@jskit-ai/workspaces-core 0.1.138-oldline.1 → 0.1.138

package/src/server/workspacePendingInvitations/workspacePendingInvitationsActions.js

@@ -4,15 +4,21 @@ import {
 import { returnJsonApiData } from "@jskit-ai/http-runtime/shared";
 import { workspaceMembersResource } from "../../shared/resources/workspaceMembersResource.js";
 import { workspacePendingInvitationsResource } from "../../shared/resources/workspacePendingInvitationsResource.js";
+import { createInviteDecisionEvents } from "../common/support/realtimeServiceEvents.js";
 import { resolveActionUser } from "../common/support/resolveActionUser.js";
 
-const workspacePendingInvitationsActions = Object.freeze([
+const WORKSPACE_INVITE_DECISION_EVENTS = createInviteDecisionEvents();
+
+const workspacePendingInvitationsActionSpecifications = Object.freeze([
   {
     id: "workspace.invitation.resolve",
     version: 1,
     kind: "query",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "enabled",
+    surfaces: ["*"],
+    permission: {
+      require: "none"
+    },
     input: workspacePendingInvitationsResource.operations.resolve.query,
     output: null,
     idempotency: "none",
@@ -20,9 +26,9 @@ const workspacePendingInvitationsActions = Object.freeze([
       actionName: "workspace.invitation.resolve"
     },
     observability: {},
-    async execute(input, context, deps) {
+    async run(workspacePendingInvitationsService, input, context) {
       return returnJsonApiData(
-        await deps.workspacePendingInvitationsService.resolveInviteByToken(input?.token, {
+        await workspacePendingInvitationsService.resolveInviteByToken(input?.token, {
           context
         })
       );
@@ -33,7 +39,7 @@ const workspacePendingInvitationsActions = Object.freeze([
     version: 1,
     kind: "query",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "enabled",
+    surfaces: ["*"],
     permission: {
       require: "authenticated"
     },
@@ -44,9 +50,9 @@ const workspacePendingInvitationsActions = Object.freeze([
       actionName: "workspace.invitations.pending.list"
     },
     observability: {},
-    async execute(input, context, deps) {
+    async run(workspacePendingInvitationsService, input, context) {
       return returnJsonApiData({
-        pendingInvites: await deps.workspacePendingInvitationsService.listPendingInvitesForUser(resolveActionUser(context, input), {
+        pendingInvites: await workspacePendingInvitationsService.listPendingInvitesForUser(resolveActionUser(context, input), {
           context
         })
       });
@@ -57,7 +63,7 @@ const workspacePendingInvitationsActions = Object.freeze([
     version: 1,
     kind: "command",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "enabled",
+    surfaces: ["*"],
     permission: {
       require: "authenticated"
     },
@@ -68,12 +74,13 @@ const workspacePendingInvitationsActions = Object.freeze([
       actionName: "workspace.invite.redeem"
     },
     observability: {},
-    async execute(input, context, deps) {
+    events: WORKSPACE_INVITE_DECISION_EVENTS,
+    async run(workspacePendingInvitationsService, input, context) {
       const payload = input || {};
       const user = resolveActionUser(context, input);
 
       if (payload.decision === "accept") {
-        return returnJsonApiData(await deps.workspacePendingInvitationsService.acceptInviteByToken({
+        return returnJsonApiData(await workspacePendingInvitationsService.acceptInviteByToken({
           user,
           token: payload.token
         }, {
@@ -81,7 +88,7 @@ const workspacePendingInvitationsActions = Object.freeze([
         }));
       }
 
-      return returnJsonApiData(await deps.workspacePendingInvitationsService.refuseInviteByToken({
+      return returnJsonApiData(await workspacePendingInvitationsService.refuseInviteByToken({
         user,
         token: payload.token
       }, {
@@ -91,4 +98,16 @@ const workspacePendingInvitationsActions = Object.freeze([
   }
 ]);
 
-export { workspacePendingInvitationsActions };
+function buildWorkspacePendingInvitationsActions({ workspacePendingInvitationsService } = {}) {
+  if (!workspacePendingInvitationsService) {
+    throw new TypeError("buildWorkspacePendingInvitationsActions requires workspacePendingInvitationsService.");
+  }
+  return workspacePendingInvitationsActionSpecifications.map(({ run, ...definition }) => Object.freeze({
+    ...definition,
+    execute(input, context) {
+      return run(workspacePendingInvitationsService, input, context);
+    }
+  }));
+}
+
+export { workspacePendingInvitationsActionSpecifications, buildWorkspacePendingInvitationsActions };

package/src/server/workspaceSettings/bootWorkspaceSettings.js

@@ -19,14 +19,11 @@ function resolveWorkspaceSettingsRecordId(record = {}, context = {}) {
   throw new Error("Workspace settings JSON:API response requires workspace id.");
 }
 
-function bootWorkspaceSettings(app) {
-  if (!app || typeof app.make !== "function") {
-    throw new Error("bootWorkspaceSettings requires application make().");
+function registerWorkspaceSettingsRoutes(router, { config = {} } = {}) {
+  if (!router || typeof router.register !== "function") {
+    throw new TypeError("registerWorkspaceSettingsRoutes requires router.register().");
   }
-
-  const router = app.make("jskit.http.router");
-  const appConfig = typeof app.has === "function" && app.has("appConfig") ? app.make("appConfig") : {};
-  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(appConfig);
+  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(config);
 
   router.register(
     "GET",
@@ -92,4 +89,4 @@ function bootWorkspaceSettings(app) {
   );
 }
 
-export { bootWorkspaceSettings };
+export { registerWorkspaceSettingsRoutes };

package/src/server/workspaceSettings/workspaceSettingsActions.js

@@ -2,8 +2,15 @@ import { composeSchemaDefinitions } from "@jskit-ai/kernel/shared/validators";
 import { returnJsonApiData } from "@jskit-ai/http-runtime/shared";
 import { workspaceSettingsResource } from "../../shared/resources/workspaceSettingsResource.js";
 import { workspaceSlugParamsValidator } from "../common/validators/routeParamsValidator.js";
+import { createWorkspaceEntityAndBootstrapEvents } from "../common/support/realtimeServiceEvents.js";
 import { resolveWorkspace } from "../support/resolveWorkspace.js";
 
+const WORKSPACE_SETTINGS_CHANGED_EVENTS = createWorkspaceEntityAndBootstrapEvents({
+  workspaceEntity: "settings",
+  workspaceOperation: "updated",
+  workspaceRealtimeEvent: "workspace.settings.changed"
+});
+
 const workspaceSettingsUpdateInputValidator = composeSchemaDefinitions([
   workspaceSlugParamsValidator,
   workspaceSettingsResource.operations.patch.body
@@ -12,13 +19,13 @@ const workspaceSettingsUpdateInputValidator = composeSchemaDefinitions([
   context: "workspaceSettingsActions.workspaceSettingsUpdateInputValidator"
 });
 
-const workspaceSettingsActions = Object.freeze([
+const workspaceSettingsActionSpecifications = Object.freeze([
   {
     id: "workspace.settings.read",
     version: 1,
     kind: "query",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "workspace",
+    surfaces: ["*"],
     permission: {
       require: "any",
       permissions: ["workspace.settings.view", "workspace.settings.update"]
@@ -30,8 +37,8 @@ const workspaceSettingsActions = Object.freeze([
       actionName: "workspace.settings.read"
     },
     observability: {},
-    async execute(input, context, deps) {
-      const response = await deps.workspaceSettingsService.getWorkspaceSettings(resolveWorkspace(context, input), {
+    async run(workspaceSettingsService, input, context) {
+      const response = await workspaceSettingsService.getWorkspaceSettings(resolveWorkspace(context, input), {
         context
       });
 
@@ -43,7 +50,7 @@ const workspaceSettingsActions = Object.freeze([
     version: 1,
     kind: "command",
     channels: ["api", "assistant_tool", "automation", "internal"],
-    surfacesFrom: "workspace",
+    surfaces: ["*"],
     permission: {
       require: "all",
       permissions: ["workspace.settings.update"]
@@ -55,14 +62,15 @@ const workspaceSettingsActions = Object.freeze([
       actionName: "workspace.settings.update"
     },
     observability: {},
+    events: WORKSPACE_SETTINGS_CHANGED_EVENTS,
     extensions: {
       assistant: {
         description: "Update workspace settings."
       }
     },
-    async execute(input, context, deps) {
+    async run(workspaceSettingsService, input, context) {
       const { workspaceSlug, ...patch } = input;
-      const response = await deps.workspaceSettingsService.updateWorkspaceSettings(
+      const response = await workspaceSettingsService.updateWorkspaceSettings(
         resolveWorkspace(context, input),
         patch,
         {
@@ -75,4 +83,14 @@ const workspaceSettingsActions = Object.freeze([
   }
 ]);
 
-export { workspaceSettingsActions };
+function buildWorkspaceSettingsActions({ workspaceSettingsService } = {}) {
+  if (!workspaceSettingsService) throw new TypeError("buildWorkspaceSettingsActions requires workspaceSettingsService.");
+  return workspaceSettingsActionSpecifications.map(({ run, ...definition }) => Object.freeze({
+    ...definition,
+    execute(input, context) {
+      return run(workspaceSettingsService, input, context);
+    }
+  }));
+}
+
+export { workspaceSettingsActionSpecifications, buildWorkspaceSettingsActions };

package/src/server/workspaceSettings/workspaceSettingsRepository.js

@@ -35,7 +35,7 @@ function pickPatchFields(source = {}) {
   return patch;
 }
 
-function createDefaultWorkspaceSettingsCreatePayload(workspaceId) {
+function createDefaultWorkspaceSettingsCreatePayload(workspaceId, defaultInvitesEnabled) {
   const palettes = resolveWorkspaceThemePalettes({});
 
   return {
@@ -48,11 +48,11 @@ function createDefaultWorkspaceSettingsCreatePayload(workspaceId) {
     darkSecondaryColor: palettes.dark.secondaryColor,
     darkSurfaceColor: palettes.dark.surfaceColor,
     darkSurfaceVariantColor: palettes.dark.surfaceVariantColor,
-    invitesEnabled: true
+    invitesEnabled: defaultInvitesEnabled
   };
 }
 
-function createRepository({ api, knex } = {}) {
+function createRepository({ api, knex, defaultInvitesEnabled = true } = {}) {
   if (!api?.resources?.workspaceSettings) {
     throw new TypeError("workspaceSettingsRepository requires json-rest-api workspaceSettings resource.");
   }
@@ -103,7 +103,7 @@ function createRepository({ api, knex } = {}) {
         {
           inputRecord: createJsonApiInputRecord(
             RESOURCE_TYPE,
-            createDefaultWorkspaceSettingsCreatePayload(normalizedWorkspaceId),
+            createDefaultWorkspaceSettingsCreatePayload(normalizedWorkspaceId, defaultInvitesEnabled === true),
             {
               id: normalizedWorkspaceId
             }

package/test/exportsContract.test.js

@@ -14,7 +14,8 @@ test("workspaces-core exports are explicit and aligned with production usage", (
     packageDir: PACKAGE_DIR,
     packageId: "@jskit-ai/workspaces-core",
     requiredExports: [
-      "./server/WorkspacesCoreServiceProvider",
+      "./server/WorkspacesFeature",
+      "./server/WorkspacesIntegrationsProvider",
       "./server/validators/routeParamsValidator",
       "./server/support/workspaceRouteInput",
       "./shared/resources/workspaceResource",

package/test/featureRuntime.test.js

@@ -0,0 +1,116 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createAuthExtensions } from "@jskit-ai/auth-core/server/authExtensions";
+import { createActionProvider } from "@jskit-ai/kernel/server/actions";
+import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { createBootstrapRuntime } from "@jskit-ai/kernel/server/runtime";
+import { createUsersExtensions } from "@jskit-ai/users-core/server/usersExtensions";
+import { WorkspacesFeature } from "../src/server/WorkspacesFeature.js";
+import { WorkspacesIntegrationsProvider } from "../src/server/WorkspacesIntegrationsProvider.js";
+
+function createJsonRestApiFixture() {
+  const resources = {};
+  return {
+    resources,
+    async addResource(scopeName) {
+      resources[scopeName] = Object.freeze({
+        query: async () => ({ data: [] }),
+        post: async () => null,
+        patch: async () => null
+      });
+    }
+  };
+}
+
+function runtimeConfig() {
+  return {
+    appPublicUrl: "http://localhost:5173",
+    tenancyMode: "workspaces",
+    tenancyPolicy: { workspace: { allowSelfCreate: true } },
+    workspaceInvitations: { enabled: true },
+    workspaceMembers: { defaults: { inviteExpiresInMs: 86400000 } },
+    workspaceSettings: { defaults: { invitesEnabled: true } },
+    surfaceDefaultId: "customer",
+    surfaceDefinitions: {
+      customer: { id: "customer", requiresWorkspace: true, accessPolicyId: "workspace_authenticated" }
+    },
+    surfaceAccessPolicies: {
+      workspace_authenticated: { requireWorkspaceMembership: false }
+    },
+    roleCatalog: {
+      workspace: { defaultInviteRole: "member" },
+      roles: {
+        owner: { permissions: ["workspace.*"] },
+        member: { assignable: true, permissions: ["workspace.settings.view"] }
+      }
+    }
+  };
+}
+
+test("WorkspacesFeature assembles workspace behavior and explicit integrations", async () => {
+  const routes = [];
+  const visibilityResolvers = [];
+  const bootstrap = createBootstrapRuntime();
+  const authExtensions = createAuthExtensions();
+  const usersExtensions = createUsersExtensions();
+  const jsonRestApi = createJsonRestApiFixture();
+  let workspaces = null;
+  let actionCatalogue = null;
+  const probe = defineProvider({
+    id: "test.workspaces.probe",
+    requires: {
+      actions: "runtime.actions",
+      workspaceCapability: "workspaces.core"
+    },
+    setup({ actions, workspaceCapability }) {
+      actionCatalogue = actions;
+      workspaces = workspaceCapability;
+      return {};
+    }
+  });
+  const runtime = createCapabilityRuntime({
+    inputs: {
+      "auth.extensions": authExtensions,
+      "runtime.bootstrap": bootstrap,
+      "runtime.config": runtimeConfig(),
+      "runtime.database": { knex() {} },
+      "runtime.env": {},
+      "runtime.http": {
+        router: {
+          register(method, path) {
+            routes.push(`${method} ${path}`);
+          }
+        },
+        registerVisibilityResolver(resolver) {
+          visibilityResolvers.push(resolver);
+        }
+      },
+      "runtime.json-rest-api": jsonRestApi,
+      "users.core": {
+        repositories: {
+          userProfiles: { async findById() { return null; } }
+        }
+      },
+      "users.extensions": usersExtensions
+    },
+    providers: [createActionProvider(), WorkspacesFeature, WorkspacesIntegrationsProvider, probe]
+  });
+
+  await runtime.start();
+
+  assert.deepEqual(Object.keys(jsonRestApi.resources).sort(), [
+    "workspaceInvites",
+    "workspaceMemberships",
+    "workspaceSettings",
+    "workspaces"
+  ]);
+  assert.equal(typeof workspaces.services.directory.resolveWorkspaceContextForUserBySlug, "function");
+  assert.equal(routes.includes("POST /api/workspaces"), true);
+  assert.equal(routes.includes("GET /api/workspace/invitations/resolve"), true);
+  assert.equal(actionCatalogue.listDefinitions().length, 16);
+  assert.deepEqual(bootstrap.diagnostics().contributorIds, ["workspaces.bootstrap"]);
+  assert.deepEqual(visibilityResolvers.map((entry) => entry.id), ["workspaces.visibility"]);
+  assert.deepEqual(usersExtensions.diagnostics().profileSyncLifecycleContributorIds, ["workspaces.provisioning"]);
+  assert.deepEqual(authExtensions.diagnostics().invitationContextResolverIds, ["workspaces.invitation"]);
+  assert.deepEqual(authExtensions.diagnostics().policyContextResolverIds, ["workspaces.policy"]);
+});

package/test/packageMetadata.test.js

@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import path from "node:path";
+import test from "node:test";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import packageJson from "../package.json" with { type: "json" };
+
+const packageMetadata = packageJson.jskit;
+
+const TEST_DIRECTORY = path.dirname(fileURLToPath(import.meta.url));
+const PACKAGE_DIR = path.resolve(TEST_DIRECTORY, "..");
+
+function findRoute(method, routePath) {
+  const routes = packageMetadata?.metadata?.server?.routes;
+  return Array.isArray(routes)
+    ? routes.find((entry) => entry?.method === method && entry?.path === routePath) || null
+    : null;
+}
+
+test("workspaces-core packageMetadata advertises public invite resolution route metadata", () => {
+  assert.deepEqual(findRoute("GET", "/api/workspace/invitations/resolve"), {
+    method: "GET",
+    path: "/api/workspace/invitations/resolve",
+    summary: "Resolve safe public workspace invitation metadata."
+  });
+});
+
+test("workspaces-core publishes an app-owned editable role catalog pattern", async () => {
+  const source = await readFile(
+    path.join(PACKAGE_DIR, "patterns", "workspace-server", "example", "config", "roles.js"),
+    "utf8"
+  );
+
+  assert.match(source, /export const roleCatalog/);
+  assert.equal(Object.hasOwn(packageMetadata, "mutations"), false);
+});
+
+test("workspaces-core publishes an app-owned editable workspace invite email pattern", async () => {
+  const source = await readFile(
+    path.join(
+      PACKAGE_DIR,
+      "patterns",
+      "workspace-server",
+      "example",
+      "packages",
+      "main",
+      "src",
+      "server",
+      "email",
+      "workspaceInviteEmail.js"
+    ),
+    "utf8"
+  );
+
+  assert.match(source, /function renderWorkspaceInviteEmail/);
+  assert.match(source, /export \{ renderWorkspaceInviteEmail \}/);
+  assert.match(source, /inviteUrl/);
+  assert.deepEqual(packageMetadata.migrations, { directories: ["migrations"] });
+});

package/test/usersRouteResources.test.js

@@ -95,7 +95,7 @@ test("workspace settings and invite operations expose canonical validators", ()
   }
 });
 
-test("workspaces-core no longer uses a workspace schema helper that exposes raw schema leaves", () => {
+test("workspaces-core keeps raw workspace schema leaves private", () => {
   const testFilePath = fileURLToPath(import.meta.url);
   const packageRoot = path.resolve(path.dirname(testFilePath), "..");
   const workspaceRoutesFilePath = path.join(packageRoot, "src", "server", "common", "routes", "workspaceRoutes.js");

package/test/workspaceActionContextContributor.test.js

@@ -47,8 +47,7 @@ test("workspace action context contributor resolves workspace context for worksp
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -147,8 +146,7 @@ test("workspace action context contributor always resolves and stores resolved c
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -224,8 +222,7 @@ test("workspace action context contributor resolves context for workspace-visibl
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -306,8 +303,7 @@ test("workspace action context contributor resolves context for workspace surfac
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -376,10 +372,9 @@ test("workspace action context contributor permits missing membership only for a
     },
     input: { workspaceSlug: "acme" },
     context: {
-      requestMeta: { request }
-    },
-    request,
-    surface: "app"
+      requestMeta: { request },
+      surface: "app"
+    }
   });
 
   assert.equal(calls.length, 1);

package/test/workspaceAuthPolicyContextResolver.test.js

@@ -148,3 +148,33 @@ test("workspace auth policy context resolver treats optional context as membersh
   assert.equal(resolved.membership, null);
   assert.deepEqual(resolved.permissions, []);
 });
+
+test("workspace auth policy honors membership-optional workspace surfaces", async () => {
+  const calls = [];
+  const request = {
+    params: { workspaceSlug: "dog-and-groom" },
+    routeOptions: { config: { surface: "customer" } }
+  };
+  const resolver = createWorkspaceAuthPolicyContextResolver({
+    workspaceMembershipOptionalSurfaceIds: ["customer"],
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, options) {
+        calls.push({ actor, workspaceSlug, options });
+        return {
+          workspace: { id: 11, slug: workspaceSlug },
+          membership: null,
+          permissions: []
+        };
+      }
+    }
+  });
+
+  const resolved = await resolver({
+    request,
+    actor: { id: 7 },
+    meta: { contextPolicy: "required" }
+  });
+
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.equal(resolved.membership, null);
+});

package/test/workspaceRouteVisibilityResolver.test.js

@@ -81,3 +81,34 @@ test("workspace route visibility resolver still marks workspace_user as actor-sc
     userId: "user_99"
   });
 });
+
+test("workspace route visibility honors membership-optional workspace surfaces", async () => {
+  const calls = [];
+  const request = {
+    routeOptions: { config: { surface: "customer" } }
+  };
+  const resolver = createWorkspaceRouteVisibilityResolver({
+    workspaceMembershipOptionalSurfaceIds: ["customer"],
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, options) {
+        calls.push({ actor, workspaceSlug, options });
+        return { workspace: { id: 11 } };
+      }
+    }
+  });
+
+  const contribution = await resolver.resolve({
+    visibility: "workspace_user",
+    context: { actor: { id: "user_99" } },
+    input: { workspaceSlug: "dog-and-groom" },
+    request
+  });
+
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.deepEqual(contribution, {
+    scopeKind: "workspace_user",
+    requiresActorScope: true,
+    scopeOwnerId: "11",
+    userId: "user_99"
+  });
+});

package/test/workspaceService.test.js

@@ -179,7 +179,7 @@ function createWorkspaceServiceFixture({
   return { service, calls, insertedPayloads };
 }
 
-test("workspaceService no longer exposes bootstrap payload assembly", () => {
+test("workspaceService keeps bootstrap payload assembly outside its API", () => {
   const { service } = createWorkspaceServiceFixture();
   assert.equal(service.buildBootstrapPayload, undefined);
 });
@@ -199,7 +199,7 @@ test("workspaceService.listWorkspacesForUser returns only accessible workspaces"
   assert.equal(calls.insert, 0);
 });
 
-test("workspaceService.listWorkspacesForUser no longer provisions personal workspace in workspace mode", async () => {
+test("workspaceService.listWorkspacesForUser does not provision a personal workspace in workspace mode", async () => {
   const { service, calls } = createWorkspaceServiceFixture({
     tenancyMode: "workspaces",
     personalWorkspace: null