@nuxt-customer-portal/clients 0.3.3 → 0.4.0

package/server/api/admin/private-client-invitations/index.post.ts

@@ -0,0 +1,137 @@
+import { privateClientInvitationSchema } from '../../../../shared/private-client-invitation'
+import { and, eq, gt, sql } from 'drizzle-orm'
+import { db, requireSession } from '@nuxt-customer-portal/core/server/portal'
+import { invitation, member, user } from '@nuxt-customer-portal/core/schema'
+import { sendEmail } from '@nuxt-customer-portal/core/server/utils/email'
+import { getPersonalAccountInvitationEmailContent } from '@nuxt-customer-portal/core/server/utils/email-texts'
+import { clientProfile } from '../../../db/schema/clients'
+import { getClientConfiguration } from '../../../utils/client-configuration'
+import { createClientInTransaction, getClient } from '../../../utils/client-repository'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  if (session.user.role !== 'admin') {
+    throw createError({ statusCode: 403 })
+  }
+  const parsed = privateClientInvitationSchema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid invitation details' })
+  }
+  const input = parsed.data
+  const result = await db.transaction(async (tx) => {
+    await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('portal-client-configuration'))`)
+    const config = await getClientConfiguration()
+    if (!config.allowedTypes.includes('person')) {
+      throw createError({ statusCode: 403, message: 'Private clients are disabled' })
+    }
+    const [retry] = await tx.select().from(invitation).where(eq(invitation.id, input.requestId))
+    if (retry) {
+      if (
+        retry.inviterId !== session.user.id ||
+        retry.email !== input.email ||
+        (input.clientId && retry.organizationId !== input.clientId)
+      ) {
+        throw createError({ statusCode: 409, message: 'Invitation request already used' })
+      }
+      return { invitation: retry, created: false }
+    }
+    const [personalOwner] = await tx
+      .select({ id: member.id })
+      .from(user)
+      .innerJoin(member, eq(member.userId, user.id))
+      .innerJoin(clientProfile, eq(clientProfile.organizationId, member.organizationId))
+      .where(and(sql`lower(${user.email}) = ${input.email}`, eq(clientProfile.clientType, 'person')))
+      .limit(1)
+    if (personalOwner) {
+      throw createError({ statusCode: 409, message: 'This user already has a private client account' })
+    }
+    const [pendingForEmail] = await tx
+      .select({ id: invitation.id })
+      .from(invitation)
+      .innerJoin(clientProfile, eq(clientProfile.organizationId, invitation.organizationId))
+      .where(
+        and(
+          sql`lower(${invitation.email}) = ${input.email}`,
+          eq(invitation.status, 'pending'),
+          gt(invitation.expiresAt, new Date()),
+          eq(clientProfile.clientType, 'person')
+        )
+      )
+      .limit(1)
+    if (pendingForEmail) {
+      throw createError({
+        statusCode: 409,
+        message:
+          'A private-client invitation is already pending for this email. Revoke it from Pending invitations before inviting the existing private client again.'
+      })
+    }
+    let clientId = input.clientId
+    if (clientId) {
+      const [profile] = await tx.select().from(clientProfile).where(eq(clientProfile.organizationId, clientId))
+      const [linked] = await tx
+        .select({ id: member.id })
+        .from(member)
+        .where(eq(member.organizationId, clientId))
+        .limit(1)
+      const [pending] = await tx
+        .select({ id: invitation.id })
+        .from(invitation)
+        .where(
+          and(
+            eq(invitation.organizationId, clientId),
+            eq(invitation.status, 'pending'),
+            gt(invitation.expiresAt, new Date())
+          )
+        )
+        .limit(1)
+      if (!profile || profile.clientType !== 'person' || profile.archivedAt || linked || pending) {
+        throw createError({
+          statusCode: 409,
+          message: 'Choose an active private client without a linked user or pending invitation'
+        })
+      }
+    } else {
+      const [firstName, ...lastNameParts] = input.name!.trim().split(/\s+/)
+      clientId = await createClientInTransaction(tx, session.user.id, {
+        clientType: 'person',
+        name: input.name!,
+        firstName: firstName!,
+        lastName: lastNameParts.join(' ') || firstName!,
+        invoiceEmail: input.email,
+        address: '',
+        preferredLocale: input.preferredLocale,
+        timezone: null,
+        moduleIds: config.defaultModules ?? []
+      })
+    }
+    const [created] = await tx
+      .insert(invitation)
+      .values({
+        id: input.requestId,
+        organizationId: clientId,
+        email: input.email,
+        inviterId: session.user.id,
+        role: 'owner',
+        status: 'pending',
+        expiresAt: new Date(Date.now() + 2 * 24 * 60 * 60 * 1000)
+      })
+      .returning()
+    return { invitation: created!, created: true }
+  })
+  if (result.created) {
+    const client = await getClient(result.invitation.organizationId)
+    const baseURL = process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3000'
+    try {
+      await sendEmail({
+        to: input.email,
+        ...getPersonalAccountInvitationEmailContent({
+          recipientName: client?.firstName || client?.name,
+          invitationLink: `${baseURL}/signup?invitationId=${result.invitation.id}`
+        })
+      })
+    } catch {
+      return { invitationId: result.invitation.id, deliveryFailed: true }
+    }
+  }
+  return { invitationId: result.invitation.id, deliveryFailed: false }
+})

package/server/api/client-account.get.ts

@@ -0,0 +1,12 @@
+import { and, eq } from 'drizzle-orm'
+import { requireSession, db } from '@nuxt-customer-portal/core/server/portal'
+import { member } from '@nuxt-customer-portal/core/schema'
+import { clientProfile } from '../db/schema/clients'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  return db
+    .select({ organizationId: clientProfile.organizationId, clientType: clientProfile.clientType })
+    .from(clientProfile)
+    .innerJoin(member, and(eq(member.organizationId, clientProfile.organizationId), eq(member.userId, session.user.id)))
+})

package/server/api/clients/[id]/index.patch.ts

@@ -5,6 +5,10 @@ import { clientUpdateSchema } from '@nuxt-customer-portal/clients/server/utils/c
 export default defineEventHandler(async (event) => {
   const id = getRouterParam(event, 'id')!
   await requireClientProfileManager(event, id)
-  await updateClient(id, clientUpdateSchema.parse(await readBody(event)))
+  const parsed = clientUpdateSchema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid client details', data: { issues: parsed.error.issues } })
+  }
+  await updateClient(id, parsed.data)
   return getClient(id)
 })

package/server/api/clients/[id]/invitations/[invitationId]/resend.post.ts

@@ -0,0 +1,78 @@
+import { and, eq } from 'drizzle-orm'
+import { db } from '@nuxt-customer-portal/core/server/portal'
+import { invitation, organization, user } from '@nuxt-customer-portal/core/schema'
+import { sendEmail } from '@nuxt-customer-portal/core/server/utils/email'
+import {
+  getInvitationEmailContent,
+  getPersonalAccountInvitationEmailContent
+} from '@nuxt-customer-portal/core/server/utils/email-texts'
+import { requireClientMemberManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
+import { clientProfile } from '@nuxt-customer-portal/clients/server/db/schema/clients'
+
+export default defineEventHandler(async (event) => {
+  const organizationId = getRouterParam(event, 'id')!
+  const invitationId = getRouterParam(event, 'invitationId')!
+  await requireClientMemberManager(event, organizationId)
+
+  const [pending] = await db
+    .select({
+      id: invitation.id,
+      email: invitation.email,
+      role: invitation.role,
+      organizationName: organization.name,
+      inviterName: user.name,
+      inviterEmail: user.email,
+      clientType: clientProfile.clientType,
+      firstName: clientProfile.firstName,
+      preferredLocale: clientProfile.preferredLocale
+    })
+    .from(invitation)
+    .innerJoin(organization, eq(organization.id, invitation.organizationId))
+    .innerJoin(user, eq(user.id, invitation.inviterId))
+    .leftJoin(clientProfile, eq(clientProfile.organizationId, invitation.organizationId))
+    .where(
+      and(
+        eq(invitation.id, invitationId),
+        eq(invitation.organizationId, organizationId),
+        eq(invitation.status, 'pending')
+      )
+    )
+    .limit(1)
+
+  if (!pending) {
+    throw createError({ statusCode: 409, message: 'Invitation is no longer pending' })
+  }
+
+  const expiresAt = new Date(Date.now() + 2 * 24 * 60 * 60 * 1000)
+  await db
+    .update(invitation)
+    .set({ expiresAt })
+    .where(
+      and(
+        eq(invitation.id, invitationId),
+        eq(invitation.organizationId, organizationId),
+        eq(invitation.status, 'pending')
+      )
+    )
+
+  const baseURL = process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3000'
+  const invitationLink = `${baseURL}/signup?invitationId=${invitationId}`
+  await sendEmail({
+    to: pending.email,
+    locale: pending.preferredLocale ?? undefined,
+    ...(pending.clientType === 'person'
+      ? getPersonalAccountInvitationEmailContent({
+          invitationLink,
+          recipientName: pending.firstName || pending.organizationName
+        })
+      : getInvitationEmailContent({
+          inviterName: pending.inviterName || '',
+          inviterEmail: pending.inviterEmail,
+          organizationName: pending.organizationName,
+          role: pending.role || 'member',
+          invitationLink
+        }))
+  })
+
+  return { success: true, expiresAt }
+})

package/server/api/clients/[id]/invitations/[invitationId].patch.ts

@@ -1,8 +1,8 @@
 import { changePendingInvitation } from '@nuxt-customer-portal/core/server/utils/invitation-management'
-import { requireClientProfileManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
+import { requireClientMemberManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
 
 export default defineEventHandler(async (event) => {
   const organizationId = getRouterParam(event, 'id')!
-  await requireClientProfileManager(event, organizationId)
+  await requireClientMemberManager(event, organizationId)
   return changePendingInvitation(organizationId, getRouterParam(event, 'invitationId')!, await readBody(event))
 })

package/server/api/clients/[id]/invitations/index.post.ts

@@ -1,20 +1,37 @@
+import { isPersonalClient } from '@nuxt-customer-portal/core/server/utils/client-account-policy'
 import { and, eq } from 'drizzle-orm'
 import { db } from '@nuxt-customer-portal/core/server/portal'
 import { generateId } from '@nuxt-customer-portal/core/server/utils/auth'
-import { invitation, organization } from '@nuxt-customer-portal/core/schema'
+import { invitation, organization, member } from '@nuxt-customer-portal/core/schema'
 import { sendEmail } from '@nuxt-customer-portal/core/server/utils/email'
-import { getInvitationEmailContent } from '@nuxt-customer-portal/core/server/utils/email-texts'
-import { requireClientProfileManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
+import {
+  getInvitationEmailContent,
+  getPersonalAccountInvitationEmailContent
+} from '@nuxt-customer-portal/core/server/utils/email-texts'
+import { requireClientMemberManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
 import { genericClientInvitationSchema } from '@nuxt-customer-portal/clients/server/utils/client-validation'
+import { clientProfile } from '@nuxt-customer-portal/clients/server/db/schema/clients'
 
 export default defineEventHandler(async (event) => {
   const organizationId = getRouterParam(event, 'id')!
-  const context = await requireClientProfileManager(event, organizationId)
+  const context = await requireClientMemberManager(event, organizationId)
   const parsedInput = genericClientInvitationSchema.safeParse(await readBody(event))
   if (!parsedInput.success) {
     throw createError({ statusCode: 400, message: 'A valid email address and role are required' })
   }
   const input = parsedInput.data
+  const personalClient = await isPersonalClient(organizationId)
+  if (personalClient) {
+    input.role = 'owner'
+    const existing = await db
+      .select({ id: member.id })
+      .from(member)
+      .where(eq(member.organizationId, organizationId))
+      .limit(1)
+    if (existing.length) {
+      throw createError({ statusCode: 409, message: 'Personal client already has an account' })
+    }
+  }
   const [pending] = await db
     .select({ id: invitation.id })
     .from(invitation)
@@ -30,8 +47,9 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 409, message: 'A pending invitation already exists' })
   }
   const [client] = await db
-    .select({ name: organization.name })
+    .select({ name: organization.name, firstName: clientProfile.firstName })
     .from(organization)
+    .leftJoin(clientProfile, eq(clientProfile.organizationId, organization.id))
     .where(and(eq(organization.id, organizationId), eq(organization.organizationType, 'CLIENT')))
     .limit(1)
   if (!client) {
@@ -54,13 +72,18 @@ export default defineEventHandler(async (event) => {
   const baseURL = process.env.BETTER_AUTH_URL || process.env.PUBLIC_URL || 'http://localhost:3000'
   await sendEmail({
     to: input.email,
-    ...getInvitationEmailContent({
-      inviterName: context.session.user.name || '',
-      inviterEmail: context.session.user.email ?? '',
-      organizationName: client.name,
-      role: input.role,
-      invitationLink: `${baseURL}/signup?invitationId=${id}`
-    })
+    ...(personalClient
+      ? getPersonalAccountInvitationEmailContent({
+          recipientName: client.firstName || client.name,
+          invitationLink: `${baseURL}/signup?invitationId=${id}`
+        })
+      : getInvitationEmailContent({
+          inviterName: context.session.user.name || '',
+          inviterEmail: context.session.user.email ?? '',
+          organizationName: client.name,
+          role: input.role,
+          invitationLink: `${baseURL}/signup?invitationId=${id}`
+        }))
   })
   return created
 })

package/server/api/clients/[id]/members/[memberId].delete.ts

@@ -1,11 +1,11 @@
 import { and, count, eq } from 'drizzle-orm'
 import { db } from '@nuxt-customer-portal/core/server/portal'
 import { member } from '@nuxt-customer-portal/core/schema'
-import { requireClientProfileManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
+import { requireClientMemberManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
 
 export default defineEventHandler(async (event) => {
   const organizationId = getRouterParam(event, 'id')!
-  await requireClientProfileManager(event, organizationId)
+  await requireClientMemberManager(event, organizationId)
   const memberId = getRouterParam(event, 'memberId')!
   const [selected] = await db
     .select({ role: member.role })

package/server/api/clients/[id]/members/[memberId].patch.ts

@@ -1,12 +1,16 @@
+import { isPersonalClient } from '@nuxt-customer-portal/core/server/utils/client-account-policy'
 import { and, eq } from 'drizzle-orm'
 import { db } from '@nuxt-customer-portal/core/server/portal'
 import { member } from '@nuxt-customer-portal/core/schema'
-import { requireClientProfileManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
+import { requireClientMemberManager } from '@nuxt-customer-portal/clients/server/utils/client-access'
 import { genericClientMemberUpdateSchema } from '@nuxt-customer-portal/clients/server/utils/client-validation'
 
 export default defineEventHandler(async (event) => {
   const organizationId = getRouterParam(event, 'id')!
-  await requireClientProfileManager(event, organizationId)
+  await requireClientMemberManager(event, organizationId)
+  if (await isPersonalClient(organizationId)) {
+    throw createError({ statusCode: 403, message: 'Personal membership roles cannot be changed' })
+  }
   const input = genericClientMemberUpdateSchema.parse(await readBody(event))
   const [updated] = await db
     .update(member)

package/server/api/clients/index.post.ts

@@ -4,7 +4,11 @@ import { genericClientCreateSchema } from '@nuxt-customer-portal/clients/server/
 
 export default defineEventHandler(async (event) => {
   const { session } = await requireOwnerClientManager(event)
-  const input = genericClientCreateSchema.parse(await readBody(event))
+  const parsed = genericClientCreateSchema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid client details', data: { issues: parsed.error.issues } })
+  }
+  const input = parsed.data
   const organizationId = await createClient(session.user.id, input)
   return getClient(organizationId)
 })

package/server/api/personal-client/address.get.ts

@@ -0,0 +1,15 @@
+import { and, eq } from 'drizzle-orm'
+import { requireSession, db } from '@nuxt-customer-portal/core/server/portal'
+import { member } from '@nuxt-customer-portal/core/schema'
+import { clientProfile } from '../../db/schema/clients'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  const [client] = await db
+    .select({ address: clientProfile.address, archived: clientProfile.archivedAt })
+    .from(clientProfile)
+    .innerJoin(member, eq(member.organizationId, clientProfile.organizationId))
+    .where(and(eq(member.userId, session.user.id), eq(clientProfile.clientType, 'person')))
+    .limit(1)
+  return client ? { address: client.address, archived: Boolean(client.archived) } : null
+})

package/server/api/personal-client/address.patch.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod'
+import { and, eq, inArray, isNull } from 'drizzle-orm'
+import { requireSession, db } from '@nuxt-customer-portal/core/server/portal'
+import { member } from '@nuxt-customer-portal/core/schema'
+import { clientProfile } from '../../db/schema/clients'
+
+const schema = z.object({ address: z.string().trim().max(1000) }).strict()
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  const parsed = schema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid address', data: { issues: parsed.error.issues } })
+  }
+  const [client] = await db
+    .update(clientProfile)
+    .set({ address: parsed.data.address, updatedAt: new Date() })
+    .where(
+      and(
+        eq(clientProfile.clientType, 'person'),
+        isNull(clientProfile.archivedAt),
+        inArray(
+          clientProfile.organizationId,
+          db.select({ id: member.organizationId }).from(member).where(eq(member.userId, session.user.id))
+        )
+      )
+    )
+    .returning({ address: clientProfile.address })
+  if (!client) {
+    throw createError({ statusCode: 404, message: 'No active personal client account' })
+  }
+  return { address: client.address, archived: false }
+})

package/server/api/personal-client.get.ts

@@ -0,0 +1,43 @@
+import { and, eq, gt, sql } from 'drizzle-orm'
+import { requireSession, db } from '@nuxt-customer-portal/core/server/portal'
+import { user, member, invitation } from '@nuxt-customer-portal/core/schema'
+import { getClientConfiguration } from '../utils/client-configuration'
+import { needsPersonalOnboarding } from '../../shared/personal-onboarding'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  const config = await getClientConfiguration()
+  if (!config.personalSelfRegistration) {
+    return { onboardingRequired: false }
+  }
+  const [account] = await db
+    .select({ email: user.email, emailVerified: user.emailVerified })
+    .from(user)
+    .where(eq(user.id, session.user.id))
+    .limit(1)
+  if (!account) {
+    throw createError({ statusCode: 401 })
+  }
+  const [memberships, invitations] = await Promise.all([
+    db.select({ id: member.id }).from(member).where(eq(member.userId, session.user.id)).limit(1),
+    db
+      .select({ id: invitation.id })
+      .from(invitation)
+      .where(
+        and(
+          sql`lower(${invitation.email}) = lower(${account.email})`,
+          eq(invitation.status, 'pending'),
+          gt(invitation.expiresAt, new Date())
+        )
+      )
+      .limit(1)
+  ])
+  return {
+    onboardingRequired: needsPersonalOnboarding({
+      enabled: true,
+      emailVerified: account.emailVerified,
+      membershipCount: memberships.length,
+      hasPendingInvitation: invitations.length > 0
+    })
+  }
+})

package/server/api/personal-client.post.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod'
+import { eq, and, sql } from 'drizzle-orm'
+import { nanoid } from 'nanoid'
+import { requireSession, db } from '@nuxt-customer-portal/core/server/portal'
+import { member, user } from '@nuxt-customer-portal/core/schema'
+import { timezoneSchema } from '@nuxt-customer-portal/core/server/utils/timezone-validation'
+import { clientProfile } from '../db/schema/clients'
+import { getClientConfiguration } from '../utils/client-configuration'
+import { createClientInTransaction, getClient } from '../utils/client-repository'
+
+const schema = z.object({
+  firstName: z.string().trim().min(1).max(80),
+  lastName: z.string().trim().min(1).max(80),
+  preferredLocale: z.enum(['nl', 'en']),
+  timezone: timezoneSchema.nullable()
+})
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  const config = await getClientConfiguration()
+  if (!config.personalSelfRegistration || !config.allowedTypes.includes('person')) {
+    throw createError({ statusCode: 403, message: 'Personal registration is disabled' })
+  }
+  const parsed = schema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid client details', data: { issues: parsed.error.issues } })
+  }
+  const input = parsed.data
+  const id = await db
+    .transaction(async (tx) => {
+      await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('portal-client-configuration'))`)
+      if (!(await getClientConfiguration()).personalSelfRegistration) {
+        throw createError({ statusCode: 403, message: 'Personal registration is disabled' })
+      }
+      // Per-user lock makes retries and concurrent onboarding idempotent.
+      await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${session.user.id}))`)
+      const [account] = await tx.select().from(user).where(eq(user.id, session.user.id)).limit(1)
+      if (!account?.emailVerified) {
+        throw createError({ statusCode: 403, message: 'Verify your email first' })
+      }
+      const [existing] = await tx
+        .select({ id: member.organizationId })
+        .from(member)
+        .innerJoin(clientProfile, eq(clientProfile.organizationId, member.organizationId))
+        .where(and(eq(member.userId, account.id), eq(clientProfile.clientType, 'person')))
+        .limit(1)
+      if (existing) {
+        return existing.id
+      }
+      const id = await createClientInTransaction(tx, account.id, {
+        ...input,
+        name: account.name || `${input.firstName} ${input.lastName}`,
+        clientType: 'person',
+        address: '',
+        invoiceEmail: account.email,
+        moduleIds: config.defaultModules ?? []
+      })
+      await tx
+        .insert(member)
+        .values({ id: nanoid(), organizationId: id, userId: account.id, role: 'owner', createdAt: new Date() })
+      await tx
+        .update(user)
+        .set({
+          timezone: input.timezone,
+          firstName: input.firstName,
+          lastName: input.lastName
+        })
+        .where(eq(user.id, account.id))
+      return id
+    })
+    .catch((error: { code?: string; cause?: { code?: string } }) => {
+      if (error.code === '23505' || error.cause?.code === '23505') {
+        throw createError({ statusCode: 409, message: 'Personal account already exists. Contact your coach.' })
+      }
+      throw error
+    })
+  return getClient(id)
+})

package/server/db/schema/clients.ts

@@ -1,5 +1,6 @@
-import { boolean, index, pgSchema, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core'
-import { organization, user } from '@nuxt-customer-portal/core/schema'
+import { sql } from 'drizzle-orm'
+import { boolean, check, index, pgSchema, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core'
+import { organization, user, member } from '@nuxt-customer-portal/core/schema'
 
 export const clientsSchema = pgSchema('clients')
 
@@ -17,6 +18,10 @@ export const clientProfile = clientsSchema.table(
     organizationId: text('organization_id')
       .primaryKey()
       .references(() => organization.id, { onDelete: 'restrict' }),
+    clientType: text('client_type').$type<'organization' | 'person'>().default('organization').notNull(),
+    firstName: text('first_name'),
+    lastName: text('last_name'),
+    timezone: text('timezone'),
     officialName: text('official_name').notNull(),
     address: text('address').default('').notNull(),
     registrationNumber: text('registration_number'),
@@ -27,7 +32,14 @@ export const clientProfile = clientsSchema.table(
     archivedById: text('archived_by_id').references(() => user.id, { onDelete: 'set null' }),
     ...auditColumns
   },
-  (table) => [index('client_profile_archived_idx').on(table.archivedAt)]
+  (table) => [
+    index('client_profile_archived_idx').on(table.archivedAt),
+    check('client_profile_client_type_check', sql`${table.clientType} IN ('organization', 'person')`),
+    check(
+      'person_no_company_fields',
+      sql`${table.clientType} <> 'person' OR (${table.registrationNumber} IS NULL AND ${table.vatNumber} IS NULL)`
+    )
+  ]
 )
 
 export const clientModule = clientsSchema.table(
@@ -53,3 +65,17 @@ export const clientModule = clientsSchema.table(
 
 export type ClientProfileRecord = typeof clientProfile.$inferSelect
 export type ClientModuleRecord = typeof clientModule.$inferSelect
+
+export const personalMembership = clientsSchema.table('personal_membership', {
+  organizationId: text('organization_id')
+    .primaryKey()
+    .references(() => clientProfile.organizationId, { onDelete: 'cascade' }),
+  userId: text('user_id')
+    .notNull()
+    .unique()
+    .references(() => user.id, { onDelete: 'cascade' }),
+  memberId: text('member_id')
+    .notNull()
+    .unique()
+    .references(() => member.id, { onDelete: 'cascade' })
+})

package/server/middleware/00-client-configuration.ts

@@ -0,0 +1,5 @@
+import { requireClientConfigurationReady } from '../utils/client-configuration'
+
+export default defineEventHandler(async () => {
+  await requireClientConfigurationReady()
+})