@nextsparkjs/core 0.1.0-beta.83 → 0.1.0-beta.85

package/dist/templates/app/api/v1/teams/route.ts

@@ -0,0 +1,293 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { queryWithRLS, getTransactionClient, queryRows } from '@nextsparkjs/core/lib/db'
+import {
+  createApiResponse,
+  createApiError,
+  createPaginationMeta,
+  withApiLogging,
+  handleCorsPreflightRequest,
+  addCorsHeaders,
+} from '@nextsparkjs/core/lib/api/helpers'
+import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { isSuperAdmin } from '@nextsparkjs/core/lib/api/auth/permissions'
+import { createTeamSchema, teamListQuerySchema } from '@nextsparkjs/core/lib/teams/schema'
+import { TeamService } from '@nextsparkjs/core/lib/services'
+import type { Team } from '@nextsparkjs/core/lib/teams/types'
+import { APP_CONFIG_MERGED } from '@nextsparkjs/core/lib/config/config-sync'
+
+// Handle CORS preflight
+export async function OPTIONS(req: NextRequest) {
+  return handleCorsPreflightRequest(req)
+}
+
+// GET /api/v1/teams - List user's teams
+export const GET = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+  try {
+    // Authenticate using dual auth
+    const authResult = await authenticateRequest(req)
+
+    if (!authResult.success) {
+      return NextResponse.json(
+        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
+        { status: 401 }
+      )
+    }
+
+    if (authResult.rateLimitResponse) {
+      return authResult.rateLimitResponse as NextResponse
+    }
+
+    // Parse query parameters (filter out null values so Zod defaults work)
+    const { searchParams } = new URL(req.url)
+    const queryParams = Object.fromEntries(
+      Object.entries({
+        page: searchParams.get('page'),
+        limit: searchParams.get('limit'),
+        search: searchParams.get('search'),
+        sort: searchParams.get('sort'),
+        order: searchParams.get('order'),
+        scope: searchParams.get('scope'),
+      }).filter(([, value]) => value !== null && value !== '')
+    )
+
+    const validatedQuery = teamListQuerySchema.parse(queryParams)
+    const { page, limit, search, sort, order, scope } = validatedQuery
+    const offset = (page - 1) * limit
+
+    // Check if scope=all is requested (requires superadmin)
+    const requestAllTeams = scope === 'all'
+    if (requestAllTeams && !isSuperAdmin(authResult)) {
+      const response = createApiError(
+        'Insufficient permissions. Superadmin access required for scope=all.',
+        403
+      )
+      return addCorsHeaders(response, req)
+    }
+
+    // Build WHERE clause based on filters
+    // If scope=all (superadmin), don't filter by user
+    let whereClause = requestAllTeams ? 'WHERE 1=1' : 'WHERE tm."userId" = $1'
+    const queryValues: unknown[] = requestAllTeams ? [] : [authResult.user!.id]
+    let paramCount = requestAllTeams ? 1 : 2
+
+    if (search) {
+      whereClause += ` AND (t.name ILIKE $${paramCount} OR t.description ILIKE $${paramCount})`
+      queryValues.push(`%${search}%`)
+      paramCount++
+    }
+
+    // Build ORDER BY clause
+    const orderByMap: Record<string, string> = {
+      createdAt: 't."createdAt"',
+      updatedAt: 't."updatedAt"',
+      name: 't.name',
+    }
+    const orderByClause = `${orderByMap[sort]} ${order.toUpperCase()}`
+
+    // Add pagination params
+    queryValues.push(limit, offset)
+
+    let teams: (Team & { userRole: string | null; memberCount: string })[]
+    let totalResult: { count: string }[]
+
+    if (requestAllTeams) {
+      // Superadmin query: get all teams without user membership filter
+      teams = await queryRows<Team & { userRole: string | null; memberCount: string }>(
+        `SELECT
+          t.*,
+          NULL as "userRole",
+          COUNT(DISTINCT tm.id) as "memberCount"
+        FROM "teams" t
+        LEFT JOIN "team_members" tm ON t.id = tm."teamId"
+        ${whereClause}
+        GROUP BY t.id, t.name, t.slug, t.description, t."ownerId", t."avatarUrl",
+                 t.settings, t."createdAt", t."updatedAt"
+        ORDER BY ${orderByClause}
+        LIMIT $${paramCount++} OFFSET $${paramCount++}`,
+        queryValues
+      )
+
+      // Get total count for pagination (superadmin)
+      totalResult = await queryRows<{ count: string }>(
+        `SELECT COUNT(DISTINCT t.id) as count
+         FROM "teams" t
+         ${whereClause}`,
+        queryValues.slice(0, -2) // Remove limit and offset
+      )
+    } else {
+      // Regular user query: filter by membership
+      teams = await queryWithRLS<Team & { userRole: string; memberCount: string }>(
+        `SELECT
+          t.*,
+          tm.role as "userRole",
+          COUNT(DISTINCT tm2.id) as "memberCount"
+        FROM "teams" t
+        INNER JOIN "team_members" tm ON t.id = tm."teamId"
+        LEFT JOIN "team_members" tm2 ON t.id = tm2."teamId"
+        ${whereClause}
+        GROUP BY t.id, t.name, t.slug, t.description, t."ownerId", t."avatarUrl",
+                 t.settings, t."createdAt", t."updatedAt", tm.role
+        ORDER BY ${orderByClause}
+        LIMIT $${paramCount++} OFFSET $${paramCount++}`,
+        queryValues,
+        authResult.user!.id
+      )
+
+      // Get total count for pagination (regular user)
+      totalResult = await queryWithRLS<{ count: string }>(
+        `SELECT COUNT(DISTINCT t.id) as count
+         FROM "teams" t
+         INNER JOIN "team_members" tm ON t.id = tm."teamId"
+         ${whereClause}`,
+        queryValues.slice(0, -2), // Remove limit and offset
+        authResult.user!.id
+      )
+    }
+
+    const total = parseInt(totalResult[0]?.count || '0', 10)
+    const paginationMeta = createPaginationMeta(page, limit, total)
+
+    // Transform data
+    const teamsWithMembers = teams.map((team) => ({
+      ...team,
+      memberCount: parseInt(team.memberCount, 10),
+    }))
+
+    const response = createApiResponse(teamsWithMembers, paginationMeta)
+    return addCorsHeaders(response, req)
+  } catch (error) {
+    console.error('Error fetching teams:', error)
+    const response = createApiError('Internal server error', 500)
+    return addCorsHeaders(response, req)
+  }
+})
+
+// POST /api/v1/teams - Create new team
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+  try {
+    // Authenticate using dual auth
+    const authResult = await authenticateRequest(req)
+
+    if (!authResult.success) {
+      return NextResponse.json(
+        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
+        { status: 401 }
+      )
+    }
+
+    if (authResult.rateLimitResponse) {
+      return authResult.rateLimitResponse as NextResponse
+    }
+
+    const body = await req.json()
+    const validatedData = createTeamSchema.parse(body)
+
+    const { mode, options } = APP_CONFIG_MERGED.teams
+    const userId = authResult.user!.id
+
+    // Validate if the mode allows creating teams
+    if (mode !== 'multi-tenant') {
+      const response = createApiError(
+        'Team creation is not allowed in this mode',
+        403,
+        null,
+        'TEAM_CREATION_DISABLED'
+      )
+      return addCorsHeaders(response, req)
+    }
+
+    // Validate allowCreateTeams option
+    const allowCreateTeams = options?.allowCreateTeams ?? true
+    if (!allowCreateTeams) {
+      // Check if user is already owner of any team
+      const ownedTeams = await queryWithRLS<{ count: string }>(
+        `SELECT COUNT(*) as count FROM "team_members"
+         WHERE "userId" = $1 AND role = 'owner'`,
+        [userId],
+        userId
+      )
+
+      if (parseInt(ownedTeams[0]?.count || '0', 10) > 0) {
+        const response = createApiError(
+          'You are already owner of a team. Creating additional teams is not allowed.',
+          403,
+          null,
+          'MAX_TEAMS_REACHED'
+        )
+        return addCorsHeaders(response, req)
+      }
+    }
+
+    // Check if slug is available
+    const slugAvailable = await TeamService.isSlugAvailable(validatedData.slug)
+    if (!slugAvailable) {
+      const response = createApiError('Team slug already exists', 409, null, 'SLUG_EXISTS')
+      return addCorsHeaders(response, req)
+    }
+
+    // Use transaction to ensure atomicity
+    const tx = await getTransactionClient(userId)
+
+    try {
+      // Create team WITHOUT type column
+      const [team] = await tx.query<Team>(
+        `INSERT INTO "teams" (name, slug, description, "ownerId")
+         VALUES ($1, $2, $3, $4)
+         RETURNING *`,
+        [
+          validatedData.name,
+          validatedData.slug,
+          validatedData.description || null,
+          userId,
+        ]
+      )
+
+      if (!team) {
+        throw new Error('Failed to create team')
+      }
+
+      // Add creator as owner
+      await tx.query(
+        `INSERT INTO "team_members" ("teamId", "userId", role, "joinedAt")
+         VALUES ($1, $2, 'owner', NOW())`,
+        [team.id, authResult.user!.id]
+      )
+
+      await tx.commit()
+
+      // Fetch team with member count
+      const teamWithCount = await queryWithRLS<Team & { memberCount: string }>(
+        `SELECT
+          t.*,
+          COUNT(DISTINCT tm.id) as "memberCount"
+        FROM "teams" t
+        LEFT JOIN "team_members" tm ON t.id = tm."teamId"
+        WHERE t.id = $1
+        GROUP BY t.id`,
+        [team.id],
+        authResult.user!.id
+      )
+
+      const responseData = {
+        ...teamWithCount[0],
+        memberCount: parseInt(teamWithCount[0]?.memberCount || '1', 10),
+      }
+
+      const response = createApiResponse(responseData, { created: true }, 201)
+      return addCorsHeaders(response, req)
+    } catch (error) {
+      await tx.rollback()
+      throw error
+    }
+  } catch (error) {
+    if (error instanceof Error && error.name === 'ZodError') {
+      const zodError = error as { issues?: unknown[] }
+      const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
+      return addCorsHeaders(response, req)
+    }
+
+    console.error('Error creating team:', error)
+    const response = createApiError('Internal server error', 500)
+    return addCorsHeaders(response, req)
+  }
+})

package/dist/templates/app/api/v1/teams/switch/route.ts

@@ -0,0 +1,88 @@
+import { NextRequest, NextResponse } from 'next/server'
+import {
+  createApiResponse,
+  createApiError,
+  withApiLogging,
+  handleCorsPreflightRequest,
+  addCorsHeaders,
+} from '@nextsparkjs/core/lib/api/helpers'
+import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { TeamService } from '@nextsparkjs/core/lib/services'
+import { z } from 'zod'
+
+const switchTeamSchema = z.object({
+  teamId: z.string().min(1, 'Team ID is required'),
+})
+
+// Handle CORS preflight
+export async function OPTIONS() {
+  return handleCorsPreflightRequest()
+}
+
+// POST /api/v1/teams/switch - Switch active team context
+export const POST = withApiLogging(async (req: NextRequest): Promise<NextResponse> => {
+  try {
+    // Authenticate using dual auth
+    const authResult = await authenticateRequest(req)
+
+    if (!authResult.success) {
+      return NextResponse.json(
+        { success: false, error: 'Authentication required', code: 'AUTHENTICATION_FAILED' },
+        { status: 401 }
+      )
+    }
+
+    if (authResult.rateLimitResponse) {
+      return authResult.rateLimitResponse as NextResponse
+    }
+
+    const body = await req.json()
+    const validatedData = switchTeamSchema.parse(body)
+
+    try {
+      // Use the TeamService.switchActive (verifies membership)
+      await TeamService.switchActive(authResult.user!.id, validatedData.teamId)
+
+      const response = createApiResponse({
+        success: true,
+        teamId: validatedData.teamId,
+        message: 'Active team switched successfully',
+      })
+
+      // Set cookie for server-side access (layouts, server components)
+      // This enables permission validation in [entity]/layout.tsx
+      // SECURITY: httpOnly prevents client-side JS manipulation
+      response.cookies.set('activeTeamId', validatedData.teamId, {
+        path: '/',
+        httpOnly: true,  // Security: prevent client-side manipulation
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: 60 * 60 * 24 * 365  // 1 year
+      })
+
+      return addCorsHeaders(response)
+    } catch (error) {
+      if (error instanceof Error && error.message === 'User is not a member of this team') {
+        const response = createApiError(
+          'You are not a member of this team',
+          403,
+          null,
+          'NOT_TEAM_MEMBER'
+        )
+        return addCorsHeaders(response)
+      }
+
+      throw error
+    }
+  } catch (error) {
+    if (error instanceof Error && error.name === 'ZodError') {
+      const zodError = error as { issues?: unknown[] }
+      const response = createApiError('Validation error', 400, zodError.issues, 'VALIDATION_ERROR')
+      return addCorsHeaders(response)
+    }
+
+    console.error('Error switching team:', error)
+    const response = createApiError('Internal server error', 500)
+    return addCorsHeaders(response)
+  }
+})