@manablox/api-rpc 0.1.0 → 0.2.0

package/src/routers/role.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { authed, scoped } from '../base.js';
+import { machineName, uuid } from '../schemas.js';
+
+const roleSchema = z.object({
+  spaceId: uuid,
+  name: z.string().trim().min(1).max(100),
+  machineName,
+  description: z.string().max(500).nullable().optional(),
+  /** `space:write`, `content:read` for every type, `content:read:<typeId>` for one. */
+  permissions: z.array(z.string().max(120)).max(500),
+});
+
+/**
+ * The roles of a space. The rules — reserved names, grants that exist, a role nobody
+ * holds before it goes — live in `RoleService`; a procedure here is an input schema, a
+ * permission and one call.
+ */
+export const roleRouter = {
+  /** The permission catalogue, grouped the way the role editor lays it out. */
+  catalog: authed.handler(async ({ context }) => context.roles.catalog()),
+
+  list: scoped('role:read')
+    .input(z.object({ spaceId: uuid }))
+    .handler(async ({ input, context }) => context.roles.list(input.spaceId)),
+
+  get: scoped('role:read')
+    .input(z.object({ spaceId: uuid, id: uuid }))
+    .handler(async ({ input, context }) => context.roles.get(input.spaceId, input.id)),
+
+  create: scoped('role:write')
+    .input(roleSchema)
+    .handler(async ({ input, context }) => {
+      const { spaceId, ...data } = input;
+      return context.roles.create(spaceId, data);
+    }),
+
+  update: scoped('role:write')
+    .input(roleSchema.extend({ id: uuid }))
+    .handler(async ({ input, context }) => {
+      const { spaceId, id, ...data } = input;
+      return context.roles.update(spaceId, id, data);
+    }),
+
+  delete: scoped('role:write')
+    .input(z.object({ spaceId: uuid, id: uuid }))
+    .handler(async ({ input, context }) => {
+      await context.roles.delete(input.spaceId, input.id);
+      return { ok: true };
+    }),
+};

package/src/routers/space.ts

@@ -1,230 +1,125 @@
-import { ManabloxError } from '@manablox/core';
-import { SpaceTransferService } from '@manablox/services';
 import { z } from 'zod';
 import { authed, base, scoped, superadmin } from '../base.js';
-import type { RpcContext } from '../context.js';
-
-const uuid = z.string().uuid();
+import {
+  locale,
+  localeList,
+  machineName,
+  mimeTypePattern,
+  searchTerm,
+  spaceRole,
+  uuid,
+} from '../schemas.js';
 
 const spaceSchema = z.object({
   name: z.string().min(1).max(200),
-  machineName: z
-    .string()
-    .regex(/^[a-z][a-z0-9_-]*$/)
-    .max(64),
+  machineName,
   description: z.string().nullable().optional(),
   url: z.string().url(),
-  defaultLocale: z.string().min(2).max(10).default('en'),
-  locales: z.array(z.string().min(2).max(10)).min(1).default(['en']),
+  defaultLocale: locale.default('en'),
+  locales: localeList.default(['en']),
   settings: z.record(z.string(), z.unknown()).optional(),
 });
 
 /**
- * `spaces_machine_name_key` is enforced in the database, so a taken machine name arrives
- * as a Postgres unique violation and would surface as an opaque 500. Drizzle wraps the
- * driver error, so the SQLSTATE is on `cause`.
+ * Spaces and membership. Every rule — the locale invariant, the last-owner guard, the
+ * creator-owns-it grant — lives in `SpaceService`; a procedure here is an input schema,
+ * a permission and one call.
  */
-function rethrowMachineNameConflict(error: unknown, machineName: string | undefined): never {
-  const cause = (error as { cause?: { code?: string; message?: string } }).cause;
-  const code = (error as { code?: string }).code ?? cause?.code;
-  const detail = `${cause?.message ?? ''} ${(error as { message?: string }).message ?? ''}`;
-
-  if (code === '23505' && detail.includes('machine_name')) {
-    throw ManabloxError.validation(
-      [
-        {
-          key: 'space.machineName.taken',
-          path: ['machineName'],
-          params: { machineName: machineName ?? '' },
-        },
-      ],
-      'space.validation.failed',
-    );
-  }
-  throw error;
-}
-
-/**
- * A space with no owner can never be granted one again: `user:write` is an owner's and an
- * admin's permission, and an admin cannot promote themselves past their own role.
- */
-async function assertNotLastOwner(
-  context: Pick<RpcContext, 'repos'>,
-  spaceId: string,
-  userId: string,
-): Promise<void> {
-  if ((await context.repos.users.roleIn(userId, spaceId)) !== 'owner') return;
-  const owners = (await context.repos.users.membersOf(spaceId)).filter(
-    (member) => member.role === 'owner',
-  );
-  if (owners.length <= 1) throw ManabloxError.badRequest('space.member.lastOwner', { spaceId });
-}
-
-/**
- * The default locale names the column content falls back to, so a default outside the
- * space's own locale set would leave every document with no readable fallback.
- */
-function assertDefaultIsALocale(defaultLocale: string, locales: readonly string[]): void {
-  if (locales.includes(defaultLocale)) return;
-  throw ManabloxError.validation(
-    [
-      {
-        key: 'space.defaultLocale.notInLocales',
-        path: ['defaultLocale'],
-        params: { defaultLocale, locales: locales.join(', ') },
-      },
-    ],
-    'space.validation.failed',
-  );
-}
-
 export const spaceRouter = {
-  /** Only the spaces the caller is a member of — a superadmin sees all. */
+  /**
+   * Only the spaces the caller is a member of — a superadmin sees all. A member's query
+   * is bounded by their memberships rather than by the instance, so a large multi-tenant
+   * install does not load every space to show someone their two.
+   */
   list: authed.handler(async ({ context }) => {
-    const all = await context.repos.spaces.all();
-    const allowed = context.principal?.allowedSpaceIds;
-    const visible = allowed ? all.filter((space) => allowed.includes(space.id)) : all;
-    if (context.principal?.role === 'superadmin') return visible;
-    return visible.filter((space) => Boolean(context.principal?.spaces[space.id]));
+    const { principal } = context;
+    const all =
+      principal.role === 'superadmin'
+        ? await context.repos.spaces.all()
+        : await context.repos.spaces.findManyByIds(Object.keys(principal.spaces));
+    const allowed = principal.allowedSpaceIds;
+    return allowed ? all.filter((space) => allowed.includes(space.id)) : all;
   }),
 
   get: scoped('space:read')
     .input(z.object({ spaceId: uuid }))
     .handler(async ({ input, context }) => context.repos.spaces.findById(input.spaceId)),
 
-  create: superadmin.input(spaceSchema).handler(async ({ input, context }) => {
-    assertDefaultIsALocale(input.defaultLocale, input.locales);
-    const space = await context.repos.spaces
-      .create(input)
-      .catch((error) => rethrowMachineNameConflict(error, input.machineName));
-    // Whoever creates a space owns it, or they would immediately lock themselves out.
-    if (context.principal) {
-      await context.repos.users.grant(context.principal.userId, space.id, 'owner');
-    }
-    return space;
-  }),
+  create: superadmin
+    .input(spaceSchema)
+    .handler(async ({ input, context }) =>
+      context.spaces.create(input, context.principal?.userId ?? null),
+    ),
 
   update: scoped('space:write')
     .input(spaceSchema.partial().extend({ spaceId: uuid }))
     .handler(async ({ input, context }) => {
       const { spaceId, ...data } = input;
-
-      // A partial update may move either half of the pair, so the check runs against the
-      // stored values for whichever half this call leaves alone.
-      if (data.defaultLocale || data.locales) {
-        const current = await context.repos.spaces.findById(spaceId);
-        if (!current) throw ManabloxError.notFound('space.notFound', { spaceId });
-        assertDefaultIsALocale(
-          data.defaultLocale ?? current.defaultLocale,
-          data.locales ?? current.locales,
-        );
-      }
-
-      return context.repos.spaces
-        .update(spaceId, data)
-        .catch((error) => rethrowMachineNameConflict(error, data.machineName));
+      return context.spaces.update(spaceId, data);
     }),
 
   delete: scoped('space:delete')
     .input(z.object({ spaceId: uuid }))
     .handler(async ({ input, context }) => {
-      await context.repos.spaces.delete(input.spaceId);
+      await context.spaces.delete(input.spaceId);
       return { ok: true };
     }),
 
-  /**
-   * Nominates one document as the space's root. Stored in `settings` rather than on the
-   * content row so it survives the document being renamed, re-slugged or moved, and so a
-   * space has exactly one by construction.
-   *
-   * The delivery APIs resolve the empty path through it, matching the requested locale by
-   * localization group — pass `null` to clear.
-   */
+  /** Nominates one document as the space's root; `null` clears it. */
   setHome: scoped('space:write')
     .input(z.object({ spaceId: uuid, contentId: uuid.nullable() }))
-    .handler(async ({ input, context }) => {
-      const space = await context.repos.spaces.findById(input.spaceId);
-      if (!space) throw ManabloxError.notFound('space.notFound', { spaceId: input.spaceId });
-
-      if (input.contentId) {
-        const row = await context.repos.content.findById(input.contentId);
-        if (!row || row.spaceId !== input.spaceId) {
-          throw ManabloxError.badRequest('content.notInSpace', { id: input.contentId });
-        }
-      }
-
-      const settings = { ...space.settings };
-      if (input.contentId) settings.homeContentId = input.contentId;
-      else delete settings.homeContentId;
-
-      return context.repos.spaces.update(input.spaceId, { settings });
-    }),
+    .handler(async ({ input, context }) => context.spaces.setHome(input.spaceId, input.contentId)),
 
   /**
-   * The whole space as one JSON document: its settings, its runtime content types, every
-   * document and the asset metadata. `space:write` rather than `space:read` because an
-   * export is every field of every document in one file, regardless of who may read what.
+   * The space's upload limits, each narrowing the instance's. `allowedMimeTypes` absent
+   * means the instance's list; empty means the same thing rather than "nothing".
    */
-  export: scoped('space:write')
-    .input(z.object({ spaceId: uuid }))
+  setAssetSettings: scoped('space:write')
+    .input(
+      z.object({
+        spaceId: uuid,
+        allowedMimeTypes: z.array(mimeTypePattern).max(50).optional(),
+        maxFileSize: z.number().int().positive().nullable().optional(),
+      }),
+    )
     .handler(async ({ input, context }) =>
-      new SpaceTransferService(context.manablox, context.repos).export(input.spaceId),
+      context.spaces.setAssetSettings(input.spaceId, {
+        ...(input.allowedMimeTypes?.length ? { allowedMimeTypes: input.allowedMimeTypes } : {}),
+        ...(input.maxFileSize ? { maxFileSize: input.maxFileSize } : {}),
+      }),
     ),
 
   /**
-   * Restores such a document, ids and all, into an instance that does not hold the space
-   * yet. Superadmin, because it creates a space — the same bar as `create`.
+   * The whole space as one JSON document. `space:write` rather than `space:read` because
+   * an export is every field of every document in one file, regardless of who may read
+   * what.
    */
+  export: scoped('space:write')
+    .input(z.object({ spaceId: uuid }))
+    .handler(async ({ input, context }) => context.spaces.export(input.spaceId)),
+
+  /** Restores such a document into an instance that does not hold the space yet. Superadmin, because it creates a space. */
   import: superadmin
     .input(z.object({ payload: z.unknown() }))
-    .handler(async ({ input, context }) => {
-      const result = await new SpaceTransferService(context.manablox, context.repos).import(
-        input.payload,
-        context.principal.userId,
-      );
-      // Whoever imports a space owns it, exactly as if they had created it by hand.
-      await context.repos.users.grant(context.principal.userId, result.spaceId, 'owner');
-      return result;
-    }),
+    .handler(async ({ input, context }) =>
+      context.spaces.import(input.payload, context.principal.userId),
+    ),
 
   members: scoped('user:read')
     .input(z.object({ spaceId: uuid }))
-    .handler(async ({ input, context }) => context.repos.users.membersOf(input.spaceId)),
+    .handler(async ({ input, context }) => context.spaces.members(input.spaceId)),
 
   grant: scoped('user:write')
-    .input(
-      z.object({
-        spaceId: uuid,
-        userId: uuid,
-        role: z.enum(['owner', 'admin', 'editor', 'author', 'viewer']),
-      }),
-    )
+    .input(z.object({ spaceId: uuid, userId: uuid, role: spaceRole }))
     .handler(async ({ input, context }) => {
-      // Demoting the last owner locks the space out of ownership just as removing them does.
-      if (input.role !== 'owner') {
-        await assertNotLastOwner(context, input.spaceId, input.userId);
-      }
-      await context.repos.users.grant(input.userId, input.spaceId, input.role);
+      await context.spaces.grant(input.spaceId, input.userId, input.role);
       return { ok: true };
     }),
 
-  /**
-   * Users who are not yet members, for the add-member picker. Scoped to `user:write` and
-   * returning only a name, an email and an id: a space admin needs to pick a colleague
-   * without being handed the instance's user directory, which is superadmin-only.
-   */
+  /** Users who are not yet members, for the add-member picker. */
   candidates: scoped('user:write')
-    .input(z.object({ spaceId: uuid, search: z.string().max(200).optional() }))
-    .handler(async ({ input, context }) => {
-      const [members, all] = await Promise.all([
-        context.repos.users.membersOf(input.spaceId),
-        context.repos.users.list({ limit: 100, offset: 0 }, input.search),
-      ]);
-      const taken = new Set(members.map((member) => member.userId));
-      return all.items
-        .filter((user) => !taken.has(user.id))
-        .map((user) => ({ id: user.id, name: user.name, email: user.email }));
-    }),
+    .input(z.object({ spaceId: uuid, search: searchTerm.optional() }))
+    .handler(async ({ input, context }) => context.spaces.candidates(input.spaceId, input.search)),
 
   /** Grants the same role to several users at once, as the picker hands them over. */
   addMembers: scoped('user:write')
@@ -232,36 +127,23 @@ export const spaceRouter = {
       z.object({
         spaceId: uuid,
         userIds: z.array(uuid).min(1).max(100),
-        role: z.enum(['owner', 'admin', 'editor', 'author', 'viewer']).default('editor'),
+        role: spaceRole.default('editor'),
       }),
     )
-    .handler(async ({ input, context }) => {
-      // Already-members are skipped rather than rejected: the picker offers only
-      // non-members, so an overlap means the list went stale, not that the caller erred.
-      const members = await context.repos.users.membersOf(input.spaceId);
-      const taken = new Set(members.map((member) => member.userId));
-      const added = input.userIds.filter((userId) => !taken.has(userId));
-
-      for (const userId of added) {
-        await context.repos.users.grant(userId, input.spaceId, input.role);
-      }
-      return { ok: true, added: added.length };
-    }),
+    .handler(async ({ input, context }) => ({
+      ok: true,
+      added: await context.spaces.addMembers(input.spaceId, input.userIds, input.role),
+    })),
 
   revoke: scoped('user:write')
     .input(z.object({ spaceId: uuid, userId: uuid }))
     .handler(async ({ input, context }) => {
-      await assertNotLastOwner(context, input.spaceId, input.userId);
-      await context.repos.users.revoke(input.userId, input.spaceId);
+      await context.spaces.revoke(input.spaceId, input.userId);
       return { ok: true };
     }),
 
   /** Locales available for a space, for the editor's language switcher. */
-  locales: base.input(z.object({ spaceId: uuid })).handler(async ({ input, context }) => {
-    const space = await context.repos.spaces.findById(input.spaceId);
-    return {
-      available: space?.locales ?? context.manablox.config.locales.available,
-      default: space?.defaultLocale ?? context.manablox.config.locales.default,
-    };
-  }),
+  locales: base
+    .input(z.object({ spaceId: uuid }))
+    .handler(async ({ input, context }) => context.spaces.locales(input.spaceId)),
 };

package/src/routers/user.ts

@@ -1,9 +1,19 @@
-import { assertCan } from '@manablox/auth';
+import { assertCan, effectiveGrants, MIN_PASSWORD_LENGTH, normaliseGrants } from '@manablox/auth';
+import { ManabloxError } from '@manablox/core';
 import { z } from 'zod';
-import { authed, superadmin } from '../base.js';
+import { authed, base, superadmin } from '../base.js';
+import { pagination, searchTerm, uuid } from '../schemas.js';
 
-const uuid = z.string().uuid();
+const instanceRole = z.enum(['superadmin', 'editor']);
+const password = z.string().min(MIN_PASSWORD_LENGTH).max(200);
+const email = z.string().email().max(320);
+const displayName = z.string().trim().min(1).max(200);
 
+/**
+ * The caller's own account and keys, and — for a superadmin — every account on the
+ * instance. The rules (no locking yourself out, one superadmin always remains) live in
+ * `UserService`; a procedure here is an input schema, a permission and one call.
+ */
 export const userRouter = {
   me: authed.handler(async ({ context }) => {
     const user = await context.repos.users.findById(context.principal.userId);
@@ -15,25 +25,88 @@ export const userRouter = {
           image: user.image,
           role: user.role,
           spaces: context.principal.spaces,
+          // Space id → every grant held there, built-in roles resolved too, so the admin
+          // shows and hides controls from the same table the server enforces.
+          permissions: Object.fromEntries(
+            Object.keys(context.principal.spaces).map((spaceId) => [
+              spaceId,
+              effectiveGrants(context.principal, spaceId),
+            ]),
+          ),
         }
       : null;
   }),
 
+  /**
+   * Whether the instance still has no account at all. Public, because the login page
+   * needs it before anyone is signed in: it decides whether to offer "create the first
+   * account". Once one exists, sign-up is closed and every account is created here.
+   */
+  setupNeeded: base.handler(async ({ context }) => ({
+    setupNeeded: (await context.repos.users.count()) === 0,
+  })),
+
   list: superadmin
+    .input(pagination({ limit: 25, max: 100 }).extend({ search: searchTerm.optional() }))
+    .handler(async ({ input, context }) =>
+      context.users.list({ limit: input.limit, offset: input.offset }, input.search),
+    ),
+
+  get: superadmin
+    .input(z.object({ userId: uuid }))
+    .handler(async ({ input, context }) => context.users.get(input.userId)),
+
+  create: superadmin
     .input(
       z.object({
-        search: z.string().max(200).optional(),
-        limit: z.number().int().min(1).max(100).default(25),
-        offset: z.number().int().min(0).default(0),
+        name: displayName,
+        email,
+        password,
+        role: instanceRole.default('editor'),
       }),
     )
+    .handler(async ({ input, context }) => context.users.create(input)),
+
+  update: superadmin
+    .input(z.object({ userId: uuid, name: displayName.optional(), email: email.optional() }))
+    .handler(async ({ input, context }) => {
+      const { userId, ...data } = input;
+      return context.users.update(userId, data);
+    }),
+
+  setRole: superadmin
+    .input(z.object({ userId: uuid, role: instanceRole }))
+    .handler(async ({ input, context }) => context.users.setRole(input.userId, input.role)),
+
+  /** Resets a password and signs the account out everywhere. */
+  setPassword: superadmin
+    .input(z.object({ userId: uuid, password }))
+    .handler(async ({ input, context }) => {
+      await context.users.setPassword(input.userId, input.password);
+      return { ok: true };
+    }),
+
+  ban: superadmin
+    .input(z.object({ userId: uuid, reason: z.string().trim().max(500).optional() }))
     .handler(async ({ input, context }) =>
-      context.repos.users.list({ limit: input.limit, offset: input.offset }, input.search),
+      context.users.ban(context.principal.userId, input.userId, input.reason || null),
     ),
 
-  setRole: superadmin
-    .input(z.object({ userId: uuid, role: z.enum(['superadmin', 'editor']) }))
-    .handler(async ({ input, context }) => context.repos.users.setRole(input.userId, input.role)),
+  unban: superadmin
+    .input(z.object({ userId: uuid }))
+    .handler(async ({ input, context }) => context.users.unban(input.userId)),
+
+  revokeSessions: superadmin
+    .input(z.object({ userId: uuid }))
+    .handler(async ({ input, context }) => {
+      await context.users.revokeSessions(input.userId);
+      return { ok: true };
+    }),
+
+  delete: superadmin.input(z.object({ userId: uuid })).handler(async ({ input, context }) => {
+    await context.users.delete(context.principal.userId, input.userId);
+    return { ok: true };
+  }),
 
   apiKeys: authed.handler(async ({ context }) => context.apiKeys.list(context.principal.userId)),
 
@@ -44,6 +117,12 @@ export const userRouter = {
         expiresAt: z.coerce.date().optional(),
         /** Empty or omitted issues an unrestricted key. */
         spaceIds: z.array(uuid).optional(),
+        /**
+         * Grants the key is confined to, in the roles' vocabulary; omitted leaves the
+         * owner's role as the limit. At use the two are intersected, so a grant here
+         * never widens the key beyond its owner.
+         */
+        permissions: z.array(z.string().max(120)).max(500).optional(),
       }),
     )
     .handler(async ({ input, context }) => {
@@ -52,9 +131,37 @@ export const userRouter = {
       for (const spaceId of input.spaceIds ?? []) {
         assertCan(context.principal, spaceId, 'space:read');
       }
+      // A typed grant may name a type of any space the key will reach.
+      const reachable = input.spaceIds?.length
+        ? input.spaceIds
+        : context.principal.role === 'superadmin'
+          ? null
+          : Object.keys(context.principal.spaces);
+      const typeIds = new Set(
+        (reachable
+          ? reachable.flatMap((spaceId) => context.manablox.contentTypes.forSpace(spaceId))
+          : context.manablox.contentTypes.all
+        ).map((type) => type.id),
+      );
+      let permissions: string[] | null = null;
+      if (input.permissions) {
+        const checked = normaliseGrants(input.permissions, typeIds);
+        if (checked.unknown.length) {
+          throw ManabloxError.validation(
+            checked.unknown.map(({ index, grant }) => ({
+              key: 'role.permission.unknown' as const,
+              path: ['permissions', index],
+              params: { permission: grant },
+            })),
+            'apiKey.validation.failed',
+          );
+        }
+        permissions = checked.permissions;
+      }
       return context.apiKeys.issue(context.principal.userId, input.name, {
         expiresAt: input.expiresAt,
         spaceIds: input.spaceIds,
+        permissions,
       });
     }),