@oneteam-app/apps-cli 0.1.0-alpha.5 → 0.1.0-alpha.7

package/templates/hosted/src/worker/index.test.ts

@@ -0,0 +1,113 @@
+import { applyD1Migrations, env } from 'cloudflare:test';
+import { withFakeContext, type FakeContextOptions } from '@oneteam-app/apps/testing';
+import { beforeAll, describe, expect, it } from 'vitest';
+import type { Item, ItemsResponse } from '../shared';
+import { app, type Env } from './index';
+
+// Who is asking. Permissions are Oneteam permissions, held per community (store).
+const sam: FakeContextOptions = { userId: '123', firstName: 'Sam', communities: [{ id: '12', name: 'Store Amsterdam' }] };
+const noor: FakeContextOptions = {
+  userId: '456',
+  firstName: 'Noor',
+  communities: [{ id: '12', name: 'Store Amsterdam', permissions: ['network::users.update'] }, { id: '13', name: 'Store Rotterdam' }],
+};
+const lisa: FakeContextOptions = { userId: '999', firstName: 'Lisa', communities: [{ id: '13', name: 'Store Rotterdam' }] };
+
+const bindings = { DB: env.DB, ASSETS: { fetch: async () => new Response('front end') } } as unknown as Env;
+
+function call(path: string, as: FakeContextOptions, body?: unknown) {
+  return app.request(
+    withFakeContext(path, as, body === undefined ? undefined : { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }),
+    undefined,
+    bindings,
+  );
+}
+
+async function logItem(as: FakeContextOptions, title: string, communityId?: string): Promise<Item> {
+  const response = await call('/api/items', as, { title, location: 'Fitting rooms', communityId });
+
+  expect(response.status).toBe(201);
+
+  return response.json();
+}
+
+beforeAll(() => applyD1Migrations(env.DB, env.TEST_MIGRATIONS));
+
+describe('who can see what', () => {
+  it('refuses a request that did not come through the sign-on gateway', async () => {
+    const response = await app.request('http://app.test/api/items', undefined, bindings);
+
+    expect(response.status).toBe(401);
+  });
+
+  it("only lists items of the user's own stores", async () => {
+    await logItem(sam, 'Blue umbrella');
+    await logItem(lisa, 'Car keys');
+
+    const forSam: ItemsResponse = await (await call('/api/items', sam)).json();
+    const forNoor: ItemsResponse = await (await call('/api/items', noor)).json();
+
+    expect(forSam.items.map((item) => item.title)).toEqual(['Blue umbrella']);
+    expect(forNoor.items.map((item) => item.title).sort()).toEqual(['Blue umbrella', 'Car keys']);
+  });
+
+  it('does not let someone log an item for a store they are not in', async () => {
+    const response = await call('/api/items', sam, { title: 'Scarf', communityId: '13' });
+
+    expect(response.status).toBe(403);
+  });
+});
+
+describe('marking an item as returned', () => {
+  it('is refused without the permission in that store', async () => {
+    const item = await logItem(sam, 'Wallet');
+    const response = await call(`/api/items/${item.id}/return`, sam, { returnedTo: 'A customer' });
+
+    expect(response.status).toBe(403);
+    expect(await response.json()).toMatchObject({ error: 'forbidden', permission: 'network::users.update', community_id: '12' });
+    expect(item.canReturn).toBe(false);
+  });
+
+  it('is allowed for a manager of that store', async () => {
+    const item = await logItem(sam, 'Phone charger');
+    const response = await call(`/api/items/${item.id}/return`, noor, { returnedTo: 'Mr. de Boer' });
+    const returned: Item = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(returned.returnedTo).toBe('Mr. de Boer');
+    expect(returned.returnedAt).not.toBeNull();
+  });
+
+  it('is refused for a manager of another store: the permission counts per store', async () => {
+    // Noor manages Amsterdam (12) and is only a member of Rotterdam (13).
+    const item = await logItem(lisa, 'Sunglasses');
+    const response = await call(`/api/items/${item.id}/return`, noor, { returnedTo: 'Someone' });
+
+    expect(response.status).toBe(403);
+  });
+
+  it('answers "not found" for an item of a store the user is not in', async () => {
+    const item = await logItem(lisa, 'Gloves');
+    const response = await call(`/api/items/${item.id}/return`, sam, { returnedTo: 'Someone' });
+
+    expect(response.status).toBe(404);
+  });
+});
+
+describe('scheduled jobs', () => {
+  it('answers the platform\'s call for a job this app does not have with 404, and never reaches the app', async () => {
+    const { default: worker } = await import('./index');
+    const { fakeJobRequest } = await import('@oneteam-app/apps/testing');
+    const response = await worker.fetch(fakeJobRequest('send-reminders'), bindings, undefined as never);
+
+    expect(response.status).toBe(404);
+    expect(((await response.json()) as { error: string }).error).toContain('no handler for the job "send-reminders"');
+  });
+
+  it('does not let a signed-in person call the job path', async () => {
+    const { default: worker } = await import('./index');
+    const response = await worker.fetch(withFakeContext('/__oneteam/jobs/send-reminders', noor, { method: 'POST' }), bindings, undefined as never);
+
+    expect(response.status).toBe(404);
+  });
+});

package/templates/hosted/src/worker/index.ts

@@ -0,0 +1,121 @@
+import { assertCan, can, errorResponse, oneteam, toClientSession, withJobs, type HostedSession, type OneteamVariables } from '@oneteam-app/apps/hosted';
+import { Hono } from 'hono';
+import { RETURN_PERMISSION, type Item, type ItemsResponse } from '../shared';
+import { addItem, findItem, listItems, markReturned } from './items';
+import { jobs } from './jobs';
+
+export interface Env {
+  /** This app's own database. The only way to reach it: there are no credentials */
+  DB: D1Database;
+  /** The built front end */
+  ASSETS: Fetcher;
+  // A secret (an API key for another service) is a name here and under
+  // "secrets" in oneteam.app.json, never a value in the code:
+  //
+  //   SUPABASE_SERVICE_KEY: string;
+  //
+  // Read it with `secret(c.env, 'SUPABASE_SERVICE_KEY')` from
+  // '@oneteam-app/apps/hosted', only in this Worker. See "Secrets" in the README.
+}
+
+/** The communities (stores) the signed-in user belongs to: the scope of everything they can see. */
+function communitiesOf(session: HostedSession) {
+  return session.user.communities ?? [];
+}
+
+function withAccess(session: HostedSession, item: Omit<Item, 'canReturn'>): Item {
+  return { ...item, canReturn: !item.returnedAt && can(session, RETURN_PERMISSION, { communityId: item.communityId }) };
+}
+
+function text(value: unknown, max: number): string {
+  return typeof value === 'string' ? value.trim().slice(0, max) : '';
+}
+
+const api = new Hono<{ Bindings: Env; Variables: OneteamVariables }>();
+
+// Every route below has a signed-in user. Requests that did not come through
+// the sign-on gateway get a 401 here and never reach a route.
+api.use(oneteam());
+
+api.get('/me', (c) => c.json(toClientSession(c.get('session'))));
+
+api.get('/items', async (c) => {
+  const session = c.get('session');
+  const communities = communitiesOf(session);
+  const items = await listItems(c.env.DB, communities.map((community) => community.id));
+  const body: ItemsResponse = {
+    items: items.map((item) => withAccess(session, item)),
+    communities: communities.map(({ id, name }) => ({ id, name })),
+  };
+
+  return c.json(body);
+});
+
+api.post('/items', async (c) => {
+  const session = c.get('session');
+  const input = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;
+  const communities = communitiesOf(session);
+  const title = text(input.title, 120);
+  // Never trust a community id from the browser: it has to be one of the user's own.
+  const community = communities.find((item) => item.id === input.communityId) ?? communities.find((item) => item.isPrimary) ?? communities[0];
+
+  if (!title) return c.json({ error: 'Describe what was found' }, 400);
+  if (!community || (input.communityId !== undefined && community.id !== input.communityId)) {
+    return c.json({ error: 'You can only log items for your own store' }, 403);
+  }
+
+  const item = await addItem(c.env.DB, {
+    communityId: community.id,
+    title,
+    location: text(input.location, 120),
+    userId: session.user.id,
+    userName: session.user.name,
+  });
+
+  return c.json(withAccess(session, item), 201);
+});
+
+api.post('/items/:id/return', async (c) => {
+  const session = c.get('session');
+  const input = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;
+  const item = await findItem(c.env.DB, Number(c.req.param('id')), communitiesOf(session).map((community) => community.id));
+
+  // An item of another store is not found, rather than forbidden: its existence is not theirs to know.
+  if (!item) return c.json({ error: 'Item not found' }, 404);
+
+  // Only people who manage colleagues in the item's store hand items back.
+  assertCan(session, RETURN_PERMISSION, { communityId: item.communityId });
+
+  const returnedTo = text(input.returnedTo, 120);
+
+  if (!returnedTo) return c.json({ error: 'Say who the item was returned to' }, 400);
+
+  const updated = await markReturned(c.env.DB, item.id, item.communityId, returnedTo, session.user.id);
+
+  if (!updated) return c.json({ error: 'This item was already returned' }, 409);
+
+  return c.json(withAccess(session, updated));
+});
+
+api.all('*', (c) => c.json({ error: 'Not found' }, 404));
+
+const app = new Hono<{ Bindings: Env }>();
+
+app.route('/api', api);
+// Everything else is the front end.
+app.all('*', (c) => c.env.ASSETS.fetch(c.req.raw));
+app.onError((error, c) => {
+  // 401 without a session, 403 for a failed assertCan.
+  const known = errorResponse(error);
+
+  if (known) return known;
+
+  console.error(error);
+
+  return c.json({ error: 'Something went wrong' }, 500);
+});
+
+export { app };
+// The platform's calls for a scheduled job go to its handler in jobs.ts;
+// everything else is the app.
+export default withJobs<Env, typeof app>(app, jobs);

package/templates/hosted/src/worker/items.ts

@@ -0,0 +1,85 @@
+import type { Item } from '../shared';
+
+/**
+ * All database access for items. Two rules, everywhere:
+ * - values are bound with `?`, never put into the SQL text
+ * - every query is limited to the communities passed in, which come from the session
+ */
+
+interface ItemRow {
+  id: number;
+  community_id: string;
+  title: string;
+  location: string;
+  found_by_name: string;
+  created_at: string;
+  returned_at: string | null;
+  returned_to: string | null;
+}
+
+const COLUMNS = 'id, community_id, title, location, found_by_name, created_at, returned_at, returned_to';
+
+function toItem(row: ItemRow): Omit<Item, 'canReturn'> {
+  return {
+    id: row.id,
+    communityId: row.community_id,
+    title: row.title,
+    location: row.location,
+    foundByName: row.found_by_name,
+    createdAt: row.created_at,
+    returnedAt: row.returned_at,
+    returnedTo: row.returned_to,
+  };
+}
+
+/** `?, ?, ?` for an IN list: the ids themselves are bound, not interpolated. */
+function placeholders(values: unknown[]): string {
+  return values.map(() => '?').join(', ');
+}
+
+export async function listItems(db: D1Database, communityIds: string[]) {
+  if (communityIds.length === 0) return [];
+
+  const { results } = await db
+    .prepare(`SELECT ${COLUMNS} FROM items WHERE community_id IN (${placeholders(communityIds)}) ORDER BY returned_at IS NOT NULL, created_at DESC LIMIT 200`)
+    .bind(...communityIds)
+    .all<ItemRow>();
+
+  return results.map(toItem);
+}
+
+/** An item the user may see, or null: an item of another community does not exist for them. */
+export async function findItem(db: D1Database, id: number, communityIds: string[]) {
+  if (communityIds.length === 0) return null;
+
+  const row = await db
+    .prepare(`SELECT ${COLUMNS} FROM items WHERE id = ? AND community_id IN (${placeholders(communityIds)})`)
+    .bind(id, ...communityIds)
+    .first<ItemRow>();
+
+  return row ? toItem(row) : null;
+}
+
+export async function addItem(
+  db: D1Database,
+  item: { communityId: string; title: string; location: string; userId: string; userName: string },
+) {
+  const row = await db
+    .prepare(`INSERT INTO items (community_id, title, location, found_by_user_id, found_by_name) VALUES (?, ?, ?, ?, ?) RETURNING ${COLUMNS}`)
+    .bind(item.communityId, item.title, item.location, item.userId, item.userName)
+    .first<ItemRow>();
+
+  return toItem(row!);
+}
+
+export async function markReturned(db: D1Database, id: number, communityId: string, returnedTo: string, userId: string) {
+  const row = await db
+    .prepare(
+      `UPDATE items SET returned_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), returned_to = ?, returned_by_user_id = ?
+       WHERE id = ? AND community_id = ? AND returned_at IS NULL RETURNING ${COLUMNS}`,
+    )
+    .bind(returnedTo, userId, id, communityId)
+    .first<ItemRow>();
+
+  return row ? toItem(row) : null;
+}

package/templates/hosted/src/worker/jobs.ts

@@ -0,0 +1,22 @@
+import { defineJobs } from '@oneteam-app/apps/hosted';
+import type { Env } from './index';
+
+// Jobs the platform runs on a schedule. Each name here is also listed under
+// "schedules" in oneteam.app.json, and the other way round: `oneteam-apps
+// deploy` checks both before it uploads anything.
+//
+//   "schedules": [{ "name": "send-reminders", "every": "day", "at": "07:00" }],
+//   "sends": ["notifications"]
+//
+//   'send-reminders': async (job, env) => {
+//     const waiting = await itemsWaitingLongerThan(env.DB, 7);
+//
+//     for (const item of waiting) {
+//       await notify(job, { userIds: [item.foundBy], title: 'Still waiting', body: `${item.title} has been here for a week.` });
+//     }
+//   },
+//
+// Nobody is signed in while a job runs: there is no session. A job has 30
+// seconds, a run that is missed is not caught up, and one can be started again
+// by hand, so keep it short and safe to run twice.
+export const jobs = defineJobs<Env>({});

package/templates/hosted/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "types": ["vite/client"]
+  },
+  "include": ["src/client", "src/shared.ts", "vite.config.ts"]
+}

package/templates/hosted/tsconfig.worker.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "skipLibCheck": true,
+    "isolatedModules": true,
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "types": ["@cloudflare/workers-types", "@cloudflare/vitest-plugin/types"]
+  },
+  "include": ["src/worker", "src/shared.ts", "vitest.config.ts", "oneteam.app.json"]
+}

package/templates/hosted/vite.config.ts

@@ -0,0 +1,15 @@
+import { cloudflare } from '@cloudflare/vite-plugin';
+import tailwindcss from '@tailwindcss/vite';
+import react from '@vitejs/plugin-react';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+  // Relative asset URLs: the app is served from /<organisation>/<app>/ and
+  // from /<organisation>/<app>--preview/, never from a path known at build time.
+  base: './',
+  plugins: [react(), tailwindcss(), cloudflare()],
+  // One copy of React, also when a package that uses it is linked from elsewhere.
+  resolve: { dedupe: ['react', 'react-dom'] },
+  // Not 5173, which another project usually has.
+  server: { port: 5310, strictPort: true },
+});

package/templates/hosted/vitest.config.ts

@@ -0,0 +1,16 @@
+import { cloudflareTest, readD1Migrations } from '@cloudflare/vitest-plugin';
+import { defineConfig } from 'vitest/config';
+
+// Tests run in the Workers runtime with a real, empty D1 database per test file.
+export default defineConfig({
+  plugins: [
+    cloudflareTest(async () => ({
+      miniflare: {
+        compatibilityDate: '2026-09-01',
+        d1Databases: ['DB'],
+        bindings: { TEST_MIGRATIONS: await readD1Migrations('./migrations') },
+      },
+    })),
+  ],
+  test: { include: ['src/worker/**/*.test.ts'] },
+});

package/templates/hosted/wrangler.jsonc

@@ -0,0 +1,18 @@
+{
+  // Local development only (`pnpm dev`). The platform runs the app from the
+  // bundle `oneteam-apps deploy` uploads and provides the same two bindings:
+  // DB (this app's own database) and ASSETS (the built front end).
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "lost-and-found",
+  // The dev entry adds a stand-in sign-on. The deployed Worker is src/worker/index.ts.
+  "main": "src/worker/dev.ts",
+  "compatibility_date": "2026-09-01",
+  "assets": {
+    "binding": "ASSETS",
+    "not_found_handling": "single-page-application",
+    "run_worker_first": true
+  },
+  "d1_databases": [
+    { "binding": "DB", "database_name": "lost-and-found", "database_id": "local", "migrations_dir": "migrations" }
+  ]
+}