@nuxt-customer-portal/core 0.3.0

package/server/db/schema/auth-schema.ts

@@ -0,0 +1,198 @@
+// Core authentication and organization schema owned by portal core.
+
+import { sql } from 'drizzle-orm'
+import { pgTable, text, timestamp, boolean, check, index, uniqueIndex, jsonb } from 'drizzle-orm/pg-core'
+
+export const user = pgTable(
+  'user',
+  {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    email: text('email').notNull().unique(),
+    emailVerified: boolean('email_verified').default(false).notNull(),
+    image: text('image'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .defaultNow()
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    role: text('role').default('user').notNull(),
+    banned: boolean('banned').default(false),
+    banReason: text('ban_reason'),
+    banExpires: timestamp('ban_expires')
+  },
+  (table) => [index('user_name_idx').on(table.name), uniqueIndex('user_email_idx').on(table.email)]
+)
+
+export const session = pgTable(
+  'session',
+  {
+    id: text('id').primaryKey(),
+    expiresAt: timestamp('expires_at').notNull(),
+    token: text('token').notNull().unique(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    ipAddress: text('ip_address'),
+    userAgent: text('user_agent'),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    activeOrganizationId: text('active_organization_id'),
+    impersonatedBy: text('impersonated_by')
+  },
+  (table) => [
+    index('session_user_id_idx').on(table.userId),
+    index('session_active_organization_id_idx').on(table.activeOrganizationId)
+  ]
+)
+
+export const account = pgTable(
+  'account',
+  {
+    id: text('id').primaryKey(),
+    accountId: text('account_id').notNull(),
+    providerId: text('provider_id').notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    accessToken: text('access_token'),
+    refreshToken: text('refresh_token'),
+    idToken: text('id_token'),
+    accessTokenExpiresAt: timestamp('access_token_expires_at'),
+    refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
+    scope: text('scope'),
+    password: text('password'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull()
+  },
+  (table) => [
+    index('account_user_id_idx').on(table.userId),
+    index('account_account_id_idx').on(table.accountId),
+    index('account_provider_id_idx').on(table.providerId)
+  ]
+)
+
+export const verification = pgTable(
+  'verification',
+  {
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    value: text('value').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .defaultNow()
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull()
+  },
+  (table) => [
+    index('verification_identifier_idx').on(table.identifier),
+    index('verification_value_idx').on(table.value)
+  ]
+)
+
+export const organization = pgTable(
+  'organization',
+  {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    slug: text('slug').notNull().unique(),
+    logo: text('logo'),
+    createdAt: timestamp('created_at').notNull(),
+    metadata: text('metadata'),
+    organizationType: text('organization_type').notNull()
+  },
+  (table) => [
+    index('organization_slug_idx').on(table.slug),
+    check('organization_type_check', sql`${table.organizationType} IN ('PROVIDER', 'CLIENT')`),
+    uniqueIndex('organization_single_provider_uidx')
+      .on(table.organizationType)
+      .where(sql`${table.organizationType} = 'PROVIDER'`)
+  ]
+)
+
+export const member = pgTable(
+  'member',
+  {
+    id: text('id').primaryKey(),
+    organizationId: text('organization_id')
+      .notNull()
+      .references(() => organization.id, { onDelete: 'cascade' }),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    role: text('role').default('member').notNull(),
+    phone: text('phone'),
+    jobTitle: text('job_title'),
+    createdAt: timestamp('created_at').notNull()
+  },
+  (table) => [
+    index('member_organization_id_idx').on(table.organizationId),
+    index('member_user_id_idx').on(table.userId)
+  ]
+)
+
+export const portalEmailSettings = pgTable('portal_email_settings', {
+  id: boolean('id').primaryKey().default(true),
+  provider: text('provider').default('RESEND').notNull(),
+  encryptedApiKey: text('encrypted_api_key'),
+  keyFingerprint: text('key_fingerprint'),
+  keyLastFour: text('key_last_four'),
+  fromName: text('from_name'),
+  fromEmail: text('from_email'),
+  defaultLocale: text('default_locale').default('en').notNull(),
+  htmlTemplate: text('html_template'),
+  textOverrides: jsonb('text_overrides').$type<Record<string, unknown>>().default({}).notNull(),
+  configuredById: text('configured_by_id').references(() => user.id, { onDelete: 'set null' }),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at')
+    .defaultNow()
+    .$onUpdate(() => /* @__PURE__ */ new Date())
+    .notNull()
+})
+
+// Retained for one compatibility release. Runtime email delivery no longer reads this table.
+export const organizationEmailCredential = pgTable('organization_email_credential', {
+  organizationId: text('organization_id')
+    .primaryKey()
+    .references(() => organization.id, { onDelete: 'cascade' }),
+  provider: text('provider').default('RESEND').notNull(),
+  apiKey: text('api_key'),
+  keyFingerprint: text('key_fingerprint'),
+  keyLastFour: text('key_last_four'),
+  configuredById: text('configured_by_id').references(() => user.id, { onDelete: 'set null' }),
+  removedById: text('removed_by_id').references(() => user.id, { onDelete: 'set null' }),
+  removedAt: timestamp('removed_at'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at')
+    .defaultNow()
+    .$onUpdate(() => new Date())
+    .notNull()
+})
+
+export const invitation = pgTable(
+  'invitation',
+  {
+    id: text('id').primaryKey(),
+    organizationId: text('organization_id')
+      .notNull()
+      .references(() => organization.id, { onDelete: 'cascade' }),
+    email: text('email').notNull(),
+    role: text('role'),
+    status: text('status').default('pending').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    inviterId: text('inviter_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at').defaultNow().notNull()
+  },
+  (table) => [
+    index('invitation_organization_id_idx').on(table.organizationId),
+    index('invitation_inviter_id_idx').on(table.inviterId),
+    index('invitation_email_idx').on(table.email)
+  ]
+)

package/server/db/schema/index.ts

@@ -0,0 +1 @@
+export * from './auth-schema'

package/server/middleware/api-docs-auth.ts

@@ -0,0 +1,26 @@
+import { createError, defineEventHandler, setResponseHeader } from 'h3'
+import { auth } from '../utils/auth'
+
+const API_DOCS_PATH = '/api-docs'
+
+const isApiDocsRequest = (path: string): boolean => path === API_DOCS_PATH || path.startsWith(`${API_DOCS_PATH}/`)
+
+export default defineEventHandler(async (event) => {
+  if (!isApiDocsRequest(event.path)) {
+    return
+  }
+
+  setResponseHeader(event, 'Cache-Control', 'private, no-store')
+
+  const session = await auth.api.getSession({
+    headers: event.headers
+  })
+
+  if (!session?.user) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Unauthorized',
+      message: 'Authentication is required to access the API documentation'
+    })
+  }
+})

package/server/middleware/auth.ts

@@ -0,0 +1,61 @@
+import { defineEventHandler, type H3Event, createError } from 'h3'
+import { auth } from '../utils/auth'
+
+async function isAuthenticated(event: H3Event): Promise<boolean> {
+  const session = await auth.api.getSession({
+    headers: event.headers
+  })
+  if (!session) {
+    return false
+  }
+  return !!session.user
+}
+
+export default defineEventHandler(async (event) => {
+  const url = event.node.req.url
+
+  if (!url || !url.startsWith('/api/')) {
+    return
+  }
+  const unprotectedPaths = [
+    '/api/auth/',
+    '/api/_nuxt_icon',
+    '/api/health',
+    '/api/portal/bootstrap',
+    '/api/portal/public'
+  ]
+
+  const isUnprotected = unprotectedPaths.some((path) => url.startsWith(path))
+
+  if (isUnprotected) {
+    return
+  }
+
+  // Allow specific GET requests for single questionnaires
+  if (event.method === 'GET' && url.match(/^\/api\/questionnaires\/[^/]+$/)) {
+    return
+  }
+
+  // Allow POST (index), PUT (specific response), and GET (specific response) to questionnaire-responses for anonymous users
+  const isQuestionnaireResponseIndex = url === '/api/questionnaire-responses'
+  const isSpecificQuestionnaireResponse = url.startsWith('/api/questionnaire-responses/')
+
+  if (
+    (isQuestionnaireResponseIndex && event.method === 'POST') ||
+    (isSpecificQuestionnaireResponse && (event.method === 'PUT' || event.method === 'GET'))
+  ) {
+    return
+  }
+
+  const authenticated = await isAuthenticated(event)
+  if (authenticated) {
+    return
+  }
+
+  console.warn(`Unauthorized access attempt to: ${url}`)
+  throw createError({
+    statusCode: 401,
+    statusMessage: 'Unauthorized',
+    message: 'Authentication required'
+  })
+})

package/server/portal.ts

@@ -0,0 +1,212 @@
+import type { H3Event } from 'h3'
+import { and, asc, eq, ilike, inArray, ne } from 'drizzle-orm'
+import { nanoid } from 'nanoid'
+import type {
+  PortalFeaturePolicy,
+  PortalOrganizationRole,
+  PortalOrganizationType
+} from '@nuxt-customer-portal/core/shared/types/feature'
+import { isPortalActionAllowed } from '@nuxt-customer-portal/core/shared/feature-registry'
+import { getActiveOrganizationId, type PortalSession } from '@nuxt-customer-portal/core/shared/portal-session'
+import { member, organization, user } from './db/schema/auth-schema'
+import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import { getUserOrganizationRole } from '@nuxt-customer-portal/core/server/utils/permissions'
+
+export { db }
+export type { PortalSession } from '@nuxt-customer-portal/core/shared/portal-session'
+
+export const getSession = async (event: H3Event): Promise<PortalSession | null> => {
+  const session = await auth.api.getSession({ headers: event.headers })
+  return session as PortalSession | null
+}
+
+export const requireSession = async (event: H3Event): Promise<PortalSession> => {
+  const session = await getSession(event)
+  if (!session?.user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+  return session
+}
+
+export const requireActiveOrganization = (session: PortalSession): string => {
+  // Better Auth has returned both shapes across versions/configurations.
+  // Keep the layer adapter compatible with either so feature APIs do not
+  // lose their tenant context during a layer or auth upgrade.
+  const organizationId = getActiveOrganizationId(session)
+  if (!organizationId) {
+    throw createError({ statusCode: 400, message: 'No active organization' })
+  }
+  return organizationId
+}
+
+export const getPortalOrganization = async (organizationId: string) => {
+  const [selected] = await db.select().from(organization).where(eq(organization.id, organizationId)).limit(1)
+  return selected ?? null
+}
+
+export const requireOrganizationContext = async (session: PortalSession) => {
+  const organizationId = requireActiveOrganization(session)
+  const [selected, role] = await Promise.all([
+    getPortalOrganization(organizationId),
+    getUserOrganizationRole(session.user.id, organizationId) as Promise<PortalOrganizationRole | null>
+  ])
+  if (!selected || !role) {
+    throw createError({ statusCode: 403, message: 'Organization membership required' })
+  }
+  return {
+    organizationId,
+    organizationType: selected.organizationType as PortalOrganizationType,
+    organization: selected,
+    role
+  }
+}
+
+export const authorize = async <Action extends string>(
+  session: PortalSession,
+  organizationId: string,
+  policy: PortalFeaturePolicy<Action>,
+  action: Action
+): Promise<void> => {
+  const [role, selected] = await Promise.all([
+    getUserOrganizationRole(session.user.id, organizationId) as Promise<PortalOrganizationRole | null>,
+    getPortalOrganization(organizationId)
+  ])
+  if (!selected || !isPortalActionAllowed(policy, role, action, selected.organizationType as PortalOrganizationType)) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+}
+
+export const hasFeatureAccess = async <Action extends string>(
+  session: PortalSession,
+  organizationId: string,
+  policy: PortalFeaturePolicy<Action>,
+  action: Action
+): Promise<boolean> => {
+  const [role, selected] = await Promise.all([
+    getUserOrganizationRole(session.user.id, organizationId) as Promise<PortalOrganizationRole | null>,
+    getPortalOrganization(organizationId)
+  ])
+  return Boolean(
+    selected && isPortalActionAllowed(policy, role, action, selected.organizationType as PortalOrganizationType)
+  )
+}
+
+export const requireFeatureAccess = async <Action extends string>(
+  event: H3Event,
+  policy: PortalFeaturePolicy<Action>,
+  action: Action
+) => {
+  const session = await requireSession(event)
+  const organizationId = requireActiveOrganization(session)
+  const [selected, role] = await Promise.all([
+    getPortalOrganization(organizationId),
+    getUserOrganizationRole(session.user.id, organizationId) as Promise<PortalOrganizationRole | null>
+  ])
+  if (!selected || !isPortalActionAllowed(policy, role, action, selected.organizationType as PortalOrganizationType)) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
+  }
+  return { session, organizationId, organizationType: selected.organizationType as PortalOrganizationType, role }
+}
+
+export const requireActiveOrganizationRole = async (event: H3Event) => {
+  const session = await requireSession(event)
+  return { session, ...(await requireOrganizationContext(session)) }
+}
+
+/**
+ * Stable portal-core projections used by feature layers. Keeping these here
+ * prevents features from importing host authentication tables at runtime.
+ */
+export const listPortalOrganizationMembers = async (organizationId: string) =>
+  db
+    .select({
+      id: user.id,
+      name: user.name,
+      email: user.email,
+      image: user.image,
+      organizationRole: member.role,
+      phone: member.phone,
+      jobTitle: member.jobTitle
+    })
+    .from(member)
+    .innerJoin(user, eq(user.id, member.userId))
+    .where(eq(member.organizationId, organizationId))
+    .orderBy(asc(user.name), asc(user.email))
+
+export const searchPortalOrganizations = async (workspaceOrganizationId: string, search?: string) =>
+  db
+    .select({
+      id: organization.id,
+      name: organization.name,
+      slug: organization.slug,
+      logo: organization.logo,
+      metadata: organization.metadata,
+      organizationType: organization.organizationType
+    })
+    .from(organization)
+    .where(
+      and(ne(organization.id, workspaceOrganizationId), search ? ilike(organization.name, `%${search}%`) : undefined)
+    )
+    .orderBy(asc(organization.name))
+    .limit(50)
+
+export const listPortalOrganizationsForUser = async (userId: string) => {
+  const selection = {
+    id: organization.id,
+    name: organization.name,
+    slug: organization.slug,
+    logo: organization.logo,
+    organizationType: organization.organizationType
+  }
+  return db
+    .select(selection)
+    .from(member)
+    .innerJoin(organization, eq(organization.id, member.organizationId))
+    .where(eq(member.userId, userId))
+    .orderBy(asc(organization.name))
+}
+
+export const getPortalOrganizationsByIds = async (organizationIds: string[]) => {
+  if (!organizationIds.length) {
+    return []
+  }
+  return db
+    .select({
+      id: organization.id,
+      name: organization.name,
+      slug: organization.slug,
+      logo: organization.logo,
+      metadata: organization.metadata,
+      organizationType: organization.organizationType
+    })
+    .from(organization)
+    .where(inArray(organization.id, organizationIds))
+    .orderBy(asc(organization.name))
+}
+
+export const createPortalOrganizationRecord = async (input: {
+  name: string
+  slug: string
+  logo?: string | null
+  organizationType?: PortalOrganizationType
+}) => {
+  const [created] = await db
+    .insert(organization)
+    .values({
+      id: nanoid(),
+      name: input.name,
+      slug: input.slug,
+      logo: input.logo ?? null,
+      organizationType: input.organizationType ?? 'CLIENT',
+      createdAt: new Date()
+    })
+    .returning({
+      id: organization.id,
+      name: organization.name,
+      slug: organization.slug,
+      logo: organization.logo,
+      organizationType: organization.organizationType
+    })
+  return created
+}

package/server/routes/api-docs/openapi.json.get.ts

@@ -0,0 +1,22 @@
+import { fetchWithEvent, getRequestURL } from 'h3'
+import { auth } from '../../utils/auth'
+import { mergeBetterAuthOpenApi } from '../../utils/openapi-auth'
+import { enrichOpenApiContracts } from '../../utils/openapi-contracts'
+import { orderOpenApiDocument, type OpenApiDocument } from '../../utils/openapi-order'
+
+defineRouteMeta({
+  openAPI: {
+    tags: ['Internal'],
+    summary: 'Get the ordered OpenAPI document',
+    description:
+      'Returns the generated OpenAPI document in a stable, domain-oriented order for the documentation interfaces.',
+    'x-scalar-ignore': true
+  }
+})
+
+export default defineEventHandler(async (event) => {
+  const response = await fetchWithEvent(event, new URL('/api-docs/openapi.raw.json', getRequestURL(event)))
+  const document = (await response.json()) as OpenApiDocument
+  const authDocument = (await auth.api.generateOpenAPISchema()) as unknown as OpenApiDocument
+  return orderOpenApiDocument(enrichOpenApiContracts(mergeBetterAuthOpenApi(document, authDocument)))
+})

package/server/utils/admin-email-allowlist.ts

@@ -0,0 +1,12 @@
+export function parseSystemAdminEmails(value: string | undefined) {
+  return new Set(
+    (value || '')
+      .split(',')
+      .map((email) => email.trim().toLowerCase())
+      .filter(Boolean)
+  )
+}
+
+export function isSystemAdminEmail(email: string | null | undefined, allowlist: ReadonlySet<string>) {
+  return Boolean(email && allowlist.has(email.trim().toLowerCase()))
+}