Why `skip()` has the same durable effect as `complete()`
|
|
39
39
|
* ---------------------------------------------------------------------
|
|
40
40
|
* The `users` table has no separate "skipped" column, so there is
|
|
41
|
-
* nothing else to persist.
|
|
41
|
+
* nothing else to persist. The product's original `skipOnboarding()` action
|
|
42
42
|
* logged an analytics event and then delegated to `completeOnboarding()`
|
|
43
43
|
* unchanged; this service mirrors that shape as two distinct methods
|
|
44
44
|
* (rather than collapsing `skip` into an alias) so a transport can
|
package/dist/org-api.js
CHANGED
|
@@ -13,12 +13,12 @@
|
|
|
13
13
|
* which is the vocabulary the rest of this package's `team/` module
|
|
14
14
|
* uses.
|
|
15
15
|
*
|
|
16
|
-
* (Ported from the product
|
|
17
|
-
* team-settings backend
|
|
18
|
-
* contract now
|
|
16
|
+
* (Ported from the first product's Better-Auth type wrapper when the
|
|
17
|
+
* team-settings backend moved into the framework — packages/auth owns
|
|
18
|
+
* the org-api contract now.)
|
|
19
19
|
*
|
|
20
20
|
* IMPORTANT — found while wiring the real-DB integration test for this
|
|
21
|
-
*
|
|
21
|
+
* move: the product's original module built `orgApi` as
|
|
22
22
|
* `auth.api as unknown as OrgApi`, i.e. a bare type-cast that assumes
|
|
23
23
|
* `auth.api` is keyed by these HTTP path strings. It is not. Better-Auth's
|
|
24
24
|
* organization plugin (`better-auth@1.6.30`,
|
|
@@ -44,13 +44,13 @@
|
|
|
44
44
|
* function` at runtime for every call whose row above differs in the
|
|
45
45
|
* first two columns — i.e. invite-member, leave, list, and set-active
|
|
46
46
|
* unconditionally, since their server ids aren't just a casing change
|
|
47
|
-
* of the path. This was invisible in
|
|
47
|
+
* of the path. This was invisible in the product's test suite because
|
|
48
48
|
* `actions/__tests__/team.test.ts` mocks `@/types/better-auth` (the
|
|
49
49
|
* whole `orgApi` object) rather than exercising the cast against a
|
|
50
|
-
* real `auth.api`, and only surfaced once this
|
|
51
|
-
* `service.integration.test.ts` called the real thing. It
|
|
52
|
-
* bug in
|
|
53
|
-
* hypothetical
|
|
50
|
+
* real `auth.api`, and only surfaced once this package's
|
|
51
|
+
* `service.integration.test.ts` called the real thing. It was a live
|
|
52
|
+
* bug in the product's shipped team-management actions, not a
|
|
53
|
+
* hypothetical.
|
|
54
54
|
*
|
|
55
55
|
* `orgApi` below is therefore a real object, not a cast: each path key
|
|
56
56
|
* forwards to the correctly-named `auth.api` method. The `OrgApi`
|
package/dist/profile/schemas.js
CHANGED
|
@@ -4,9 +4,8 @@
|
|
|
4
4
|
* Zod schemas for user profile updates, shared by the profile service
|
|
5
5
|
* and its transports.
|
|
6
6
|
*
|
|
7
|
-
* (Ported from the product
|
|
8
|
-
* same semantics: optional name, optional-and-nullable image URL.
|
|
9
|
-
* Ignite's copy is retired at cutover.)
|
|
7
|
+
* (Ported from the first product's `lib/validations/profile.ts` —
|
|
8
|
+
* same semantics: optional name, optional-and-nullable image URL.)
|
|
10
9
|
*/
|
|
11
10
|
import { z } from "zod";
|
|
12
11
|
export const updateProfileSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/profile/schemas.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/profile/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;SAC5C,GAAG,CAAC,GAAG,EAAE,qCAAqC,CAAC;SAC/C,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC"}
|
package/dist/profile/service.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Profile management service — the durable business rules behind
|
|
3
3
|
* reading the caller's own profile, updating it, and deleting the
|
|
4
|
-
* account,
|
|
4
|
+
* account, lifted out of the first product's profile actions
|
|
5
5
|
* (page/registry migration, `profile-settings` family, roadmap item 9).
|
|
6
6
|
*
|
|
7
7
|
* Mirrors `createTeamService(ports)` / `createWorkspaceService(ports)`
|
|
@@ -38,11 +38,11 @@
|
|
|
38
38
|
* direct calls: this service should not own *content* — copy, subject
|
|
39
39
|
* lines, template shape — for a side effect a consumer may want to
|
|
40
40
|
* localize, skip, or replace with a different provider. `onAccountDeleted`
|
|
41
|
-
* is fire-and-forget by design (matching
|
|
41
|
+
* is fire-and-forget by design (matching the original action's `.catch(console.error)`
|
|
42
42
|
* pattern): a failed confirmation email must never block the deletion
|
|
43
43
|
* that already succeeded.
|
|
44
44
|
*/
|
|
45
|
-
import {
|
|
45
|
+
import { getRequestHeaders } from "@intelligo-dev/core/request-context";
|
|
46
46
|
import { eq } from "drizzle-orm";
|
|
47
47
|
import { createLogger } from "@intelligo-dev/core/logger";
|
|
48
48
|
import { db } from "@intelligo-dev/core/db";
|
|
@@ -98,12 +98,12 @@ export function createProfileService(ports = {}) {
|
|
|
98
98
|
* Only the fields present in `input` are sent — omitting a field
|
|
99
99
|
* leaves it unchanged; `image: null` is dropped rather than forwarded
|
|
100
100
|
* (Better-Auth's `updateUser` does not accept `null`), matching
|
|
101
|
-
*
|
|
101
|
+
* the original action.
|
|
102
102
|
*/
|
|
103
103
|
async function updateProfile(input) {
|
|
104
104
|
await callRequireAuth();
|
|
105
105
|
const validated = parseInput(updateProfileSchema, input);
|
|
106
|
-
const hdrs = await
|
|
106
|
+
const hdrs = await getRequestHeaders();
|
|
107
107
|
const updateData = {};
|
|
108
108
|
if (validated.name !== undefined)
|
|
109
109
|
updateData.name = validated.name;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/profile/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/profile/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAA2B,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtE,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAyB3C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,gDAAgD;AAChD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;QAC/D,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAI,MAAkB,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,eAAe,EACjB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA6B,EAAE;IAClE,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,UAAU;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAEzC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,aAAa,CAAC,KAAyB;QACpD,MAAM,eAAe,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,UAAU,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAsC,EAAE,CAAC;QACzD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACnE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC9D,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACrC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,0BAA0B,EAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,aAAa;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAEhC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,0BAA0B,EAC1B,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,KAAK;iBACF,gBAAgB,CAAC;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBACxC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;aACzB,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,aAAa;QACb,aAAa;KACd,CAAC;AACJ,CAAC"}
|
package/dist/server.js
CHANGED
|
@@ -15,6 +15,7 @@ import { admin, organization } from "better-auth/plugins";
|
|
|
15
15
|
import { createAccessControl } from "better-auth/plugins/access";
|
|
16
16
|
import { adminAc, defaultStatements, userAc, } from "better-auth/plugins/admin/access";
|
|
17
17
|
import { PLATFORM_ADMIN_ROLE } from "./roles.js";
|
|
18
|
+
import { resolveTrustedOrigins } from "./trusted-origins.js";
|
|
18
19
|
/**
|
|
19
20
|
* Access control for the platform role.
|
|
20
21
|
*
|
|
@@ -32,6 +33,22 @@ import { db } from "@intelligo-dev/core/db";
|
|
|
32
33
|
import { users, sessions, accounts, verifications, organization as organizationTable, member, invitation, } from "@intelligo-dev/core/db/schema";
|
|
33
34
|
import { sendVerifyEmail, sendPasswordResetEmail, sendWelcomeEmail, sendInvitationEmail, } from "@intelligo-dev/core/email";
|
|
34
35
|
import { eq } from "drizzle-orm";
|
|
36
|
+
/**
|
|
37
|
+
* The origin this app is served from.
|
|
38
|
+
*
|
|
39
|
+
* `NEXT_PUBLIC_APP_URL` is a REQUIRED variable (`assertEnv` in
|
|
40
|
+
* `@intelligo-dev/core/env`), but auth is configured at module load,
|
|
41
|
+
* long before any composition root asserts it. This value therefore
|
|
42
|
+
* still needs a fallback for the absolute links that go into email —
|
|
43
|
+
* a verification or invitation URL has to name a concrete host.
|
|
44
|
+
*/
|
|
45
|
+
const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:4000";
|
|
46
|
+
/**
|
|
47
|
+
* Origins the CSRF check accepts — the one place the fallback above
|
|
48
|
+
* must NOT apply, because a guessed port there does not degrade
|
|
49
|
+
* gracefully. See `resolveTrustedOrigins` for the rule.
|
|
50
|
+
*/
|
|
51
|
+
const TRUSTED_ORIGINS = resolveTrustedOrigins(process.env);
|
|
35
52
|
export const auth = betterAuth({
|
|
36
53
|
// Explicit, so the name the framework documents (doctor, scaffold,
|
|
37
54
|
// env validation) is the one that is honoured; AUTH_SECRET stays a
|
|
@@ -51,7 +68,7 @@ export const auth = betterAuth({
|
|
|
51
68
|
invitation: invitation,
|
|
52
69
|
},
|
|
53
70
|
}),
|
|
54
|
-
baseURL:
|
|
71
|
+
baseURL: APP_URL,
|
|
55
72
|
emailAndPassword: {
|
|
56
73
|
enabled: true,
|
|
57
74
|
// Only enforce email verification when a real email provider is configured
|
|
@@ -104,7 +121,7 @@ export const auth = betterAuth({
|
|
|
104
121
|
// Session token updated every 24 hours (extends expiration on active usage)
|
|
105
122
|
updateAge: 60 * 60 * 24,
|
|
106
123
|
},
|
|
107
|
-
trustedOrigins:
|
|
124
|
+
trustedOrigins: TRUSTED_ORIGINS,
|
|
108
125
|
// Database hooks for automatic workspace setup (WORK-01)
|
|
109
126
|
databaseHooks: {
|
|
110
127
|
user: {
|
|
@@ -147,7 +164,7 @@ export const auth = betterAuth({
|
|
|
147
164
|
// Send welcome email (EMAIL-03, fire-and-forget).
|
|
148
165
|
// NOTE(DB-12): No retry or outbox — downstream failures silently ignored.
|
|
149
166
|
// Acceptable for v0.2; consider transactional outbox for Phase 14.
|
|
150
|
-
const dashboardUrl = `${
|
|
167
|
+
const dashboardUrl = `${APP_URL}/dashboard`;
|
|
151
168
|
sendWelcomeEmail({
|
|
152
169
|
to: user.email,
|
|
153
170
|
userName: user.name || user.email,
|
|
@@ -211,14 +228,13 @@ export const auth = betterAuth({
|
|
|
211
228
|
creatorRole: "owner",
|
|
212
229
|
// Invitation email sending via Resend (EMAIL-06, replaces Phase 10 placeholder)
|
|
213
230
|
sendInvitationEmail: async (data) => {
|
|
214
|
-
const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000";
|
|
215
231
|
sendInvitationEmail({
|
|
216
232
|
to: data.email,
|
|
217
233
|
inviterName: data.inviter?.user?.name || "A team member",
|
|
218
234
|
workspaceName: data.organization?.name || "a workspace",
|
|
219
235
|
role: data.role || "member",
|
|
220
|
-
acceptUrl: `${
|
|
221
|
-
declineUrl: `${
|
|
236
|
+
acceptUrl: `${APP_URL}/accept-invitation/${data.id}`,
|
|
237
|
+
declineUrl: `${APP_URL}/invitation/decline?id=${data.id}`,
|
|
222
238
|
}).catch((err) => console.error("[Auth] Failed to send invitation email:", err));
|
|
223
239
|
},
|
|
224
240
|
// Invitations expire after 7 days (matches TEAM-10)
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,MAAM,GACP,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,MAAM,GACP,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,YAAY,IAAI,iBAAiB,EACjC,MAAM,EACN,UAAU,GACX,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;AAE3E;;;;GAIG;AACH,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC;IAC7B,mEAAmE;IACnE,mEAAmE;IACnE,gBAAgB;IAChB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;IACjE,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;QAC3B,QAAQ,EAAE,IAAI;QACd,wDAAwD;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,aAAa;YAC3B,wCAAwC;YACxC,YAAY,EAAE,iBAAiB;YAC/B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,UAAU;SACvB;KACF,CAAC;IAEF,OAAO,EAAE,OAAO;IAEhB,gBAAgB,EAAE;QAChB,OAAO,EAAE,IAAI;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,wBAAwB,EACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;QACvE,uCAAuC;QACvC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YACzC,sBAAsB,CAAC;gBACrB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;gBACjC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAClE,CAAC;QACJ,CAAC;KACF;IAED,qCAAqC;IACrC,iBAAiB,EAAE;QACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,eAAe,CAAC;gBACd,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;gBACjC,eAAe,EAAE,GAAG;aACrB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAChE,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,IAAI;QAClB,2BAA2B,EAAE,IAAI;KAClC;IAED,eAAe,EAAE;QACf,2DAA2D;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAClE,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC/C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,2DAA2D;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAClE,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC/C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR;IAED,OAAO,EAAE;QACP,+BAA+B;QAC/B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3B,4EAA4E;QAC5E,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;KACxB;IAED,cAAc,EAAE,eAAe;IAE/B,yDAAyD;IACzD,aAAa,EAAE;QACb,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACpB,+CAA+C;oBAC/C,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;6BAC1D,WAAW,EAAE;6BACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;6BAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAEhB,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;4BAChC,OAAO,EAAE,IAAI,OAAO,EAAE;4BACtB,IAAI,EAAE;gCACJ,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,cAAc;gCAC1C,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;gCAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,0BAA0B;6BAC5C;yBACF,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,kEAAkE;wBAClE,oEAAoE;wBACpE,iDAAiD;wBACjD,IACE,KAAK,YAAY,KAAK;4BACtB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;gCACnC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;gCACjC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClC,CAAC;4BACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;gCAC5C,OAAO,EAAE,IAAI,OAAO,EAAE;6BACvB,CAAC,CAAC;4BACH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC5B,wDAAwD;gCACxD,OAAO;4BACT,CAAC;wBACH,CAAC;wBACD,qEAAqE;wBACrE,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,KAAK,CACN,CAAC;oBACJ,CAAC;oBAED,kDAAkD;oBAClD,0EAA0E;oBAC1E,mEAAmE;oBACnE,MAAM,YAAY,GAAG,GAAG,OAAO,YAAY,CAAC;oBAC5C,gBAAgB,CAAC;wBACf,EAAE,EAAE,IAAI,CAAC,KAAK;wBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;wBACjC,YAAY;qBACb,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAC3D,CAAC;gBACJ,CAAC;aACF;SACF;QACD,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAqC,EAAE;oBAC3D,wDAAwD;oBACxD,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,MAAM,EAAE;6BACxB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;6BACtC,IAAI,CAAC,KAAK,CAAC;6BACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;6BACnC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAEZ,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;4BAC7B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,KAAK,CACN,CAAC;wBACF,MAAM,KAAK,CAAC,CAAC,uCAAuC;oBACtD,CAAC;oBAED,mDAAmD;oBACnD,mEAAmE;oBACnE,sEAAsE;oBACtE,uEAAuE;oBACvE,IAAI,CAAC;wBACH,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACjD,OAAO,EAAE,IAAI,OAAO,EAAE;4BACtB,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;yBAClC,CAAC,CAAC;wBAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC5B,0CAA0C;4BAC1C,OAAO;gCACL,IAAI,EAAE;oCACJ,GAAG,OAAO;oCACV,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;iCACjC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,KAAK,CACN,CAAC;oBACJ,CAAC;oBAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;aACF;SACF;KACF;IAED,OAAO,EAAE;QACP,YAAY,CAAC;YACX,2EAA2E;YAC3E,6BAA6B,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC/C,oDAAoD;YACpD,iBAAiB,EAAE,CAAC;YACpB,+CAA+C;YAC/C,WAAW,EAAE,OAAO;YACpB,gFAAgF;YAChF,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClC,mBAAmB,CAAC;oBAClB,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,eAAe;oBACxD,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,aAAa;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;oBAC3B,SAAS,EAAE,GAAG,OAAO,sBAAsB,IAAI,CAAC,EAAE,EAAE;oBACpD,UAAU,EAAE,GAAG,OAAO,0BAA0B,IAAI,CAAC,EAAE,EAAE;iBAC1D,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,oDAAoD;YACpD,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SACtC,CAAC;QACF;;;;;;;;;;;;;;;;;WAiBG;QACH,KAAK,CAAC;YACJ,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE;YACnE,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,mBAAmB,CAAC;YACjC,4BAA4B,EAAE,EAAE,GAAG,EAAE;YACrC,wBAAwB,EAAE,KAAK;SAChC,CAAC;KACH;CACF,CAAC,CAAC"}
|
package/dist/team/schemas.js
CHANGED
|
@@ -4,8 +4,8 @@
|
|
|
4
4
|
* Zod schemas for team invite and member management inputs, shared by
|
|
5
5
|
* the team service and its transports.
|
|
6
6
|
*
|
|
7
|
-
* (Ported from the product
|
|
8
|
-
* semantics.
|
|
7
|
+
* (Ported from the first product's team validation module — same
|
|
8
|
+
* semantics.)
|
|
9
9
|
*/
|
|
10
10
|
import { z } from "zod";
|
|
11
11
|
/**
|
package/dist/team/service.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Team management service — the durable business rules behind
|
|
3
|
-
* workspace membership and invitations,
|
|
4
|
-
*
|
|
5
|
-
*
|
|
3
|
+
* workspace membership and invitations, lifted out of the first
|
|
4
|
+
* product's team actions (first slice of the page/registry migration,
|
|
5
|
+
* section C1).
|
|
6
6
|
*
|
|
7
7
|
* Mirrors `createExecutions(ports)` (packages/executions/src/lifecycle.ts):
|
|
8
8
|
* a factory over optional ports, so this package's allowlisted
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
* option, the hook fires on every `inviteMember()` call this service
|
|
39
39
|
* makes — there is no code path where it does not.
|
|
40
40
|
*
|
|
41
|
-
*
|
|
41
|
+
* The product's original `actions/team.ts` ALSO called
|
|
42
42
|
* `@intelligo-dev/core/email`'s `sendInvitationEmail` directly after the
|
|
43
43
|
* same `/organization/invite-member` call. That means **two** emails
|
|
44
44
|
* go out per invitation today. This is a live duplication bug, not a
|
|
@@ -71,7 +71,7 @@
|
|
|
71
71
|
* resolved `workspace.id` (or, in `acceptInvitation`, the invitation's
|
|
72
72
|
* own `organizationId`).
|
|
73
73
|
*/
|
|
74
|
-
import {
|
|
74
|
+
import { getRequestHeaders } from "@intelligo-dev/core/request-context";
|
|
75
75
|
import { createLogger } from "@intelligo-dev/core/logger";
|
|
76
76
|
import { auth } from "../server.js";
|
|
77
77
|
import { requireAuth, requireRole, requireWorkspace } from "../helpers.js";
|
|
@@ -140,7 +140,7 @@ export function createTeamService(ports = {}) {
|
|
|
140
140
|
*/
|
|
141
141
|
async function listMembers() {
|
|
142
142
|
const { workspace } = await callRequireWorkspace();
|
|
143
|
-
const hdrs = await
|
|
143
|
+
const hdrs = await getRequestHeaders();
|
|
144
144
|
const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
|
|
145
145
|
headers: hdrs,
|
|
146
146
|
query: { organizationId: workspace.id },
|
|
@@ -152,7 +152,7 @@ export function createTeamService(ports = {}) {
|
|
|
152
152
|
*/
|
|
153
153
|
async function listInvitations() {
|
|
154
154
|
const { workspace } = await callRequireWorkspace();
|
|
155
|
-
const hdrs = await
|
|
155
|
+
const hdrs = await getRequestHeaders();
|
|
156
156
|
const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
|
|
157
157
|
headers: hdrs,
|
|
158
158
|
query: { organizationId: workspace.id },
|
|
@@ -169,7 +169,7 @@ export function createTeamService(ports = {}) {
|
|
|
169
169
|
async function inviteMember(input) {
|
|
170
170
|
const { workspace, user } = await callRequireRole(["owner", "admin"]);
|
|
171
171
|
const validated = parseInput(inviteMemberSchema, input);
|
|
172
|
-
const hdrs = await
|
|
172
|
+
const hdrs = await getRequestHeaders();
|
|
173
173
|
// Check team member limit (FLAG-05), via port only.
|
|
174
174
|
if (ports.checkMemberLimit) {
|
|
175
175
|
const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
|
|
@@ -184,7 +184,7 @@ export function createTeamService(ports = {}) {
|
|
|
184
184
|
}
|
|
185
185
|
// Better-Auth's own duplicate-pending-invite guard
|
|
186
186
|
// (USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION) runs inside this
|
|
187
|
-
// call and surfaces as a provider_error if tripped —
|
|
187
|
+
// call and surfaces as a provider_error if tripped — the original
|
|
188
188
|
// action never added a second check on top of it, so neither does
|
|
189
189
|
// this service.
|
|
190
190
|
const result = await callOrgApi("invite-member", () => orgApi["/organization/invite-member"]({
|
|
@@ -225,7 +225,7 @@ export function createTeamService(ports = {}) {
|
|
|
225
225
|
*/
|
|
226
226
|
async function acceptInvitation(invitationId) {
|
|
227
227
|
const { user } = await callRequireAuth();
|
|
228
|
-
const hdrs = await
|
|
228
|
+
const hdrs = await getRequestHeaders();
|
|
229
229
|
if (typeof invitationId !== "string" || invitationId.length === 0) {
|
|
230
230
|
throw new TeamServiceError("invalid_input", "Invalid invitation id");
|
|
231
231
|
}
|
|
@@ -259,7 +259,7 @@ export function createTeamService(ports = {}) {
|
|
|
259
259
|
//
|
|
260
260
|
// Reuses `targetOrg` from the post-check above (scoped to
|
|
261
261
|
// `matched.organizationId`, the org the caller just joined) rather
|
|
262
|
-
// than re-fetching "the active org" the way
|
|
262
|
+
// than re-fetching "the active org" the way the original
|
|
263
263
|
// action did: Better-Auth's org plugin needs a
|
|
264
264
|
// `sessions.activeOrganizationId` column to resolve an org from
|
|
265
265
|
// headers alone, and this repo's Drizzle schema for `sessions`
|
|
@@ -306,7 +306,7 @@ export function createTeamService(ports = {}) {
|
|
|
306
306
|
*/
|
|
307
307
|
async function rejectInvitation(invitationId) {
|
|
308
308
|
await callRequireAuth();
|
|
309
|
-
const hdrs = await
|
|
309
|
+
const hdrs = await getRequestHeaders();
|
|
310
310
|
if (typeof invitationId !== "string" || invitationId.length === 0) {
|
|
311
311
|
throw new TeamServiceError("invalid_input", "Invalid invitation id");
|
|
312
312
|
}
|
|
@@ -324,7 +324,7 @@ export function createTeamService(ports = {}) {
|
|
|
324
324
|
*/
|
|
325
325
|
async function cancelInvitation(invitationId) {
|
|
326
326
|
await callRequireRole(["owner", "admin"]);
|
|
327
|
-
const hdrs = await
|
|
327
|
+
const hdrs = await getRequestHeaders();
|
|
328
328
|
await callOrgApi("cancel-invitation", () => orgApi["/organization/cancel-invitation"]({
|
|
329
329
|
headers: hdrs,
|
|
330
330
|
body: { invitationId },
|
|
@@ -335,7 +335,7 @@ export function createTeamService(ports = {}) {
|
|
|
335
335
|
*/
|
|
336
336
|
async function removeMember(memberId) {
|
|
337
337
|
const { workspace } = await callRequireRole(["owner", "admin"]);
|
|
338
|
-
const hdrs = await
|
|
338
|
+
const hdrs = await getRequestHeaders();
|
|
339
339
|
await callOrgApi("remove-member", () => orgApi["/organization/remove-member"]({
|
|
340
340
|
headers: hdrs,
|
|
341
341
|
body: { memberIdOrEmail: memberId, organizationId: workspace.id },
|
|
@@ -347,7 +347,7 @@ export function createTeamService(ports = {}) {
|
|
|
347
347
|
async function updateMemberRole(input) {
|
|
348
348
|
const { workspace } = await callRequireRole(["owner", "admin"]);
|
|
349
349
|
const validated = parseInput(updateRoleSchema, input);
|
|
350
|
-
const hdrs = await
|
|
350
|
+
const hdrs = await getRequestHeaders();
|
|
351
351
|
await callOrgApi("update-member-role", () => orgApi["/organization/update-member-role"]({
|
|
352
352
|
headers: hdrs,
|
|
353
353
|
body: {
|
|
@@ -363,7 +363,7 @@ export function createTeamService(ports = {}) {
|
|
|
363
363
|
*/
|
|
364
364
|
async function leaveWorkspace() {
|
|
365
365
|
const { workspace, membership } = await callRequireWorkspace();
|
|
366
|
-
const hdrs = await
|
|
366
|
+
const hdrs = await getRequestHeaders();
|
|
367
367
|
if (membership.role === "owner") {
|
|
368
368
|
const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
|
|
369
369
|
headers: hdrs,
|
|
@@ -392,7 +392,7 @@ export function createTeamService(ports = {}) {
|
|
|
392
392
|
*/
|
|
393
393
|
async function transferOwnership(targetMemberId) {
|
|
394
394
|
const { workspace } = await callRequireRole(["owner"]);
|
|
395
|
-
const hdrs = await
|
|
395
|
+
const hdrs = await getRequestHeaders();
|
|
396
396
|
// Promote target to owner. Note: Better-Auth may handle demotion of
|
|
397
397
|
// the previous owner automatically. If not, the old owner remains
|
|
398
398
|
// as co-owner, which is acceptable (ported behavior).
|
|
@@ -409,10 +409,10 @@ export function createTeamService(ports = {}) {
|
|
|
409
409
|
* Get the caller's own pending invitations (for the invitation
|
|
410
410
|
* accept page). No explicit requireAuth here — Better-Auth's
|
|
411
411
|
* list-user-invitations endpoint reads the session off `headers`
|
|
412
|
-
* itself; ported as-is from
|
|
412
|
+
* itself; ported as-is from the original action.
|
|
413
413
|
*/
|
|
414
414
|
async function getUserInvitations() {
|
|
415
|
-
const hdrs = await
|
|
415
|
+
const hdrs = await getRequestHeaders();
|
|
416
416
|
const invitations = await callOrgApi("list-user-invitations", () => orgApi["/organization/list-user-invitations"]({ headers: hdrs }));
|
|
417
417
|
return invitations ?? [];
|
|
418
418
|
}
|