@openhi/constructs 0.0.118 → 0.0.120

package/lib/provision-default-workspace.handler.mjs

@@ -3,7 +3,7 @@ import {
   createRoleAssignmentOperation,
   createTenantOperation,
   createWorkspaceOperation
-} from "./chunk-QWWLM452.mjs";
+} from "./chunk-7WDX6GPO.mjs";
 import "./chunk-HQ67J7BP.mjs";
 import "./chunk-QJDHVMKT.mjs";
 import {

package/lib/rest-api-lambda.handler.js

@@ -4946,6 +4946,19 @@ function extractDenormalizedReferenceDisplay(resource, fieldName) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 
+// src/data/operations/control/membership-constraints/assert-workspace-in-tenant-operation.ts
+async function assertWorkspaceInTenantOperation(params) {
+  const { tenantId, workspaceId, tableName } = params;
+  const service = getDynamoControlService(tableName);
+  const { data: item } = await service.entities.workspace.get({ tenantId, id: workspaceId, sk: "CURRENT" }).go();
+  if (!item) {
+    throw new ConflictError(
+      `Workspace ${workspaceId} does not belong to tenant ${tenantId}; the workspace must be created in the referenced tenant before this resource can reference it.`,
+      { details: { tenantId, workspaceId } }
+    );
+  }
+}
+
 // src/data/operations/control/membership/membership-create-operation.ts
 async function createMembershipOperation(params) {
   const { context, body, tableName } = params;
@@ -4986,6 +4999,15 @@ async function createMembershipOperation(params) {
     resourceRecord,
     "workspace"
   );
+  if (workspaceIdFromResource !== void 0) {
+    const tenantIdFromResource = extractReferenceSlug(resourceRecord, "tenant");
+    const referencedTenantId = tenantIdFromResource ?? context.tenantId;
+    await assertWorkspaceInTenantOperation({
+      tenantId: referencedTenantId,
+      workspaceId: workspaceIdFromResource,
+      tableName
+    });
+  }
   const userProjectionItem = userIdFromResource !== void 0 ? buildMembershipUserProjectionItem({
     tenantId: context.tenantId,
     userId: userIdFromResource,
@@ -5061,6 +5083,22 @@ async function createMembershipRoute(req, res) {
     });
     return res.status(201).location(`${BASE_PATH.MEMBERSHIP}/${result.id}`).json({ ...result.resource, meta: result.meta });
   } catch (err) {
+    if (err instanceof ConflictError) {
+      return res.status(409).json({
+        resourceType: "OperationOutcome",
+        issue: [
+          { severity: "error", code: "conflict", diagnostics: err.message }
+        ]
+      });
+    }
+    if (err instanceof ValidationError) {
+      return res.status(400).json({
+        resourceType: "OperationOutcome",
+        issue: [
+          { severity: "error", code: "invalid", diagnostics: err.message }
+        ]
+      });
+    }
     console.error("POST Membership error:", err);
     return res.status(500).json({
       resourceType: "OperationOutcome",
@@ -5743,6 +5781,21 @@ function buildRoleAssignmentWorkspaceProjectionItem(input) {
   };
 }
 
+// src/data/operations/control/membership-constraints/assert-user-has-tenant-membership-operation.ts
+var TENANT_LANE_SK_PREFIX = "MEMBERSHIP#TENANT#";
+async function assertUserHasTenantMembershipOperation(params) {
+  const { userId, tenantId, tableName } = params;
+  const service = getDynamoControlService(tableName);
+  const result = await service.entities.membershipUserProjection.query.record({ userId }).begins({ sk: TENANT_LANE_SK_PREFIX }).go();
+  const matched = (result.data ?? []).some((row) => row.tenantId === tenantId);
+  if (!matched) {
+    throw new ConflictError(
+      `User ${userId} has no tenant-level Membership in tenant ${tenantId}; a Membership must exist before a RoleAssignment can be created.`,
+      { details: { userId, tenantId } }
+    );
+  }
+}
+
 // src/data/operations/control/roleassignment/roleassignment-create-operation.ts
 async function createRoleAssignmentOperation(params) {
   const { context, body, tableName } = params;
@@ -5772,6 +5825,22 @@ async function createRoleAssignmentOperation(params) {
     resourceRecord,
     "workspace"
   );
+  if (userIdFromResource !== void 0) {
+    const tenantIdFromResource = extractReferenceSlug2(resourceRecord, "tenant");
+    const referencedTenantId = tenantIdFromResource ?? context.tenantId;
+    await assertUserHasTenantMembershipOperation({
+      userId: userIdFromResource,
+      tenantId: referencedTenantId,
+      tableName
+    });
+    if (workspaceIdFromResource !== void 0) {
+      await assertWorkspaceInTenantOperation({
+        tenantId: referencedTenantId,
+        workspaceId: workspaceIdFromResource,
+        tableName
+      });
+    }
+  }
   const userProjectionItem = userIdFromResource !== void 0 && roleIdFromResource !== void 0 ? buildRoleAssignmentUserProjectionItem({
     tenantId: context.tenantId,
     userId: userIdFromResource,
@@ -5850,6 +5919,22 @@ async function createRoleAssignmentRoute(req, res) {
     });
     return res.status(201).location(`${BASE_PATH.ROLEASSIGNMENT}/${result.id}`).json({ ...result.resource, meta: result.meta });
   } catch (err) {
+    if (err instanceof ConflictError) {
+      return res.status(409).json({
+        resourceType: "OperationOutcome",
+        issue: [
+          { severity: "error", code: "conflict", diagnostics: err.message }
+        ]
+      });
+    }
+    if (err instanceof ValidationError) {
+      return res.status(400).json({
+        resourceType: "OperationOutcome",
+        issue: [
+          { severity: "error", code: "invalid", diagnostics: err.message }
+        ]
+      });
+    }
     console.error("POST RoleAssignment error:", err);
     return res.status(500).json({
       resourceType: "OperationOutcome",