@meridianjs/meridian 0.1.27 → 0.1.30

package/dist/api/admin/config/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/config/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAKhD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/config/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAehD,CAAA"}

package/dist/api/admin/config/route.js

@@ -1,7 +1,16 @@
 export const GET = async (req, res) => {
     const config = req.scope.resolve("config");
+    let googleOAuthEnabled = false;
+    try {
+        req.scope.resolve("googleOAuthService");
+        googleOAuthEnabled = true;
+    }
+    catch {
+        // googleOAuthService not registered — feature disabled
+    }
     res.json({
         maxChildIssueDepth: config?.projectConfig?.maxChildIssueDepth ?? 1,
+        googleOAuthEnabled,
     });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/config/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/config/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,GAAG,CAAC,IAAI,CAAC;QACP,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,IAAI,CAAC;KACnE,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/config/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IAEjD,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACvC,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC;QACP,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,IAAI,CAAC;QAClE,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/users/me/avatar/route.d.ts

@@ -0,0 +1,13 @@
+import type { Response } from "express";
+/**
+ * POST /admin/users/me/avatar
+ * Upload / replace the authenticated user's avatar image.
+ * Expects multipart/form-data with field name "avatar".
+ */
+export declare const POST: (req: any, res: Response) => Promise<void>;
+/**
+ * DELETE /admin/users/me/avatar
+ * Remove the authenticated user's avatar.
+ */
+export declare const DELETE: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/admin/users/me/avatar/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/users/me/avatar/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;;GAIG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAyBjD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAiBnD,CAAA"}

package/dist/api/admin/users/me/avatar/route.js

@@ -0,0 +1,51 @@
+import { processUpload, deleteUpload } from "../../../../../utils/upload.js";
+/**
+ * POST /admin/users/me/avatar
+ * Upload / replace the authenticated user's avatar image.
+ * Expects multipart/form-data with field name "avatar".
+ */
+export const POST = async (req, res) => {
+    const userId = req.user?.id;
+    if (!userId) {
+        res.status(401).json({ error: { message: "Not authenticated" } });
+        return;
+    }
+    const userService = req.scope.resolve("userModuleService");
+    const existing = await userService.retrieveUser(userId).catch(() => null);
+    if (!existing) {
+        res.status(404).json({ error: { message: "User not found." } });
+        return;
+    }
+    const upload = await processUpload(req, res, "avatar", "user-avatars");
+    if (!upload) {
+        res.status(400).json({ error: { message: "No file uploaded. Use multipart/form-data with field name 'avatar'." } });
+        return;
+    }
+    if (existing.avatar_url)
+        await deleteUpload(req, existing.avatar_url);
+    const user = await userService.updateUser(userId, { avatar_url: upload.url });
+    const { password_hash: _, ...safeUser } = user;
+    res.json({ user: safeUser });
+};
+/**
+ * DELETE /admin/users/me/avatar
+ * Remove the authenticated user's avatar.
+ */
+export const DELETE = async (req, res) => {
+    const userId = req.user?.id;
+    if (!userId) {
+        res.status(401).json({ error: { message: "Not authenticated" } });
+        return;
+    }
+    const userService = req.scope.resolve("userModuleService");
+    const existing = await userService.retrieveUser(userId).catch(() => null);
+    if (!existing) {
+        res.status(404).json({ error: { message: "User not found." } });
+        return;
+    }
+    if (existing.avatar_url)
+        await deleteUpload(req, existing.avatar_url);
+    await userService.updateUser(userId, { avatar_url: null });
+    res.json({ ok: true });
+};
+//# sourceMappingURL=route.js.map

package/dist/api/admin/users/me/avatar/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/users/me/avatar/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAY,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qEAAqE,EAAE,EAAE,CAAC,CAAA;QACnH,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;IAErE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC7E,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC9B,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAY,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;IACrE,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA"}

package/dist/api/admin/users/me/google/route.d.ts

@@ -0,0 +1,7 @@
+import type { Response } from "express";
+/**
+ * DELETE /admin/users/me/google
+ * Unlinks the Google account from the currently authenticated user.
+ */
+export declare const DELETE: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/admin/users/me/google/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/users/me/google/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;GAGG;AACH,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAUnD,CAAA"}

package/dist/api/admin/users/me/google/route.js

@@ -0,0 +1,15 @@
+/**
+ * DELETE /admin/users/me/google
+ * Unlinks the Google account from the currently authenticated user.
+ */
+export const DELETE = async (req, res) => {
+    const userId = req.user?.id;
+    if (!userId) {
+        res.status(401).json({ error: { message: "Not authenticated" } });
+        return;
+    }
+    const userService = req.scope.resolve("userModuleService");
+    await userService.updateUser(userId, { google_id: null });
+    res.json({ ok: true });
+};
+//# sourceMappingURL=route.js.map

package/dist/api/admin/users/me/google/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/users/me/google/route.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAY,CAAA;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA"}

package/dist/api/admin/users/me/route.d.ts

@@ -0,0 +1,14 @@
+import type { Response } from "express";
+/**
+ * GET /admin/users/me
+ * Returns the currently authenticated user's profile.
+ * Requires JWT (handled by /admin/* middleware).
+ */
+export declare const GET: (req: any, res: Response) => Promise<void>;
+/**
+ * PATCH /admin/users/me
+ * Update the current user's personal details.
+ * Allowed fields: first_name, last_name, designation, phone_number.
+ */
+export declare const PATCH: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/admin/users/me/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/users/me/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;;GAIG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAYhD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,KAAK,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAmBlD,CAAA"}

package/dist/api/admin/users/me/route.js

@@ -0,0 +1,43 @@
+/**
+ * GET /admin/users/me
+ * Returns the currently authenticated user's profile.
+ * Requires JWT (handled by /admin/* middleware).
+ */
+export const GET = async (req, res) => {
+    const userService = req.scope.resolve("userModuleService");
+    const userId = req.user?.id;
+    if (!userId) {
+        res.status(401).json({ error: { message: "Not authenticated" } });
+        return;
+    }
+    const user = await userService.retrieveUser(userId);
+    const { password_hash: _, ...safeUser } = user;
+    res.json(safeUser);
+};
+/**
+ * PATCH /admin/users/me
+ * Update the current user's personal details.
+ * Allowed fields: first_name, last_name, designation, phone_number.
+ */
+export const PATCH = async (req, res) => {
+    const userService = req.scope.resolve("userModuleService");
+    const userId = req.user?.id;
+    if (!userId) {
+        res.status(401).json({ error: { message: "Not authenticated" } });
+        return;
+    }
+    const { first_name, last_name, designation, phone_number } = req.body;
+    const updates = {};
+    if (first_name !== undefined)
+        updates.first_name = first_name;
+    if (last_name !== undefined)
+        updates.last_name = last_name;
+    if (designation !== undefined)
+        updates.designation = designation;
+    if (phone_number !== undefined)
+        updates.phone_number = phone_number;
+    const user = await userService.updateUser(userId, updates);
+    const { password_hash: _, ...safeUser } = user;
+    res.json({ user: safeUser });
+};
+//# sourceMappingURL=route.js.map

package/dist/api/admin/users/me/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/me/route.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAY,CAAA;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IAC9C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpB,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAY,CAAA;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAM;IACR,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAA+B,CAAA;IAChG,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;IAC7D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAA;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,YAAY,CAAA;IAEnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1D,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC9B,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAevC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAQhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAkCjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAevC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAQhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA2CjD,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/route.js

@@ -22,10 +22,18 @@ export const POST = async (req, res) => {
     if (!await assertWorkspaceMembership(req, res))
         return;
     const { email, role, app_role_id } = req.body;
-    if (!role || !["admin", "member"].includes(role)) {
-        res.status(400).json({ error: { message: "role must be 'admin' or 'member'" } });
+    if (!role || !["super-admin", "admin", "member"].includes(role)) {
+        res.status(400).json({ error: { message: "role must be 'super-admin', 'admin', or 'member'" } });
         return;
     }
+    // Privilege check: only admins/super-admins can invite admins or super-admins
+    if (role !== "member") {
+        const callerRoles = req.user?.roles ?? [];
+        if (!callerRoles.includes("super-admin") && !callerRoles.includes("admin")) {
+            res.status(403).json({ error: { message: "Only admins can invite users with elevated roles" } });
+            return;
+        }
+    }
     if (email?.trim()) {
         const userService = req.scope.resolve("userModuleService");
         const [existing] = await userService.listAndCountUsers({ email: email.trim().toLowerCase() }, { limit: 1 });

package/dist/api/admin/workspaces/[id]/invitations/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AAExF,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,GAAa;IAC9D,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAC5D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;QAChF,OAAM;IACR,CAAC;IAED,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,KAAK,CAAC,IAAI,EAAE,oEAAoE,EAAE,EAAE,CAAC,CAAA;YACnJ,OAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC3F,KAAK,EAAE;YACL,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;YAC3B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5B,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,IAAI;YAChC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAA;IAEF,IAAI,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,6BAA6B,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AAExF,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,GAAa;IAC9D,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACzE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAC5D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;YAChG,OAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,KAAK,CAAC,IAAI,EAAE,oEAAoE,EAAE,EAAE,CAAC,CAAA;YACnJ,OAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC3F,KAAK,EAAE;YACL,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;YAC3B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5B,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,IAAI;YAChC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAA;IAEF,IAAI,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,6BAA6B,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/members/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA2BhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBA4BrE,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAsChD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAyCrE,CAAA"}

package/dist/api/admin/workspaces/[id]/members/route.js

@@ -1,5 +1,15 @@
 import { requirePermission } from "@meridianjs/auth";
 export const GET = async (req, res) => {
+    // Authorization: super-admin/admin see all; members must belong to this workspace
+    const roles = req.user?.roles ?? [];
+    if (!roles.includes("super-admin") && !roles.includes("admin")) {
+        const workspaceMemberService0 = req.scope.resolve("workspaceMemberModuleService");
+        const membership = await workspaceMemberService0.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return;
+        }
+    }
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const userService = req.scope.resolve("userModuleService");
     const [members] = await workspaceMemberService.listAndCountWorkspaceMembers({ workspace_id: req.params.id }, { limit: 100 });
@@ -24,7 +34,7 @@ export const POST = async (req, res, next) => {
     requirePermission("member:invite")(req, res, async () => {
         try {
             const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-            const { user_id, role } = req.body;
+            const { user_id, role, app_role_id } = req.body;
             if (!user_id) {
                 res.status(400).json({ error: { message: "user_id is required" } });
                 return;
@@ -34,11 +44,23 @@ export const POST = async (req, res, next) => {
                 res.status(409).json({ error: { message: "User is already a member of this workspace" } });
                 return;
             }
+            // workspace_member.role only supports "admin" | "member" — map super-admin → admin
+            const wsRole = role === "member" ? "member" : "admin";
             const member = await workspaceMemberService.createWorkspaceMember({
                 workspace_id: req.params.id,
                 user_id,
-                role: role ?? "member",
+                role: wsRole,
             });
+            // Optionally assign custom app role to the user
+            if (app_role_id) {
+                try {
+                    const userService = req.scope.resolve("userModuleService");
+                    await userService.updateUser(user_id, { app_role_id });
+                }
+                catch {
+                    // Non-fatal
+                }
+            }
             res.status(201).json({ member });
         }
         catch (err) {

package/dist/api/admin/workspaces/[id]/members/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACtD,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACjG,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACtF,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAElC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC;gBAChE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,OAAO;gBACP,IAAI,EAAE,IAAI,IAAI,QAAQ;aACvB,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,kFAAkF;IAClF,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,uBAAuB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACxF,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACtD,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACjG,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACtF,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YAED,mFAAmF;YACnF,MAAM,MAAM,GAAuB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAEzE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC;gBAChE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,OAAO;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAA;YAEF,gDAAgD;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;oBACjE,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/auth/google/_exchange-store.d.ts

@@ -0,0 +1,20 @@
+/**
+ * In-memory one-time code store for the Google OAuth callback.
+ *
+ * After a successful OAuth flow, the backend issues a short-lived one-time code
+ * (instead of putting the JWT directly in the redirect URL where it would appear
+ * in server access logs). The frontend exchanges this code for the real JWT via
+ * POST /auth/google/exchange within a 2-minute window.
+ *
+ * Module-level singleton — shared between the callback and exchange routes
+ * because Node.js caches module instances.
+ */
+/** Store a one-time code mapped to a JWT. TTL: 2 minutes. */
+export declare function storeExchangeCode(code: string, token: string): void;
+/**
+ * Consume a one-time code and return the associated JWT.
+ * The code is deleted immediately — it cannot be reused.
+ * Returns null if the code is invalid or expired.
+ */
+export declare function consumeExchangeCode(code: string): string | null;
+//# sourceMappingURL=_exchange-store.d.ts.map

package/dist/api/auth/google/_exchange-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_exchange-store.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/google/_exchange-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK/D"}

package/dist/api/auth/google/_exchange-store.js

@@ -0,0 +1,29 @@
+/**
+ * In-memory one-time code store for the Google OAuth callback.
+ *
+ * After a successful OAuth flow, the backend issues a short-lived one-time code
+ * (instead of putting the JWT directly in the redirect URL where it would appear
+ * in server access logs). The frontend exchanges this code for the real JWT via
+ * POST /auth/google/exchange within a 2-minute window.
+ *
+ * Module-level singleton — shared between the callback and exchange routes
+ * because Node.js caches module instances.
+ */
+const store = new Map();
+/** Store a one-time code mapped to a JWT. TTL: 2 minutes. */
+export function storeExchangeCode(code, token) {
+    store.set(code, { token, expiresAt: Date.now() + 2 * 60 * 1000 });
+}
+/**
+ * Consume a one-time code and return the associated JWT.
+ * The code is deleted immediately — it cannot be reused.
+ * Returns null if the code is invalid or expired.
+ */
+export function consumeExchangeCode(code) {
+    const entry = store.get(code);
+    store.delete(code); // always delete — single use
+    if (!entry || entry.expiresAt < Date.now())
+        return null;
+    return entry.token;
+}
+//# sourceMappingURL=_exchange-store.js.map

package/dist/api/auth/google/_exchange-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_exchange-store.js","sourceRoot":"","sources":["../../../../src/api/auth/google/_exchange-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;AAE9C,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,6BAA6B;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAA;IACvD,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC"}

package/dist/api/auth/google/callback/route.d.ts

@@ -0,0 +1,7 @@
+import type { Response } from "express";
+/**
+ * GET /auth/google/callback?code=...&state=...
+ * Handles the Google OAuth redirect. Absent googleOAuthService → 501.
+ */
+export declare const GET: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/google/callback/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/google/callback/route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;GAGG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAoKhD,CAAA"}

package/dist/api/auth/google/callback/route.js

@@ -0,0 +1,160 @@
+import jwt from "jsonwebtoken";
+import { randomBytes } from "node:crypto";
+import { storeExchangeCode } from "../_exchange-store.js";
+/**
+ * GET /auth/google/callback?code=...&state=...
+ * Handles the Google OAuth redirect. Absent googleOAuthService → 501.
+ */
+export const GET = async (req, res) => {
+    let googleOAuthService;
+    try {
+        googleOAuthService = req.scope.resolve("googleOAuthService");
+    }
+    catch {
+        res.status(501).json({ error: { message: "Google OAuth is not configured" } });
+        return;
+    }
+    const frontendUrl = googleOAuthService.frontendUrl;
+    const errorRedirect = (msg) => {
+        // Error messages are not credentials, query param is fine here
+        res.redirect(302, `${frontendUrl}/oauth/google/callback?error=${encodeURIComponent(msg)}`);
+    };
+    const { code, state } = req.query;
+    if (!code || !state) {
+        errorRedirect("Missing authorization code or state");
+        return;
+    }
+    const config = req.scope.resolve("config");
+    const jwtSecret = config?.projectConfig?.jwtSecret;
+    // Verify state JWT
+    let statePayload;
+    try {
+        statePayload = jwt.verify(state, jwtSecret, { algorithms: ["HS256"] });
+    }
+    catch (err) {
+        if (err.name === "TokenExpiredError") {
+            errorRedirect("OAuth session expired. Please try again.");
+        }
+        else {
+            errorRedirect("Invalid OAuth state. Please try again.");
+        }
+        return;
+    }
+    // CSRF check — nonce must match the HttpOnly cookie
+    const cookieNonce = req.cookies?.oauth_nonce;
+    if (!cookieNonce || cookieNonce !== statePayload.nonce) {
+        errorRedirect("CSRF validation failed. Please try again.");
+        return;
+    }
+    // Clear the nonce cookie immediately (single-use)
+    res.clearCookie("oauth_nonce", { path: "/auth/google/callback" });
+    const flow = statePayload.flow;
+    const inviteToken = statePayload.invite_token;
+    // ── Link flow: attach Google account to existing user ────────────────────────
+    if (flow === "link" && statePayload.userId) {
+        let profile;
+        try {
+            profile = await googleOAuthService.exchangeCode(code);
+        }
+        catch (err) {
+            errorRedirect(err.message ?? "Failed to authenticate with Google");
+            return;
+        }
+        const userService = req.scope.resolve("userModuleService");
+        // Check if this Google account is already tied to a different user
+        try {
+            const [existing] = await userService.listUsers({ google_id: profile.googleId }, { limit: 1 });
+            if (existing && existing.id !== statePayload.userId) {
+                errorRedirect("This Google account is already linked to another user.");
+                return;
+            }
+        }
+        catch {
+            // listUsers may throw if no results — that's fine, continue
+        }
+        await userService.updateUser(statePayload.userId, { google_id: profile.googleId });
+        res.redirect(302, `${frontendUrl}/oauth/google/callback?linked=true`);
+        return;
+    }
+    // Pre-flight invite validation
+    let inviteRecord = null;
+    if (flow === "invite" && inviteToken) {
+        try {
+            const invitationService = req.scope.resolve("invitationModuleService");
+            const [invitations] = await invitationService.listAndCountInvitations({ token: inviteToken }, { limit: 1 });
+            const invitation = invitations?.[0];
+            if (!invitation) {
+                errorRedirect("Invitation not found");
+                return;
+            }
+            if (invitation.status !== "pending") {
+                errorRedirect("Invitation has already been used");
+                return;
+            }
+            if (invitation.expires_at && new Date(invitation.expires_at) < new Date()) {
+                errorRedirect("Invitation has expired. Ask for a new one.");
+                return;
+            }
+            inviteRecord = {
+                id: invitation.id,
+                email: invitation.email,
+                role: invitation.role,
+                workspace_id: invitation.workspace_id,
+                app_role_id: invitation.app_role_id ?? null,
+            };
+        }
+        catch {
+            errorRedirect("Failed to validate invitation");
+            return;
+        }
+    }
+    // Exchange code for Google profile
+    let profile;
+    try {
+        profile = await googleOAuthService.exchangeCode(code);
+    }
+    catch (err) {
+        errorRedirect(err.message ?? "Failed to authenticate with Google");
+        return;
+    }
+    // Verify invite email matches Google email (if invite has a locked email)
+    if (inviteRecord?.email && profile.email.toLowerCase() !== inviteRecord.email.toLowerCase()) {
+        errorRedirect(`This invitation was sent to ${inviteRecord.email}. Please sign in with that Google account.`);
+        return;
+    }
+    // Perform login / register
+    let authResult;
+    try {
+        const authService = req.scope.resolve("authModuleService");
+        authResult = await authService.loginOrRegisterWithGoogle({
+            googleId: profile.googleId,
+            email: profile.email,
+            firstName: profile.firstName,
+            lastName: profile.lastName,
+            picture: profile.picture,
+            inviteRecord,
+        });
+    }
+    catch (err) {
+        errorRedirect(err.message ?? "Authentication failed");
+        return;
+    }
+    // Mark invite accepted after successful login/register
+    if (flow === "invite" && inviteRecord) {
+        try {
+            const invitationService = req.scope.resolve("invitationModuleService");
+            await invitationService.updateInvitation(inviteRecord.id, { status: "accepted" });
+        }
+        catch {
+            // Non-fatal
+        }
+    }
+    // Issue a one-time code instead of putting the JWT in the redirect URL.
+    // The JWT in a redirect URL (even as a hash fragment) appears in the server's
+    // access log on the 302 Location header. The frontend exchanges this short-lived
+    // code for the real JWT via POST /auth/google/exchange within 2 minutes.
+    const exchangeCode = randomBytes(32).toString("hex");
+    storeExchangeCode(exchangeCode, authResult.token);
+    res.redirect(302, `${frontendUrl}/oauth/google/callback?code=${exchangeCode}`);
+};
+//# sourceMappingURL=route.js.map

package/dist/api/auth/google/callback/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/google/callback/route.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,kBAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,kBAAkB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QAC9E,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAW,kBAAkB,CAAC,WAAW,CAAA;IAC1D,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE;QACpC,+DAA+D;QAC/D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,gCAAgC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC,CAAA;IAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAA;IAEtE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,aAAa,CAAC,qCAAqC,CAAC,CAAA;QACpD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,SAAmB,CAAA;IAE5D,mBAAmB;IACnB,IAAI,YAAqF,CAAA;IACzF,IAAI,CAAC;QACH,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAQ,CAAA;IAC/E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACrC,aAAa,CAAC,0CAA0C,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,wCAAwC,CAAC,CAAA;QACzD,CAAC;QACD,OAAM;IACR,CAAC;IAED,oDAAoD;IACpD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,WAAW,CAAA;IAC5C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;QACvD,aAAa,CAAC,2CAA2C,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,kDAAkD;IAClD,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAEjE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAA;IAC9B,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAA;IAE7C,gFAAgF;IAChF,IAAI,IAAI,KAAK,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QAC3C,IAAI,OAAuH,CAAA;QAC3H,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,GAAG,CAAC,OAAO,IAAI,oCAAoC,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7F,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBACpD,aAAa,CAAC,wDAAwD,CAAC,CAAA;gBACvE,OAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QAED,MAAM,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,oCAAoC,CAAC,CAAA;QACrE,OAAM;IACR,CAAC;IAED,+BAA+B;IAC/B,IAAI,YAAY,GAAgH,IAAI,CAAA;IACpI,IAAI,IAAI,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,WAAW,EAAE,EACtB,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;YACD,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,aAAa,CAAC,sBAAsB,CAAC,CAAA;gBACrC,OAAM;YACR,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,aAAa,CAAC,kCAAkC,CAAC,CAAA;gBACjD,OAAM;YACR,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC1E,aAAa,CAAC,4CAA4C,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,YAAY,GAAG;gBACb,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,IAAI;aAC5C,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,+BAA+B,CAAC,CAAA;YAC9C,OAAM;QACR,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAuH,CAAA;IAC3H,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,aAAa,CAAC,GAAG,CAAC,OAAO,IAAI,oCAAoC,CAAC,CAAA;QAClE,OAAM;IACR,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5F,aAAa,CACX,+BAA+B,YAAY,CAAC,KAAK,4CAA4C,CAC9F,CAAA;QACD,OAAM;IACR,CAAC;IAED,2BAA2B;IAC3B,IAAI,UAA6B,CAAA;IACjC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,UAAU,GAAG,MAAM,WAAW,CAAC,yBAAyB,CAAC;YACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,aAAa,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,KAAK,QAAQ,IAAI,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,iFAAiF;IACjF,yEAAyE;IACzE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;IACjD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,+BAA+B,YAAY,EAAE,CAAC,CAAA;AAChF,CAAC,CAAA"}

package/dist/api/auth/google/exchange/route.d.ts

@@ -0,0 +1,10 @@
+import type { Response } from "express";
+/**
+ * POST /auth/google/exchange
+ * Public — exchanges a short-lived one-time code (issued by the OAuth callback)
+ * for the real JWT. The code is valid for 2 minutes and cannot be reused.
+ *
+ * This keeps the JWT out of redirect URLs (and therefore out of server access logs).
+ */
+export declare const POST: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/google/exchange/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/google/exchange/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAgBjD,CAAA"}

package/dist/api/auth/google/exchange/route.js

@@ -0,0 +1,22 @@
+import { consumeExchangeCode } from "../_exchange-store.js";
+/**
+ * POST /auth/google/exchange
+ * Public — exchanges a short-lived one-time code (issued by the OAuth callback)
+ * for the real JWT. The code is valid for 2 minutes and cannot be reused.
+ *
+ * This keeps the JWT out of redirect URLs (and therefore out of server access logs).
+ */
+export const POST = async (req, res) => {
+    const { code } = req.body;
+    if (!code || typeof code !== "string") {
+        res.status(400).json({ error: { message: "code is required" } });
+        return;
+    }
+    const token = consumeExchangeCode(code);
+    if (!token) {
+        res.status(401).json({ error: { message: "Invalid or expired exchange code" } });
+        return;
+    }
+    res.json({ token });
+};
+//# sourceMappingURL=route.js.map

package/dist/api/auth/google/exchange/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/google/exchange/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAyB,CAAA;IAE9C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAChE,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;QAChF,OAAM;IACR,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACrB,CAAC,CAAA"}

package/dist/api/auth/google/link/route.d.ts

@@ -0,0 +1,9 @@
+import type { Response } from "express";
+/**
+ * GET /auth/google/link
+ * Returns a Google OAuth URL for the link flow (connecting Google to an existing account).
+ * Requires a valid Bearer token in the Authorization header (manually verified here
+ * because /auth/* middleware does not apply JWT authentication).
+ */
+export declare const GET: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/google/link/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/google/link/route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAgDhD,CAAA"}

package/dist/api/auth/google/link/route.js

@@ -0,0 +1,53 @@
+import { randomBytes } from "node:crypto";
+import jwt from "jsonwebtoken";
+/**
+ * GET /auth/google/link
+ * Returns a Google OAuth URL for the link flow (connecting Google to an existing account).
+ * Requires a valid Bearer token in the Authorization header (manually verified here
+ * because /auth/* middleware does not apply JWT authentication).
+ */
+export const GET = async (req, res) => {
+    // Manually verify the Bearer token
+    const authHeader = req.headers.authorization;
+    const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+    if (!token) {
+        res.status(401).json({ error: { message: "Authorization header required" } });
+        return;
+    }
+    const config = req.scope.resolve("config");
+    const jwtSecret = config?.projectConfig?.jwtSecret;
+    let payload;
+    try {
+        payload = jwt.verify(token, jwtSecret, { algorithms: ["HS256"] });
+    }
+    catch {
+        res.status(401).json({ error: { message: "Invalid or expired token" } });
+        return;
+    }
+    const userId = (payload.sub ?? payload.id);
+    if (!userId) {
+        res.status(401).json({ error: { message: "Invalid token: missing user id" } });
+        return;
+    }
+    let googleOAuthService;
+    try {
+        googleOAuthService = req.scope.resolve("googleOAuthService");
+    }
+    catch {
+        res.status(501).json({ error: { message: "Google OAuth is not configured" } });
+        return;
+    }
+    const nonce = randomBytes(16).toString("hex");
+    const statePayload = { nonce, flow: "link", userId };
+    const state = jwt.sign(statePayload, jwtSecret, { expiresIn: "10m", algorithm: "HS256" });
+    res.cookie("oauth_nonce", nonce, {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/auth/google/callback",
+        maxAge: 600_000,
+        secure: process.env.NODE_ENV === "production",
+    });
+    const url = googleOAuthService.getAuthUrl(state);
+    res.json({ url });
+};
+//# sourceMappingURL=route.js.map

package/dist/api/auth/google/link/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/google/link/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,GAAG,MAAM,cAAc,CAAA;AAG9B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,mCAAmC;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAmC,CAAA;IAClE,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAA;QAC7E,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,SAAmB,CAAA;IAE5D,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAQ,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAA;QACxE,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAuB,CAAA;IAChE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QAC9E,OAAM;IACR,CAAC;IAED,IAAI,kBAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,kBAAkB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QAC9E,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IAEzF,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE;QAC/B,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;KAC9C,CAAC,CAAA;IAEF,MAAM,GAAG,GAAW,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACxD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;AACnB,CAAC,CAAA"}

package/dist/api/auth/google/route.d.ts

@@ -0,0 +1,7 @@
+import type { Response } from "express";
+/**
+ * GET /auth/google?flow=login|register|invite&invite_token=<tok>
+ * Initiates Google OAuth flow. Absent googleOAuthService → 501.
+ */
+export declare const GET: (req: any, res: Response) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/auth/google/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/google/route.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;GAGG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA2ChD,CAAA"}

package/dist/api/auth/google/route.js

@@ -0,0 +1,45 @@
+import { randomBytes } from "crypto";
+import jwt from "jsonwebtoken";
+/**
+ * GET /auth/google?flow=login|register|invite&invite_token=<tok>
+ * Initiates Google OAuth flow. Absent googleOAuthService → 501.
+ */
+export const GET = async (req, res) => {
+    let googleOAuthService;
+    try {
+        googleOAuthService = req.scope.resolve("googleOAuthService");
+    }
+    catch {
+        res.status(501).json({ error: { message: "Google OAuth is not configured" } });
+        return;
+    }
+    const flow = req.query.flow;
+    if (!["login", "register", "invite"].includes(flow)) {
+        res.status(400).json({ error: { message: "Invalid flow. Must be login, register, or invite." } });
+        return;
+    }
+    if (flow === "invite" && !req.query.invite_token) {
+        res.status(400).json({ error: { message: "invite_token is required for invite flow" } });
+        return;
+    }
+    const config = req.scope.resolve("config");
+    const jwtSecret = config?.projectConfig?.jwtSecret;
+    // Generate a cryptographically random nonce for CSRF protection
+    const nonce = randomBytes(16).toString("hex");
+    // Sign a state JWT containing the nonce and flow metadata
+    const statePayload = { nonce, flow };
+    if (flow === "invite" && req.query.invite_token) {
+        statePayload.invite_token = req.query.invite_token;
+    }
+    const state = jwt.sign(statePayload, jwtSecret, { expiresIn: "10m", algorithm: "HS256" });
+    // HttpOnly SameSite=Lax nonce cookie scoped to the callback path
+    res.cookie("oauth_nonce", nonce, {
+        httpOnly: true,
+        sameSite: "lax",
+        path: "/auth/google/callback",
+        maxAge: 600_000,
+        secure: process.env.NODE_ENV === "production",
+    });
+    res.redirect(302, googleOAuthService.getAuthUrl(state));
+};
+//# sourceMappingURL=route.js.map

package/dist/api/auth/google/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/google/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,OAAO,GAAG,MAAM,cAAc,CAAA;AAG9B;;;GAGG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,kBAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,kBAAkB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QAC9E,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAc,CAAA;IACrC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,SAAmB,CAAA;IAE5D,gEAAgE;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAE7C,0DAA0D;IAC1D,MAAM,YAAY,GAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC5D,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAChD,YAAY,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,YAAsB,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IAEzF,iEAAiE;IACjE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE;QAC/B,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;KAC9C,CAAC,CAAA;IAEF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AACzD,CAAC,CAAA"}

package/dist/api/auth/invite/[token]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,qGAAqG;AACrG,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA+BhD,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAwDjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,qGAAqG;AACrG,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAoChD,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAqEjD,CAAA"}

package/dist/api/auth/invite/[token]/route.js

@@ -13,6 +13,10 @@ export const GET = async (req, res) => {
         res.status(410).json({ error: { message: `Invitation has been ${invitation.status}` } });
         return;
     }
+    if (invitation.expires_at && new Date(invitation.expires_at) < new Date()) {
+        res.status(410).json({ error: { message: "Invitation has expired. Ask for a new one." } });
+        return;
+    }
     const workspace = await workspaceService.retrieveWorkspace(invitation.workspace_id);
     res.json({
         invitation: {
@@ -48,6 +52,10 @@ export const POST = async (req, res) => {
         res.status(410).json({ error: { message: `Invitation has already been ${invitation.status}` } });
         return;
     }
+    if (invitation.expires_at && new Date(invitation.expires_at) < new Date()) {
+        res.status(410).json({ error: { message: "Invitation has expired. Ask for a new one." } });
+        return;
+    }
     const parsed = acceptSchema.safeParse(req.body);
     if (!parsed.success) {
         res.status(400).json({ error: { message: "Validation error", details: parsed.error.flatten().fieldErrors } });
@@ -59,14 +67,23 @@ export const POST = async (req, res) => {
         });
         return;
     }
-    const authResult = await authService.register({
-        email: parsed.data.email,
-        password: parsed.data.password,
-        first_name: parsed.data.first_name,
-        last_name: parsed.data.last_name,
-        role: invitation.role,
-    });
-    await workspaceMemberService.ensureMember(invitation.workspace_id, authResult.user.id, invitation.role);
+    let authResult;
+    try {
+        authResult = await authService.register({
+            email: parsed.data.email,
+            password: parsed.data.password,
+            first_name: parsed.data.first_name,
+            last_name: parsed.data.last_name,
+            role: invitation.role,
+        });
+    }
+    catch (err) {
+        res.status(err.status ?? 500).json({ error: { message: err.message ?? "Registration failed" } });
+        return;
+    }
+    // workspace_member.role only supports "admin" | "member" — map super-admin → admin
+    const wsRole = invitation.role === "member" ? "member" : "admin";
+    await workspaceMemberService.ensureMember(invitation.workspace_id, authResult.user.id, wsRole);
     if (invitation.app_role_id) {
         try {
             const userService = req.scope.resolve("userModuleService");

package/dist/api/auth/invite/[token]/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,qGAAqG;AACrG,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAE3E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAEnF,GAAG,CAAC,IAAI,CAAC;QACP,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B;QACD,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;KAC5E,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,KAAK,kCAAkC,EAAE;SACtG,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QAC5C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;QACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;QAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAChC,IAAI,EAAE,UAAU,CAAC,IAAI;KACtB,CAAC,CAAA;IAEF,MAAM,sBAAsB,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IAEvG,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAE/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAClC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,qGAAqG;AACrG,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAE3E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAEnF,GAAG,CAAC,IAAI,CAAC;QACP,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B;QACD,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;KAC5E,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,KAAK,kCAAkC,EAAE;SACtG,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,UAAmD,CAAA;IACvD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;YAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;YAChC,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,mFAAmF;IACnF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,MAAM,sBAAsB,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAE9F,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAE/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAClC,CAAC,CAAA"}

package/dist/api/auth/register/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/register/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AASvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBASjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/register/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AASvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAoBjD,CAAA"}

package/dist/api/auth/register/route.js

@@ -6,6 +6,16 @@ const registerSchema = z.object({
     last_name: z.string().optional(),
 });
 export const POST = async (req, res) => {
+    // Registration is only open for the very first user (super-admin setup).
+    // All subsequent accounts must be created via an invitation link.
+    const userService = req.scope.resolve("userModuleService");
+    const [, userCount] = await userService.listAndCountUsers({}, { limit: 1 });
+    if (userCount > 0) {
+        res.status(403).json({
+            error: { message: "Registration is closed. Ask an admin to send you an invitation link." },
+        });
+        return;
+    }
     const result = registerSchema.safeParse(req.body);
     if (!result.success) {
         res.status(400).json({ error: { message: "Validation error", details: result.error.flatten().fieldErrors } });

package/dist/api/auth/register/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/register/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/register/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3E,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE;SAC3F,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC,CAAA"}

package/dist/api/auth/setup/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/setup/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEhD;;;;GAIG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAShD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/setup/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEhD;;;;GAIG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAmBhD,CAAA"}

package/dist/api/auth/setup/route.js

@@ -4,14 +4,23 @@
  * Returns whether the app needs first-time setup (no users registered yet).
  */
 export const GET = async (req, res) => {
+    let needsSetup = false;
     try {
         const userService = req.scope.resolve("userModuleService");
         const count = await userService.countUsers();
-        res.json({ needsSetup: count === 0 });
+        needsSetup = count === 0;
     }
     catch {
         // userModuleService not configured — assume setup not needed
-        res.json({ needsSetup: false });
     }
+    let googleOAuthEnabled = false;
+    try {
+        req.scope.resolve("googleOAuthService");
+        googleOAuthEnabled = true;
+    }
+    catch {
+        // googleOAuthService not registered — feature disabled
+    }
+    res.json({ needsSetup, googleOAuthEnabled });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/auth/setup/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/setup/route.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjC,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/setup/route.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;QAC5C,UAAU,GAAG,KAAK,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACvC,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA"}

package/dist/workflows/create-invitation.d.ts

@@ -1,7 +1,7 @@
 export interface CreateInvitationInput {
     workspace_id: string;
     email?: string | null;
-    role: "admin" | "member";
+    role: "super-admin" | "admin" | "member";
     app_role_id?: string | null;
     created_by: string;
 }

package/dist/workflows/create-invitation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-invitation.d.ts","sourceRoot":"","sources":["../../src/workflows/create-invitation.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;CACnB;AAqBD,eAAO,MAAM,wBAAwB,gJAkBpC,CAAA"}
+{"version":3,"file":"create-invitation.d.ts","sourceRoot":"","sources":["../../src/workflows/create-invitation.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,EAAE,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAA;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;CACnB;AAqBD,eAAO,MAAM,wBAAwB,gJAkBpC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/meridian",
-  "version": "0.1.27",
+  "version": "0.1.30",
   "description": "Default API routes, workflows, links, and subscribers for Meridian applications",
   "main": "./dist/index.js",
   "module": "./dist/index.js",