@jskit-ai/workspaces-core 0.1.81 → 0.1.83

package/test/workspacePendingInvitationsService.test.js

@@ -5,9 +5,11 @@ import { createService } from "../src/server/workspacePendingInvitations/workspa
 
 function createFixture({
   pendingInvitesByEmail = [],
-  inviteByTokenHash = null
+  inviteByTokenHash = null,
+  resolvedInviteByTokenHash = null
 } = {}) {
   const tokenHashCalls = [];
+  const resolveTokenHashCalls = [];
   const upsertCalls = [];
   const revokeCalls = [];
   const acceptCalls = [];
@@ -25,6 +27,14 @@ function createFixture({
 
         return inviteByTokenHash[String(tokenHash || "")] || null;
       },
+      async findByTokenHashWithWorkspace(tokenHash) {
+        resolveTokenHashCalls.push(String(tokenHash || ""));
+        if (!resolvedInviteByTokenHash || typeof resolvedInviteByTokenHash !== "object") {
+          return null;
+        }
+
+        return resolvedInviteByTokenHash[String(tokenHash || "")] || null;
+      },
       async revokeById(inviteId) {
         revokeCalls.push(Number(inviteId));
       },
@@ -47,6 +57,7 @@ function createFixture({
     service,
     calls: {
       tokenHashCalls,
+      resolveTokenHashCalls,
       upsertCalls,
       revokeCalls,
       acceptCalls
@@ -83,6 +94,120 @@ test("listPendingInvitesForUser returns raw pending invite rows for the action l
   assert.equal(pendingInvites[0].status, "pending");
 });
 
+test("resolveInviteByToken returns safe public invite metadata without mutating the invite", async () => {
+  const tokenHash = "d".repeat(64);
+  const encodedToken = encodeInviteTokenHash(tokenHash);
+  const { service, calls } = createFixture({
+    resolvedInviteByTokenHash: {
+      [tokenHash]: {
+        id: "46",
+        workspaceId: "8",
+        workspaceSlug: "acme",
+        workspaceName: "Acme",
+        workspaceAvatarUrl: "https://example.com/acme.png",
+        email: "Invitee@Example.com",
+        roleSid: "admin",
+        status: "pending",
+        tokenHash,
+        expiresAt: "2030-01-01T00:00:00.000Z"
+      }
+    }
+  });
+
+  const resolved = await service.resolveInviteByToken(encodedToken);
+
+  assert.deepEqual(calls.resolveTokenHashCalls, [tokenHash]);
+  assert.deepEqual(calls.revokeCalls, []);
+  assert.equal(resolved.id, "46");
+  assert.equal(resolved.token, encodedToken);
+  assert.equal(resolved.status, "pending");
+  assert.equal(resolved.email, "invitee@example.com");
+  assert.equal(resolved.maskedEmail, "in*****@example.com");
+  assert.equal(resolved.roleSid, "admin");
+  assert.deepEqual(resolved.workspace, {
+    id: "8",
+    slug: "acme",
+    name: "Acme",
+    avatarUrl: "https://example.com/acme.png"
+  });
+});
+
+test("resolveInviteByToken reports expired and missing invitations as terminal states", async () => {
+  const expiredTokenHash = "e".repeat(64);
+  const missingTokenHash = "f".repeat(64);
+  const expiredToken = encodeInviteTokenHash(expiredTokenHash);
+  const missingToken = encodeInviteTokenHash(missingTokenHash);
+  const { service, calls } = createFixture({
+    resolvedInviteByTokenHash: {
+      [expiredTokenHash]: {
+        id: "47",
+        workspaceId: "8",
+        workspaceSlug: "acme",
+        workspaceName: "Acme",
+        workspaceAvatarUrl: "",
+        email: "invitee@example.com",
+        roleSid: "member",
+        status: "pending",
+        tokenHash: expiredTokenHash,
+        expiresAt: "2000-01-01T00:00:00.000Z"
+      }
+    }
+  });
+
+  const expired = await service.resolveInviteByToken(expiredToken);
+  const missing = await service.resolveInviteByToken(missingToken);
+
+  assert.equal(expired.status, "expired");
+  assert.equal(missing.status, "not_found");
+  assert.equal(missing.email, "");
+  assert.deepEqual(calls.revokeCalls, []);
+  assert.deepEqual(calls.acceptCalls, []);
+});
+
+test("resolveInviteContextForAuth returns invite context for matching registration emails", async () => {
+  const tokenHash = "1".repeat(64);
+  const encodedToken = encodeInviteTokenHash(tokenHash);
+  const { service } = createFixture({
+    resolvedInviteByTokenHash: {
+      [tokenHash]: {
+        id: "48",
+        workspaceId: "8",
+        workspaceSlug: "acme",
+        workspaceName: "Acme",
+        workspaceAvatarUrl: "",
+        email: "Invitee@Example.com",
+        roleSid: "member",
+        status: "pending",
+        tokenHash,
+        expiresAt: "2030-01-01T00:00:00.000Z"
+      }
+    }
+  });
+
+  const context = await service.resolveInviteContextForAuth({
+    token: encodedToken,
+    email: "invitee@example.com"
+  });
+
+  assert.deepEqual(context, {
+    token: encodedToken,
+    workspaceId: "8",
+    workspaceSlug: "acme",
+    workspaceName: "Acme",
+    email: "invitee@example.com",
+    roleSid: "member",
+    expiresAt: "2030-01-01T00:00:00.000Z"
+  });
+  await assert.rejects(
+    () =>
+      service.resolveInviteContextForAuth({
+        token: encodedToken,
+        email: "other@example.com"
+      }),
+    /Invitation email does not match account email/
+  );
+});
+
 test("acceptInviteByToken accepts opaque invite token and resolves invite by decoded hash", async () => {
   const tokenHash = "b".repeat(64);
   const encodedToken = encodeInviteTokenHash(tokenHash);

package/test/workspacesRouteRequestInputValidator.test.js

@@ -161,6 +161,10 @@ test("workspace and settings routes attach only shared schema definitions on raw
     method: "DELETE",
     path: "/api/w/:workspaceSlug/invites/:inviteId"
   });
+  const workspaceInviteResolve = findRoute(routes, {
+    method: "GET",
+    path: "/api/workspace/invitations/resolve"
+  });
 
   assert.equal(typeof workspaceSettings?.params?.schema, "object");
   assert.equal(typeof workspacePatch?.body?.schema, "object");
@@ -169,6 +173,7 @@ test("workspace and settings routes attach only shared schema definitions on raw
   assert.equal(typeof workspaceMemberRole?.body?.schema, "object");
   assert.equal(typeof workspaceMemberDelete?.params?.schema, "object");
   assert.equal(typeof workspaceInviteDelete?.params?.schema, "object");
+  assert.equal(typeof workspaceInviteResolve?.query?.schema, "object");
 });
 
 test("workspace core/settings routes mount one canonical workspace endpoint", async () => {
@@ -264,6 +269,7 @@ test("workspaces-core route registration follows tenancy mode matrix", async ()
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug" }), null);
   assert.equal(findRoute(noneRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug" }), null);
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspace/invitations/resolve" }), null);
   assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspace/invitations/pending" }), null);
 
   assert.equal(findRoute(personalRoutes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
@@ -280,6 +286,10 @@ test("workspaces-core route registration follows tenancy mode matrix", async ()
     findRoute(personalRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" })?.path,
     "/api/w/:workspaceSlug/settings"
   );
+  assert.equal(
+    findRoute(personalRoutes, { method: "GET", path: "/api/workspace/invitations/resolve" })?.path,
+    "/api/workspace/invitations/resolve"
+  );
   assert.equal(
     findRoute(personalRoutes, { method: "GET", path: "/api/workspace/invitations/pending" })?.path,
     "/api/workspace/invitations/pending"
@@ -299,6 +309,10 @@ test("workspaces-core route registration follows tenancy mode matrix", async ()
     findRoute(workspaceRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" })?.path,
     "/api/w/:workspaceSlug/settings"
   );
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "GET", path: "/api/workspace/invitations/resolve" })?.path,
+    "/api/workspace/invitations/resolve"
+  );
   assert.equal(
     findRoute(workspaceRoutes, { method: "GET", path: "/api/workspace/invitations/pending" })?.path,
     "/api/workspace/invitations/pending"
@@ -318,6 +332,7 @@ test("workspaces-core boot skips invitation redeem/list routes when workspace in
     workspaceSelfCreateEnabled: false
   });
 
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/workspace/invitations/resolve" }), null);
   assert.equal(findRoute(routes, { method: "GET", path: "/api/workspace/invitations/pending" }), null);
   assert.equal(findRoute(routes, { method: "POST", path: "/api/workspace/invitations/redeem" }), null);
   assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/invites" }), null);
@@ -335,6 +350,10 @@ test("workspace invite and member handlers build action input from request.input
     method: "POST",
     path: "/api/workspace/invitations/redeem"
   });
+  const workspaceInviteResolve = findRoute(routes, {
+    method: "GET",
+    path: "/api/workspace/invitations/resolve"
+  });
   const workspaceMemberRolePatch = findRoute(routes, {
     method: "PATCH",
     path: "/api/w/:workspaceSlug/members/:memberUserId/role"
@@ -366,6 +385,15 @@ test("workspace invite and member handlers build action input from request.input
     }),
     createReplyDouble()
   );
+  await workspaceInviteResolve.handler(
+    createActionRequest({
+      input: {
+        query: { token: "token-0" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
   await workspaceInviteRedeem.handler(
     createActionRequest({
       input: {
@@ -418,11 +446,15 @@ test("workspace invite and member handlers build action input from request.input
     actionId: "workspace.workspaces.create",
     input: { name: "Operations", slug: "operations" }
   });
-  assert.deepEqual(calls[1].input, { token: "token-1", decision: "accept" });
-  assert.deepEqual(calls[2].input, { workspaceSlug: "acme", memberUserId: "12", roleSid: "admin" });
-  assert.deepEqual(calls[3].input, { workspaceSlug: "acme", email: "user@example.com", roleSid: "member" });
-  assert.deepEqual(calls[4].input, { workspaceSlug: "acme", memberUserId: "44" });
-  assert.deepEqual(calls[5].input, { workspaceSlug: "acme", inviteId: "55" });
+  assert.deepEqual(calls[1], {
+    actionId: "workspace.invitation.resolve",
+    input: { token: "token-0" }
+  });
+  assert.deepEqual(calls[2].input, { token: "token-1", decision: "accept" });
+  assert.deepEqual(calls[3].input, { workspaceSlug: "acme", memberUserId: "12", roleSid: "admin" });
+  assert.deepEqual(calls[4].input, { workspaceSlug: "acme", email: "user@example.com", roleSid: "member" });
+  assert.deepEqual(calls[5].input, { workspaceSlug: "acme", memberUserId: "44" });
+  assert.deepEqual(calls[6].input, { workspaceSlug: "acme", inviteId: "55" });
 });
 
 test("workspace settings route handlers build action input from request.input", async () => {