@ossy/users 1.13.0 → 1.13.2

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@ossy/users",
-  "description": "User domain — aggregate, events, and validators for the Ossy user model",
-  "version": "1.13.0",
+  "description": "User domain - aggregate, events, and validators for the Ossy user model",
+  "version": "1.13.2",
   "private": false,
   "type": "module",
   "main": "./src/index.js",
   "module": "./src/index.js",
   "exports": {
-    ".": "./src/index.js"
+    ".": "./src/index.js",
+    "./server": "./src/server.js"
   },
   "scripts": {
     "test": "NODE_OPTIONS=--experimental-vm-modules jest --verbose"
@@ -17,17 +18,22 @@
   "ossy": {
     "src": "./src"
   },
+  "peerDependencies": {
+    "@ossy/authentication": ">=1.0.0",
+    "@ossy/sdk-react": ">=1.0.0",
+    "react": ">=19.0.0 <20.0.0"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@ossy/observability": "^1.8.0",
+    "@ossy/observability": "^1.8.2",
     "nanoid": "^5.1.11"
   },
   "devDependencies": {
     "@jest/globals": "^30.2.0",
-    "@ossy/platform": "^1.39.0",
+    "@ossy/platform": "^1.39.2",
     "casual": "^1.6.2",
     "jest": "^30.2.0"
   },
@@ -35,5 +41,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "d9d31182be64a448d575da432af2830d909ad4b9"
+  "gitHead": "2b8745d57fee8b6c08787e2755b4df489291a5cd"
 }

package/src/create-api-token.action.js

@@ -1,35 +1 @@
-import jwt from 'jsonwebtoken'
-import { Aggregate } from '@ossy/event-store'
-import { Token, TokenEvents } from '@ossy/tokens'
-import { ConfigService } from '@ossy/platform'
-import { createLogger } from '@ossy/observability'
-
-const log = createLogger('users/create-api-token')
-
-const SECONDS_IN_100_YEARS = 60 * 60 * 24 * 365 * 100
-
-export const id = 'users/create-api-token'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const createdBy = payload?.userId ?? req?.userId
-  const name = payload?.name
-  const description = payload?.description
-
-  if (!name || typeof name !== 'string') {
-    log.debug('[users/create-api-token] No name provided')
-    throw Object.assign(new Error('No name provided'), { status: 400 })
-  }
-  if (!description || typeof description !== 'string') {
-    log.debug('[users/create-api-token] No description provided')
-    throw Object.assign(new Error('No description provided'), { status: 400 })
-  }
-
-  const expiresIn = SECONDS_IN_100_YEARS
-  const expiresAt = Date.now() + expiresIn * 1000
-  const token = jwt.sign({ sub: createdBy, type: 'Api' }, ConfigService.TokenSecret, { expiresIn })
-
-  const event = TokenEvents.Created({ name, description, createdBy, type: 'Api', subject: createdBy, token, expiresAt })
-
-  return Aggregate.Of(Token, event).then(Aggregate.View())
-}
+export const metadata = { id: 'users/create-api-token', access: 'authenticated' }

package/src/create-api-token.task.js

@@ -0,0 +1,34 @@
+import jwt from 'jsonwebtoken'
+import { Aggregate } from '@ossy/event-store'
+import { Token, TokenEvents } from '@ossy/tokens/server'
+import { ConfigService } from '@ossy/platform'
+import { createLogger } from '@ossy/observability'
+
+export const metadata = { id: 'users/create-api-token' }
+
+const log = createLogger('users/create-api-token')
+
+const SECONDS_IN_100_YEARS = 60 * 60 * 24 * 365 * 100
+
+export async function run({ payload, req }) {
+  const createdBy = payload?.userId ?? req?.userId
+  const name = payload?.name
+  const description = payload?.description
+
+  if (!name || typeof name !== 'string') {
+    log.debug('[users/create-api-token] No name provided')
+    throw Object.assign(new Error('No name provided'), { status: 400 })
+  }
+  if (!description || typeof description !== 'string') {
+    log.debug('[users/create-api-token] No description provided')
+    throw Object.assign(new Error('No description provided'), { status: 400 })
+  }
+
+  const expiresIn = SECONDS_IN_100_YEARS
+  const expiresAt = Date.now() + expiresIn * 1000
+  const token = jwt.sign({ sub: createdBy, type: 'Api' }, ConfigService.TokenSecret, { expiresIn })
+
+  const event = TokenEvents.Created({ name, description, createdBy, type: 'Api', subject: createdBy, token, expiresAt })
+
+  return Aggregate.Of(Token, event).then(Aggregate.View())
+}

package/src/get-api-tokens.action.js

@@ -1,20 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { createLogger } from '@ossy/observability'
-
-const log = createLogger('users/get-api-tokens')
-
-export const id = 'users/get-api-tokens'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const userId = payload?.userId ?? req?.userId
-
-  log.info('[users/get-api-tokens] Fetching API tokens for user')
-  const tokens = await Aggregate.Collection.find({
-    type: 'Token',
-    'state.subject': userId,
-    'state.type': 'Api',
-  }, { state: true }).toArray().then(docs => docs.map(d => d.state))
-
-  return tokens.map(({ token: _secret, ...meta }) => meta)
-}
+export const metadata = { id: 'users/get-api-tokens', access: 'authenticated' }

package/src/get-api-tokens.task.js

@@ -0,0 +1,19 @@
+import { Aggregate } from '@ossy/event-store'
+import { createLogger } from '@ossy/observability'
+
+export const metadata = { id: 'users/get-api-tokens' }
+
+const log = createLogger('users/get-api-tokens')
+
+export async function run({ payload, req }) {
+  const userId = payload?.userId ?? req?.userId
+
+  log.info('[users/get-api-tokens] Fetching API tokens for user')
+  const tokens = await Aggregate.Collection.find({
+    type: 'Token',
+    'state.subject': userId,
+    'state.type': 'Api',
+  }, { state: true }).toArray().then(docs => docs.map(d => d.state))
+
+  return tokens.map(({ token: _secret, ...meta }) => meta)
+}

package/src/get-current-user-history.action.js

@@ -1,11 +1 @@
-import { EventStore } from '@ossy/event-store'
-import { User } from '@ossy/users'
-
-export const id = 'users/get-current-user-history'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const userId = payload?.userId ?? req?.userId
-  const events = await EventStore.GetEventStream({ aggregateId: userId, fromVersion: 0 })
-  return User.History(events)
-}
+export const metadata = { id: 'users/get-current-user-history', access: 'authenticated' }

package/src/get-current-user-history.task.js

@@ -0,0 +1,10 @@
+import { EventStore } from '@ossy/event-store'
+import { User } from '@ossy/users/server'
+
+export const metadata = { id: 'users/get-current-user-history' }
+
+export async function run({ payload, req }) {
+  const userId = payload?.userId ?? req?.userId
+  const events = await EventStore.GetEventStream({ aggregateId: userId, fromVersion: 0 })
+  return User.History(events)
+}

package/src/index.js

@@ -1,4 +1,7 @@
-export * from './user.aggregate.js'
-export * from './users.events.js'
-export * from './users.validators.js'
-export * from './users.queries.js'
+export { metadata as GetUserApiTokens } from './get-api-tokens.action.js'
+export { metadata as CreateUserApiToken } from './create-api-token.action.js'
+export { metadata as InvalidateApiToken } from './invalidate-api-token.action.js'
+export { metadata as UpdateUserDetails } from './update-details.action.js'
+export { metadata as GetCurrentUserHistory } from './get-current-user-history.action.js'
+export { metadata as JoinWorkspace } from './join-workspace.action.js'
+export { metadata as LeaveWorkspace } from './leave-workspace.action.js'

package/src/invalidate-api-token.action.js

@@ -1,16 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { Token, TokenEvents } from '@ossy/tokens'
-
-export const id = 'users/invalidate-api-token'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const createdBy = payload?.userId ?? req?.userId
-  const tokenId = payload?.tokenId ?? req?.params?.tokenId
-
-  if (!tokenId) throw Object.assign(new Error('tokenId is required'), { status: 400 })
-
-  const event = TokenEvents.Revoked({ createdBy })
-  await Aggregate.Of(Token, tokenId).then(Aggregate.Add(event))
-  return ''
-}
+export const metadata = { id: 'users/invalidate-api-token', access: 'authenticated' }

package/src/invalidate-api-token.task.js

@@ -0,0 +1,15 @@
+import { Aggregate } from '@ossy/event-store'
+import { Token, TokenEvents } from '@ossy/tokens/server'
+
+export const metadata = { id: 'users/invalidate-api-token' }
+
+export async function run({ payload, req }) {
+  const createdBy = payload?.userId ?? req?.userId
+  const tokenId = payload?.tokenId ?? req?.params?.tokenId
+
+  if (!tokenId) throw Object.assign(new Error('tokenId is required'), { status: 400 })
+
+  const event = TokenEvents.Revoked({ createdBy })
+  await Aggregate.Of(Token, tokenId).then(Aggregate.Add(event))
+  return ''
+}

package/src/join-workspace.action.js

@@ -1,18 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { User, UsersEvents } from '@ossy/users'
-
-export const id = 'users/join-workspace'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const userId = payload?.targetUserId ?? payload?.userId ?? req?.userId
-  const workspaceId = payload?.workspaceId
-  const createdBy = payload?.createdBy ?? userId
-
-  if (!workspaceId) throw Object.assign(new Error('workspaceId is required'), { status: 400 })
-
-  await Aggregate.Of(User, userId)
-    .then(Aggregate.Add(UsersEvents.WorkspaceJoined({ workspaceId, createdBy })))
-    .then(Aggregate.Save())
-  return null
-}
+export const metadata = { id: 'users/join-workspace', access: 'authenticated' }

package/src/join-workspace.task.js

@@ -0,0 +1,17 @@
+import { Aggregate } from '@ossy/event-store'
+import { User, UsersEvents } from '@ossy/users/server'
+
+export const metadata = { id: 'users/join-workspace' }
+
+export async function run({ payload, req }) {
+  const userId = payload?.targetUserId ?? payload?.userId ?? req?.userId
+  const workspaceId = payload?.workspaceId
+  const createdBy = payload?.createdBy ?? userId
+
+  if (!workspaceId) throw Object.assign(new Error('workspaceId is required'), { status: 400 })
+
+  await Aggregate.Of(User, userId)
+    .then(Aggregate.Add(UsersEvents.WorkspaceJoined({ workspaceId, createdBy })))
+    .then(Aggregate.Save())
+  return null
+}

package/src/leave-workspace.action.js

@@ -1,17 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { User, UsersEvents } from '@ossy/users'
-
-export const id = 'users/leave-workspace'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const userId = payload?.userId ?? req?.userId
-  const workspaceId = payload?.workspaceId
-
-  if (!workspaceId) throw Object.assign(new Error('workspaceId is required'), { status: 400 })
-
-  await Aggregate.Of(User, userId)
-    .then(Aggregate.Add(UsersEvents.WorkspaceLeft({ workspaceId, createdBy: userId })))
-    .then(Aggregate.Save())
-  return null
-}
+export const metadata = { id: 'users/leave-workspace', access: 'authenticated' }

package/src/leave-workspace.task.js

@@ -0,0 +1,16 @@
+import { Aggregate } from '@ossy/event-store'
+import { User, UsersEvents } from '@ossy/users/server'
+
+export const metadata = { id: 'users/leave-workspace' }
+
+export async function run({ payload, req }) {
+  const userId = payload?.userId ?? req?.userId
+  const workspaceId = payload?.workspaceId
+
+  if (!workspaceId) throw Object.assign(new Error('workspaceId is required'), { status: 400 })
+
+  await Aggregate.Of(User, userId)
+    .then(Aggregate.Add(UsersEvents.WorkspaceLeft({ workspaceId, createdBy: userId })))
+    .then(Aggregate.Save())
+  return null
+}

package/src/server.js

@@ -0,0 +1,4 @@
+export * from './user.aggregate.js'
+export * from './users.events.js'
+export * from './users.validators.js'
+export * from './users.queries.js'

package/src/update-details.action.js

@@ -1,29 +1 @@
-import { Aggregate } from '@ossy/event-store'
-import { User, UsersEvents } from '@ossy/users'
-
-export const id = 'users/update-details'
-export const access = 'authenticated'
-
-export async function run({ payload, req }) {
-  const createdBy = payload?.userId ?? req?.userId
-  const currentUser = payload?.currentUser ?? req?.user
-
-  const firstName = (payload?.firstName ?? currentUser?.firstName)?.trim?.()
-  const lastName = (payload?.lastName ?? currentUser?.lastName)?.trim?.()
-
-  if (!firstName || typeof firstName !== 'string') {
-    throw Object.assign(new Error('No firstName provided'), { status: 400 })
-  }
-  if (!lastName || typeof lastName !== 'string') {
-    throw Object.assign(new Error('No lastName provided'), { status: 400 })
-  }
-
-  const hasChanges = firstName + lastName !== currentUser?.firstName + currentUser?.lastName
-  if (!hasChanges) {
-    throw Object.assign(new Error('No changes provided'), { status: 400 })
-  }
-
-  return Aggregate.Of(User, createdBy)
-    .then(Aggregate.Add(UsersEvents.NameUpdated({ firstName, lastName, createdBy })))
-    .then(Aggregate.View())
-}
+export const metadata = { id: 'users/update-details', access: 'authenticated' }

package/src/update-details.task.js

@@ -0,0 +1,28 @@
+import { Aggregate } from '@ossy/event-store'
+import { User, UsersEvents } from '@ossy/users/server'
+
+export const metadata = { id: 'users/update-details' }
+
+export async function run({ payload, req }) {
+  const createdBy = payload?.userId ?? req?.userId
+  const currentUser = payload?.currentUser ?? req?.user
+
+  const firstName = (payload?.firstName ?? currentUser?.firstName)?.trim?.()
+  const lastName = (payload?.lastName ?? currentUser?.lastName)?.trim?.()
+
+  if (!firstName || typeof firstName !== 'string') {
+    throw Object.assign(new Error('No firstName provided'), { status: 400 })
+  }
+  if (!lastName || typeof lastName !== 'string') {
+    throw Object.assign(new Error('No lastName provided'), { status: 400 })
+  }
+
+  const hasChanges = firstName + lastName !== currentUser?.firstName + currentUser?.lastName
+  if (!hasChanges) {
+    throw Object.assign(new Error('No changes provided'), { status: 400 })
+  }
+
+  return Aggregate.Of(User, createdBy)
+    .then(Aggregate.Add(UsersEvents.NameUpdated({ firstName, lastName, createdBy })))
+    .then(Aggregate.View())
+}

package/src/users.spec.js

@@ -1,9 +1,10 @@
 import casual from 'casual'
 import { TestUtil, getApiTestBaseUrl, getSetCookieHeader } from '@ossy/platform/test'
 
-const isUUID = x =>
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-    .test(x)
+const authHeaders = (token) => ({
+  'Content-Type': 'application/json',
+  Authorization: token,
+})
 
 const invalidEmails = [
   undefined,
@@ -22,36 +23,32 @@ const invalidVerifySignInCases = [
   { label: 'numeric string', query: 'token=2', status: 401, body: '' },
 ]
 
-function invalidSignUpBody(invalidEmail) {
+function invalidSignUpPayload(invalidEmail) {
   const o = { firstName: 'Test', lastName: 'User' }
   if (invalidEmail !== undefined) o.email = invalidEmail
-  return JSON.stringify(o)
+  return o
 }
 
-describe('[/users/sign-up][POST]', () => {
+describe('[authentication/sign-up]', () => {
 
   describe('given an email that is not already in use', () => {
 
-    it('must return OK 200', () => TestUtil.AssertResponse({
-        endpoint: '/users/sign-up',
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json'},
-        body: TestUtil.signUpBody({ email: casual.email }),
-        expectedResponseStatus: 200,
-        expectedResponseBody: ''
+    it('must return OK 200', () => TestUtil.AssertActionResponse({
+      actionId: 'authentication/sign-up',
+      body: TestUtil.signUpBody({ email: casual.email }),
+      expectedResponseStatus: 200,
+      expectedResponseBody: { ok: true }
     }))
 
     it('must produce a SignedUp event', async () => {
 
       const email = casual.email
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
       await TestUtil.AssertEventExist({
@@ -70,32 +67,28 @@ describe('[/users/sign-up][POST]', () => {
       const email = casual.email
 
       const signUpTestRequest = {
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       }
 
-      await TestUtil.AssertResponse(signUpTestRequest)
-      await TestUtil.AssertResponse(signUpTestRequest)
+      await TestUtil.AssertActionResponse(signUpTestRequest)
+      await TestUtil.AssertActionResponse(signUpTestRequest)
     })
 
     it('must not produce another SignUp event', async () => {
       const email = `dup-${Date.now()}-${casual.email}`
 
       const signUpTestRequest = {
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       }
 
-      await TestUtil.AssertResponse(signUpTestRequest)
-      await TestUtil.AssertResponse(signUpTestRequest)
+      await TestUtil.AssertActionResponse(signUpTestRequest)
+      await TestUtil.AssertActionResponse(signUpTestRequest)
 
       const signUpEvents = await TestUtil.GetEvents({
         aggregateType: 'User',
@@ -113,13 +106,11 @@ describe('[/users/sign-up][POST]', () => {
     invalidEmails.forEach(invalidEmail => {
       it(
         `must return BAD REQUEST 400 for invalid email: ${invalidEmail}`,
-        () => TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: invalidSignUpBody(invalidEmail),
+        () => TestUtil.AssertActionResponse({
+          actionId: 'authentication/sign-up',
+          payload: invalidSignUpPayload(invalidEmail),
           expectedResponseStatus: 400,
-          expectedResponseBody: 'Invalid email'
+          expectedResponseBody: { error: 'Invalid email' }
       })
     )
     })
@@ -127,31 +118,25 @@ describe('[/users/sign-up][POST]', () => {
 
 })
 
-describe('[/users/sign-in][POST]', () => {
+describe('[authentication/request-sign-in]', () => {
 
   describe('given an email that is in use', () => {
 
     it('must return an OK 200 response', async () => {
       const email = casual.email
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
     })
@@ -160,24 +145,18 @@ describe('[/users/sign-in][POST]', () => {
 
       const email = casual.email
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
       const signedUpEvent = await TestUtil.GetEvent({
@@ -195,14 +174,11 @@ describe('[/users/sign-in][POST]', () => {
   describe('given an email that is not in use', () => {
 
     it('must, for security reasons, return an OK 200 response', async () => {
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email: casual.email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/request-sign-in',
+        payload: { email: casual.email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
     })
 
@@ -210,14 +186,11 @@ describe('[/users/sign-in][POST]', () => {
 
       const verificationTokensBefore = await TestUtil.countVerificationTokenEvents()
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          description: '',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email: casual.email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/request-sign-in',
+        payload: { email: casual.email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
       const verificationTokensAfter = await TestUtil.countVerificationTokenEvents()
@@ -233,13 +206,11 @@ describe('[/users/sign-in][POST]', () => {
     invalidEmails.forEach(invalidEmail => {
       it(
         `must return BAD REQUEST 400 for invalid email: ${invalidEmail}`,
-        () => TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email: invalidEmail }),
+        () => TestUtil.AssertActionResponse({
+          actionId: 'authentication/request-sign-in',
+          payload: { email: invalidEmail },
           expectedResponseStatus: 400,
-          expectedResponseBody: { message: 'No email provided' }
+          expectedResponseBody: { error: 'No email provided' }
       })
     )
     })
@@ -253,13 +224,11 @@ describe('[/users/verify-sign-in][GET]', () => {
     it('must return OK 200 and an auth cookie and must produce a SignInVerified event', async () => {
       const email = casual.email
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
       const signedUpEvent = await TestUtil.GetEvent({
@@ -294,22 +263,18 @@ describe('[/users/verify-sign-in][GET]', () => {
     it('must return OK 200 and an auth cookie and must produce a SignInVerified event', async () => {
       const email = casual.email
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-up',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: TestUtil.signUpBody({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
-      await TestUtil.AssertResponse({
-          endpoint: '/users/sign-in',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json'},
-          body: JSON.stringify({ email }),
-          expectedResponseStatus: 200,
-          expectedResponseBody: ''
+      await TestUtil.AssertActionResponse({
+        actionId: 'authentication/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true }
       })
 
       const signedUpEvent = await TestUtil.GetEvent({
@@ -369,22 +334,23 @@ describe('[/users/verify-sign-in][GET]', () => {
 
 })
 
-describe('[/users/me][GET]', () => {
+describe('[authentication/get-current-user]', () => {
 
-  TestUtil.AssertAuthenticationNeeded({
-    endpoint: '/users/me',
-    method: 'GET',
-    headers: { 'Content-Type': 'application/json' },
+  describe('given no auth token is provided', () => {
+    it('must return null', async () => {
+      const response = await TestUtil.InvokeAction({ actionId: 'authentication/get-current-user' })
+      expect(response.status).toEqual(200)
+      await expect(response.json()).resolves.toBeNull()
+    })
   })
 
   describe('given an auth token', () => {
     it('must return OK 200 with a view of the current user state', async () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me',
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'authentication/get-current-user',
+        headers: authHeaders(user.token),
       })
 
       const body = await response.json()
@@ -404,22 +370,19 @@ describe('[/users/me][GET]', () => {
   })
 })
 
-describe('[/users/me/history][GET]', () => {
+describe('[users/get-current-user-history]', () => {
 
-  TestUtil.AssertAuthenticationNeeded({
-    endpoint: '/users/me/history',
-    method: 'GET',
-    headers: { 'Content-Type': 'application/json' },
+  TestUtil.AssertActionAuthenticationNeeded({
+    actionId: 'users/get-current-user-history',
   })
 
   describe('given an auth token', () => {
     it('must return OK 200 with a view of the history of the current user', async () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me/history',
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/get-current-user-history',
+        headers: authHeaders(user.token),
       })
 
       const body = await response.json()
@@ -436,24 +399,21 @@ describe('[/users/me/history][GET]', () => {
   })
 })
 
-describe('[/users/me/tokens][POST]', () => {
+describe('[users/create-api-token]', () => {
 
-  TestUtil.AssertAuthenticationNeeded({
-    endpoint: '/users/me/tokens',
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ name: 't', description: 'd' })
+  TestUtil.AssertActionAuthenticationNeeded({
+    actionId: 'users/create-api-token',
+    payload: { name: 't', description: 'd' }
   })
 
   describe('given a valid auth token', () => {
     it('must return OK 200 with an API token and produce an ApiTokenCreated event', async () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me/tokens',
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token },
-        body: JSON.stringify({ name: 'cli', description: casual.sentence })
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/create-api-token',
+        headers: authHeaders(user.token),
+        payload: { name: 'cli', description: casual.sentence }
       })
 
       const responseBody = await response.json()
@@ -487,11 +447,10 @@ describe('[/users/me/tokens][POST]', () => {
         else if (invalidDescription === '') payload = { name: 'token', description: '' }
         else payload = invalidDescription
 
-        const response = await TestUtil.MakeRequest({
-          endpoint: '/users/me/tokens',
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json', 'Authorization': user.token },
-          body: JSON.stringify(payload)
+        const response = await TestUtil.InvokeAction({
+          actionId: 'users/create-api-token',
+          headers: authHeaders(user.token),
+          payload,
         })
 
         const responseBody = await response.json()
@@ -504,7 +463,7 @@ describe('[/users/me/tokens][POST]', () => {
 
         expect(response.status).toEqual(400)
         expect(response.headers.get('Content-Type').includes('application/json')).toEqual(true)
-        expect(responseBody).toEqual('')
+        expect(responseBody).toEqual({ error: 'No description provided' })
         await expect(event).rejects.toEqual(undefined)
       })
     })
@@ -512,12 +471,10 @@ describe('[/users/me/tokens][POST]', () => {
 
 })
 
-describe('[/users/me/tokens][GET]', () => {
+describe('[users/get-api-tokens]', () => {
 
-  TestUtil.AssertAuthenticationNeeded({
-    endpoint: '/users/me/tokens',
-    method: 'GET',
-    headers: { 'Content-Type': 'application/json' },
+  TestUtil.AssertActionAuthenticationNeeded({
+    actionId: 'users/get-api-tokens',
   })
 
   describe('given authentication token is provided', () => {
@@ -525,17 +482,15 @@ describe('[/users/me/tokens][GET]', () => {
 
       const user = await TestUtil.GetAuthenticatedTestUser()
 
-      const token = await TestUtil.MakeRequest({
-        endpoint: '/users/me/tokens',
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token },
-        body: JSON.stringify({ name: 'list-test', description: casual.sentence })
+      const token = await TestUtil.InvokeAction({
+        actionId: 'users/create-api-token',
+        headers: authHeaders(user.token),
+        payload: { name: 'list-test', description: casual.sentence }
       }).then(response => response.json())
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me/tokens',
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token  }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/get-api-tokens',
+        headers: authHeaders(user.token),
       })
 
       const responseBody = await response.json()
@@ -560,22 +515,20 @@ describe('[/users/me/tokens][GET]', () => {
 })
 
 const createApiToken = async (user) => {
-  const token = await TestUtil.MakeRequest({
-    endpoint: '/users/me/tokens',
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'Authorization': user.token },
-    body: JSON.stringify({ name: 'delete-test', description: casual.sentence })
+  const token = await TestUtil.InvokeAction({
+    actionId: 'users/create-api-token',
+    headers: authHeaders(user.token),
+    payload: { name: 'delete-test', description: casual.sentence }
   }).then(response => response.json())
 
   return token
 }
 
-describe('[/users/me/tokens/:tokenId][DELETE]', () => {
+describe('[users/invalidate-api-token]', () => {
 
-  TestUtil.AssertAuthenticationNeeded({
-    endpoint: `/users/me/tokens/123`,
-    method: 'DELETE',
-    headers: { 'Content-Type': 'application/json' },
+  TestUtil.AssertActionAuthenticationNeeded({
+    actionId: 'users/invalidate-api-token',
+    payload: { tokenId: '123' },
   })
 
   describe('authentication with user token', () => {
@@ -584,10 +537,10 @@ describe('[/users/me/tokens/:tokenId][DELETE]', () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
       const token = await createApiToken(user)
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: `/users/me/tokens/${token.id}`,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token  }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/invalidate-api-token',
+        headers: authHeaders(user.token),
+        payload: { tokenId: token.id },
       })
 
       const responseBody = await response.json()
@@ -608,16 +561,15 @@ describe('[/users/me/tokens/:tokenId][DELETE]', () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
       const token = await createApiToken(user)
 
-      await TestUtil.MakeRequest({
-        endpoint: `/users/me/tokens/${token.id}`,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token  }
+      await TestUtil.InvokeAction({
+        actionId: 'users/invalidate-api-token',
+        headers: authHeaders(user.token),
+        payload: { tokenId: token.id },
       })
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me/tokens',
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json', 'Authorization': user.token  }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/get-api-tokens',
+        headers: authHeaders(user.token),
       })
 
       const responseBody = await response.json()
@@ -634,10 +586,10 @@ describe('[/users/me/tokens/:tokenId][DELETE]', () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
       const token = await createApiToken(user)
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: `/users/me/tokens/${token.id}`,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', 'Authorization': token.token  }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/invalidate-api-token',
+        headers: authHeaders(token.token),
+        payload: { tokenId: token.id },
       })
 
       const responseBody = await response.json()
@@ -658,22 +610,21 @@ describe('[/users/me/tokens/:tokenId][DELETE]', () => {
       const user = await TestUtil.GetAuthenticatedTestUser()
       const token = await createApiToken(user)
 
-      await TestUtil.MakeRequest({
-        endpoint: `/users/me/tokens/${token.id}`,
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json', 'Authorization': token.token  }
+      await TestUtil.InvokeAction({
+        actionId: 'users/invalidate-api-token',
+        headers: authHeaders(token.token),
+        payload: { tokenId: token.id },
       })
 
-      const response = await TestUtil.MakeRequest({
-        endpoint: '/users/me/tokens',
-        method: 'GET',
-        headers: { 'Content-Type': 'application/json', 'Authorization': token.token  }
+      const response = await TestUtil.InvokeAction({
+        actionId: 'users/get-api-tokens',
+        headers: authHeaders(token.token),
       })
 
       const responseBody = await response.json()
 
       expect(response.status).toEqual(401)
-      expect(responseBody).toEqual('')
+      expect(responseBody).toEqual({ error: 'Unauthorized' })
     })
 
   })

package/src/users.startup.js

@@ -1,5 +1,5 @@
 import { Aggregate } from '@ossy/event-store'
-import { UsersEvents, User } from './index.js'
+import { UsersEvents, User } from './server.js'
 import { createLogger } from '@ossy/observability'
 
 const log = createLogger('users')

package/src/list.api.js

@@ -1,23 +0,0 @@
-import { ActionService } from '@ossy/platform'
-
-export const metadata = {
-  id: 'users.list',
-  path: '/api/v0/users',
-}
-
-export default async function handle(req, res) {
-  if (req.method !== 'GET') {
-    res.setHeader('Allow', 'GET')
-    res.status(405).json({ error: 'Method Not Allowed' })
-    return
-  }
-  try {
-    const users = await ActionService.invoke('workspaces/get-users', {
-      payload: { workspaceId: req.workspaceId },
-      req,
-    })
-    res.json(users)
-  } catch (err) {
-    res.status(err?.status ?? 500).json()
-  }
-}

package/src/me-history.api.js

@@ -1,23 +0,0 @@
-import { ActionService } from '@ossy/platform'
-
-export const metadata = {
-  id: 'users.me.history',
-  path: '/api/v0/users/me/history',
-}
-
-export default async function handle(req, res) {
-  if (req.method !== 'GET') {
-    res.setHeader('Allow', 'GET')
-    res.status(405).json({ error: 'Method Not Allowed' })
-    return
-  }
-  try {
-    const history = await ActionService.invoke('users/get-current-user-history', {
-      payload: { userId: req.userId },
-      req,
-    })
-    res.status(200).json(history)
-  } catch (err) {
-    res.status(err?.status ?? 500).json('')
-  }
-}

package/src/me-token.api.js

@@ -1,32 +0,0 @@
-import { ActionService } from '@ossy/platform'
-
-export const metadata = {
-  id: 'users.me.token',
-  path: '/api/v0/users/me/tokens/:tokenId',
-}
-
-export default async function handle(req, res) {
-  if (req.method !== 'DELETE') {
-    res.setHeader('Allow', 'DELETE')
-    res.status(405).json({ error: 'Method Not Allowed' })
-    return
-  }
-
-  const pathname = (req.path || new URL(req.originalUrl, 'http://localhost').pathname).replace(/\/+$/, '')
-  const m = pathname.match(/^\/api\/v0\/users\/me\/tokens\/([^/]+)$/)
-  if (!m) {
-    res.status(404).json('')
-    return
-  }
-
-  const tokenId = decodeURIComponent(m[1])
-  try {
-    await ActionService.invoke('users/invalidate-api-token', {
-      payload: { userId: req.userId, tokenId },
-      req,
-    })
-    res.status(200).json('')
-  } catch (err) {
-    res.status(err?.status ?? 500).json()
-  }
-}

package/src/me-tokens.api.js

@@ -1,35 +0,0 @@
-import { ActionService } from '@ossy/platform'
-
-export const metadata = {
-  id: 'users.me.tokens',
-  path: '/api/v0/users/me/tokens',
-}
-
-export default async function handle(req, res) {
-  if (req.method === 'GET') {
-    try {
-      const tokens = await ActionService.invoke('users/get-api-tokens', {
-        payload: { userId: req.userId },
-        req,
-      })
-      res.json(tokens)
-    } catch (err) {
-      res.status(err?.status ?? 500).json()
-    }
-    return
-  }
-  if (req.method === 'POST') {
-    try {
-      const token = await ActionService.invoke('users/create-api-token', {
-        payload: { userId: req.userId, name: req.body?.name, description: req.body?.description },
-        req,
-      })
-      res.json(token)
-    } catch (err) {
-      res.status(err?.status ?? 400).json('')
-    }
-    return
-  }
-  res.setHeader('Allow', 'GET, POST')
-  res.status(405).json({ error: 'Method Not Allowed' })
-}

package/src/me.api.js

@@ -1,41 +0,0 @@
-import { ActionService } from '@ossy/platform'
-
-export const metadata = {
-  id: 'users.me',
-  path: '/api/v0/users/me',
-}
-
-export default async function handle(req, res) {
-  if (req.method === 'GET' || req.method === 'POST') {
-    try {
-      if (!req.user || req.user.anonymous) {
-        res.status(401).json('')
-        return
-      }
-      const user = await ActionService.invoke('authentication/get-current-user', { req })
-      res.status(200).json(user)
-    } catch (err) {
-      res.status(err?.status ?? 500).json('')
-    }
-    return
-  }
-  if (req.method === 'PUT') {
-    try {
-      const user = await ActionService.invoke('users/update-details', {
-        payload: {
-          userId: req.userId,
-          firstName: req.body?.firstName,
-          lastName: req.body?.lastName,
-          currentUser: req.user,
-        },
-        req,
-      })
-      res.status(200).json(user)
-    } catch (err) {
-      res.status(err?.status ?? 400).json(err?.message)
-    }
-    return
-  }
-  res.setHeader('Allow', 'GET, POST, PUT')
-  res.status(405).json({ error: 'Method Not Allowed' })
-}

package/src/workspace-membership.api.js

@@ -1,72 +0,0 @@
-import { ConfigService } from '@ossy/platform'
-import { ActionService } from '@ossy/platform'
-import { createLogger } from '@ossy/observability'
-
-const log = createLogger('users')
-
-function isBotUser(req) {
-  return req.userId === ConfigService.BotUserId
-}
-
-export const metadata = {
-  id: 'users.workspace-membership',
-  path: '/api/v0/users/:userId/workspaces',
-}
-
-export default async function handle(req, res) {
-  const pathname = (req.path || new URL(req.originalUrl, 'http://localhost').pathname).replace(/\/+$/, '')
-
-  const deleteMatch = pathname.match(/^\/api\/v0\/users\/([^/]+)\/workspaces\/([^/]+)$/)
-  if (deleteMatch && req.method === 'DELETE') {
-    const userId = decodeURIComponent(deleteMatch[1])
-    const workspaceId = decodeURIComponent(deleteMatch[2])
-
-    if (!isBotUser(req)) {
-      res.status(403).json({ error: 'Forbidden' })
-      return
-    }
-
-    try {
-      await ActionService.invoke('users/leave-workspace', {
-        payload: { userId, workspaceId },
-        req,
-      })
-      res.status(204).send()
-    } catch (err) {
-      log.error('[workspace-membership.api] remove error', undefined, err)
-      res.status(err?.status ?? 500).json({ error: 'Internal Server Error' })
-    }
-    return
-  }
-
-  const postMatch = pathname.match(/^\/api\/v0\/users\/([^/]+)\/workspaces$/)
-  if (postMatch && req.method === 'POST') {
-    const userId = decodeURIComponent(postMatch[1])
-    const workspaceId = req.body?.workspaceId
-    const createdBy = req.body?.createdBy ?? userId
-
-    if (!isBotUser(req)) {
-      res.status(403).json({ error: 'Forbidden' })
-      return
-    }
-
-    if (!workspaceId) {
-      res.status(400).json({ error: 'workspaceId is required' })
-      return
-    }
-
-    try {
-      await ActionService.invoke('users/join-workspace', {
-        payload: { targetUserId: userId, workspaceId, createdBy },
-        req,
-      })
-      res.status(204).send()
-    } catch (err) {
-      log.error('[workspace-membership.api] add error', undefined, err)
-      res.status(err?.status ?? 500).json({ error: 'Internal Server Error' })
-    }
-    return
-  }
-
-  res.status(404).json({ error: 'Not Found' })
-}