@lastshotlabs/bunshot 0.0.25 → 0.0.28

package/dist/packages/bunshot-auth/src/routes/organizations.js

@@ -0,0 +1,741 @@
+import { getEffectiveRoles } from '../lib/groups';
+import { userAuth } from '../middleware/userAuth';
+import { ErrorResponse } from '../schemas/error';
+import { z } from 'zod';
+import { createRoute, withSecurity } from '../../../bunshot-core/src/index.js';
+import { createRouter } from '../../../bunshot-core/src/index.js';
+import { HttpError } from '../../../bunshot-core/src/index.js';
+// ---------------------------------------------------------------------------
+// Zod schemas
+// ---------------------------------------------------------------------------
+const SLUG_REGEX = /^[a-z0-9_-]+$/;
+const OrgBody = z.object({
+    name: z.string().min(1).max(200),
+    slug: z
+        .string()
+        .min(1)
+        .max(100)
+        .regex(SLUG_REGEX, 'slug must be lowercase letters, digits, underscores, or hyphens'),
+    tenantId: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
+const OrgUpdateBody = z.object({
+    name: z.string().min(1).max(200).optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional(),
+});
+const OrgResponse = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    slug: z.string(),
+    tenantId: z.string().optional(),
+    createdAt: z.string(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .openapi('Organization');
+const OrgMemberBody = z.object({
+    userId: z.string().min(1),
+    roles: z.array(z.string()).default([]),
+});
+const OrgMemberRolesBody = z.object({
+    roles: z.array(z.string()),
+});
+const OrgMemberResponse = z
+    .object({
+    orgId: z.string(),
+    userId: z.string(),
+    roles: z.array(z.string()),
+    joinedAt: z.string(),
+    invitedBy: z.string().optional(),
+})
+    .openapi('OrgMembership');
+const InvitationBody = z.object({
+    email: z.string().email(),
+    roles: z.array(z.string()).default([]),
+    ttlSeconds: z.number().int().positive().optional(),
+});
+const InvitationResponse = z
+    .object({
+    id: z.string(),
+    orgId: z.string(),
+    email: z.string(),
+    roles: z.array(z.string()),
+    expiresAt: z.string(),
+    invitedBy: z.string(),
+})
+    .openapi('OrgInvitation');
+const AcceptInvitationBody = z.object({
+    token: z.string().min(1),
+});
+const PaginatedOrgsResponse = z
+    .object({
+    orgs: z.array(OrgResponse),
+    nextCursor: z.string().optional(),
+})
+    .openapi('PaginatedOrgs');
+const tags = ['Organizations'];
+// Helper: serialize an org for JSON response
+function serializeOrg(org) {
+    if (!org)
+        return null;
+    return {
+        id: org.id,
+        name: org.name,
+        slug: org.slug,
+        tenantId: org.tenantId,
+        createdAt: org.createdAt.toISOString(),
+        metadata: org.metadata,
+    };
+}
+function serializeMembership(m) {
+    return {
+        orgId: m.orgId,
+        userId: m.userId,
+        roles: m.roles,
+        joinedAt: m.joinedAt.toISOString(),
+        invitedBy: m.invitedBy,
+    };
+}
+function serializeInvitation(inv) {
+    return {
+        id: inv.id,
+        orgId: inv.orgId,
+        email: inv.email,
+        roles: inv.roles,
+        expiresAt: inv.expiresAt.toISOString(),
+        invitedBy: inv.invitedBy,
+        // token is intentionally excluded — it is the hashed token
+    };
+}
+// ---------------------------------------------------------------------------
+// Helper: check admin role in handler (avoids inline middleware issues with openapi())
+// ---------------------------------------------------------------------------
+async function assertAdmin(c, runtime) {
+    const userId = c.get('authUserId');
+    if (!userId)
+        throw new HttpError(401, 'Unauthorized');
+    const roles = await getEffectiveRoles(runtime.adapter, userId, null);
+    if (!roles.includes('admin'))
+        throw new HttpError(403, 'Forbidden');
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+export const createOrgRouter = (_config, runtime) => {
+    const { adapter, eventBus } = runtime;
+    const svc = runtime.orgService;
+    const { createOrg, getOrg, listOrgs, updateOrg, deleteOrg, addOrgMember, removeOrgMember, getOrgMembers, getUserOrgs, updateOrgMemberRoles, createOrgInvitation, consumeOrgInvitation, listOrgInvitations, revokeOrgInvitation, getDefaultInvitationTtl, } = svc;
+    const router = createRouter();
+    // Apply userAuth globally to all org and org-related auth routes.
+    // Write routes additionally call assertAdmin() in the handler.
+    router.use('/orgs/*', userAuth);
+    router.use('/orgs', userAuth);
+    router.use('/auth/me/orgs', userAuth);
+    router.use('/auth/orgs/accept-invitation', userAuth);
+    // -------------------------------------------------------------------------
+    // POST /orgs — create org (admin only)
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'post',
+        path: '/orgs',
+        tags,
+        summary: 'Create organization',
+        request: {
+            body: { content: { 'application/json': { schema: OrgBody } }, required: true },
+        },
+        responses: {
+            201: { content: { 'application/json': { schema: OrgResponse } }, description: 'Created' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Slug already exists',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const body = c.req.valid('json');
+        try {
+            const org = await createOrg({
+                name: body.name,
+                slug: body.slug,
+                tenantId: body.tenantId,
+                metadata: body.metadata,
+            });
+            return c.json(serializeOrg(org), 201);
+        }
+        catch (err) {
+            if (err?.message?.includes('already exists')) {
+                return c.json({ error: err.message }, 409);
+            }
+            throw err;
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /orgs — list orgs (authenticated)
+    // -------------------------------------------------------------------------
+    // Note: we need a separate use() for GET /orgs that only requires userAuth
+    // The POST /orgs guard above applies to the path "/orgs" for all methods.
+    // Since Hono router.use matches all methods, the admin guard already covers POST.
+    // For GET we override by re-applying just userAuth (already applied at app level).
+    // Actually: router.use applies to all methods on that path. To have different
+    // guards per method, we use the inline middleware approach with a workaround —
+    // put the lighter guard first and let the route handler check.
+    // The cleanest approach: use middleware per-path without method specificity,
+    // applying the stricter admin guard to the write endpoints via path patterns.
+    // Since GET /orgs needs just userAuth (already applied), let's restructure.
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/orgs',
+        tags,
+        summary: 'List organizations',
+        request: {
+            query: z.object({
+                limit: z.string().optional().openapi({ description: 'Max results (default 50)' }),
+                cursor: z
+                    .string()
+                    .optional()
+                    .openapi({ description: 'Opaque pagination cursor from a previous response' }),
+            }),
+        },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: PaginatedOrgsResponse } },
+                description: 'Organizations list',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const { limit, cursor } = c.req.valid('query');
+        const result = await listOrgs({
+            limit: limit ? Math.min(parseInt(limit, 10), 200) : 50,
+            cursor: cursor || undefined,
+        });
+        return c.json({
+            orgs: result.orgs.map((o) => serializeOrg(o)),
+            nextCursor: result.nextCursor,
+        }, 200);
+    });
+    // -------------------------------------------------------------------------
+    // GET /orgs/:orgId — get org (authenticated)
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/orgs/:orgId',
+        tags,
+        summary: 'Get organization',
+        request: { params: z.object({ orgId: z.string() }) },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: OrgResponse } },
+                description: 'Organization',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const { orgId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        return c.json(serializeOrg(org), 200);
+    });
+    // -------------------------------------------------------------------------
+    // PATCH /orgs/:orgId — update org (admin only)
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'patch',
+        path: '/orgs/:orgId',
+        tags,
+        summary: 'Update organization',
+        request: {
+            params: z.object({ orgId: z.string() }),
+            body: { content: { 'application/json': { schema: OrgUpdateBody } }, required: true },
+        },
+        responses: {
+            200: { content: { 'application/json': { schema: OrgResponse } }, description: 'Updated' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const org = await updateOrg(orgId, {
+            name: body.name,
+            metadata: body.metadata === null ? undefined : body.metadata,
+        });
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        return c.json(serializeOrg(org), 200);
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /orgs/:orgId — delete org + cascade (admin only)
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'delete',
+        path: '/orgs/:orgId',
+        tags,
+        summary: 'Delete organization',
+        description: 'Delete organization and cascade-delete all memberships and pending invitations.',
+        request: { params: z.object({ orgId: z.string() }) },
+        responses: {
+            204: { description: 'Deleted' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        await deleteOrg(orgId);
+        return c.body(null, 204);
+    });
+    // -------------------------------------------------------------------------
+    // GET /orgs/:orgId/members — list members
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/orgs/:orgId/members',
+        tags,
+        summary: 'List organization members',
+        request: { params: z.object({ orgId: z.string() }) },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: z.array(OrgMemberResponse) } },
+                description: 'Members',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        const members = await getOrgMembers(orgId);
+        return c.json(members.map(serializeMembership), 200);
+    });
+    // -------------------------------------------------------------------------
+    // POST /orgs/:orgId/members — add member
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'post',
+        path: '/orgs/:orgId/members',
+        tags,
+        summary: 'Add organization member',
+        request: {
+            params: z.object({ orgId: z.string() }),
+            body: { content: { 'application/json': { schema: OrgMemberBody } }, required: true },
+        },
+        responses: {
+            201: {
+                content: { 'application/json': { schema: OrgMemberResponse } },
+                description: 'Member added',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Already a member',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        try {
+            const membership = await addOrgMember(orgId, body.userId, body.roles);
+            return c.json(serializeMembership(membership), 201);
+        }
+        catch (err) {
+            if (err?.message?.includes('already a member')) {
+                return c.json({ error: err.message }, 409);
+            }
+            throw err;
+        }
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /orgs/:orgId/members/:userId — remove member
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'delete',
+        path: '/orgs/:orgId/members/:userId',
+        tags,
+        summary: 'Remove organization member',
+        request: {
+            params: z.object({ orgId: z.string(), userId: z.string() }),
+        },
+        responses: {
+            204: { description: 'Removed' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId, userId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        await removeOrgMember(orgId, userId);
+        return c.body(null, 204);
+    });
+    // -------------------------------------------------------------------------
+    // PATCH /orgs/:orgId/members/:userId/roles — update member roles
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'patch',
+        path: '/orgs/:orgId/members/:userId/roles',
+        tags,
+        summary: 'Update organization member roles',
+        request: {
+            params: z.object({ orgId: z.string(), userId: z.string() }),
+            body: { content: { 'application/json': { schema: OrgMemberRolesBody } }, required: true },
+        },
+        responses: {
+            204: { description: 'Updated' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId, userId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        await updateOrgMemberRoles(orgId, userId, body.roles);
+        return c.body(null, 204);
+    });
+    // -------------------------------------------------------------------------
+    // POST /orgs/:orgId/invitations — create invitation
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'post',
+        path: '/orgs/:orgId/invitations',
+        tags,
+        summary: 'Create organization invitation',
+        request: {
+            params: z.object({ orgId: z.string() }),
+            body: { content: { 'application/json': { schema: InvitationBody } }, required: true },
+        },
+        responses: {
+            201: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            invitation: InvitationResponse,
+                            token: z
+                                .string()
+                                .describe('Raw invitation token to send to the user. Not stored — only available now.'),
+                        }),
+                    },
+                },
+                description: 'Invitation created',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        const inviterId = c.get('authUserId');
+        const ttl = body.ttlSeconds ?? getDefaultInvitationTtl();
+        const { invitation, token } = await createOrgInvitation(orgId, body.email, body.roles, inviterId, ttl);
+        const expiryDays = Math.round(ttl / 86400);
+        const invitationLink = `/auth/orgs/accept-invitation?token=${encodeURIComponent(token)}`;
+        eventBus.emit('auth:delivery.org_invitation', {
+            email: body.email,
+            orgName: org.name,
+            invitationLink,
+            expiryDays,
+        });
+        return c.json({ invitation: serializeInvitation(invitation), token }, 201);
+    });
+    // -------------------------------------------------------------------------
+    // GET /orgs/:orgId/invitations — list pending invitations
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/orgs/:orgId/invitations',
+        tags,
+        summary: 'List pending organization invitations',
+        request: { params: z.object({ orgId: z.string() }) },
+        responses: {
+            200: {
+                content: { 'application/json': { schema: z.array(InvitationResponse) } },
+                description: 'Invitations',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        const invitations = await listOrgInvitations(orgId);
+        return c.json(invitations.map(serializeInvitation), 200);
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /orgs/:orgId/invitations/:invitationId — revoke invitation
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'delete',
+        path: '/orgs/:orgId/invitations/:invitationId',
+        tags,
+        summary: 'Revoke organization invitation',
+        request: {
+            params: z.object({ orgId: z.string(), invitationId: z.string() }),
+        },
+        responses: {
+            204: { description: 'Revoked' },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Forbidden',
+            },
+            404: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Not found',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        await assertAdmin(c, runtime);
+        const { orgId, invitationId } = c.req.valid('param');
+        const org = await getOrg(orgId);
+        if (!org)
+            return c.json({ error: 'Organization not found' }, 404);
+        await revokeOrgInvitation(invitationId);
+        return c.body(null, 204);
+    });
+    // -------------------------------------------------------------------------
+    // POST /auth/orgs/accept-invitation — public: accept invitation
+    // -------------------------------------------------------------------------
+    router.openapi(createRoute({
+        method: 'post',
+        path: '/auth/orgs/accept-invitation',
+        tags: ['Auth', ...tags],
+        summary: 'Accept organization invitation',
+        description: 'Consumes a one-time invitation token and adds the authenticated user to the organization.',
+        request: {
+            body: { content: { 'application/json': { schema: AcceptInvitationBody } }, required: true },
+        },
+        responses: {
+            200: {
+                content: {
+                    'application/json': {
+                        schema: z.object({
+                            org: OrgResponse,
+                            membership: OrgMemberResponse,
+                        }),
+                    },
+                },
+                description: 'Joined organization',
+            },
+            400: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Invalid or expired token',
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+            403: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Invitation was sent to a different email address',
+            },
+            409: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Already a member',
+            },
+            422: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Validation error',
+            },
+        },
+    }), async (c) => {
+        const { token } = c.req.valid('json');
+        const userId = c.get('authUserId');
+        const invitation = await consumeOrgInvitation(token);
+        if (!invitation) {
+            return c.json({ error: 'Invalid or expired invitation token' }, 400);
+        }
+        // Verify the invitation email matches the authenticated user's email.
+        // Without this check, any authenticated user could accept another user's invitation.
+        const authUser = adapter.getUser ? await adapter.getUser(userId) : null;
+        if (!authUser || invitation.email !== authUser.email) {
+            return c.json({ error: 'This invitation was sent to a different email address' }, 403);
+        }
+        const org = await getOrg(invitation.orgId);
+        if (!org) {
+            return c.json({ error: 'Organization not found' }, 400);
+        }
+        try {
+            const membership = await addOrgMember(invitation.orgId, userId, invitation.roles, invitation.invitedBy);
+            return c.json({
+                org: serializeOrg(org),
+                membership: serializeMembership(membership),
+            }, 200);
+        }
+        catch (err) {
+            if (err?.message?.includes('already a member')) {
+                return c.json({ error: err.message }, 409);
+            }
+            throw err;
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /auth/me/orgs — current user's organizations
+    // -------------------------------------------------------------------------
+    router.openapi(withSecurity(createRoute({
+        method: 'get',
+        path: '/auth/me/orgs',
+        tags: ['Auth', ...tags],
+        summary: "Get current user's organizations",
+        responses: {
+            200: {
+                content: { 'application/json': { schema: z.array(OrgResponse) } },
+                description: "User's organizations",
+            },
+            401: {
+                content: { 'application/json': { schema: ErrorResponse } },
+                description: 'Unauthorized',
+            },
+        },
+    }), { cookieAuth: [] }, { userToken: [] }), async (c) => {
+        const userId = c.get('authUserId');
+        const orgs = await getUserOrgs(userId);
+        return c.json(orgs.map((o) => serializeOrg(o)), 200);
+    });
+    return router;
+};