@plandesk/api 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/access-control.d.ts

@@ -90,6 +90,7 @@ export declare const member: import("better-auth/plugins/access").Role<import("b
 }>;
 export declare const admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
     readonly project: ["create", "delete"];
+    readonly invitation: ["create", "cancel"];
     readonly task: readonly ["read", "create", "update", "delete"];
     readonly document: readonly ["read", "create", "update", "delete"];
     readonly edge: readonly ["read", "create", "update", "delete"];
@@ -98,7 +99,6 @@ export declare const admin: import("better-auth/plugins/access").Role<import("be
     readonly agent_run: readonly ["read", "create", "update", "delete"];
     readonly organization: readonly [];
     readonly member: readonly [];
-    readonly invitation: readonly [];
     readonly team: readonly [];
     readonly ac: readonly [];
     readonly apiKey: readonly [];

package/dist/access-control.js

@@ -35,6 +35,10 @@ export const member = ac.newRole(memberPermissions);
 export const admin = ac.newRole({
     ...memberPermissions,
     project: ['create', 'delete'],
+    // Admins can invite teammates (as member or admin) and cancel invites, but
+    // cannot manage members directly (member:update/delete) or mint owners —
+    // better-auth blocks a non-owner inviting the creatorRole. Owner-only stays owner-only.
+    invitation: ['create', 'cancel'],
 });
 export const owner = ac.newRole({
     ...memberPermissions,

package/dist/auth.js

@@ -192,6 +192,8 @@ const PUBLIC_AUTH_PATHS = new Set([
 ]);
 /** Invitation accept: invitee may have a session but zero org memberships yet. */
 const INVITATION_ACCEPT_PATH = /^\/api\/v1\/invitations\/[^/]+\/accept$/;
+/** Invitation preview (GET only): the claim page renders "invited to X" pre-auth. */
+const INVITATION_PREVIEW_PATH = /^\/api\/v1\/invitations\/[^/]+$/;
 export function isInvitationAcceptPath(path) {
     return INVITATION_ACCEPT_PATH.test(path);
 }
@@ -204,7 +206,8 @@ export function isPublicAuthPath(path) {
         return true;
     }
     // BA3c: accept is session-checked in-handler, not org-gated.
-    return isInvitationAcceptPath(path);
+    // Preview (GET /invitations/:id) is capability-gated by the unguessable id.
+    return isInvitationAcceptPath(path) || INVITATION_PREVIEW_PATH.test(path);
 }
 /**
  * Pre-join share surfaces: meta (render "X invited you"), join (claim a guest

package/dist/organizations.d.ts

@@ -30,6 +30,21 @@ export type OrganizationMemberSummary = {
 };
 /** List better-auth members of an organization (email/name joined from user). */
 export declare function listOrganizationMembers(auth: BetterAuthInstance, organizationId: string): Promise<OrganizationMemberSummary[]>;
+export type InvitationPreview = {
+    organizationId: string;
+    organizationName: string;
+    role: string;
+    email: string;
+    status: string;
+    expiresAt: string;
+};
+/**
+ * Preview an invitation by id (capability: holding the link is authorization).
+ * Returns the org name + role + invited email so the claim page can orient the
+ * invitee before they sign in. No session required — mirrors the link-only,
+ * deliver-by-hand model; ids are unguessable so enumeration is infeasible.
+ */
+export declare function getInvitationPreview(auth: BetterAuthInstance, invitationId: string): Promise<InvitationPreview | undefined>;
 /**
  * Display-friendly org for /auth/session and similar.
  * Falls back to DEFAULT_ORG_ID → "Personal" when better-auth is not configured

package/dist/organizations.js

@@ -68,6 +68,36 @@ export async function listOrganizationMembers(auth, organizationId) {
         };
     }));
 }
+/**
+ * Preview an invitation by id (capability: holding the link is authorization).
+ * Returns the org name + role + invited email so the claim page can orient the
+ * invitee before they sign in. No session required — mirrors the link-only,
+ * deliver-by-hand model; ids are unguessable so enumeration is infeasible.
+ */
+export async function getInvitationPreview(auth, invitationId) {
+    const adapter = (await auth.$context).adapter;
+    const invitation = await adapter.findOne({
+        model: 'invitation',
+        where: [{ field: 'id', value: invitationId }],
+    });
+    if (invitation === null) {
+        return undefined;
+    }
+    const org = await adapter.findOne({
+        model: 'organization',
+        where: [{ field: 'id', value: invitation.organizationId }],
+    });
+    return {
+        organizationId: invitation.organizationId,
+        organizationName: org?.name ?? '',
+        role: invitation.role,
+        email: invitation.email,
+        status: invitation.status,
+        expiresAt: invitation.expiresAt instanceof Date
+            ? invitation.expiresAt.toISOString()
+            : String(invitation.expiresAt),
+    };
+}
 /**
  * Display-friendly org for /auth/session and similar.
  * Falls back to DEFAULT_ORG_ID → "Personal" when better-auth is not configured

package/dist/routes/orgs.js

@@ -3,7 +3,7 @@ import { getProjectInOrg, importProject, InvalidExportVersionError, PLANDESK_EXP
 import { createScopedAgentKey } from '../agent-keys.js';
 import { getAuthContext, getOrgAuthContext } from '../auth-context.js';
 import { acceptOrganizationInvitation, createOrganizationInvitation, isAuthApiError, isInvitationRole, } from '../invitations.js';
-import { getOrganizationById, listOrganizationMembers } from '../organizations.js';
+import { getInvitationPreview, getOrganizationById, listOrganizationMembers, } from '../organizations.js';
 import { requirePermission } from '../permissions.js';
 function isPermissionSet(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
@@ -122,8 +122,9 @@ export function createOrgsRouter(db, options = {}) {
         return c.json({ members }, 200);
     });
     /**
-     * BA3c: invite by email (link-only, no mailer). Session owner only
-     * (member:create). Returns claimUrl for the inviter to deliver by hand.
+     * BA3c: invite by email (link-only, no mailer). Owners and admins may invite
+     * (invitation:create); better-auth still blocks a non-owner inviting an owner.
+     * Returns claimUrl for the inviter to deliver by hand.
      */
     router.post('/orgs/:id/invitations', async (c) => {
         const orgId = c.req.param('id');
@@ -131,11 +132,11 @@ export function createOrgsRouter(db, options = {}) {
             return c.json({ error: 'not_found' }, 404);
         }
         const authCtx = getOrgAuthContext();
-        // Session owner only — token/loopback cannot drive better-auth createInvitation.
+        // Session only — token/loopback cannot drive better-auth createInvitation.
         if (authCtx.kind !== 'session') {
             return c.json({ error: 'forbidden' }, 403);
         }
-        requirePermission(authCtx, 'member', 'create');
+        requirePermission(authCtx, 'invitation', 'create');
         if (betterAuth === undefined) {
             return c.json({ error: 'unavailable' }, 503);
         }
@@ -169,6 +170,25 @@ export function createOrgsRouter(db, options = {}) {
             throw err;
         }
     });
+    /**
+     * Preview an invitation (capability: the unguessable id is the authorization).
+     * Public so the claim page can render "you've been invited to X as Y" before
+     * the invitee signs in. Returns org name + role + invited email + status.
+     */
+    router.get('/invitations/:invitationId', async (c) => {
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const invitationId = c.req.param('invitationId');
+        if (invitationId.trim() === '') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        const preview = await getInvitationPreview(betterAuth, invitationId);
+        if (preview === undefined) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        return c.json(preview, 200);
+    });
     /**
      * BA3c: accept invitation. Session-gated at the handler (public path so
      * org-less invitees can reach it); not org-gated. Single-use → 410 on retry.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plandesk/api",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "type": "module",
   "exports": {
     ".": {
@@ -26,7 +26,7 @@
     "@libsql/kysely-libsql": "^0.4.1",
     "better-auth": "1.6.23",
     "hono": "^4.12.23",
-    "@plandesk/db": "1.0.0-beta.3"
+    "@plandesk/db": "1.0.0-beta.5"
   },
   "description": "Plan Desk REST + SSE API and service layer (local-first planning workspace).",
   "license": "MIT",