@nuxt-customer-portal/organizations 0.3.3 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @nuxt-customer-portal/organizations
 
+## 0.4.0
+
+### Minor Changes
+
+- 59c8921: Support organization and personal clients with optional verified self-registration, single-person access safeguards, and shared provider, client, and user timezone preferences. Preserve existing B2B defaults, module references, invoice history, and Timesheets timezone behavior.
+
+  Collect and store first and last names during signup and personal onboarding. Route ordinary personal registration and verified users without memberships or pending invitations through onboarding.
+
+  Allow users to edit first name, last name, and an independent display name in profile settings.
+
+  Synchronize display-name edits with the linked private client name and current billing name in the same transaction, preserving organizations and historical invoices.
+
+  Let private clients edit their own billing address in profile settings, independently of the active organization, with server-side ownership checks.
+
+  Private clients use their own invoice email without contact persons; hide contact management and reject private-client contact creation or selection server-side.
+
+  Add a B2C-only Invite private client action to the Users page, supporting new and existing private clients with atomic record creation, request retry protection, and pending invitation recovery when email delivery fails.
+
+### Patch Changes
+
+- 59c8921: Allow SaaS administrators to configure allowed client types and personal self-registration in Portal Settings. Apply saved preferences to server authorization, onboarding, client forms and navigation, preserving configuration defaults for existing portals. Prevent disabling client types that still have records, including during concurrent creation.
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+- Updated dependencies [59c8921]
+  - @nuxt-customer-portal/core@0.4.0
+  - @nuxt-customer-portal/ui@0.4.0
+
 ## 0.3.3
 
 ### Patch Changes

package/app/components/DeleteAccountModal.vue

@@ -91,7 +91,12 @@ const handleCancel = () => {
 </script>
 
 <template>
-  <UModal v-model:open="open" :title="t('security.account.delete.confirmTitle')" :ui="{ footer: 'justify-end' }">
+  <UModal
+    v-if="open"
+    v-model:open="open"
+    :title="t('security.account.delete.confirmTitle')"
+    :ui="{ footer: 'justify-end' }"
+  >
     <template #body>
       <div class="space-y-4">
         <p class="text-sm text-gray-600 dark:text-gray-400">

package/app/components/OrganizationMembers.vue

@@ -193,7 +193,7 @@ onMounted(() => {
       </div>
     </div>
 
-    <UModal v-model="showInviteModal" @close="showInviteModal = false">
+    <UModal v-if="showInviteModal" v-model:open="showInviteModal">
       <UCard>
         <template #header>
           <h3 class="text-lg font-semibold">Invite Member</h3>

package/app/components/OrganizationSettings.vue

@@ -304,6 +304,8 @@ onUnmounted(() => {
         </UButton>
         <UButton
           type="submit"
+          icon="i-lucide-save"
+          class="ml-auto flex min-w-28 justify-center"
           :loading="updating"
           :disabled="updating || !isOwner || (slugChanged && slugStatus !== 'available')"
         >

package/app/components/OrganizationSwitcher.vue

@@ -18,6 +18,7 @@ const emit = defineEmits<{
   switched: []
 }>()
 
+const runtimeConfig = useRuntimeConfig()
 const toast = useToast()
 const { t } = useI18n()
 const userStore = useUserStore()
@@ -25,6 +26,18 @@ const { activeOrganizationId } = storeToRefs(userStore)
 const selectedOrg = ref('')
 const error = ref('')
 const organizations = authClient.useListOrganizations()
+const clientAccounts = ref<{ organizationId: string; clientType: string }[]>([])
+watch(
+  () => organizations.value.data?.map((org) => org.id).join(','),
+  async () => {
+    if (runtimeConfig.public.clients && organizations.value.data?.length) {
+      clientAccounts.value = await $fetch('/api/client-account')
+    } else {
+      clientAccounts.value = []
+    }
+  },
+  { immediate: true }
+)
 
 // Sync selectedOrg with activeOrganizationId from store
 watch(
@@ -58,7 +71,7 @@ const selectItems = computed<SelectItem[]>(() => {
     return []
   }
   return organizations.value.data.map((org) => ({
-    label: org.name,
+    label: `${org.name}${clientAccounts.value.some((account) => account.organizationId === org.id && account.clientType === 'person') ? ` · ${t('timezones.personalAccount')}` : ''}`,
     value: org.id
   }))
 })
@@ -108,12 +121,12 @@ const createNewOrg = () => {
         />
       </div>
       <div v-else class="flex flex-col gap-4">
-        <UFormField label="Select Organization" name="organization">
+        <UFormField :label="t('timezones.selectAccount')" name="organization">
           <USelect
             id="org-select"
             v-model="selectedOrg"
             :items="selectItems"
-            placeholder="Select Organization"
+            :placeholder="t('timezones.selectAccount')"
             value-key="value"
             class="w-full"
             @update:model-value="switchOrganization"
@@ -145,7 +158,7 @@ const createNewOrg = () => {
           id="org-select-header"
           v-model="selectedOrg"
           :items="selectItems"
-          placeholder="Organization"
+          :placeholder="t('timezones.selectAccount')"
           value-key="value"
           size="sm"
           class="min-w-[160px]"

package/app/components/TimezonePreferences.vue

@@ -0,0 +1,72 @@
+<script setup lang="ts">
+import { z } from 'zod'
+import { isValidTimezone } from '@nuxt-customer-portal/core/shared/timezone'
+
+const props = defineProps<{ provider?: boolean }>()
+const { t } = useI18n()
+const api = useTimezonePreferences()
+const { data, refresh } = await useAsyncData(`timezone-preferences-${props.provider}`, () => api.get())
+const state = reactive({
+  timezone: (props.provider ? data.value?.providerTimezone : data.value?.userTimezone) ?? (null as string | null)
+})
+const schema = computed(() =>
+  z.object({
+    timezone: z
+      .string()
+      .nullable()
+      .refine((value) => (value === null ? !props.provider : isValidTimezone(value)), t('timezones.invalid'))
+  })
+)
+const busy = ref(false)
+const error = ref('')
+const toast = useToast()
+const save = async () => {
+  busy.value = true
+  error.value = ''
+  try {
+    if (props.provider) {
+      await api.saveProvider(state.timezone!)
+    } else {
+      await api.saveUser(state.timezone)
+    }
+    await refresh()
+    toast.add({ title: t('timezones.saved'), color: 'success' })
+  } catch {
+    error.value = t('timezones.failed')
+  } finally {
+    busy.value = false
+  }
+}
+const suggest = () => {
+  state.timezone = Intl.DateTimeFormat().resolvedOptions().timeZone
+}
+</script>
+
+<template>
+  <UCard class="mb-6">
+    <template #header
+      ><h2 class="font-semibold">{{ t(provider ? 'timezones.provider' : 'timezones.preference') }}</h2></template
+    >
+    <UForm :state="state" :schema="schema" novalidate class="space-y-4" @submit="save">
+      <UFormField name="timezone" :label="t('timezones.label')" :description="t('timezones.savedPreference')">
+        <PortalTimezoneSelect
+          v-model="state.timezone"
+          :allow-inherit="!provider"
+          :inherited-timezone="data?.schedulingTimezone"
+        />
+      </UFormField>
+      <p v-if="data" class="text-sm text-muted">
+        {{ t('timezones.current', { timezone: provider ? data.providerTimezone : data.displayTimezone }) }}
+      </p>
+      <UAlert v-if="error" color="error" :title="error" />
+      <div class="flex justify-end gap-2">
+        <UButton v-if="!provider" type="button" variant="outline" @click="suggest">{{
+          t('timezones.useDevice')
+        }}</UButton>
+        <UButton type="submit" icon="i-lucide-save" class="ml-auto flex min-w-28 justify-center" :loading="busy">{{
+          t('timezones.save')
+        }}</UButton>
+      </div>
+    </UForm>
+  </UCard>
+</template>

package/app/components/organization/InviteMemberModal.vue

@@ -63,7 +63,12 @@ const handleSubmit = async (event: FormSubmitEvent<z.output<typeof formSchema.va
 </script>
 
 <template>
-  <UModal v-model:open="open" :title="t('organization.members.invitations.modalTitle')" :ui="{ footer: 'justify-end' }">
+  <UModal
+    v-if="open"
+    v-model:open="open"
+    :title="t('organization.members.invitations.modalTitle')"
+    :ui="{ footer: 'justify-end' }"
+  >
     <template #body>
       <UForm :state="form" :schema="formSchema" class="space-y-4" @submit="handleSubmit">
         <UFormField name="email" :label="t('organization.members.invitations.emailLabel')" required>

package/app/composables/useTimezonePreferences.ts

@@ -0,0 +1,12 @@
+export const useTimezonePreferences = () => ({
+  get: () =>
+    $fetch<{
+      providerTimezone: string
+      clientTimezone: string | null
+      userTimezone: string | null
+      schedulingTimezone: string
+      displayTimezone: string
+    }>('/api/timezones'),
+  saveUser: (timezone: string | null) => $fetch('/api/profile', { method: 'PATCH', body: { timezone } }),
+  saveProvider: (timezone: string) => $fetch('/api/provider-timezone', { method: 'PATCH', body: { timezone } })
+})

package/app/pages/settings/index.vue

@@ -8,30 +8,35 @@ const userStore = useUserStore()
 const { currentUser } = storeToRefs(userStore)
 const { setCurrentUser } = userStore
 const toast = useToast()
+const clientConfiguration = useClientConfiguration()
 
 const fileRef = ref<HTMLInputElement>()
 
 // Zod schema for profile form validation
-const schema = z
-  .object({
-    name: z
-      .string()
-      .trim()
-      .min(1, t('profile.validation.nameRequired'))
-      .max(255, t('profile.validation.nameMaxLength')),
-    image: z
-      .union([z.string().url(t('profile.validation.imageInvalidUrl')), z.literal('').transform(() => null), z.null()])
-      .optional()
-  })
-  .refine((data) => data.name !== undefined || data.image !== undefined, {
-    message: t('profile.validation.atLeastOneField')
-  })
+const schema = z.object({
+  name: z.string().trim().min(1, t('profile.validation.nameRequired')).max(255, t('profile.validation.nameMaxLength')),
+  firstName: z
+    .string()
+    .trim()
+    .min(1, t('profile.validation.firstNameRequired'))
+    .max(80, t('profile.validation.namePartMaxLength')),
+  lastName: z
+    .string()
+    .trim()
+    .min(1, t('profile.validation.lastNameRequired'))
+    .max(80, t('profile.validation.namePartMaxLength')),
+  image: z
+    .union([z.string().url(t('profile.validation.imageInvalidUrl')), z.literal('').transform(() => null), z.null()])
+    .optional()
+})
 
 type Schema = z.output<typeof schema>
 
 // Form state
 const form = reactive<Partial<Schema>>({
   name: '',
+  firstName: '',
+  lastName: '',
   image: ''
 })
 
@@ -43,6 +48,8 @@ const selectedFile = ref<File | null>(null)
 watchEffect(() => {
   if (currentUser.value) {
     form.name = currentUser.value.name || ''
+    form.firstName = currentUser.value.firstName || ''
+    form.lastName = currentUser.value.lastName || ''
     form.image = currentUser.value.image || ''
     isDirty.value = false
   }
@@ -50,10 +57,13 @@ watchEffect(() => {
 
 // Watch for form changes
 watch(
-  () => [form.name, form.image],
+  () => [form.name, form.firstName, form.lastName, form.image],
   () => {
     if (currentUser.value) {
-      const nameChanged = form.name !== (currentUser.value.name || '')
+      const nameChanged =
+        form.name !== (currentUser.value.name || '') ||
+        form.firstName !== (currentUser.value.firstName || '') ||
+        form.lastName !== (currentUser.value.lastName || '')
       const imageChanged = form.image !== (currentUser.value.image || '')
       isDirty.value = nameChanged || imageChanged
     }
@@ -92,13 +102,17 @@ const handleSubmit = async (event: FormSubmitEvent<Schema>) => {
       user?: {
         id: string
         name: string
+        firstName: string
+        lastName: string
         email: string
         image: string | null
       }
     }>('/api/profile', {
       method: 'PATCH',
       body: {
-        name: event.data.name?.trim(),
+        name: event.data.name,
+        firstName: event.data.firstName,
+        lastName: event.data.lastName,
         image: imageUrl
       }
     })
@@ -108,9 +122,12 @@ const handleSubmit = async (event: FormSubmitEvent<Schema>) => {
       setCurrentUser({
         ...currentUser.value,
         name: response.user.name,
+        firstName: response.user.firstName,
+        lastName: response.user.lastName,
         image: response.user.image || undefined
       })
 
+      await userStore.refreshOrganizations()
       toast.add({
         title: t('profile.messages.success'),
         description: t('profile.messages.profileUpdated'),
@@ -149,6 +166,8 @@ const handleReset = () => {
       URL.revokeObjectURL(form.image)
     }
     form.name = currentUser.value.name || ''
+    form.firstName = currentUser.value.firstName || ''
+    form.lastName = currentUser.value.lastName || ''
     form.image = currentUser.value.image || ''
     isDirty.value = false
     selectedFile.value = null
@@ -192,8 +211,17 @@ onUnmounted(() => {
 </script>
 
 <template>
+  <UButton
+    v-if="clientConfiguration.personalSelfRegistration"
+    to="/personal-onboarding"
+    class="mb-4"
+    variant="outline"
+    >{{ t('timezones.openPersonalAccount') }}</UButton
+  >
+  <TimezonePreferences />
+  <component :is="resolveComponent('ClientsPersonalAddress')" v-if="useRuntimeConfig().public.clients" />
   <AppCard class="mb-8" :title="$t('profile.sections.profileInfo')">
-    <UForm :state="form" :schema="schema" class="space-y-6" @submit="handleSubmit">
+    <UForm novalidate :state="form" :schema="schema" class="space-y-6" @submit="handleSubmit">
       <!-- Profile Picture Section -->
       <UFormField
         :label="$t('profile.fields.profilePicture')"
@@ -215,19 +243,18 @@ onUnmounted(() => {
       </UFormField>
 
       <UFormField
-        :label="$t('profile.fields.name')"
-        :description="$t('profile.fields.nameDescription')"
+        :label="$t('profile.fields.displayName')"
+        :description="$t('profile.fields.displayNameDescription')"
         name="name"
         required
       >
-        <UInput
-          v-model="form.name"
-          type="text"
-          :placeholder="$t('profile.fields.namePlaceholder')"
-          icon="i-lucide-user"
-          class="w-full"
-          required
-        />
+        <UInput v-model="form.name" autocomplete="nickname" icon="i-lucide-user" class="w-full" />
+      </UFormField>
+      <UFormField :label="$t('profile.fields.firstName')" name="firstName" required>
+        <UInput v-model="form.firstName" autocomplete="given-name" icon="i-lucide-user" class="w-full" />
+      </UFormField>
+      <UFormField :label="$t('profile.fields.lastName')" name="lastName" required>
+        <UInput v-model="form.lastName" autocomplete="family-name" icon="i-lucide-user" class="w-full" />
       </UFormField>
 
       <UFormField :label="$t('profile.fields.email')" :description="$t('profile.fields.emailDescription')" name="email">
@@ -239,7 +266,13 @@ onUnmounted(() => {
         <UButton type="button" variant="ghost" color="neutral" :disabled="!isDirty || isLoading" @click="handleReset">
           {{ $t('common.reset') }}
         </UButton>
-        <UButton type="submit" :loading="isLoading" :disabled="!isDirty">
+        <UButton
+          type="submit"
+          icon="i-lucide-save"
+          class="ml-auto flex min-w-28 justify-center"
+          :loading="isLoading"
+          :disabled="!isDirty"
+        >
           {{ $t('common.save') }}
         </UButton>
       </div>

package/app/pages/settings/organization.vue

@@ -9,6 +9,7 @@ import type {
 import { authClient } from '@nuxt-customer-portal/core/app/utils/auth-client'
 import { canViewOrganizationDirectory as canViewDirectory } from '@nuxt-customer-portal/core/shared/feature-registry'
 
+const runtimeConfig = useRuntimeConfig()
 const userStore = useUserStore()
 const { activeOrganizationId } = storeToRefs(userStore)
 const { hasPermission } = userStore
@@ -26,7 +27,10 @@ const members = ref<OrganizationMemberWithUser[]>([])
 const invitations = ref<OrganizationInvitationsResponse>([])
 const showEditModal = ref(false)
 const userOrganizationRole = ref<MemberRole | null>(null)
-const canViewOrganizationDirectory = computed(() => canViewDirectory(userOrganizationRole.value))
+const personalAccount = ref(false)
+const canViewOrganizationDirectory = computed(
+  () => !personalAccount.value && canViewDirectory(userOrganizationRole.value)
+)
 
 // Load organization details
 const loadOrganization = async () => {
@@ -49,6 +53,13 @@ const loadOrganization = async () => {
       throw roleError
     }
     userOrganizationRole.value = (roleData?.role as MemberRole | undefined) ?? null
+    personalAccount.value = false
+    if (runtimeConfig.public.clients) {
+      const accounts = await $fetch<{ organizationId: string; clientType: string }[]>('/api/client-account')
+      personalAccount.value = accounts.some(
+        (account) => account.organizationId === activeOrganizationId.value && account.clientType === 'person'
+      )
+    }
     organization.value = await $fetch<Organization>(`/api/organizations/${activeOrganizationId.value}`)
     if (organization.value && canViewOrganizationDirectory.value) {
       await loadMembers()
@@ -138,7 +149,13 @@ watch(
 
     <!-- Organization Details -->
     <div v-else-if="organization && hasPermission('organization', 'read')" class="space-y-6">
+      <TimezonePreferences
+        v-if="organization.organizationType === 'PROVIDER' && ['owner', 'admin'].includes(userOrganizationRole || '')"
+        provider
+      />
+      <component :is="resolveComponent('ClientsPersonalProfile')" v-if="personalAccount" :client-id="organization.id" />
       <OrganizationDetailsCard
+        v-else
         :organization="organization"
         :role="userOrganizationRole"
         :can-edit="userOrganizationRole === 'owner'"

package/app/pages/settings.vue

@@ -20,7 +20,7 @@ const links = [
       exact: true
     },
     {
-      label: t('settings.organization'),
+      label: t('timezones.accountSettings'),
       icon: 'i-lucide-users',
       to: '/settings/organization'
     },

package/i18n/locales/en.json

@@ -183,7 +183,11 @@
       "namePlaceholder": "Enter your name",
       "profilePicture": "Profile Picture",
       "profilePictureDescription": "JPG, GIF or PNG. 1MB Max.",
-      "chooseAvatar": "Choose"
+      "chooseAvatar": "Choose",
+      "firstName": "First name",
+      "lastName": "Last name",
+      "displayName": "Display name",
+      "displayNameDescription": "The name shown in the portal. This can differ from your first and last name."
     },
     "messages": {
       "error": "Error",
@@ -202,7 +206,10 @@
       "atLeastOneField": "At least one field (name or image) must be provided",
       "imageInvalidUrl": "Image must be a valid URL",
       "nameMaxLength": "Name must be less than 255 characters",
-      "nameRequired": "Name is required"
+      "nameRequired": "Name is required",
+      "firstNameRequired": "First name is required",
+      "lastNameRequired": "Last name is required",
+      "namePartMaxLength": "Use at most 80 characters"
     }
   }
 }

package/i18n/locales/nl.json

@@ -183,7 +183,11 @@
       "namePlaceholder": "Voer je naam in",
       "profilePicture": "Profielfoto",
       "profilePictureDescription": "JPG, GIF of PNG. Max. 1MB.",
-      "chooseAvatar": "Kiezen"
+      "chooseAvatar": "Kiezen",
+      "firstName": "Voornaam",
+      "lastName": "Achternaam",
+      "displayName": "Weergavenaam",
+      "displayNameDescription": "De naam die in het portaal wordt getoond. Deze mag afwijken van je voor- en achternaam."
     },
     "messages": {
       "error": "Fout",
@@ -202,7 +206,10 @@
       "atLeastOneField": "Ten minste één veld (naam of afbeelding) moet worden ingevuld",
       "imageInvalidUrl": "Afbeelding moet een geldige URL zijn",
       "nameMaxLength": "Naam moet minder dan 255 tekens zijn",
-      "nameRequired": "Naam is verplicht"
+      "nameRequired": "Naam is verplicht",
+      "firstNameRequired": "Voornaam is verplicht",
+      "lastNameRequired": "Achternaam is verplicht",
+      "namePartMaxLength": "Gebruik maximaal 80 tekens"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt-customer-portal/organizations",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "license": "MIT",
   "homepage": "https://nuxt-customer-portal.com",
   "repository": {
@@ -39,8 +39,8 @@
     "pg": "^8.22.0",
     "zod": "^4.4.3",
     "@nuxt/ui": "^4.10.0",
-    "@nuxt-customer-portal/core": "^0.3.3",
-    "@nuxt-customer-portal/ui": "^0.3.3"
+    "@nuxt-customer-portal/core": "^0.4.0",
+    "@nuxt-customer-portal/ui": "^0.4.0"
   },
   "peerDependencies": {
     "nuxt": "^4.5.1"

package/portal.manifest.mjs

@@ -1,6 +1,6 @@
 export default {
   id: 'organizations',
-  version: '0.3.3',
+  version: '0.4.0',
   source: '@nuxt-customer-portal/organizations',
   dependsOn: ['core', 'ui']
 }

package/server/api/organizations/accept-invitation.post.ts

@@ -1,3 +1,7 @@
+import {
+  assertClientInvitationAcceptance,
+  isPersonalClient
+} from '@nuxt-customer-portal/core/server/utils/client-account-policy'
 import { defineEventHandler, createError, readBody } from 'h3'
 import { z } from 'zod'
 import { auth, generateId } from '@nuxt-customer-portal/core/server/utils/auth'
@@ -32,6 +36,9 @@ export default defineEventHandler(async (event) => {
   }
 
   const user = session.user as SessionUser
+  if (!user.emailVerified) {
+    throw createError({ statusCode: 403, message: 'Verify your email before accepting an invitation' })
+  }
   const parsed = z.object({ invitationId: z.string().min(1) }).safeParse(await readBody(event))
   if (!parsed.success) {
     throw createError({ statusCode: 400, message: 'Invitation ID is required' })
@@ -72,17 +79,6 @@ export default defineEventHandler(async (event) => {
         })
       }
 
-      // Check if user is already a member
-      const [existingMember] = await tx
-        .select()
-        .from(memberTable)
-        .where(and(eq(memberTable.organizationId, invitation.organizationId), eq(memberTable.userId, user.id)))
-        .limit(1)
-
-      if (existingMember) {
-        throw createError({ statusCode: 400, message: 'You are already a member of this organization' })
-      }
-
       // Get organization details
       const [organization] = await tx
         .select()
@@ -94,6 +90,28 @@ export default defineEventHandler(async (event) => {
         throw createError({ statusCode: 404, message: 'Organization not found' })
       }
 
+      // Reconcile an interrupted Better Auth acceptance where membership was
+      // created but the invitation was left pending.
+      const [existingMember] = await tx
+        .select()
+        .from(memberTable)
+        .where(and(eq(memberTable.organizationId, invitation.organizationId), eq(memberTable.userId, user.id)))
+        .limit(1)
+
+      if (existingMember) {
+        await tx.update(invitationTable).set({ status: 'accepted' }).where(eq(invitationTable.id, invitationId))
+        return {
+          success: true,
+          member: existingMember,
+          organization: { id: organization.id, name: organization.name }
+        }
+      }
+
+      await assertClientInvitationAcceptance(invitation.organizationId, user.id)
+      if (await isPersonalClient(invitation.organizationId)) {
+        invitation.role = 'owner'
+      }
+
       // Create the member record
       const memberId = generateId()
       await tx.insert(memberTable).values({
@@ -125,6 +143,10 @@ export default defineEventHandler(async (event) => {
     if (err instanceof Error && 'statusCode' in err) {
       throw err
     }
+    const cause = err as { code?: string; cause?: { code?: string } }
+    if (cause.code === '23505' || cause.cause?.code === '23505') {
+      throw createError({ statusCode: 409, message: 'Personal account already exists. Contact your coach.' })
+    }
     const errorMessage = err instanceof Error ? err.message : 'Failed to accept invitation'
     throw createError({ statusCode: 500, message: errorMessage })
   }

package/server/api/organizations/invitation-signup.post.ts

@@ -0,0 +1,161 @@
+import { and, eq } from 'drizzle-orm'
+import { createError, defineEventHandler, readBody } from 'h3'
+import { z } from 'zod'
+import { auth, generateId } from '@nuxt-customer-portal/core/server/utils/auth'
+import { db } from '@nuxt-customer-portal/core/server/utils/db'
+import {
+  assertClientInvitationAcceptance,
+  getClientAccountIdentity,
+  isPersonalClient
+} from '@nuxt-customer-portal/core/server/utils/client-account-policy'
+import {
+  invitation as invitationTable,
+  member as memberTable,
+  organization as organizationTable,
+  user as userTable
+} from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
+
+const bodySchema = z.object({
+  invitationId: z.string().min(1),
+  email: z.email(),
+  password: z.string().min(8)
+})
+
+export default defineEventHandler(async (event) => {
+  const parsed = bodySchema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'Invalid signup details' })
+  }
+
+  const input = parsed.data
+  const email = input.email.trim().toLowerCase()
+  const [invitation] = await db
+    .select()
+    .from(invitationTable)
+    .where(eq(invitationTable.id, input.invitationId))
+    .limit(1)
+
+  if (!invitation) {
+    throw createError({ statusCode: 400, message: 'Invitation is no longer valid' })
+  }
+  if (invitation.email.trim().toLowerCase() !== email) {
+    throw createError({ statusCode: 400, message: 'This invitation was sent to a different email address' })
+  }
+  if (invitation.status === 'accepted') {
+    const [acceptedAccount] = await db
+      .select({ userId: userTable.id, organizationId: organizationTable.id, organizationName: organizationTable.name })
+      .from(memberTable)
+      .innerJoin(userTable, eq(userTable.id, memberTable.userId))
+      .innerJoin(organizationTable, eq(organizationTable.id, memberTable.organizationId))
+      .where(
+        and(
+          eq(memberTable.organizationId, invitation.organizationId),
+          eq(userTable.email, email),
+          eq(userTable.emailVerified, true)
+        )
+      )
+      .limit(1)
+    if (acceptedAccount) {
+      return {
+        success: true,
+        organization: { id: acceptedAccount.organizationId, name: acceptedAccount.organizationName }
+      }
+    }
+    throw createError({ statusCode: 400, message: 'Invitation is no longer valid' })
+  }
+  if (invitation.status !== 'pending') {
+    throw createError({ statusCode: 400, message: 'Invitation is no longer valid' })
+  }
+  if (new Date(invitation.expiresAt) < new Date()) {
+    throw createError({ statusCode: 400, message: 'Invitation has expired' })
+  }
+  const [existingUser] = await db
+    .select({ id: userTable.id })
+    .from(userTable)
+    .where(eq(userTable.email, email))
+    .limit(1)
+  if (existingUser) {
+    throw createError({
+      statusCode: 409,
+      message: 'An account already exists for this email. Sign in to accept the invitation.'
+    })
+  }
+
+  const identity = await getClientAccountIdentity(invitation.organizationId)
+  const signup = await auth.api.signUpEmail({
+    body: {
+      name: identity?.name || email.split('@')[0] || email,
+      ...(identity?.firstName ? { firstName: identity.firstName } : {}),
+      ...(identity?.lastName ? { lastName: identity.lastName } : {}),
+      email,
+      password: input.password
+    }
+  })
+
+  const createdUserId = signup.user.id
+  let organization: { id: string; name: string }
+
+  try {
+    organization = await db.transaction(async (tx) => {
+      const [lockedInvitation] = await tx
+        .select()
+        .from(invitationTable)
+        .where(eq(invitationTable.id, input.invitationId))
+        .limit(1)
+        .for('update')
+
+      if (!lockedInvitation || lockedInvitation.status !== 'pending') {
+        throw createError({ statusCode: 400, message: 'Invitation is no longer valid' })
+      }
+      if (new Date(lockedInvitation.expiresAt) < new Date()) {
+        throw createError({ statusCode: 400, message: 'Invitation has expired' })
+      }
+      if (lockedInvitation.email.trim().toLowerCase() !== email) {
+        throw createError({ statusCode: 400, message: 'This invitation was sent to a different email address' })
+      }
+
+      const [targetOrganization] = await tx
+        .select({ id: organizationTable.id, name: organizationTable.name })
+        .from(organizationTable)
+        .where(eq(organizationTable.id, lockedInvitation.organizationId))
+        .limit(1)
+      if (!targetOrganization) {
+        throw createError({ statusCode: 404, message: 'Organization not found' })
+      }
+
+      await assertClientInvitationAcceptance(lockedInvitation.organizationId, createdUserId)
+      const role = (await isPersonalClient(lockedInvitation.organizationId))
+        ? 'owner'
+        : lockedInvitation.role || 'member'
+      const [existingMember] = await tx
+        .select({ id: memberTable.id })
+        .from(memberTable)
+        .where(
+          and(eq(memberTable.organizationId, lockedInvitation.organizationId), eq(memberTable.userId, createdUserId))
+        )
+        .limit(1)
+
+      if (!existingMember) {
+        await tx.insert(memberTable).values({
+          id: generateId(),
+          organizationId: lockedInvitation.organizationId,
+          userId: createdUserId,
+          role,
+          createdAt: new Date()
+        })
+      }
+
+      await tx
+        .update(userTable)
+        .set({ emailVerified: true, updatedAt: new Date() })
+        .where(eq(userTable.id, createdUserId))
+      await tx.update(invitationTable).set({ status: 'accepted' }).where(eq(invitationTable.id, lockedInvitation.id))
+      return targetOrganization
+    })
+  } catch (error) {
+    await db.delete(userTable).where(eq(userTable.id, createdUserId))
+    throw error
+  }
+
+  return { success: true, organization }
+})

package/server/api/profile.patch.ts

@@ -1,5 +1,10 @@
+import {
+  runUserDisplayNameChangedHooks,
+  runUserIdentityChangedHooks
+} from '@nuxt-customer-portal/core/server/utils/business-hooks'
 import { defineEventHandler, createError, readBody } from 'h3'
 import { z } from 'zod'
+import { timezoneSchema } from '@nuxt-customer-portal/core/server/utils/timezone-validation'
 import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
 import { db } from '@nuxt-customer-portal/core/server/utils/db'
 import { user as userTable } from '@nuxt-customer-portal/core/server/db/schema/auth-schema'
@@ -19,6 +24,9 @@ defineRouteMeta({
 // Zod schema for profile update request
 const updateProfileSchema = z
   .object({
+    firstName: z.string().trim().min(1).max(80).optional(),
+    lastName: z.string().trim().min(1).max(80).optional(),
+    timezone: timezoneSchema.nullable().optional(),
     name: z
       .string()
       .trim()
@@ -29,9 +37,19 @@ const updateProfileSchema = z
       .union([z.string().url('Image must be a valid URL'), z.literal('').transform(() => null), z.null()])
       .optional()
   })
-  .refine((data) => data.name !== undefined || data.image !== undefined, {
-    message: 'At least one field (name or image) must be provided'
+  .refine((data) => (data.firstName === undefined) === (data.lastName === undefined), {
+    message: 'Provide both first and last name'
   })
+  .refine(
+    (data) =>
+      data.firstName !== undefined ||
+      data.name !== undefined ||
+      data.image !== undefined ||
+      data.timezone !== undefined,
+    {
+      message: 'At least one field (name or image) must be provided'
+    }
+  )
 
 interface UpdateProfileResponse {
   success: boolean
@@ -39,8 +57,11 @@ interface UpdateProfileResponse {
   user?: {
     id: string
     name: string
+    firstName: string | null
+    lastName: string | null
     email: string
     image: string | null
+    timezone: string | null
   }
 }
 
@@ -66,20 +87,48 @@ export default defineEventHandler(async (event): Promise<UpdateProfileResponse>
   const validatedData = validationResult.data
 
   // Build update object
-  const updateData: { name?: string; image?: string | null } = {}
+  const updateData: {
+    name?: string
+    firstName?: string | null
+    lastName?: string | null
+    image?: string | null
+    timezone?: string | null
+  } = {}
+  if (validatedData.timezone !== undefined) {
+    updateData.timezone = validatedData.timezone
+  }
   if (validatedData.name !== undefined) {
     updateData.name = validatedData.name.trim()
   }
+  if (validatedData.firstName !== undefined && validatedData.lastName !== undefined) {
+    updateData.firstName = validatedData.firstName
+    updateData.lastName = validatedData.lastName
+  }
   if (validatedData.image !== undefined) {
     updateData.image = validatedData.image
   }
 
-  // Update user in database
-  const [updatedUser] = await db.update(userTable).set(updateData).where(eq(userTable.id, user.id)).returning({
-    id: userTable.id,
-    name: userTable.name,
-    email: userTable.email,
-    image: userTable.image
+  // Save the profile and linked private client names atomically.
+  const updatedUser = await db.transaction(async (tx) => {
+    const [updated] = await tx.update(userTable).set(updateData).where(eq(userTable.id, user.id)).returning({
+      id: userTable.id,
+      name: userTable.name,
+      firstName: userTable.firstName,
+      lastName: userTable.lastName,
+      email: userTable.email,
+      image: userTable.image,
+      timezone: userTable.timezone
+    })
+    if (updated && updateData.name !== undefined) {
+      await runUserDisplayNameChangedHooks(tx, user.id, updated.name)
+    }
+    if (updated && updateData.firstName !== undefined && updateData.lastName !== undefined) {
+      await runUserIdentityChangedHooks(tx, user.id, {
+        firstName: updated.firstName,
+        lastName: updated.lastName
+      })
+    }
+    return updated
   })
 
   if (!updatedUser) {
@@ -92,8 +141,11 @@ export default defineEventHandler(async (event): Promise<UpdateProfileResponse>
     user: {
       id: updatedUser.id,
       name: updatedUser.name,
+      firstName: updatedUser.firstName,
+      lastName: updatedUser.lastName,
       email: updatedUser.email,
-      image: updatedUser.image
+      image: updatedUser.image,
+      timezone: updatedUser.timezone
     }
   }
 })

package/server/api/provider-timezone.patch.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod'
+import { requireActiveOrganizationRole, db } from '@nuxt-customer-portal/core/server/portal'
+import { organizationSettings } from '@nuxt-customer-portal/core/schema'
+import { timezoneSchema } from '@nuxt-customer-portal/core/server/utils/timezone-validation'
+
+export default defineEventHandler(async (event) => {
+  const context = await requireActiveOrganizationRole(event)
+  if (context.organizationType !== 'PROVIDER' || !['owner', 'admin'].includes(context.role ?? '')) {
+    throw createError({ statusCode: 403 })
+  }
+  const parsed = z.object({ timezone: timezoneSchema }).safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 400, message: 'A valid IANA timezone is required' })
+  }
+  const input = parsed.data
+  await db
+    .insert(organizationSettings)
+    .values({ organizationId: context.organizationId, ...input })
+    .onConflictDoUpdate({ target: organizationSettings.organizationId, set: input })
+  return input
+})