@kelpie/server 0.5.1 → 0.5.2

package/dist/modules/workspace/workspaceAccessMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccessMiddleware.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspaceAccessMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAGxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AA4BpE,MAAM,WAAW,qCAAsC,SAAQ,sBAAsB;IACnF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;CAC3C;AAED,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,qCAAqC,GAClD,iBAAiB,CAmCnB"}
+{"version":3,"file":"workspaceAccessMiddleware.d.ts","sourceRoot":"","sources":["../../../src/modules/workspace/workspaceAccessMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAGxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAqCpE,MAAM,WAAW,qCAAsC,SAAQ,sBAAsB;IACnF,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;CAC3C;AAED,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,qCAAqC,GAClD,iBAAiB,CAmCnB"}

package/dist/modules/workspace/workspaceAccessMiddleware.js

@@ -22,13 +22,21 @@ import { WORKSPACE_ACCESS } from './capabilities.js';
  * chance of understanding why. There is no `/v1` endpoint to switch a
  * session to a different workspace membership — a session is bound to one
  * at login — so there is nothing further to exempt for that case.
+ *
+ * Also exempts `DELETE /v1/workspaces/:id` itself, and only that exact
+ * path: a suspension must never trap an owner into a workspace they can no
+ * longer read or write but also cannot leave by deleting. Every other verb
+ * and every sub-resource under `/v1/workspaces/:id` (members, invites,
+ * modules) stays gated.
  */
-function isExempt(path) {
-    return path.startsWith('/v1/auth/') || path.startsWith('/v1/account');
+const WORKSPACE_DELETE_PATH = /^\/v1\/workspaces\/[^/]+$/u;
+function isExempt(method, path) {
+    return path.startsWith('/v1/auth/') || path.startsWith('/v1/account') ||
+        (method === 'DELETE' && WORKSPACE_DELETE_PATH.test(path));
 }
 export function createWorkspaceAccessMiddleware(dependencies) {
     return async (context, next) => {
-        if (isExempt(context.req.path)) {
+        if (isExempt(context.req.method, context.req.path)) {
             await next();
             return;
         }

package/dist/modules/workspace/workspaceAccessMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccessMiddleware.js","sourceRoot":"","sources":["../../../src/modules/workspace/workspaceAccessMiddleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AACvE,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,YAAmD;IAEnD,OAAO,KAAK,EAAE,OAAgB,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnF,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,+DAA+D;gBAC/D,mEAAmE;gBACnE,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAExE,gEAAgE;QAChE,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAE7F,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"workspaceAccessMiddleware.js","sourceRoot":"","sources":["../../../src/modules/workspace/workspaceAccessMiddleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAA;AAE1D,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QACnE,CAAC,MAAM,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,YAAmD;IAEnD,OAAO,KAAK,EAAE,OAAgB,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnF,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,+DAA+D;gBAC/D,mEAAmE;gBACnE,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;QAExE,gEAAgE;QAChE,oEAAoE;QACpE,uDAAuD;QACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAE7F,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kelpie/server",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "The Kelpie service as a library: module runtime, core CRM modules, REST API, MCP surface, and the shared migration pipeline.",
   "keywords": [
     "kelpie",
@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@kelpie/schemas": "^0.5.1",
+    "@kelpie/schemas": "^0.5.2",
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.32",

package/src/modules/workspace/workspaceAccessMiddleware.ts

@@ -27,9 +27,18 @@ import { WORKSPACE_ACCESS } from './capabilities.ts'
  * chance of understanding why. There is no `/v1` endpoint to switch a
  * session to a different workspace membership — a session is bound to one
  * at login — so there is nothing further to exempt for that case.
+ *
+ * Also exempts `DELETE /v1/workspaces/:id` itself, and only that exact
+ * path: a suspension must never trap an owner into a workspace they can no
+ * longer read or write but also cannot leave by deleting. Every other verb
+ * and every sub-resource under `/v1/workspaces/:id` (members, invites,
+ * modules) stays gated.
  */
-function isExempt(path: string): boolean {
-  return path.startsWith('/v1/auth/') || path.startsWith('/v1/account')
+const WORKSPACE_DELETE_PATH = /^\/v1\/workspaces\/[^/]+$/u
+
+function isExempt(method: string, path: string): boolean {
+  return path.startsWith('/v1/auth/') || path.startsWith('/v1/account') ||
+    (method === 'DELETE' && WORKSPACE_DELETE_PATH.test(path))
 }
 
 export interface WorkspaceAccessMiddlewareDependencies extends CredentialDependencies {
@@ -40,7 +49,7 @@ export function createWorkspaceAccessMiddleware(
   dependencies: WorkspaceAccessMiddlewareDependencies,
 ): MiddlewareHandler {
   return async (context: Context, next) => {
-    if (isExempt(context.req.path)) {
+    if (isExempt(context.req.method, context.req.path)) {
       await next()
       return
     }