@meridianjs/meridian 2.5.0 → 2.7.0

package/dist/api/admin/workspaces/route.js

@@ -1,17 +1,19 @@
 import { requirePermission } from "@meridianjs/auth";
+import { ROLES } from "@meridianjs/types";
+import { isGlobalAdmin } from "../../utils/project-access.js";
 export const GET = async (req, res) => {
     const workspaceService = req.scope.resolve("workspaceModuleService");
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const limit = Number(req.query.limit) || 200;
     const offset = Number(req.query.offset) || 0;
     const roles = req.user?.roles ?? [];
-    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    const isPrivileged = isGlobalAdmin(req);
     // Always fetch the user's workspace memberships (needed for private workspace filtering)
     const userWorkspaceIds = await workspaceMemberService.getWorkspaceIdsForUser(req.user.id);
     if (isPrivileged) {
         const [workspaces, count] = await workspaceService.listAndCountWorkspaces({}, { limit, offset });
         // Super-admin org-scope bypass: return all workspaces unfiltered
-        if (roles.includes("super-admin") && req.query.org_scope === "true") {
+        if (roles.includes(ROLES.SUPER_ADMIN) && req.query.org_scope === "true") {
             res.json({ workspaces, count, limit, offset });
             return;
         }
@@ -60,7 +62,7 @@ export const POST = async (req, res, next) => {
             });
             // Auto-create workspace membership for the creator (admin role)
             if (req.user?.id) {
-                await workspaceMemberService.ensureMember(workspace.id, req.user.id, "admin");
+                await workspaceMemberService.ensureMember(workspace.id, req.user.id, ROLES.ADMIN);
                 // Assign "Workspace Admin" app role to the creator
                 try {
                     const appRoleService = req.scope.resolve("appRoleModuleService");

package/dist/api/admin/workspaces/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE5C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAChG,iEAAiE;QACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC9C,OAAM;QACR,CAAC;QACD,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,+CAA+C;IAC/C,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACvE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EACxB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAEvD,qEAAqE;YACrE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,OAAO,EAAE,sBAAsB,QAAQ,CAAC,IAAI,mBAAmB;wBAC/D,IAAI,EAAE,kBAAkB;wBACxB,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;qBACzE;iBACF,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC;gBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,MAAM;gBACpB,UAAU,EAAE,UAAU,IAAI,KAAK;aAChC,CAAC,CAAA;YAEF,gEAAgE;YAChE,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,sBAAsB,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;gBAE7E,mDAAmD;gBACnD,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;oBACvE,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;oBACjE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;oBACrH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACzE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;YACH,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/workspaces/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAE7D,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE5C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAEvC,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEzF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAChG,iEAAiE;QACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC9C,OAAM;QACR,CAAC;QACD,yDAAyD;QACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,+CAA+C;IAC/C,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACrD,OAAM;IACR,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACvE,EAAE,EAAE,EAAE,gBAAgB,EAAE,EACxB,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IACxE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;YAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;YACvF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;YAE3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAEvD,qEAAqE;YACrE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;YACrE,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE;wBACL,OAAO,EAAE,sBAAsB,QAAQ,CAAC,IAAI,mBAAmB;wBAC/D,IAAI,EAAE,kBAAkB;wBACxB,SAAS,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;qBACzE;iBACF,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC;gBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,IAAI;gBACJ,IAAI,EAAE,IAAI,IAAI,MAAM;gBACpB,UAAU,EAAE,UAAU,IAAI,KAAK;aAChC,CAAC,CAAA;YAEF,gEAAgE;YAChE,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,sBAAsB,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;gBAEjF,mDAAmD;gBACnD,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;oBACvE,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;oBACjE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;oBACrH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACzE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;YACH,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/workspaces/search/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/search/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAiChD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/search/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAoChD,CAAA"}

package/dist/api/admin/workspaces/search/route.js

@@ -1,21 +1,30 @@
 export const GET = async (req, res) => {
     const workspaceService = req.scope.resolve("workspaceModuleService");
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-    const q = (req.query.q ?? "").trim().toLowerCase();
-    const [workspaces] = await workspaceService.listAndCountWorkspaces({ is_private: false }, { limit: 100 });
-    const filtered = q
-        ? workspaces.filter((w) => w.name.toLowerCase().includes(q) ||
-            w.slug.toLowerCase().includes(q))
-        : workspaces;
-    const limited = filtered.slice(0, 20);
-    // Check membership and pending request for each workspace
-    const results = await Promise.all(limited.map(async (w) => {
-        const isMember = await workspaceMemberService.isMember(w.id, req.user?.id);
-        const hasPendingRequest = !isMember
-            ? !!(await workspaceMemberService.getPendingRequest(w.id, req.user?.id))
-            : false;
-        return { id: w.id, name: w.name, slug: w.slug, is_private: w.is_private, is_member: isMember, has_pending_request: hasPendingRequest };
-    }));
-    res.json({ workspaces: results });
+    const q = (req.query.q ?? "").trim();
+    // Push the text search into SQL rather than loading 100 rows and filtering in JS.
+    const filters = { is_private: false };
+    if (q) {
+        const term = `%${q}%`;
+        filters.$or = [{ name: { $ilike: term } }, { slug: { $ilike: term } }];
+    }
+    const [workspaces] = await workspaceService.listAndCountWorkspaces(filters, { limit: 20 });
+    // Batch the membership + pending-request lookups into two queries total
+    // instead of two per result row.
+    const userId = req.user?.id;
+    const memberWsIds = new Set(await workspaceMemberService.getWorkspaceIdsForUser(userId));
+    const pendingWsIds = new Set((await workspaceMemberService.getUserPendingRequests(userId)).map((r) => r.workspace_id));
+    const results = workspaces.map((w) => {
+        const isMember = memberWsIds.has(w.id);
+        return {
+            id: w.id,
+            name: w.name,
+            slug: w.slug,
+            is_private: w.is_private,
+            is_member: isMember,
+            has_pending_request: !isMember && pendingWsIds.has(w.id),
+        };
+    });
+    res.json({ workspaces: results, count: results.length });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/workspaces/search/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/search/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAE5D,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAChE,EAAE,UAAU,EAAE,KAAK,EAAE,EACrB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC;QAChB,CAAC,CAAC,UAAU,CAAC,MAAM,CACf,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnC;QACH,CAAC,CAAC,UAAU,CAAA;IAEd,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,0DAA0D;IAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAM,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1E,MAAM,iBAAiB,GAAG,CAAC,QAAQ;YACjC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,KAAK,CAAA;QACT,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxI,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;AACnC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/admin/workspaces/search/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE9C,kFAAkF;IAClF,MAAM,OAAO,GAA4B,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IAC9D,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAA;QACrB,OAAO,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAE1F,wEAAwE;IACxE,iCAAiC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAC3B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;IAChG,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CAAC,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAC9F,CAAA;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACtC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA"}

package/dist/api/auth/_apply-pending-invites.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_apply-pending-invites.d.ts","sourceRoot":"","sources":["../../../src/api/auth/_apply-pending-invites.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CA6DlB"}
+{"version":3,"file":"_apply-pending-invites.d.ts","sourceRoot":"","sources":["../../../src/api/auth/_apply-pending-invites.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CA6DlB"}

package/dist/api/auth/_apply-pending-invites.js

@@ -1,8 +1,9 @@
+import { ROLES } from "@meridianjs/types";
 const ROLE_RANK = {
-    "super-admin": 3,
-    "admin": 2,
+    [ROLES.SUPER_ADMIN]: 3,
+    [ROLES.ADMIN]: 2,
     "moderator": 1,
-    "member": 0,
+    [ROLES.MEMBER]: 0,
 };
 /**
  * Finds all pending invitations for the given email, applies their workspace
@@ -23,11 +24,11 @@ export async function applyPendingInvites(scope, userId, email) {
         const [invitations] = await invitationService.listAndCountInvitations({ email: normalizedEmail, status: "pending" }, { limit: 100 });
         if (!invitations || invitations.length === 0)
             return false;
-        let highestRole = "member";
+        let highestRole = ROLES.MEMBER;
         for (const inv of invitations) {
             // Create workspace membership
             if (inv.workspace_id) {
-                const wsRole = inv.role === "member" ? "member" : "admin";
+                const wsRole = inv.role === ROLES.MEMBER ? ROLES.MEMBER : ROLES.ADMIN;
                 await workspaceMemberService.ensureMember(inv.workspace_id, userId, wsRole).catch(() => { });
             }
             // Track highest role across all invitations

package/dist/api/auth/_apply-pending-invites.js.map

@@ -1 +1 @@
-{"version":3,"file":"_apply-pending-invites.js","sourceRoot":"","sources":["../../../src/api/auth/_apply-pending-invites.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAA2B;IACxC,aAAa,EAAE,CAAC;IAChB,OAAO,EAAE,CAAC;IACV,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAU,EACV,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QACzE,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACnF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QAE7D,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;QAClD,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QAED,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAE1D,IAAI,WAAW,GAAG,QAAQ,CAAA;QAE1B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,8BAA8B;YAC9B,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAuB,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;gBAC7E,MAAM,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC7F,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/D,WAAW,GAAG,GAAG,CAAC,IAAI,CAAA;YACxB,CAAC;YAED,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;gBACxE,CAAC;qBAAM,CAAC;oBACN,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;oBACnE,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EACjC,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;oBACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxE,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YAED,8BAA8B;YAC9B,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACrE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7E,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"_apply-pending-invites.js","sourceRoot":"","sources":["../../../src/api/auth/_apply-pending-invites.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,MAAM,SAAS,GAA2B;IACxC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACtB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;IACd,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAU,EACV,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;QACzE,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACnF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QAE7D,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;QAClD,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QAED,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAE1D,IAAI,WAAW,GAAW,KAAK,CAAC,MAAM,CAAA;QAEtC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,8BAA8B;YAC9B,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAuB,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;gBACzF,MAAM,sBAAsB,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC7F,CAAC;YAED,4CAA4C;YAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/D,WAAW,GAAG,GAAG,CAAC,IAAI,CAAA;YACxB,CAAC;YAED,uEAAuE;YACvE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;gBACxE,CAAC;qBAAM,CAAC;oBACN,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;oBACnE,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EACjC,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;oBACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxE,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YAED,8BAA8B;YAC9B,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACrE,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7E,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/api/auth/forgot-password/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/forgot-password/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAMvC;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA4BjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/auth/forgot-password/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAOvC;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA4BjD,CAAA"}

package/dist/api/auth/forgot-password/route.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { EVENTS } from "@meridianjs/types";
 const forgotPasswordSchema = z.object({
     email: z.string().email(),
 });
@@ -19,7 +20,7 @@ export const POST = async (req, res) => {
         try {
             const eventBus = req.scope.resolve("eventBus");
             await eventBus.emit({
-                name: "password.reset_requested",
+                name: EVENTS.PASSWORD_RESET_REQUESTED,
                 data: {
                     user_id: resetInfo.userId,
                     email: resetInfo.email,

package/dist/api/auth/forgot-password/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/forgot-password/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3E,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;YACrD,MAAM,QAAQ,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE;oBACJ,OAAO,EAAE,SAAS,CAAC,MAAM;oBACzB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC,CAAA;AACtG,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/auth/forgot-password/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3E,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;YACrD,MAAM,QAAQ,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,MAAM,CAAC,wBAAwB;gBACrC,IAAI,EAAE;oBACJ,OAAO,EAAE,SAAS,CAAC,MAAM;oBACzB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;iBACvB;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,mEAAmE,EAAE,CAAC,CAAA;AACtG,CAAC,CAAA"}

package/dist/api/auth/invite/[token]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,qGAAqG;AACrG,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAsChD,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA+EjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIvC,qGAAqG;AACrG,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAsChD,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAwFjD,CAAA"}

package/dist/api/auth/invite/[token]/route.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { assignDefaultUserRole } from "../../../utils/assign-default-role.js";
+import { ROLES } from "@meridianjs/types";
 /** Public endpoint — no auth middleware. Returns invitation + workspace name for the accept page. */
 export const GET = async (req, res) => {
     const invitationService = req.scope.resolve("invitationModuleService");
@@ -70,12 +71,20 @@ export const POST = async (req, res) => {
         });
         return;
     }
+    // Atomically claim the invitation BEFORE doing any work — two concurrent
+    // POSTs with the same token would otherwise both pass the pending check
+    // and double-spend it.
+    const claimed = await invitationService.claimInvitation(invitation.id);
+    if (!claimed) {
+        res.status(410).json({ error: { message: "Invitation has already been accepted" } });
+        return;
+    }
     let authResult;
     try {
-        // Check for a previously soft-deleted account with this email.
-        // retrieveUserByEmail finds deleted records too (no deleted_at filter).
+        // Check for a previously soft-deleted account with this email so we can
+        // restore it. The IncludingDeleted variant makes that intent explicit.
         const userService = req.scope.resolve("userModuleService");
-        const existingUser = await userService.retrieveUserByEmail(parsed.data.email);
+        const existingUser = await userService.retrieveUserByEmailIncludingDeleted(parsed.data.email);
         if (existingUser?.deleted_at) {
             // Restore the old account — preserves their user ID, issue history, comments, etc.
             authResult = await authService.restoreFromInvite(existingUser.id, {
@@ -96,16 +105,17 @@ export const POST = async (req, res) => {
         }
     }
     catch (err) {
+        // Registration failed — release the claim so the invitee can retry.
+        await invitationService.reopenInvitation(invitation.id).catch(() => { });
         res.status(err.status ?? 500).json({ error: { message: err.message ?? "Registration failed" } });
         return;
     }
     if (invitation.workspace_id) {
         // workspace_member.role only supports "admin" | "member" — map super-admin → admin
-        const wsRole = invitation.role === "member" ? "member" : "admin";
+        const wsRole = invitation.role === ROLES.MEMBER ? ROLES.MEMBER : ROLES.ADMIN;
         await workspaceMemberService.ensureMember(invitation.workspace_id, authResult.user.id, wsRole);
     }
     await assignDefaultUserRole(req, authResult.user.id, invitation.app_role_id);
-    await invitationService.updateInvitation(invitation.id, { status: "accepted" });
     res.status(201).json(authResult);
 };
 //# sourceMappingURL=route.js.map

package/dist/api/auth/invite/[token]/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAE7E,qGAAqG;AACrG,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAE3E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY;QACvC,CAAC,CAAC,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC;QACnE,CAAC,CAAC,IAAI,CAAA;IAER,GAAG,CAAC,IAAI,CAAC;QACP,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B;QACD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/F,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,KAAK,kCAAkC,EAAE;SACtG,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,UAAmD,CAAA;IACvD,IAAI,CAAC;QACH,+DAA+D;QAC/D,wEAAwE;QACxE,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE7E,IAAI,YAAY,EAAE,UAAU,EAAE,CAAC;YAC7B,mFAAmF;YACnF,UAAU,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE;gBAChE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;gBAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;gBACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;gBAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,WAAW,EAAE,UAAU,CAAC,IAAI;aAC7B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,mFAAmF;QACnF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;QAChE,MAAM,sBAAsB,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5E,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAE/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAClC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/invite/[token]/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEzC,qGAAqG;AACrG,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAE3E,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY;QACvC,CAAC,CAAC,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,YAAY,CAAC;QACnE,CAAC,CAAC,IAAI,CAAA;IAER,GAAG,CAAC,IAAI,CAAC;QACP,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B;QACD,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/F,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;IACjE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,iBAAiB,CAAC,uBAAuB,CACnE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAC3B,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,+BAA+B,UAAU,CAAC,KAAK,kCAAkC,EAAE;SACtG,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAA;QACpF,OAAM;IACR,CAAC;IAED,IAAI,UAAmD,CAAA;IACvD,IAAI,CAAC;QACH,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,mCAAmC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAE7F,IAAI,YAAY,EAAE,UAAU,EAAE,CAAC;YAC7B,mFAAmF;YACnF,UAAU,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE;gBAChE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;gBAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;gBACtC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;gBACxB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;gBAC9B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;gBAChC,WAAW,EAAE,UAAU,CAAC,IAAI;aAC7B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,oEAAoE;QACpE,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,qBAAqB,EAAE,EAAE,CAAC,CAAA;QAChG,OAAM;IACR,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5B,mFAAmF;QACnF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;QAC5E,MAAM,sBAAsB,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IAE5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAClC,CAAC,CAAA"}

package/dist/api/auth/register/send-otp/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/register/send-otp/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAQvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAqDjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth/register/send-otp/route.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AASvC,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAqDjD,CAAA"}

package/dist/api/auth/register/send-otp/route.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { generateAndStoreOtp } from "../_otp-store.js";
 import { validateEmailDomain } from "../_domain-check.js";
+import { EVENTS } from "@meridianjs/types";
 const schema = z.object({
     email: z.string().email(),
 });
@@ -47,7 +48,7 @@ export const POST = async (req, res) => {
     }
     try {
         const eventBus = req.scope.resolve("eventBus");
-        await eventBus.emit({ name: "registration.otp_requested", data: { email, otp } });
+        await eventBus.emit({ name: EVENTS.REGISTRATION_OTP_REQUESTED, data: { email, otp } });
     }
     catch {
         // Non-fatal — OTP is stored, email may not send

package/dist/api/auth/register/send-otp/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/register/send-otp/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,YAAY,CAAA;IAErD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAA;QACrE,OAAM;IACR,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;IAE7B,IAAI,CAAC;QACH,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAClF,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;QACrD,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/api/auth/register/send-otp/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAQ,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,EAAE,YAAY,CAAA;IAErD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAA;QACrE,OAAM;IACR,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;IAE7B,IAAI,CAAC;QACH,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAQ,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAClF,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;QACrD,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA"}

package/dist/api/utils/issue-access.d.ts

@@ -0,0 +1,16 @@
+import type { Response } from "express";
+/**
+ * Loads the issue at req.params.id and enforces project-level access.
+ *
+ * Returns the issue when the caller may proceed. Sends the response (404 when
+ * the issue is missing, 403 when access is denied) and returns null otherwise.
+ *
+ * Fails closed: an issue whose project row cannot be resolved (dangling
+ * project_id) is only accessible to global admins.
+ *
+ * Usage:
+ *   const issue = await assertIssueAccess(req, res)
+ *   if (!issue) return
+ */
+export declare function assertIssueAccess(req: any, res: Response): Promise<any | null>;
+//# sourceMappingURL=issue-access.d.ts.map

package/dist/api/utils/issue-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-access.d.ts","sourceRoot":"","sources":["../../../src/api/utils/issue-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAwBpF"}

package/dist/api/utils/issue-access.js

@@ -0,0 +1,38 @@
+import { hasProjectAccess, isGlobalAdmin } from "./project-access.js";
+/**
+ * Loads the issue at req.params.id and enforces project-level access.
+ *
+ * Returns the issue when the caller may proceed. Sends the response (404 when
+ * the issue is missing, 403 when access is denied) and returns null otherwise.
+ *
+ * Fails closed: an issue whose project row cannot be resolved (dangling
+ * project_id) is only accessible to global admins.
+ *
+ * Usage:
+ *   const issue = await assertIssueAccess(req, res)
+ *   if (!issue) return
+ */
+export async function assertIssueAccess(req, res) {
+    const issueService = req.scope.resolve("issueModuleService");
+    const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
+    if (!issue) {
+        res.status(404).json({ error: { message: "Issue not found" } });
+        return null;
+    }
+    if (issue.project_id) {
+        const projectService = req.scope.resolve("projectModuleService");
+        const project = await projectService.retrieveProject(issue.project_id).catch(() => null);
+        if (!project) {
+            if (!isGlobalAdmin(req)) {
+                res.status(403).json({ error: { message: "Forbidden" } });
+                return null;
+            }
+        }
+        else if (!(await hasProjectAccess(req, project))) {
+            res.status(403).json({ error: { message: "Forbidden" } });
+            return null;
+        }
+    }
+    return issue;
+}
+//# sourceMappingURL=issue-access.js.map

package/dist/api/utils/issue-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-access.js","sourceRoot":"","sources":["../../../src/api/utils/issue-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,GAAa;IAC7D,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAExF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;gBACzD,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/api/utils/project-access.d.ts

@@ -5,6 +5,8 @@
  *   const allowed = await hasProjectAccess(req, project)
  *   if (!allowed) { res.status(403).json({ error: { message: "Forbidden" } }); return }
  */
+/** True when the caller holds an org-wide admin role. */
+export declare function isGlobalAdmin(req: any): boolean;
 export declare function hasProjectAccess(req: any, project: {
     id: string;
     workspace_id: string;

package/dist/api/utils/project-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-access.d.ts","sourceRoot":"","sources":["../../../src/api/utils/project-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBhH;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,OAAO,SAAS,EAAE,QAAQ,GAC9B,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBzD"}
+{"version":3,"file":"project-access.d.ts","sourceRoot":"","sources":["../../../src/api/utils/project-access.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAG/C;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAehH;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,OAAO,SAAS,EAAE,QAAQ,GAC9B,OAAO,CAAC;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBzD"}

package/dist/api/utils/project-access.js

@@ -1,3 +1,4 @@
+import { PRIVILEGED_ROLES, ROLES, PROJECT_ROLES } from "@meridianjs/types";
 /**
  * Shared project access check.
  *
@@ -5,9 +6,13 @@
  *   const allowed = await hasProjectAccess(req, project)
  *   if (!allowed) { res.status(403).json({ error: { message: "Forbidden" } }); return }
  */
-export async function hasProjectAccess(req, project) {
+/** True when the caller holds an org-wide admin role. */
+export function isGlobalAdmin(req) {
     const roles = req.user?.roles ?? [];
-    if (roles.includes("super-admin") || roles.includes("admin"))
+    return roles.some((r) => PRIVILEGED_ROLES.includes(r));
+}
+export async function hasProjectAccess(req, project) {
+    if (isGlobalAdmin(req))
         return true;
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const teamMemberService = req.scope.resolve("teamMemberModuleService");
@@ -16,7 +21,7 @@ export async function hasProjectAccess(req, project) {
     const membership = await workspaceMemberService.getMembership(project.workspace_id, userId);
     if (!membership)
         return false;
-    if (membership.role === "admin")
+    if (membership.role === ROLES.ADMIN)
         return true;
     const userTeamIds = await teamMemberService.getUserTeamIds(userId);
     const accessibleProjectIds = await projectMemberService.getAccessibleProjectIds(userId, userTeamIds);
@@ -34,18 +39,16 @@ export async function resolveProjectAndAccess(req, res) {
         res.status(404).json({ error: { message: "Project not found" } });
         return null;
     }
-    const roles = req.user?.roles ?? [];
-    const isGlobalAdmin = roles.includes("super-admin") || roles.includes("admin");
-    if (isGlobalAdmin)
+    if (isGlobalAdmin(req))
         return { project, isAuthorized: true };
     const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
     const wsMembership = await workspaceMemberService.getMembership(project.workspace_id, req.user?.id);
-    if (wsMembership?.role === "admin")
+    if (wsMembership?.role === ROLES.ADMIN)
         return { project, isAuthorized: true };
     const projectMemberService = req.scope.resolve("projectMemberModuleService");
     const members = await projectMemberService.listProjectMembers(project.id);
     const myMembership = members.find((m) => m.user_id === req.user?.id);
-    if (myMembership?.role === "manager")
+    if (myMembership?.role === PROJECT_ROLES.MANAGER)
         return { project, isAuthorized: true };
     return { project, isAuthorized: false };
 }

package/dist/api/utils/project-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-access.js","sourceRoot":"","sources":["../../../src/api/utils/project-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,OAA6C;IAC5F,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzE,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAE3B,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAC3F,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAE5C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAClE,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpG,OAAO,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,GAA+B;IAE/B,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC9E,IAAI,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAEzD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACnG,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAE1E,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;IACnF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzE,IAAI,YAAY,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAE5E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACzC,CAAC"}
+{"version":3,"file":"project-access.js","sourceRoot":"","sources":["../../../src/api/utils/project-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE1E;;;;;;GAMG;AACH,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,OAA6C;IAC5F,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAQ,CAAA;IAC7E,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAE3B,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAC3F,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEhD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAClE,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpG,OAAO,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,GAA+B;IAE/B,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACrF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAE9D,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACnG,IAAI,YAAY,EAAE,IAAI,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAE9E,MAAM,oBAAoB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,CAAQ,CAAA;IACnF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzE,IAAI,YAAY,EAAE,IAAI,KAAK,aAAa,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IAExF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACzC,CAAC"}

package/dist/api/utils/request.d.ts

@@ -0,0 +1,30 @@
+import type { Request } from "express";
+import type { MeridianContainer } from "@meridianjs/types";
+/**
+ * The authenticated request shape shared by all /admin routes.
+ *
+ * `req.user` is populated by authenticateJWT; `req.scope` is the per-request
+ * Awilix container. Routes are written against `any` today — prefer this type
+ * on new/edited handlers so service lookups and req.user access are checked.
+ */
+export interface AuthenticatedUser {
+    id: string;
+    workspaceId: string | null;
+    roles: string[];
+    permissions: string[];
+}
+export interface MeridianRequest extends Request {
+    user?: AuthenticatedUser;
+    scope: MeridianContainer;
+}
+/**
+ * Resolve a module service from the request scope with a return type.
+ * Replaces the pervasive `req.scope.resolve("xService") as any`.
+ *
+ * @example
+ * const issues = resolveService<IssueModuleService>(req, "issueModuleService")
+ */
+export declare function resolveService<T = any>(req: {
+    scope: MeridianContainer;
+}, token: string): T;
+//# sourceMappingURL=request.d.ts.map

package/dist/api/utils/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/api/utils/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,iBAAiB,CAAA;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAE3F"}

package/dist/api/utils/request.js

@@ -0,0 +1,11 @@
+/**
+ * Resolve a module service from the request scope with a return type.
+ * Replaces the pervasive `req.scope.resolve("xService") as any`.
+ *
+ * @example
+ * const issues = resolveService<IssueModuleService>(req, "issueModuleService")
+ */
+export function resolveService(req, token) {
+    return req.scope.resolve(token);
+}
+//# sourceMappingURL=request.js.map

package/dist/api/utils/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/api/utils/request.ts"],"names":[],"mappings":"AAsBA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAU,GAAiC,EAAE,KAAa;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAM,CAAA;AACtC,CAAC"}

package/dist/api/utils/workspace-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-access.d.ts","sourceRoot":"","sources":["../../../src/api/utils/workspace-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBrF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBpF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGtD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBjG"}
+{"version":3,"file":"workspace-access.d.ts","sourceRoot":"","sources":["../../../src/api/utils/workspace-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIvC;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBrF;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBpF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGtD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBjG"}

package/dist/api/utils/workspace-access.js

@@ -1,3 +1,5 @@
+import { ROLES } from "@meridianjs/types";
+import { isGlobalAdmin } from "./project-access.js";
 /**
  * Shared workspace access check. Verifies the workspace exists and the caller
  * has access (public workspace for admins, or membership for private/members).
@@ -10,8 +12,7 @@ export async function assertWorkspaceAccess(req, res) {
         res.status(404).json({ error: { message: "Workspace not found" } });
         return false;
     }
-    const roles = req.user?.roles ?? [];
-    const isPrivileged = roles.includes("super-admin") || roles.includes("admin");
+    const isPrivileged = isGlobalAdmin(req);
     if (workspace.is_private || !isPrivileged) {
         const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
         if (!membership) {
@@ -32,12 +33,10 @@ export async function assertWorkspaceAdmin(req, res) {
         res.status(404).json({ error: { message: "Workspace not found" } });
         return false;
     }
-    const roles = req.user?.roles ?? [];
-    const isGlobalAdmin = roles.includes("super-admin") || roles.includes("admin");
-    if (isGlobalAdmin)
+    if (isGlobalAdmin(req))
         return true;
     const membership = await workspaceMemberService.getMembership(req.params.id, req.user?.id);
-    if (!membership || membership.role !== "admin") {
+    if (!membership || membership.role !== ROLES.ADMIN) {
         res.status(403).json({ error: { message: "Workspace admin access required" } });
         return false;
     }
@@ -45,7 +44,7 @@ export async function assertWorkspaceAdmin(req, res) {
 }
 export function isSuperAdminOrgScope(req) {
     const roles = req.user?.roles ?? [];
-    return roles.includes("super-admin") && req.query.org_scope === "true";
+    return roles.includes(ROLES.SUPER_ADMIN) && req.query.org_scope === "true";
 }
 /**
  * Returns workspace IDs the caller can access (public + private where member).

package/dist/api/utils/workspace-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../../src/api/utils/workspace-access.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE7E,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ,EAAE,GAAa;IAChE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC9E,IAAI,aAAa;QAAE,OAAO,IAAI,CAAA;IAE9B,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAA;QAC/E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAQ;IAC3C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAA;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,SAAoB;IAC5E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,MAAM,GAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAEnC,IAAI,UAAiB,CAAA;IACrB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACxD,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EACzD,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAC5B,CAAA;QACD,UAAU,GAAG,EAAE,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;IAChG,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAC5B,CAAC"}
+{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../../src/api/utils/workspace-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAQ,EAAE,GAAa;IACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAEvC,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAAE,CAAC,CAAA;YAC1F,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ,EAAE,GAAa;IAChE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IAEvF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAA;QAC/E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAQ;IAC3C,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAA;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAQ,EAAE,SAAoB;IAC5E,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAQ,CAAA;IAC3E,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,MAAM,GAAW,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;IAEnC,IAAI,UAAiB,CAAA;IACrB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CACxD,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EACzD,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAC5B,CAAA;QACD,UAAU,GAAG,EAAE,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChF,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAA;IAChG,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,12 @@
 import type { PluginRegistrationContext } from "@meridianjs/types";
 export { transferProjectWorkflow } from "./workflows/transfer-project.js";
 export type { TransferProjectInput } from "./workflows/transfer-project.js";
+export { createIssueWorkflow } from "./workflows/create-issue.js";
+export type { CreateIssueInput } from "./workflows/create-issue.js";
+export { updateIssueStatusWorkflow } from "./workflows/update-issue-status.js";
+export { assignIssueWorkflow } from "./workflows/assign-issue.js";
+export { hasProjectAccess, isGlobalAdmin } from "./api/utils/project-access.js";
+export { getAccessibleWorkspaceIds } from "./api/utils/workspace-access.js";
 /**
  * Tells the Meridian plugin loader where to find this package's
  * api/, links/, subscribers/, and jobs/ directories.