npm - @meridianjs/meridian - Versions diffs - 1.5.0 → 1.7.0 - Mend

@meridianjs/meridian 1.5.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (52) hide show

package/dist/api/admin/reporting/time-logs/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/reporting/time-logs/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAsDhD~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/reporting/time-logs/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA+DhD,CAAA"}

package/dist/api/admin/reporting/time-logs/route.js CHANGED Viewed

@@ -1,6 +1,6 @@
 export const GET = async (req, res) => {
     const issueService = req.scope.resolve("issueModuleService");
-    const { user_id, project_id, workspace_id, from, to } = req.query;
+    const { user_id, project_id, workspace_id, workspace_ids, from, to } = req.query;
     const roles = req.user?.roles ?? [];
     const permissions = req.user?.permissions ?? [];
     const isPrivileged = roles.includes("super-admin") || roles.includes("admin") || permissions.includes("workspace:admin");
@@ -9,8 +9,16 @@ export const GET = async (req, res) => {
         filters.user_id = user_id;
     if (project_id)
         filters.project_id = project_id;
-    if (workspace_id)
-        filters.workspace_id = workspace_id;
+    // Support both single workspace_id and comma-separated workspace_ids
+    const wsIds = workspace_ids
+        ? workspace_ids.split(",").filter(Boolean)
+        : workspace_id
+            ? [workspace_id]
+            : [];
+    if (wsIds.length === 1)
+        filters.workspace_id = wsIds[0];
+    else if (wsIds.length > 1)
+        filters.workspace_id = wsIds;
     if (from || to) {
         const dateFilter = {};
         if (from)
@@ -19,32 +27,33 @@ export const GET = async (req, res) => {
             dateFilter.$lte = new Date(to);
         filters.logged_date = dateFilter;
     }
-    if (!isPrivileged && workspace_id) {
+    if (!isPrivileged && wsIds.length > 0) {
         const userId = req.user?.id;
         const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-        const membership = await workspaceMemberService.getMembership(workspace_id, userId);
-        if (!membership) {
-            res.status(403).json({ error: { message: "Forbidden" } });
-            return;
-        }
         const teamMemberService = req.scope.resolve("teamMemberModuleService");
         const projectMemberService = req.scope.resolve("projectMemberModuleService");
-        const userTeamIds = await teamMemberService.getUserTeamIds(userId);
-        const accessibleProjectIds = await projectMemberService.getAccessibleProjectIds(userId, userTeamIds);
+        // Verify membership in each requested workspace, collect accessible projects
+        const allAccessibleProjectIds = [];
+        for (const wid of wsIds) {
+            const membership = await workspaceMemberService.getMembership(wid, userId);
+            if (!membership)
+                continue; // skip workspaces user isn't a member of
+            const userTeamIds = await teamMemberService.getUserTeamIds(userId);
+            const projectIds = await projectMemberService.getAccessibleProjectIds(userId, userTeamIds);
+            allAccessibleProjectIds.push(...projectIds);
+        }
         if (project_id) {
-            // Requested a specific project — deny if not accessible
-            if (!accessibleProjectIds.includes(project_id)) {
+            if (!allAccessibleProjectIds.includes(project_id)) {
                 res.json({ time_logs: [], total_minutes: 0 });
                 return;
             }
         }
         else {
-            // Scope to accessible projects only
-            if (accessibleProjectIds.length === 0) {
+            if (allAccessibleProjectIds.length === 0) {
                 res.json({ time_logs: [], total_minutes: 0 });
                 return;
             }
-            filters.project_id = accessibleProjectIds;
+            filters.project_id = allAccessibleProjectIds;
         }
     }
     const time_logs = await issueService.listTimeLogsForReporting(filters);

package/dist/api/admin/reporting/time-logs/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/reporting/time-logs/route.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAuB,CAAA;IAClF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAA2C,CAAA;~~IAEvG~~,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAExH,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;IACtC,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;~~IAC~~/C,~~IAAI~~,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,YAAY,CAAA;~~IACrD~~,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAA4B,EAAE,CAAA;QAC9C,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,EAAE;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,WAAW,GAAG,UAAU,CAAA;IAClC,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,~~YAAY~~,EAAE,CAAC;~~QAClC~~,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;QAC3B,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACvF,MAAM,~~UAAU~~,GAAG,~~MAAM~~,~~sBAAsB,~~CAAC,~~aAAa~~,CAAC,~~YAAY~~,~~EAAE~~,~~MAAM~~,~~CAAC~~,CAAA;~~QACnF~~,~~IAAI~~,~~CAAC~~,~~UAAU~~,~~EAAE~~,CAAC~~;YAChB~~,~~GAAG~~,CAAC,~~MAAM~~,CAAC,~~GAAG~~,~~CAAC~~,~~CAAC~~,~~IAAI~~,~~CAAC~~,~~EAAE~~,~~KAAK~~,EAAE,~~EAAE~~,~~OAAO~~,~~EAAE~~,~~WAAW~~,~~EAAE~~,EAAE,CAAC~~,CAAA~~;~~YACzD~~,~~OAAM;QACR,CAAC;QACD,~~MAAM,~~iBAAiB~~,GAAG,~~GAAG~~,CAAC,~~KAAK~~,CAAC,~~OAAO~~,~~CAAC~~,~~yBAAyB~~,~~CAAQ~~,CAAA;~~QAC7E~~,~~MAAM~~,~~oBAAoB,GAAG,GAAG,~~CAAC,~~KAAK~~,~~CAAC~~,~~OAAO,~~CAAC,~~4BAA4B,CAAQ,CAAA~~;~~QACnF~~,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;~~QAClE~~,MAAM,~~oBAAoB~~,GAAG,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;~~QAEpG~~,IAAI,UAAU,EAAE,CAAC;YACf,~~wDAAwD;YACxD,~~IAAI,CAAC,~~oBAAoB~~,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;~~gBAC/C~~,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7C,OAAM;YACR,CAAC;QACH,CAAC;aAAM,CAAC;YACN,~~oCAAoC;YACpC,~~IAAI,~~oBAAoB~~,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;~~gBACtC~~,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7C,OAAM;YACR,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,~~oBAAoB~~,CAAA;~~QAC3C~~,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,aAAa,GAAI,SAAmB,CAAC,MAAM,CAC/C,CAAC,GAAW,EAAE,CAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EACxD,CAAC,CACF,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;AACxC,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/reporting/time-logs/route.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAuB,CAAA;IAClF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAA2C,CAAA;IAEtH,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAExH,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAA;IACtC,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;IAE/C,qEAAqE;IACrE,MAAM,KAAK,GAAG,aAAa;QACzB,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1C,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,CAAC,YAAY,CAAC;YAChB,CAAC,CAAC,EAAE,CAAA;IACR,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;SAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAA;IACvD,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACf,MAAM,UAAU,GAA4B,EAAE,CAAA;QAC9C,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,EAAE;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,OAAO,CAAC,WAAW,GAAG,UAAU,CAAA;IAClC,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;QAC3B,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACvF,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QAC7E,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;QAEnF,6EAA6E;QAC7E,MAAM,uBAAuB,GAAa,EAAE,CAAA;QAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC1E,IAAI,CAAC,UAAU;gBAAE,SAAQ,CAAC,yCAAyC;YACnE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAClE,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC1F,uBAAuB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7C,OAAM;YACR,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7C,OAAM;YACR,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,uBAAuB,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACtE,MAAM,aAAa,GAAI,SAAmB,CAAC,MAAM,CAC/C,CAAC,GAAW,EAAE,CAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,EACxD,CAAC,CACF,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;AACxC,CAAC,CAAA"}

package/dist/api/admin/users/[id]/route.js CHANGED Viewed

@@ -29,9 +29,9 @@ export const PATCH = async (req, res, next) => {
                 res.status(400).json({ error: { message: `Invalid role. Must be one of: ${allowed.join(", ")}` } });
                 return;
             }
-            // Cannot promote someone to your level or above
-            if ((ROLE_RANK[role] ?? 0) >= actor) {
-                res.status(403).json({ error: { message: "You cannot assign a role equal to or above your own" } });
+            // Cannot promote someone above your level
+            if ((ROLE_RANK[role] ?? 0) > actor) {
+                res.status(403).json({ error: { message: "You cannot assign a role above your own" } });
                 return;
             }
             const userService = req.scope.resolve("userModuleService");

package/dist/api/admin/users/[id]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/[id]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAQ;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5D,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACzE,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YAEpC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,EAAE,CAAC,CAAA;gBAC3G,OAAM;YACR,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YACzB,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,~~gDAAgD~~;~~YAChD~~,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,~~IAAI~~,KAAK,EAAE,CAAC;~~gBACpC~~,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,~~qDAAqD~~,EAAE,EAAE,CAAC,CAAA;~~gBACnG~~,OAAM;YACR,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAClE,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACtE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAW,CAAA;YACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YAEpC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAEtE,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAQ,CAAA;YAC1E,MAAM,YAAY,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAE5E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/[id]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAQ;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5D,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACzE,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YAEpC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE,EAAE,CAAC,CAAA;gBAC3G,OAAM;YACR,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YACzB,MAAM,OAAO,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;YAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,0CAA0C;YAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,EAAE,CAAC,CAAA;gBACvF,OAAM;YACR,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAClE,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACtE,MAAM,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAW,CAAA;YACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;YAEpC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,WAAW,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAEtE,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAQ,CAAA;YAC1E,MAAM,YAAY,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAE5E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/users/invitations/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/users/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAuChD~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/users/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAgDhD,CAAA"}

package/dist/api/admin/users/invitations/route.js CHANGED Viewed

@@ -3,7 +3,14 @@ export const GET = async (req, res) => {
     requireRoles("super-admin", "admin")(req, res, async () => {
         const invitationService = req.scope.resolve("invitationModuleService");
         const workspaceService = req.scope.resolve("workspaceModuleService");
-        const [invitations] = await invitationService.listAndCountInvitations({}, { limit: 500 });
+        const limit = Math.min(Number(req.query.limit) || 20, 100);
+        const offset = Number(req.query.offset) || 0;
+        const q = typeof req.query.q === "string" ? req.query.q.trim() : "";
+        const filters = { status: "pending" };
+        if (q) {
+            filters.email = { $ilike: `%${q}%` };
+        }
+        const [invitations, totalCount] = await invitationService.listAndCountInvitations(filters, { limit, offset });
         // Enrich with workspace name where applicable
         const workspaceCache = new Map();
         const enriched = await Promise.all(invitations.map(async (inv) => {
@@ -32,7 +39,7 @@ export const GET = async (req, res) => {
                 created_at: inv.created_at,
             };
         }));
-        res.json({ invitations: enriched, count: enriched.length });
+        res.json({ invitations: enriched, count: totalCount, limit, offset });
     });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/users/invitations/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QAC7E,MAAM,gBAAgB,GAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAE5E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,~~EAAE~~,EAAE,EAAE,KAAK,EAAE,~~GAAG~~,EAAE,CAAC,CAAA;~~QAEzF~~,8CAA8C;QAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAQ,EAAE,EAAE;YAC5C,IAAI,cAAc,GAAkB,IAAI,CAAA;YACxC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACH,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;wBACrE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;oBAC/C,CAAC;oBAAC,MAAM,CAAC;wBACP,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;oBACxD,CAAC;gBACH,CAAC;gBACD,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAA;YAC/D,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;gBACtC,cAAc;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAA;QACH,CAAC,CAAC,CACH,CAAA;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,~~QAAQ~~,~~CAAC~~,MAAM,EAAE,CAAC,CAAA;~~IAC7D~~,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QAC7E,MAAM,gBAAgB,GAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAE5E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnE,MAAM,OAAO,GAA4B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9D,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;QACtC,CAAC;QAED,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAE7G,8CAA8C;QAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAqB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAQ,EAAE,EAAE;YAC5C,IAAI,cAAc,GAAkB,IAAI,CAAA;YACxC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACH,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;wBACrE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;oBAC/C,CAAC;oBAAC,MAAM,CAAC;wBACP,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;oBACxD,CAAC;gBACH,CAAC;gBACD,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAA;YAC/D,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;gBACtC,cAAc;gBACd,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAA;QACH,CAAC,CAAC,CACH,CAAA;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/users/map/route.d.ts ADDED Viewed

@@ -0,0 +1,8 @@
+import type { Response, NextFunction } from "express";
+/**
+ * Lightweight endpoint that returns ALL users with only the fields needed
+ * for lookup maps and dropdowns. No pagination — intended for in-app
+ * reference data (user names, initials, avatars).
+ */
+export declare const GET: (req: any, res: Response, next: NextFunction) => Promise<void>;
+//# sourceMappingURL=route.d.ts.map

package/dist/api/admin/users/map/route.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/users/map/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAepE,CAAA"}

package/dist/api/admin/users/map/route.js ADDED Viewed

@@ -0,0 +1,23 @@
+/**
+ * Lightweight endpoint that returns ALL users with only the fields needed
+ * for lookup maps and dropdowns. No pagination — intended for in-app
+ * reference data (user names, initials, avatars).
+ */
+export const GET = async (req, res, next) => {
+    try {
+        const userService = req.scope.resolve("userModuleService");
+        const users = await userService.listUsers({});
+        const mapped = users.map((u) => ({
+            id: u.id,
+            email: u.email,
+            first_name: u.first_name,
+            last_name: u.last_name,
+            avatar_url: u.avatar_url ?? null,
+        }));
+        res.json({ users: mapped });
+    }
+    catch (err) {
+        next(err);
+    }
+};
+//# sourceMappingURL=route.js.map

package/dist/api/admin/users/map/route.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/users/map/route.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAI,KAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;SACjC,CAAC,CAAC,CAAA;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;AACH,CAAC,CAAA"}

package/dist/api/admin/users/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/users/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAErD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAWpE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/users/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAErD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAsBpE,CAAA"}

package/dist/api/admin/users/route.js CHANGED Viewed

@@ -3,7 +3,16 @@ export const GET = async (req, res, next) => {
         const userService = req.scope.resolve("userModuleService");
         const limit = Math.min(Number(req.query.limit) || 20, 100);
         const offset = Number(req.query.offset) || 0;
-        const [users, count] = await userService.listAndCountUsers({}, { limit, offset });
+        const q = typeof req.query.q === "string" ? req.query.q.trim() : "";
+        const filters = {};
+        if (q) {
+            filters.$or = [
+                { email: { $ilike: `%${q}%` } },
+                { first_name: { $ilike: `%${q}%` } },
+                { last_name: { $ilike: `%${q}%` } },
+            ];
+        }
+        const [users, count] = await userService.listAndCountUsers(filters, { limit, offset });
         const safeUsers = users.map(({ password_hash: _, ...u }) => u);
         res.json({ users: safeUsers, count, limit, offset });
     }

package/dist/api/admin/users/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/users/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,~~EAAE~~,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;~~QACjF~~,MAAM,SAAS,GAAI,KAAe,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACzE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;AACH,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/users/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnE,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,CAAC,GAAG,GAAG;gBACZ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC/B,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;aACpC,CAAA;QACH,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACtF,MAAM,SAAS,GAAI,KAAe,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACzE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;AACH,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;~~AAEvC~~,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBA6CjD~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAoBvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA+CjD,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.js CHANGED Viewed

@@ -1,4 +1,21 @@
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const POST = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const roles = req.user?.roles ?? [];
     const permissions = req.user?.permissions ?? [];
     const isPrivileged = roles.includes("super-admin") || roles.includes("admin");

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAC7F,OAAM;IACR,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEtF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;QACtF,OAAM;IACR,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gEAAgE,EAAE,EAAE,CAAC,CAAA;QAC9G,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;IACrD,MAAM,QAAQ,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;YACJ,aAAa,EAAE,UAAU,CAAC,EAAE;YAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7B,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/resend/route.ts"],"names":[],"mappings":"AAEA,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAC7F,OAAM;IACR,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEtF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;QACtF,OAAM;IACR,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gEAAgE,EAAE,EAAE,CAAC,CAAA;QAC9G,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;IACrD,MAAM,QAAQ,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE;YACJ,aAAa,EAAE,UAAU,CAAC,EAAE;YAC5B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7B,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;~~AAEvC~~,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBA0BnD~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAoBvC,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA4BnD,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/route.js CHANGED Viewed

@@ -1,4 +1,21 @@
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const DELETE = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const svc = req.scope.resolve("invitationModuleService");
     const invitation = await svc.retrieveInvitation(req.params.inviteId).catch(() => null);
     if (!invitation) {

package/dist/api/admin/workspaces/[id]/invitations/[inviteId]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAE/D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACtF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,oEAAoE;IACpE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAC7F,OAAM;IACR,CAAC;IAED,MAAM,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/invitations/[inviteId]/route.ts"],"names":[],"mappings":"AAEA,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAE/D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACtF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,4DAA4D;IAC5D,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,oEAAoE;IACpE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAAE,CAAC,CAAA;QAC7F,OAAM;IACR,CAAC;IAED,MAAM,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;~~AAevC~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAQhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAwDjD,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAsBvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAQhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAwDjD,CAAA"}

package/dist/api/admin/workspaces/[id]/invitations/route.js CHANGED Viewed

@@ -1,13 +1,17 @@
 import { createInvitationWorkflow } from "../../../../../workflows/create-invitation.js";
 async function assertWorkspaceMembership(req, res) {
-    const roles = req.user?.roles ?? [];
-    if (roles.includes("super-admin") || roles.includes("admin"))
-        return true;
+    const workspaceService = req.scope.resolve("workspaceModuleService");
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-    const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
-    if (!membership) {
-        res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
-        return false;
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    // Private workspaces: always require membership regardless of role
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
     }
     return true;
 }

package/dist/api/admin/workspaces/[id]/invitations/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AAExF,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,GAAa;IAC9D,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,~~IAAI~~,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;~~QAAE~~,~~OAAO~~,IAAI,~~CAAA;IACzE~~,~~MAAM~~,~~sBAAsB~~,~~GAAG~~,~~GAAG,~~CAAC,~~KAAK~~,~~CAAC~~,~~OAAO,~~CAAC~~,8BAA8B,CAAQ,CAAA~~;~~IACvF~~,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;~~IAC1F~~,IAAI,CAAC,UAAU,EAAE,CAAC;~~QAChB~~,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;~~QAC1F~~,OAAO,KAAK,CAAA;~~IACd~~,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAC5D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;YAChG,OAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QAE7E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAChG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,eAAe,oEAAoE,EAAE,EAAE,CAAC,CAAA;YACtJ,OAAM;QACR,CAAC;QAED,8DAA8D;QAC9D,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACtE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4BAA4B,eAAe,kBAAkB,EAAE,EAAE,CAAC,CAAA;YAC3G,OAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC3F,KAAK,EAAE;YACL,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;YAC3B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5B,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,IAAI;YAChC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAA;IAEF,IAAI,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,6BAA6B,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/invitations/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AAExF,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,GAAa;IAC9D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,mEAAmE;IACnE,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAC5D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IACtD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,WAAW,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAAE,CAAC,CAAA;YAChG,OAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QAE7E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAChG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,eAAe,oEAAoE,EAAE,EAAE,CAAC,CAAA;YACtJ,OAAM;QACR,CAAC;QAED,8DAA8D;QAC9D,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACtE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4BAA4B,eAAe,kBAAkB,EAAE,EAAE,CAAC,CAAA;YAC3G,OAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC3F,KAAK,EAAE;YACL,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;YAC3B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5B,IAAI;YACJ,WAAW,EAAE,WAAW,IAAI,IAAI;YAChC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;SACrC;KACF,CAAC,CAAA;IAEF,IAAI,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,6BAA6B,EAAE,EAAE,CAAC,CAAA;QACjG,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/logo/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/logo/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;~~AAIvC~~,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAoBjD~~,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAanD~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/logo/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAsBvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAsBjD,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAenD,CAAA"}

package/dist/api/admin/workspaces/[id]/logo/route.js CHANGED Viewed

@@ -1,7 +1,24 @@
 import { requirePermission } from "@meridianjs/auth";
 import { processUpload, deleteUpload } from "../../../../../utils/upload.js";
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const POST = async (req, res) => {
     requirePermission("workspace:update")(req, res, async () => {
+        if (!await assertWorkspaceAccess(req, res))
+            return;
         const upload = await processUpload(req, res, "logo", "workspace-logos");
         if (!upload) {
             res.status(400).json({ error: { message: "No file uploaded. Use multipart/form-data with field name 'logo'." } });
@@ -21,6 +38,8 @@ export const POST = async (req, res) => {
 };
 export const DELETE = async (req, res) => {
     requirePermission("workspace:update")(req, res, async () => {
+        if (!await assertWorkspaceAccess(req, res))
+            return;
         const workspaceService = req.scope.resolve("workspaceModuleService");
         const existing = await workspaceService.retrieveWorkspace(req.params.id).catch(() => null);
         if (!existing) {

package/dist/api/admin/workspaces/[id]/logo/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/logo/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAE5E,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAA;YACjH,OAAM;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAEjE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QACjG,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/logo/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAE5E,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAM;QAElD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAA;YACjH,OAAM;QACR,CAAC;QAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAEjE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QACjG,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAM;QAElD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACjE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/members/[userId]/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/members/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAerD~~,eAAO,MAAM,KAAK,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAoCtE~~,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBA2CvE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/members/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAiCrD,eAAO,MAAM,KAAK,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAsCtE,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBA6CvE,CAAA"}

package/dist/api/admin/workspaces/[id]/members/[userId]/route.js CHANGED Viewed

@@ -9,9 +9,26 @@ function actorRank(req) {
     const roles = req.user?.roles ?? [];
     return Math.max(...roles.map((r) => ROLE_RANK[r] ?? 0), 0);
 }
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const PATCH = async (req, res, next) => {
     requirePermission("member:update_role")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
             const { role } = req.body;
             if (!role || !["admin", "member"].includes(role)) {
@@ -44,6 +61,8 @@ export const PATCH = async (req, res, next) => {
 export const DELETE = async (req, res, next) => {
     requirePermission("member:remove")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
             const projectService = req.scope.resolve("projectModuleService");
             const projectMemberService = req.scope.resolve("projectMemberModuleService");

package/dist/api/admin/workspaces/[id]/members/[userId]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/members/[userId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACzE,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAEzB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElD,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,EAAE,CAAC,CAAA;gBAC7G,OAAM;YACR,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;YACvE,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;YAEnF,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElD,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAA;gBACjG,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAA;gBAC1E,OAAM;YACR,CAAC;YAED,6CAA6C;YAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC1D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CAAA;YACD,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CACtB,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAClF,CACF,CAAA;YAED,MAAM,sBAAsB,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/members/[userId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACzE,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAEzB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElD,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,EAAE,CAAC,CAAA;gBAC7G,OAAM;YACR,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;YACvE,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;YAEnF,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElD,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC,CAAA;gBACjG,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAA;gBAC1E,OAAM;YACR,CAAC;YAED,6CAA6C;YAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC1D,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CAAA;YACD,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CACtB,oBAAoB,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAClF,CACF,CAAA;YAED,MAAM,sBAAsB,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/members/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAoChD~~,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAoDrE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAqBrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA2BhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAsDrE,CAAA"}

package/dist/api/admin/workspaces/[id]/members/route.js CHANGED Viewed

@@ -1,15 +1,22 @@
 import { requirePermission } from "@meridianjs/auth";
-export const GET = async (req, res) => {
-    // Authorization: super-admin/admin see all; members must belong to this workspace
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
     const roles = req.user?.roles ?? [];
-    if (!roles.includes("super-admin") && !roles.includes("admin")) {
-        const workspaceMemberService0 = req.scope.resolve("workspaceMemberModuleService");
-        const membership = await workspaceMemberService0.getMembership(req.params.id, req.user?.id);
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
         if (!membership) {
             res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
-            return;
+            return false;
         }
     }
+    return true;
+}
+export const GET = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const userService = req.scope.resolve("userModuleService");
     const [members] = await workspaceMemberService.listAndCountWorkspaceMembers({ workspace_id: req.params.id }, { limit: 100 });
@@ -32,6 +39,8 @@ export const GET = async (req, res) => {
 export const POST = async (req, res, next) => {
     requirePermission("member:invite")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
             const { user_id, role, app_role_id } = req.body;
             if (!user_id) {

package/dist/api/admin/workspaces/[id]/members/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,~~EAAE~~,~~GAAQ~~,~~EAAE~~,~~GAAa~~,~~EAAE~~,~~EAAE~~;~~IACnD~~,~~kFAAkF~~;~~IAClF~~,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,~~IAAI~~,~~CAAC~~,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,~~CAAC,~~KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,~~EAAE,CAAC~~;~~QAC/D~~,~~MAAM~~,~~uBAAuB~~,~~GAAG~~,~~GAAG~~,CAAC,~~KAAK~~,~~CAAC~~,~~OAAO,~~CAAC~~,8BAA8B,CAAQ,CAAA~~;~~QACxF~~,MAAM,UAAU,GAAG,MAAM,~~uBAAuB~~,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;~~QAC3F~~,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,~~OAAM~~;~~QACR~~,CAAC;IACH,CAAC;~~IAED~~,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SACjG,CAAA;IACH,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YAED,mFAAmF;YACnF,MAAM,MAAM,GAAuB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAEzE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC;gBAChE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,OAAO;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAA;YAEF,gDAAgD;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;oBACjE,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE;oBACJ,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;oBAC3B,OAAO;oBACP,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;iBACnC;aACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,0EAA0E;IAC1E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SACjG,CAAA;IACH,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YACnF,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YAED,mFAAmF;YACnF,MAAM,MAAM,GAAuB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAEzE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,qBAAqB,CAAC;gBAChE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,OAAO;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAA;YAEF,gDAAgD;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;oBACjE,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE;oBACJ,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;oBAC3B,OAAO;oBACP,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;iBACnC;aACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAgBhD~~,CAAA;AAED,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAepE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/[id]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AA4BrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAMhD,CAAA;AAED,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAkBpE,CAAA"}

package/dist/api/admin/workspaces/[id]/route.js CHANGED Viewed

@@ -1,15 +1,27 @@
 import { requirePermission } from "@meridianjs/auth";
-export const GET = async (req, res) => {
+async function assertWorkspaceAccess(req, res, workspaceId) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(workspaceId);
+    if (!workspace) {
+        res.status(404).json({ error: { message: "Workspace not found" } });
+        return false;
+    }
     const roles = req.user?.roles ?? [];
     const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
-    if (!isPrivileged) {
-        const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+    // Private workspaces: always require membership regardless of role
+    if (workspace.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(workspaceId, req.user?.id);
         if (!membership) {
             res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
-            return;
+            return false;
         }
     }
+    return true;
+}
+export const GET = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res, req.params.id))
+        return;
     const workspaceService = req.scope.resolve("workspaceModuleService");
     const workspace = await workspaceService.retrieveWorkspace(req.params.id);
     res.json({ workspace });
@@ -17,13 +29,17 @@ export const GET = async (req, res) => {
 export const PUT = async (req, res, next) => {
     requirePermission("workspace:update")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res, req.params.id))
+                return;
             const workspaceService = req.scope.resolve("workspaceModuleService");
-            const { name, logo_url } = req.body;
+            const { name, logo_url, is_private } = req.body;
             const updates = {};
             if (name !== undefined)
                 updates.name = name.trim();
             if (logo_url !== undefined)
                 updates.logo_url = logo_url;
+            if (is_private !== undefined)
+                updates.is_private = is_private;
             const workspace = await workspaceService.updateWorkspace(req.params.id, updates);
             res.json({ workspace });
         }

package/dist/api/admin/workspaces/[id]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/[id]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,~~GAAQ~~,EAAE,~~GAAa~~,EAAE,EAAE;~~IACnD~~,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,~~CAAC~~,~~YAAY,EAAE,~~CAAC~~;QAClB~~,~~MAAM~~,~~sBAAsB~~,~~GAAG,GAAG,~~CAAC,~~KAAK~~,~~CAAC~~,~~OAAO,~~CAAC~~,8BAA8B,CAAQ,CAAA~~;~~QACvF~~,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,~~GAAG~~,~~CAAC,MAAM,CAAC,~~EAAE,~~EAAE,~~GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;~~QAC1F~~,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,~~OAAM~~;~~QACR~~,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;~~YACnC~~,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAClD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAA;~~YAEvD~~,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAChF,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/[id]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa,EAAE,WAAmB;IAC/E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACvE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,mEAAmE;IACnE,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACxF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAM;IAEjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,OAAM;YAEjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAC/C,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAClD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;YAE7D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAChF,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAUvE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAqBrD,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAYvE,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.js CHANGED Viewed

@@ -1,7 +1,24 @@
 import { requirePermission } from "@meridianjs/auth";
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const DELETE = async (req, res, next) => {
     requirePermission("team:manage_members")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const teamMemberService = req.scope.resolve("teamMemberModuleService");
             await teamMemberService.removeByTeamAndUser(req.params.teamId, req.params.userId);
             res.status(204).send();

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/[userId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAyBhD~~,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBA0BrE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAqBrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA2BhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBA4BrE,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/route.js CHANGED Viewed

@@ -1,5 +1,22 @@
 import { requirePermission } from "@meridianjs/auth";
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const GET = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const teamMemberService = req.scope.resolve("teamMemberModuleService");
     const userService = req.scope.resolve("userModuleService");
     const [members] = await teamMemberService.listAndCountTeamMembers({ team_id: req.params.teamId }, { limit: 100 });
@@ -21,6 +38,8 @@ export const GET = async (req, res) => {
 export const POST = async (req, res, next) => {
     requirePermission("team:manage_members")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const teamMemberService = req.scope.resolve("teamMemberModuleService");
             const { user_id } = req.body;
             if (!user_id) {

package/dist/api/admin/workspaces/[id]/teams/[teamId]/members/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAC/D,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACtD,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACjG,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,IAAI,MAAM,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAC,CAAA;gBACrF,OAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC;gBACtD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;gBAC1B,OAAO;aACR,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/members/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CAC/D,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACtD,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACjG,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QAC5D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAC7E,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;gBACnE,OAAM;YACR,CAAC;YAED,IAAI,MAAM,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAC,CAAA;gBACrF,OAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC;gBACtD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;gBAC1B,OAAO;aACR,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAIhD~~,CAAA;AAED,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAgBpE~~,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAavE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAqBrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAMhD,CAAA;AAED,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAkBpE,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAevE,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/[teamId]/route.js CHANGED Viewed

@@ -1,5 +1,22 @@
 import { requirePermission } from "@meridianjs/auth";
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const GET = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const userService = req.scope.resolve("userModuleService");
     const team = await userService.retrieveTeam(req.params.teamId);
     res.json({ team });
@@ -7,6 +24,8 @@ export const GET = async (req, res) => {
 export const PUT = async (req, res, next) => {
     requirePermission("team:update")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const userService = req.scope.resolve("userModuleService");
             const { name, description, icon } = req.body;
             const updates = {};
@@ -27,6 +46,8 @@ export const PUT = async (req, res, next) => {
 export const DELETE = async (req, res, next) => {
     requirePermission("team:delete")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const userService = req.scope.resolve("userModuleService");
             const teamMemberService = req.scope.resolve("teamMemberModuleService");
             await teamMemberService.deleteAllForTeam(req.params.teamId);

package/dist/api/admin/workspaces/[id]/teams/[teamId]/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACpB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAC5C,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAClD,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAA;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;YAE3C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAE7E,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3D,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/workspaces/[id]/teams/[teamId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACpB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACvE,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAC5C,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;YAClD,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAA;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;YAE3C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAC1E,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;YAE7E,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3D,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/teams/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;~~AAGrD~~,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBAiBhD~~,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBAuBrE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/teams/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAqBrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAmBhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBAyBrE,CAAA"}

package/dist/api/admin/workspaces/[id]/teams/route.js CHANGED Viewed

@@ -1,5 +1,22 @@
 import { requirePermission } from "@meridianjs/auth";
+async function assertWorkspaceAccess(req, res) {
+    const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+    const workspace = await workspaceService.retrieveWorkspace(req.params.id);
+    const roles = req.user?.roles ?? [];
+    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    if (workspace?.is_private || !isPrivileged) {
+        const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
+        if (!membership) {
+            res.status(403).json({ error: { message: "Forbidden — not a member of this workspace" } });
+            return false;
+        }
+    }
+    return true;
+}
 export const GET = async (req, res) => {
+    if (!await assertWorkspaceAccess(req, res))
+        return;
     const userService = req.scope.resolve("userModuleService");
     const teamMemberService = req.scope.resolve("teamMemberModuleService");
     const [teams] = await userService.listAndCountTeams({ workspace_id: req.params.id }, { limit: 100 });
@@ -12,6 +29,8 @@ export const GET = async (req, res) => {
 export const POST = async (req, res, next) => {
     requirePermission("team:create")(req, res, async () => {
         try {
+            if (!await assertWorkspaceAccess(req, res))
+                return;
             const userService = req.scope.resolve("userModuleService");
             const { name, description, icon } = req.body;
             if (!name || typeof name !== "string" || name.trim().length === 0) {

package/dist/api/admin/workspaces/[id]/teams/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/teams/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAE7E,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CACjD,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpE,OAAO,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAA;IACjD,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;gBACxC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,IAAI,EAAE,IAAI,IAAI,IAAI;aACnB,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/workspaces/[id]/teams/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,EAAE,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAElD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAE7E,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,WAAW,CAAC,iBAAiB,CACjD,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpE,OAAO,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,CAAA;IACjD,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,aAAa,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAM;YAElD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;YACjE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;gBACxC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,IAAI,EAAE,IAAI,IAAI,IAAI;aACnB,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/route.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,~~kBA4BhD~~,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,~~kBA6BrE~~,CAAA"}
1	+ {"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGrD,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAkChD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,kBA8BrE,CAAA"}

package/dist/api/admin/workspaces/route.js CHANGED Viewed

@@ -1,23 +1,27 @@
 import { requirePermission } from "@meridianjs/auth";
 export const GET = async (req, res) => {
     const workspaceService = req.scope.resolve("workspaceModuleService");
+    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const limit = Math.min(Number(req.query.limit) || 20, 100);
     const offset = Number(req.query.offset) || 0;
     const roles = req.user?.roles ?? [];
     const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    // Always fetch the user's workspace memberships (needed for private workspace filtering)
+    const userWorkspaceIds = await workspaceMemberService.getWorkspaceIdsForUser(req.user.id);
     if (isPrivileged) {
         const [workspaces, count] = await workspaceService.listAndCountWorkspaces({}, { limit, offset });
-        res.json({ workspaces, count, limit, offset });
+        // Exclude private workspaces the user is not a member of
+        const memberSet = new Set(userWorkspaceIds);
+        const filtered = workspaces.filter((w) => !w.is_private || memberSet.has(w.id));
+        res.json({ workspaces: filtered, count: filtered.length, limit, offset });
         return;
     }
     // Members: filter to workspaces they belong to
-    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-    const workspaceIds = await workspaceMemberService.getWorkspaceIdsForUser(req.user.id);
-    if (workspaceIds.length === 0) {
+    if (userWorkspaceIds.length === 0) {
         res.json({ workspaces: [], count: 0, limit, offset });
         return;
     }
-    const [workspaces, count] = await workspaceService.listAndCountWorkspaces({ id: workspaceIds }, { limit, offset });
+    const [workspaces, count] = await workspaceService.listAndCountWorkspaces({ id: userWorkspaceIds }, { limit, offset });
     res.json({ workspaces, count, limit, offset });
 };
 export const POST = async (req, res, next) => {
@@ -25,7 +29,7 @@ export const POST = async (req, res, next) => {
         try {
             const workspaceService = req.scope.resolve("workspaceModuleService");
             const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-            const { name, plan } = req.body;
+            const { name, plan, is_private } = req.body;
             if (!name || typeof name !== "string" || name.trim().length === 0) {
                 res.status(400).json({ error: { message: "name is required" } });
                 return;
@@ -35,6 +39,7 @@ export const POST = async (req, res, next) => {
                 name: name.trim(),
                 slug,
                 plan: plan ?? "free",
+                is_private: is_private ?? false,
             });
             // Auto-create workspace membership for the creator (admin role)
             if (req.user?.id) {

package/dist/api/admin/workspaces/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE5C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAChG,GAAG,CAAC,~~IAAI~~,CAAC,~~EAAE~~,UAAU,~~EAAE~~,~~KAAK~~,~~EAAE~~,~~KAAK~~,EAAE,~~MAAM,~~EAAE,CAAC,~~CAAA;QAC9C~~,~~OAAM;IACR~~,CAAC~~;IAED,+CAA+C;IAC/C~~,~~MAAM~~,~~sBAAsB~~,~~GAAG~~,GAAG,CAAC,~~KAAK~~,CAAC,~~OAAO~~,CAAC,~~8BAA8B~~,~~CAAQ,~~CAAA;~~IACvF~~,~~MAAM,YAAY,~~GAAG,~~MAAM~~,~~sBAAsB~~,CAAC,~~sBAAsB~~,~~CAAC~~,~~GAAG~~,~~CAAC~~,~~IAAI~~,CAAC,EAAE,CAAC,CAAA;~~IAErF~~,IAAI,~~YAAY~~,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;~~QAC9B~~,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACvE,EAAE,EAAE,EAAE,~~YAAY~~,EAAE,~~EACpB~~,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;~~YAE/B~~,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC;gBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,MAAM;~~aACrB~~,CAAC,CAAA;YAEF,gEAAgE;YAChE,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,sBAAsB,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAC/E,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE5C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAChG,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,+CAA+C;IAC/C,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACvE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EACxB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC;gBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,MAAM;gBACpB,UAAU,EAAE,UAAU,IAAI,KAAK;aAChC,CAAC,CAAA;YAEF,gEAAgE;YAChE,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,sBAAsB,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAC/E,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/meridian",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Default API routes, workflows, links, and subscribers for Meridian applications",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -20,13 +20,13 @@
     "prepublishOnly": "cd ../.. && npm run check:routes && cd packages/meridian && npm run build"
   },
   "dependencies": {
-    "@meridianjs/framework": "^1.5.0",
-    "@meridianjs/framework-utils": "^1.5.0",
-    "@meridianjs/workflow-engine": "^1.5.0",
-    "@meridianjs/types": "^1.5.0",
+    "@meridianjs/framework": "^1.7.0",
+    "@meridianjs/framework-utils": "^1.7.0",
+    "@meridianjs/workflow-engine": "^1.7.0",
+    "@meridianjs/types": "^1.7.0",
     "@meridianjs/user": "^1.0.0",
-    "@meridianjs/workspace": "^1.0.0",
-    "@meridianjs/auth": "^1.5.0",
+    "@meridianjs/workspace": "^1.1.0",
+    "@meridianjs/auth": "^1.7.0",
     "@meridianjs/project": "^1.0.0",
     "@meridianjs/issue": "^1.0.0",
     "@meridianjs/sprint": "^1.0.0",