@jskit-ai/users-core 0.1.31 → 0.1.33

package/test/workspaceActionContextContributor.test.js

@@ -19,12 +19,13 @@ test("workspace action context contributor resolves workspace context for worksp
             slug: "acme"
           },
           membership: {
-            roleId: "owner"
+            roleSid: "owner"
           },
           permissions: ["workspace.settings.update"]
         };
       }
-    }
+    },
+    workspaceSurfaceIds: ["admin", "app"]
   });
 
   const request = {
@@ -35,7 +36,10 @@ test("workspace action context contributor resolves workspace context for worksp
   };
 
   const contribution = await contributor.contribute({
-    actionId: "workspace.settings.update",
+    definition: {
+      id: "workspace.settings.update",
+      surfaces: ["admin", "app"]
+    },
     input: {
       workspaceSlug: "Acme"
     },
@@ -64,7 +68,7 @@ test("workspace action context contributor resolves workspace context for worksp
           slug: "acme"
         },
         membership: {
-          roleId: "owner"
+          roleSid: "owner"
         },
         permissions: ["workspace.settings.update"]
       }
@@ -74,7 +78,7 @@ test("workspace action context contributor resolves workspace context for worksp
       slug: "acme"
     },
     membership: {
-      roleId: "owner"
+      roleSid: "owner"
     },
     permissions: ["workspace.settings.update"]
   });
@@ -113,12 +117,13 @@ test("workspace action context contributor always resolves and stores resolved c
             ownerUserId: 77
           },
           membership: {
-            roleId: "owner"
+            roleSid: "owner"
           },
           permissions: ["workspace.settings.update"]
         };
       }
-    }
+    },
+    workspaceSurfaceIds: ["admin", "app"]
   });
 
   const request = {
@@ -128,7 +133,10 @@ test("workspace action context contributor always resolves and stores resolved c
   };
 
   const contribution = await contributor.contribute({
-    actionId: "workspace.members.list",
+    definition: {
+      id: "workspace.members.list",
+      surfaces: ["admin", "app"]
+    },
     input: {
       workspaceSlug: "acme"
     },
@@ -161,13 +169,13 @@ test("workspace action context contributor always resolves and stores resolved c
           ownerUserId: 77
         },
         membership: {
-          roleId: "owner"
+          roleSid: "owner"
         },
         permissions: ["workspace.settings.update"]
       }
     },
     membership: {
-      roleId: "owner"
+      roleSid: "owner"
     },
     permissions: ["workspace.settings.update"]
   });
@@ -185,7 +193,7 @@ test("workspace action context contributor resolves context for workspace-visibl
             slug: "acme"
           },
           membership: {
-            roleId: "admin"
+            roleSid: "admin"
           },
           permissions: ["assistant.chat.use"]
         };
@@ -205,7 +213,10 @@ test("workspace action context contributor resolves context for workspace-visibl
   };
 
   const contribution = await contributor.contribute({
-    actionId: "assistant.conversations.list",
+    definition: {
+      id: "assistant.conversations.list",
+      surfaces: ["admin"]
+    },
     input: {
       workspaceSlug: "acme"
     },
@@ -234,7 +245,7 @@ test("workspace action context contributor resolves context for workspace-visibl
           slug: "acme"
         },
         membership: {
-          roleId: "admin"
+          roleSid: "admin"
         },
         permissions: ["assistant.chat.use"]
       }
@@ -244,8 +255,90 @@ test("workspace action context contributor resolves context for workspace-visibl
       slug: "acme"
     },
     membership: {
-      roleId: "admin"
+      roleSid: "admin"
     },
     permissions: ["assistant.chat.use"]
   });
 });
+
+test("workspace action context contributor resolves context for workspace surfaces even when route visibility is public", async () => {
+  const calls = [];
+  const contributor = createWorkspaceActionContextContributor({
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options) {
+        calls.push({ user, workspaceSlug, options });
+        return {
+          workspace: {
+            id: 77,
+            slug: "acme"
+          },
+          membership: {
+            roleSid: "member"
+          },
+          permissions: ["crud.breeds.list"]
+        };
+      }
+    },
+    workspaceSurfaceIds: ["admin", "app"]
+  });
+
+  const request = {
+    user: {
+      id: 42
+    },
+    routeOptions: {
+      config: {
+        surface: "admin",
+        visibility: "public"
+      }
+    }
+  };
+
+  const contribution = await contributor.contribute({
+    definition: {
+      id: "crud.breeds.list",
+      surfaces: ["admin"]
+    },
+    input: {
+      workspaceSlug: "acme"
+    },
+    context: {
+      requestMeta: {
+        request
+      }
+    },
+    request
+  });
+
+  assert.deepEqual(calls, [
+    {
+      user: request.user,
+      workspaceSlug: "acme",
+      options: {
+        request
+      }
+    }
+  ]);
+  assert.deepEqual(contribution, {
+    requestMeta: {
+      resolvedWorkspaceContext: {
+        workspace: {
+          id: 77,
+          slug: "acme"
+        },
+        membership: {
+          roleSid: "member"
+        },
+        permissions: ["crud.breeds.list"]
+      }
+    },
+    workspace: {
+      id: 77,
+      slug: "acme"
+    },
+    membership: {
+      roleSid: "member"
+    },
+    permissions: ["crud.breeds.list"]
+  });
+});

package/test/workspaceAuthPolicyContextResolver.test.js

@@ -45,7 +45,7 @@ test("workspace auth policy context resolver resolves workspace context from use
             slug: workspaceSlug
           },
           membership: {
-            roleId: "owner"
+            roleSid: "owner"
           },
           permissions: ["projects.read"]
         };
@@ -85,7 +85,7 @@ test("workspace auth policy context resolver resolves workspace context from use
       slug: "acme"
     },
     membership: {
-      roleId: "owner"
+      roleSid: "owner"
     },
     permissions: ["projects.read"]
   });

package/test/workspaceBootstrapContributor.test.js

@@ -10,7 +10,7 @@ function createAuthenticatedProfile(overrides = {}) {
   return {
     id: 7,
     authProvider: "local",
-    authProviderUserId: "user-7",
+    authProviderUserSid: "user-7",
     username: "tester",
     displayName: "Test User",
     email: "test@example.com",
@@ -39,7 +39,7 @@ test("workspace bootstrap contributor passes actor context to pending invites se
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return profile;
       }
@@ -101,7 +101,7 @@ test("workspace bootstrap contributor seeds the initial console owner on authent
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return profile;
       }
@@ -162,7 +162,7 @@ test("workspace bootstrap contributor emits canonical tenancy profile from users
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return null;
       }
@@ -228,7 +228,7 @@ test("workspace bootstrap contributor resolves workspace slug from bootstrap que
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return profile;
       }
@@ -291,7 +291,7 @@ test("workspace bootstrap contributor returns global payload with requestedWorks
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return profile;
       }
@@ -363,7 +363,7 @@ test("workspace bootstrap contributor returns requestedWorkspace=not_found when
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return profile;
       }
@@ -427,7 +427,7 @@ test("workspace bootstrap contributor returns requestedWorkspace=unauthenticated
         return [];
       }
     },
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return null;
       }

package/test/workspaceInvitesRepository.test.js

@@ -11,7 +11,7 @@ function createKnexStub() {
     id: 1,
     workspace_id: 1,
     email: "invitee@example.com",
-    role_id: "member",
+    role_sid: "member",
     status: "pending",
     token_hash: "hash",
     invited_by_user_id: 1,
@@ -57,7 +57,7 @@ test("workspaceInvitesRepository.insert normalizes expiresAt ISO input to databa
   await repository.insert({
     workspaceId: 1,
     email: "invitee@example.com",
-    roleId: "member",
+    roleSid: "member",
     status: "pending",
     tokenHash: "hash",
     invitedByUserId: 1,
@@ -76,7 +76,7 @@ test("workspaceInvitesRepository.findPendingByTokenHash reads from invites table
     id: 44,
     workspace_id: 9,
     email: "invitee@example.com",
-    role_id: "member",
+    role_sid: "member",
     status: "pending",
     token_hash: "hash-token",
     invited_by_user_id: 1,

package/test/workspaceMembersService.test.js

@@ -16,8 +16,10 @@ function authorizedOptions(permissions = []) {
 
 function createRoleCatalog() {
   return createWorkspaceRoleCatalog({
-    workspaceRoles: {
-      defaultInviteRole: "member",
+    roleCatalog: {
+      workspace: {
+        defaultInviteRole: "member"
+      },
       roles: {
         owner: {
           assignable: false,
@@ -52,7 +54,7 @@ function createFixture() {
         return [
           {
             userId: 11,
-            roleId: "member",
+            roleSid: "member",
             status: "active",
             displayName: "Alice",
             email: "alice@example.com"
@@ -65,7 +67,7 @@ function createFixture() {
         return {
           workspaceId: 7,
           userId: 11,
-          roleId: "member",
+          roleSid: "member",
           status: "active"
         };
       },
@@ -73,7 +75,7 @@ function createFixture() {
         assert.equal(Number(workspaceId), 7);
         assert.equal(Number(userId), 11);
         assert.deepEqual(patch, {
-          roleId: "admin",
+          roleSid: "admin",
           status: "active"
         });
       }
@@ -134,7 +136,7 @@ test("workspaceMembersService.createInvite uses configured inviteExpiresInMs", a
     { id: 11 },
     {
       email: "alice@example.com",
-      roleId: "member"
+      roleSid: "member"
     },
     authorizedOptions(["workspace.members.invite"])
   );
@@ -260,13 +262,13 @@ test("workspaceMembersService.updateMemberRole returns the refreshed member list
     workspace,
     {
       memberUserId: 11,
-      roleId: "admin"
+      roleSid: "admin"
     },
     authorizedOptions(["workspace.members.manage"])
   );
 
   assert.equal(response.members.length, 1);
-  assert.equal(response.members[0].roleId, "member");
+  assert.equal(response.members[0].roleSid, "member");
 });
 
 test("workspaceMembersService.removeMember marks membership revoked and returns refreshed members", async () => {
@@ -287,7 +289,7 @@ test("workspaceMembersService.removeMember marks membership revoked and returns
           : [
               {
                 userId: 11,
-                roleId: "member",
+                roleSid: "member",
                 status: "active",
                 displayName: "Alice",
                 email: "alice@example.com"
@@ -300,7 +302,7 @@ test("workspaceMembersService.removeMember marks membership revoked and returns
         return {
           workspaceId: 7,
           userId: 11,
-          roleId: "member",
+          roleSid: "member",
           status: "active"
         };
       },
@@ -308,7 +310,7 @@ test("workspaceMembersService.removeMember marks membership revoked and returns
         assert.equal(Number(workspaceId), 7);
         assert.equal(Number(userId), 11);
         assert.deepEqual(patch, {
-          roleId: "member",
+          roleSid: "member",
           status: "revoked"
         });
         removed = true;
@@ -359,7 +361,7 @@ test("workspaceMembersService.removeMember rejects removing the owner", async ()
         return {
           workspaceId: 7,
           userId: 9,
-          roleId: "owner",
+          roleSid: "owner",
           status: "active"
         };
       },

package/test/workspacePendingInvitationsResource.test.js

@@ -14,7 +14,7 @@ test("workspacePendingInvitationsResource output normalizer shapes raw invite ro
         workspaceSlug: "tonymobily3",
         workspaceName: "",
         workspaceAvatarUrl: "",
-        roleId: "Member",
+        roleSid: "Member",
         status: "Pending",
         expiresAt: "2030-01-01T00:00:00.000Z",
         tokenHash
@@ -29,7 +29,7 @@ test("workspacePendingInvitationsResource output normalizer shapes raw invite ro
       workspaceSlug: "tonymobily3",
       workspaceName: "tonymobily3",
       workspaceAvatarUrl: "",
-      roleId: "member",
+      roleSid: "member",
       status: "pending",
       expiresAt: "2030-01-01T00:00:00.000Z",
       token: encodeInviteTokenHash(tokenHash)

package/test/workspacePendingInvitationsService.test.js

@@ -64,7 +64,7 @@ test("listPendingInvitesForUser returns raw pending invite rows for the action l
         workspaceSlug: "tonymobily3",
         workspaceName: "TonyMobily3",
         workspaceAvatarUrl: "",
-        roleId: "member",
+        roleSid: "member",
         status: "pending",
         expiresAt: "2030-01-01T00:00:00.000Z",
         tokenHash
@@ -91,7 +91,7 @@ test("acceptInviteByToken accepts opaque invite token and resolves invite by dec
         id: 44,
         workspaceId: 1,
         email: "chiaramobily@gmail.com",
-        roleId: "member",
+        roleSid: "member",
         status: "pending",
         tokenHash,
         expiresAt: "2030-01-01T00:00:00.000Z"
@@ -125,7 +125,7 @@ test("refuseInviteByToken revokes the invite and returns refused", async () => {
         id: 45,
         workspaceId: 1,
         email: "chiaramobily@gmail.com",
-        roleId: "member",
+        roleSid: "member",
         status: "pending",
         tokenHash,
         expiresAt: "2030-01-01T00:00:00.000Z"

package/test/workspaceService.test.js

@@ -2,9 +2,11 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import { createService } from "../src/server/common/services/workspaceContextService.js";
 
-function createWorkspaceRoles() {
+function createRoleCatalog() {
   return {
-    defaultInviteRole: "member",
+    workspace: {
+      defaultInviteRole: "member"
+    },
     roles: {
       owner: {
         assignable: false,
@@ -21,7 +23,7 @@ function createWorkspaceRoles() {
 function createWorkspaceServiceFixture({
   tenancyMode = "workspaces",
   tenancyPolicy = {},
-  workspaceRoles = createWorkspaceRoles(),
+  roleCatalog = createRoleCatalog(),
   additionalWorkspaces = [],
   userWorkspaceRows = null,
   membershipResolver = null,
@@ -69,7 +71,7 @@ function createWorkspaceServiceFixture({
     appConfig: {
       tenancyMode,
       tenancyPolicy,
-      workspaceRoles: workspaceRoles && typeof workspaceRoles === "object" ? { ...workspaceRoles } : workspaceRoles
+      roleCatalog: roleCatalog && typeof roleCatalog === "object" ? { ...roleCatalog } : roleCatalog
     },
     workspacesRepository: {
       async findBySlug(slug) {
@@ -95,7 +97,7 @@ function createWorkspaceServiceFixture({
             slug: "tonymobily3",
             name: "TonyMobily3",
             avatarUrl: "",
-            roleId: "owner",
+            roleSid: "owner",
             membershipStatus: "active"
           },
           {
@@ -103,7 +105,7 @@ function createWorkspaceServiceFixture({
             slug: "pending-workspace",
             name: "Pending Workspace",
             avatarUrl: "",
-            roleId: "member",
+            roleSid: "member",
             membershipStatus: "pending"
           }
         ];
@@ -158,7 +160,7 @@ function createWorkspaceServiceFixture({
         return {
           workspaceId,
           userId,
-          roleId: "owner",
+          roleSid: "owner",
           status: "active"
         };
       }
@@ -190,7 +192,7 @@ test("workspaceService.listWorkspacesForUser returns only accessible workspaces"
 
   assert.equal(workspaces.length, 1);
   assert.equal(workspaces[0].slug, "tonymobily3");
-  assert.equal(workspaces[0].roleId, "owner");
+  assert.equal(workspaces[0].roleSid, "owner");
   assert.equal(calls.listForUserId, 1);
   assert.equal(calls.insert, 0);
 });
@@ -220,7 +222,7 @@ test("workspaceService.listWorkspacesForUser returns all active memberships in p
         slug: "chiaramobily",
         name: "Chiara Personal",
         avatarUrl: "",
-        roleId: "owner",
+        roleSid: "owner",
         membershipStatus: "active"
       },
       {
@@ -228,7 +230,7 @@ test("workspaceService.listWorkspacesForUser returns all active memberships in p
         slug: "tonymobily",
         name: "Tony Workspace",
         avatarUrl: "",
-        roleId: "member",
+        roleSid: "member",
         membershipStatus: "active"
       },
       {
@@ -236,7 +238,7 @@ test("workspaceService.listWorkspacesForUser returns all active memberships in p
         slug: "pending-workspace",
         name: "Pending Workspace",
         avatarUrl: "",
-        roleId: "member",
+        roleSid: "member",
         membershipStatus: "pending"
       }
     ]
@@ -393,7 +395,7 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug allows personal tena
   );
 
   assert.equal(context.workspace.slug, "team-alpha");
-  assert.equal(context.membership.roleId, "owner");
+  assert.equal(context.membership.roleSid, "owner");
   assert.deepEqual(context.permissions, ["*"]);
 });
 
@@ -404,7 +406,7 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug grants owner access
   const service = createService({
     appConfig: {
       tenancyMode: "personal",
-      workspaceRoles: createWorkspaceRoles()
+      roleCatalog: createRoleCatalog()
     },
     workspacesRepository: {
       async findBySlug(slug) {
@@ -439,7 +441,7 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug grants owner access
         membershipRecord = {
           workspaceId,
           userId,
-          roleId: "owner",
+          roleSid: "owner",
           status: "active"
         };
         return membershipRecord;
@@ -464,14 +466,16 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug grants owner access
   );
 
   assert.equal(ensuredMembershipCount, 1);
-  assert.equal(context.membership.roleId, "owner");
+  assert.equal(context.membership.roleSid, "owner");
   assert.deepEqual(context.permissions, ["*"]);
 });
 
-test("workspaceService.resolveWorkspaceContextForUserBySlug resolves permissions from appConfig.workspaceRoles", async () => {
+test("workspaceService.resolveWorkspaceContextForUserBySlug resolves permissions from appConfig.roleCatalog", async () => {
   const { service } = createWorkspaceServiceFixture({
-    workspaceRoles: {
-      defaultInviteRole: "member",
+    roleCatalog: {
+      workspace: {
+        defaultInviteRole: "member"
+      },
       roles: {
         owner: {
           assignable: false,

package/test/workspaceSettingsResource.test.js

@@ -8,8 +8,10 @@ import { createWorkspaceRoleCatalog } from "../src/shared/roles.js";
 
 function createRoleCatalog() {
   return createWorkspaceRoleCatalog({
-    workspaceRoles: {
-      defaultInviteRole: "member",
+    roleCatalog: {
+      workspace: {
+        defaultInviteRole: "member"
+      },
       roles: {
         owner: {
           assignable: false,

package/src/server/accountProfile/registerAvatarMultipartSupport.js

@@ -1,40 +0,0 @@
-import fastifyMultipart from "@fastify/multipart";
-
-async function registerAvatarMultipartSupport(app) {
-  if (!app || typeof app.has !== "function" || typeof app.make !== "function") {
-    throw new Error("registerAvatarMultipartSupport requires application has()/make().");
-  }
-
-  if (!app.has("jskit.fastify")) {
-    return;
-  }
-
-  const fastify = app.make("jskit.fastify");
-  if (!fastify || typeof fastify.register !== "function") {
-    throw new Error("registerAvatarMultipartSupport requires Fastify register().");
-  }
-
-  if (fastify["jskit.users-core.avatar.multipart.support"] === true) {
-    return;
-  }
-
-  if (typeof fastify.hasContentTypeParser === "function" && fastify.hasContentTypeParser("multipart")) {
-    Object.defineProperty(fastify, "jskit.users-core.avatar.multipart.support", {
-      value: true,
-      configurable: false,
-      enumerable: false,
-      writable: false
-    });
-    return;
-  }
-
-  await fastify.register(fastifyMultipart);
-  Object.defineProperty(fastify, "jskit.users-core.avatar.multipart.support", {
-    value: true,
-    configurable: false,
-    enumerable: false,
-    writable: false
-  });
-}
-
-export { registerAvatarMultipartSupport };

package/templates/config/workspaceRoles.js

@@ -1,30 +0,0 @@
-export const workspaceRoles = {};
-
-workspaceRoles.defaultInviteRole = "member";
-workspaceRoles.roles = {};
-
-workspaceRoles.roles.owner = {
-  assignable: false,
-  permissions: []
-};
-workspaceRoles.roles.owner.permissions.push("*");
-
-workspaceRoles.roles.admin = {
-  assignable: true,
-  permissions: []
-};
-workspaceRoles.roles.admin.permissions.push(
-  "workspace.roles.view",
-  "workspace.settings.view",
-  "workspace.settings.update",
-  "workspace.members.view",
-  "workspace.members.invite",
-  "workspace.members.manage",
-  "workspace.invites.revoke"
-);
-
-workspaceRoles.roles.member = {
-  assignable: true,
-  permissions: []
-};
-workspaceRoles.roles.member.permissions.push("workspace.settings.view");