@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/routes/web/teams.ts

@@ -0,0 +1,850 @@
+import { Hono } from 'hono'
+import { randomUUID, createHash } from 'node:crypto'
+import { getDb } from '../../db/sqlite'
+import { sessionAuth } from '../../auth/middleware'
+import { SYSTEM_USER_ID } from '../../auth/constants'
+
+const app = new Hono()
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const SLUG_RE = /^[a-z0-9-]{3,32}$/
+
+function isValidSlug(slug: string): boolean {
+  return SLUG_RE.test(slug)
+}
+
+interface UserInfo {
+  userId: string
+  isAdmin: boolean
+  role: string
+}
+
+/**
+ * Resolve the current user's info from context.
+ * System admin (via API key bypass) gets userId=SYSTEM_USER_ID.
+ * Also checks DB role for users who logged in as admin.
+ */
+function getUserInfo(c: import('hono').Context): UserInfo {
+  const userId = c.get('userId') as string
+  const isAdminCtx = c.get('isAdmin') as boolean
+
+  if (userId === SYSTEM_USER_ID || isAdminCtx) {
+    return { userId: SYSTEM_USER_ID, isAdmin: true, role: 'admin' }
+  }
+
+  // Look up user role from DB
+  const db = getDb()
+  const row = db
+    .query('SELECT role FROM users WHERE id = $id')
+    .get({ $id: userId }) as { role: string } | null
+
+  const role = row?.role || 'guest'
+
+  return {
+    userId,
+    isAdmin: role === 'admin',
+    role,
+  }
+}
+
+/**
+ * Get the user's role within a specific team.
+ * Returns null if user is not a member.
+ * System admins get 'owner' implicitly.
+ */
+function getTeamRole(teamId: string, user: UserInfo): string | null {
+  if (user.isAdmin) return 'owner'
+
+  const db = getDb()
+  const row = db
+    .query(
+      'SELECT role FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: user.userId }) as {
+    role: string
+  } | null
+
+  return row?.role || null
+}
+
+function getTeamOr404(c: import('hono').Context, teamId: string) {
+  const db = getDb()
+  const team = db
+    .query('SELECT * FROM teams WHERE id = $id AND deleted_at IS NULL')
+    .get({ $id: teamId }) as Record<string, unknown> | null
+  if (!team) {
+    return { error: c.json({ error: 'Team not found' }, 404) }
+  }
+  return { team }
+}
+
+// ---------------------------------------------------------------------------
+// Auth middleware wrapper
+// ---------------------------------------------------------------------------
+
+async function withAuth(c: import('hono').Context, next: import('hono').Next) {
+  const result = await sessionAuth(c, next)
+  if (result) return result
+}
+
+// ---------------------------------------------------------------------------
+// POST /teams — Create team
+// ---------------------------------------------------------------------------
+
+app.post('/teams', withAuth, async c => {
+  const user = getUserInfo(c)
+
+  // Guest cannot create teams
+  if (!user.isAdmin && user.role === 'guest') {
+    return c.json({ error: 'Guests cannot create teams' }, 403)
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { name, slug, description } = body as {
+    name?: string
+    slug?: string
+    description?: string
+  }
+
+  if (!name || typeof name !== 'string') {
+    return c.json({ error: 'Name is required' }, 400)
+  }
+  if (!slug || typeof slug !== 'string') {
+    return c.json({ error: 'Slug is required' }, 400)
+  }
+  if (!isValidSlug(slug)) {
+    return c.json(
+      {
+        error:
+          'Invalid slug: must be 3-32 lowercase letters, digits, or hyphens',
+      },
+      400,
+    )
+  }
+
+  const db = getDb()
+
+  // Check slug uniqueness
+  const existing = db
+    .query('SELECT id FROM teams WHERE slug = $slug AND deleted_at IS NULL')
+    .get({ $slug: slug })
+  if (existing) {
+    return c.json({ error: 'Slug already taken' }, 409)
+  }
+
+  const teamId = `team_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+
+  // For system admin, use the first admin user as created_by
+  let createdBy = user.userId
+  if (user.isAdmin) {
+    const adminUser = db
+      .query("SELECT id FROM users WHERE role = 'admin' LIMIT 1")
+      .get() as { id: string } | null
+    createdBy = adminUser?.id || user.userId
+  }
+
+  db.query(
+    `INSERT INTO teams (id, name, slug, description, created_by, created_at, updated_at)
+     VALUES ($id, $name, $slug, $desc, $by, $now, $now)`,
+  ).run({
+    $id: teamId,
+    $name: name,
+    $slug: slug,
+    $desc: description || null,
+    $by: createdBy,
+    $now: now,
+  })
+
+  // Creator becomes owner
+  db.query(
+    `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+     VALUES ($teamId, $userId, 'owner', $now, $addedBy)`,
+  ).run({ $teamId: teamId, $userId: createdBy, $addedBy: createdBy, $now: now })
+
+  return c.json(
+    {
+      id: teamId,
+      name,
+      slug,
+      description: description || null,
+      created_by: createdBy,
+      created_at: now,
+      updated_at: now,
+    },
+    201,
+  )
+})
+
+// ---------------------------------------------------------------------------
+// GET /teams — List teams
+// ---------------------------------------------------------------------------
+
+app.get('/teams', withAuth, async c => {
+  const user = getUserInfo(c)
+  const db = getDb()
+
+  if (user.isAdmin) {
+    // Admin sees all non-deleted teams
+    const teams = db
+      .query('SELECT * FROM teams WHERE deleted_at IS NULL ORDER BY name')
+      .all()
+    return c.json(teams, 200)
+  }
+
+  if (user.role === 'guest') {
+    return c.json([], 200)
+  }
+
+  // Member sees only teams they belong to
+  const teams = db
+    .query(
+      `SELECT t.* FROM teams t
+       JOIN team_members tm ON tm.team_id = t.id
+       WHERE tm.user_id = $userId AND t.deleted_at IS NULL
+       ORDER BY t.name`,
+    )
+    .all({ $userId: user.userId })
+
+  return c.json(teams, 200)
+})
+
+// ---------------------------------------------------------------------------
+// GET /teams/:id — Get team details
+// ---------------------------------------------------------------------------
+
+app.get('/teams/:id', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+  if (!teamRole) {
+    return c.json({ error: 'Not a team member' }, 403)
+  }
+
+  return c.json(result.team, 200)
+})
+
+// ---------------------------------------------------------------------------
+// PATCH /teams/:id — Update team
+// ---------------------------------------------------------------------------
+
+app.patch('/teams/:id', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Only owner (or system admin) can modify team info
+  if (!user.isAdmin && teamRole !== 'owner') {
+    return c.json({ error: 'Only team owner can modify team info' }, 403)
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { name, slug, description } = body as {
+    name?: string
+    slug?: string
+    description?: string
+  }
+
+  const db = getDb()
+
+  // If changing slug, validate and check uniqueness
+  if (slug !== undefined) {
+    if (!isValidSlug(slug)) {
+      return c.json({ error: 'Invalid slug format' }, 400)
+    }
+    const existingSlug = db
+      .query(
+        'SELECT id FROM teams WHERE slug = $slug AND id != $id AND deleted_at IS NULL',
+      )
+      .get({ $slug: slug, $id: teamId })
+    if (existingSlug) {
+      return c.json({ error: 'Slug already taken' }, 409)
+    }
+  }
+
+  const now = new Date().toISOString()
+  const updates: string[] = ['updated_at = $now']
+  const params: Record<string, string | null> = {
+    $id: teamId,
+    $now: now,
+  }
+
+  if (name !== undefined) {
+    updates.push('name = $name')
+    params.$name = name
+  }
+  if (slug !== undefined) {
+    updates.push('slug = $slug')
+    params.$slug = slug
+  }
+  if (description !== undefined) {
+    updates.push('description = $desc')
+    params.$desc = description
+  }
+
+  db.query(`UPDATE teams SET ${updates.join(', ')} WHERE id = $id`).run(params)
+
+  const updated = db
+    .query('SELECT * FROM teams WHERE id = $id')
+    .get({ $id: teamId })
+  return c.json(updated, 200)
+})
+
+// ---------------------------------------------------------------------------
+// DELETE /teams/:id — Soft delete team
+// ---------------------------------------------------------------------------
+
+app.delete('/teams/:id', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Only owner (or system admin) can delete
+  if (!user.isAdmin && teamRole !== 'owner') {
+    return c.json({ error: 'Only team owner can delete team' }, 403)
+  }
+
+  const db = getDb()
+
+  // Check for un-transferred environments
+  const envCount = db
+    .query(
+      'SELECT COUNT(*) as count FROM team_environments WHERE team_id = $teamId',
+    )
+    .get({ $teamId: teamId }) as { count: number }
+  if (envCount.count > 0) {
+    return c.json(
+      {
+        error: 'Team has environments that must be transferred first',
+      },
+      400,
+    )
+  }
+
+  const now = new Date().toISOString()
+  db.query('UPDATE teams SET deleted_at = $now WHERE id = $id').run({
+    $now: now,
+    $id: teamId,
+  })
+
+  // Remove team ownership from sessions (orphan them)
+  db.query(
+    "DELETE FROM session_owners WHERE owner_type = 'team' AND owner_id = $teamId",
+  ).run({ $teamId: teamId })
+
+  return c.json({ ok: true }, 200)
+})
+
+// ---------------------------------------------------------------------------
+// GET /teams/:id/members — List members
+// ---------------------------------------------------------------------------
+
+app.get('/teams/:id/members', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+  if (!teamRole) {
+    return c.json({ error: 'Not a team member' }, 403)
+  }
+
+  const db = getDb()
+  const members = db
+    .query(
+      `SELECT tm.*, u.username FROM team_members tm
+       LEFT JOIN users u ON u.id = tm.user_id
+       WHERE tm.team_id = $teamId`,
+    )
+    .all({ $teamId: teamId })
+
+  return c.json(members, 200)
+})
+
+// ---------------------------------------------------------------------------
+// POST /teams/:id/members — Add member
+// ---------------------------------------------------------------------------
+
+app.post('/teams/:id/members', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Only owner/admin (or system admin) can add members
+  if (!user.isAdmin && teamRole !== 'owner' && teamRole !== 'admin') {
+    return c.json({ error: 'Only team owner/admin can add members' }, 403)
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { userId, role } = body as {
+    userId?: string
+    role?: string
+  }
+
+  if (!userId) {
+    return c.json({ error: 'userId is required' }, 400)
+  }
+
+  const validRoles = ['owner', 'admin', 'member']
+  const memberRole = role || 'member'
+  if (!validRoles.includes(memberRole)) {
+    return c.json({ error: 'Invalid role' }, 400)
+  }
+
+  const db = getDb()
+
+  // Check user exists
+  const targetUser = db
+    .query('SELECT id FROM users WHERE id = $id')
+    .get({ $id: userId })
+  if (!targetUser) {
+    return c.json({ error: 'User not found' }, 404)
+  }
+
+  // Check not already a member
+  const existing = db
+    .query(
+      'SELECT user_id FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: userId })
+  if (existing) {
+    return c.json({ error: 'User is already a member' }, 409)
+  }
+
+  const now = new Date().toISOString()
+  const addedBy = user.isAdmin
+    ? (result.team.created_by as string)
+    : user.userId
+
+  db.query(
+    `INSERT INTO team_members (team_id, user_id, role, added_at, added_by)
+     VALUES ($teamId, $userId, $role, $now, $addedBy)`,
+  ).run({
+    $teamId: teamId,
+    $userId: userId,
+    $role: memberRole,
+    $now: now,
+    $addedBy: addedBy,
+  })
+
+  return c.json({ ok: true, role: memberRole }, 201)
+})
+
+// ---------------------------------------------------------------------------
+// PATCH /teams/:id/members/:userId — Change member role
+// ---------------------------------------------------------------------------
+
+app.patch('/teams/:id/members/:userId', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const targetUserId = c.req.param('userId')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Must be at least admin to change roles
+  if (!user.isAdmin && teamRole !== 'owner' && teamRole !== 'admin') {
+    return c.json({ error: 'Insufficient permissions' }, 403)
+  }
+
+  const db = getDb()
+
+  // Team admin cannot change owner/admin roles
+  if (!user.isAdmin && teamRole === 'admin') {
+    const targetMember = db
+      .query(
+        'SELECT role FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+      )
+      .get({ $teamId: teamId, $userId: targetUserId }) as {
+      role: string
+    } | null
+    if (
+      targetMember &&
+      (targetMember.role === 'owner' || targetMember.role === 'admin')
+    ) {
+      return c.json(
+        { error: 'Team admin cannot change owner/admin roles' },
+        403,
+      )
+    }
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { role } = body as { role?: string }
+  if (!role) {
+    return c.json({ error: 'role is required' }, 400)
+  }
+
+  const validRoles = ['owner', 'admin', 'member']
+  if (!validRoles.includes(role)) {
+    return c.json({ error: 'Invalid role' }, 400)
+  }
+
+  // Check target is actually a member
+  const currentMember = db
+    .query(
+      'SELECT role FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: targetUserId }) as {
+    role: string
+  } | null
+  if (!currentMember) {
+    return c.json({ error: 'User is not a member' }, 404)
+  }
+
+  // If changing from owner to something else, check there are other owners
+  if (currentMember.role === 'owner' && role !== 'owner') {
+    const ownerCount = db
+      .query(
+        `SELECT COUNT(*) as count FROM team_members
+         WHERE team_id = $teamId AND role = 'owner'`,
+      )
+      .get({ $teamId: teamId }) as { count: number }
+    if (ownerCount.count <= 1) {
+      return c.json({ error: 'Cannot demote the last owner' }, 400)
+    }
+  }
+
+  db.query(
+    `UPDATE team_members SET role = $role WHERE team_id = $teamId AND user_id = $userId`,
+  ).run({ $role: role, $teamId: teamId, $userId: targetUserId })
+
+  return c.json({ ok: true, role }, 200)
+})
+
+// ---------------------------------------------------------------------------
+// DELETE /teams/:id/members/:userId — Remove member
+// ---------------------------------------------------------------------------
+
+app.delete('/teams/:id/members/:userId', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const targetUserId = c.req.param('userId')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+  const db = getDb()
+
+  // Check target is a member
+  const targetMember = db
+    .query(
+      'SELECT role FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: targetUserId }) as {
+    role: string
+  } | null
+  if (!targetMember) {
+    return c.json({ error: 'User is not a member' }, 404)
+  }
+
+  // Members can only remove themselves
+  if (!user.isAdmin && teamRole === 'member') {
+    if (targetUserId !== user.userId) {
+      return c.json({ error: 'Members can only remove themselves' }, 403)
+    }
+  }
+
+  // Owner/admin can remove anyone (except constraints below)
+  if (
+    !user.isAdmin &&
+    teamRole !== 'owner' &&
+    teamRole !== 'admin' &&
+    targetUserId !== user.userId
+  ) {
+    return c.json({ error: 'Insufficient permissions' }, 403)
+  }
+
+  // Cannot remove the last owner
+  if (targetMember.role === 'owner') {
+    const ownerCount = db
+      .query(
+        `SELECT COUNT(*) as count FROM team_members
+         WHERE team_id = $teamId AND role = 'owner'`,
+      )
+      .get({ $teamId: teamId }) as { count: number }
+    if (ownerCount.count <= 1) {
+      return c.json({ error: 'Cannot remove the last owner' }, 400)
+    }
+  }
+
+  db.query(
+    'DELETE FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+  ).run({ $teamId: teamId, $userId: targetUserId })
+
+  return c.json({ ok: true }, 200)
+})
+
+// ---------------------------------------------------------------------------
+// POST /teams/:id/invitations — Create invitation
+// ---------------------------------------------------------------------------
+
+app.post('/teams/:id/invitations', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Only owner/admin can create invitations
+  if (!user.isAdmin && teamRole !== 'owner' && teamRole !== 'admin') {
+    return c.json(
+      { error: 'Only team owner/admin can create invitations' },
+      403,
+    )
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { role, expiresIn, maxUses } = body as {
+    role?: string
+    expiresIn?: number
+    maxUses?: number
+  }
+
+  const inviteRole = role || 'member'
+  const validRoles = ['admin', 'member']
+  if (!validRoles.includes(inviteRole)) {
+    return c.json({ error: 'Invalid role' }, 400)
+  }
+
+  const token = `inv_${randomUUID().replace(/-/g, '')}`
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+  const now = new Date()
+  const expiresAt = new Date(
+    now.getTime() + (expiresIn || 86400) * 1000,
+  ).toISOString()
+  const maxUsesValue = maxUses || 1
+
+  const db = getDb()
+  const createdBy = user.isAdmin
+    ? (result.team.created_by as string)
+    : user.userId
+
+  db.query(
+    `INSERT INTO invitations (token_hash, team_id, role, expires_at, max_uses, uses, created_by)
+     VALUES ($hash, $teamId, $role, $exp, $maxUses, 0, $by)`,
+  ).run({
+    $hash: tokenHash,
+    $teamId: teamId,
+    $role: inviteRole,
+    $exp: expiresAt,
+    $maxUses: maxUsesValue,
+    $by: createdBy,
+  })
+
+  return c.json(
+    {
+      token,
+      inviteToken: token,
+      role: inviteRole,
+      expiresAt,
+      maxUses: maxUsesValue,
+      teamId,
+    },
+    201,
+  )
+})
+
+// ---------------------------------------------------------------------------
+// DELETE /teams/:id/invitations/:token — Revoke invitation
+// ---------------------------------------------------------------------------
+
+app.delete('/teams/:id/invitations/:token', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const token = c.req.param('token')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+
+  // Only owner/admin can revoke invitations
+  if (!user.isAdmin && teamRole !== 'owner' && teamRole !== 'admin') {
+    return c.json(
+      { error: 'Only team owner/admin can revoke invitations' },
+      403,
+    )
+  }
+
+  const db = getDb()
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+
+  // Verify invitation belongs to this team
+  const invitation = db
+    .query(
+      'SELECT * FROM invitations WHERE token_hash = $hash AND team_id = $teamId',
+    )
+    .get({ $hash: tokenHash, $teamId: teamId })
+  if (!invitation) {
+    return c.json({ error: 'Invitation not found' }, 404)
+  }
+
+  // Delete the invitation (revoke)
+  db.query('DELETE FROM invitations WHERE token_hash = $hash').run({
+    $hash: tokenHash,
+  })
+
+  return c.json({ ok: true }, 200)
+})
+
+// ---------------------------------------------------------------------------
+// GET /teams/:id/environments — List team environments
+// ---------------------------------------------------------------------------
+
+app.get('/teams/:id/environments', withAuth, async c => {
+  const teamId = c.req.param('id')!
+  const user = getUserInfo(c)
+  const result = getTeamOr404(c, teamId)
+  if ('error' in result) return result.error
+
+  const teamRole = getTeamRole(teamId, user)
+  if (!teamRole) {
+    return c.json({ error: 'Not a team member' }, 403)
+  }
+
+  const db = getDb()
+  const envs = db
+    .query(
+      `SELECT te.environment_id as id, te.environment_id
+       FROM team_environments te
+       WHERE te.team_id = $teamId`,
+    )
+    .all({ $teamId: teamId })
+
+  return c.json(envs, 200)
+})
+
+// ---------------------------------------------------------------------------
+// POST /environments/:id/transfer — Transfer environment to another team
+// ---------------------------------------------------------------------------
+
+app.post('/environments/:id/transfer', withAuth, async c => {
+  const envId = c.req.param('id')!
+  const user = getUserInfo(c)
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { toTeamId } = body as { toTeamId?: string }
+  if (!toTeamId) {
+    return c.json({ error: 'toTeamId is required' }, 400)
+  }
+
+  const db = getDb()
+
+  // Check target team exists
+  const targetTeam = db
+    .query('SELECT * FROM teams WHERE id = $id AND deleted_at IS NULL')
+    .get({ $id: toTeamId })
+  if (!targetTeam) {
+    return c.json({ error: 'Target team not found' }, 404)
+  }
+
+  // Find source team
+  const sourceRow = db
+    .query(
+      'SELECT team_id FROM team_environments WHERE environment_id = $envId',
+    )
+    .get({ $envId: envId }) as { team_id: string } | null
+
+  if (sourceRow) {
+    const teamRole = getTeamRole(sourceRow.team_id, user)
+    // Only owner/admin (or system admin) can transfer
+    if (!user.isAdmin && teamRole !== 'owner' && teamRole !== 'admin') {
+      return c.json(
+        {
+          error: 'Only team owner/admin can transfer environments',
+        },
+        403,
+      )
+    }
+  } else if (!user.isAdmin) {
+    // Environment not in any team — only admin can transfer
+    return c.json({ error: 'Environment not found in any team' }, 404)
+  }
+
+  // Remove from source team
+  db.query('DELETE FROM team_environments WHERE environment_id = $envId').run({
+    $envId: envId,
+  })
+
+  // Add to target team
+  db.query(
+    `INSERT OR REPLACE INTO team_environments (team_id, environment_id)
+     VALUES ($teamId, $envId)`,
+  ).run({ $teamId: toTeamId, $envId: envId })
+
+  // Transfer session ownership for sessions in this environment
+  // Update session_owners: remove old team owners, add new team owner
+  if (sourceRow) {
+    db.query(
+      `DELETE FROM session_owners
+       WHERE owner_type = 'team' AND owner_id = $oldTeamId
+       AND session_id IN (
+         SELECT id FROM sessions WHERE environment_id = $envId
+       )`,
+    ).run({ $oldTeamId: sourceRow.team_id, $envId: envId })
+  }
+
+  // Add new team as owner for sessions in this environment
+  db.query(
+    `INSERT OR IGNORE INTO session_owners (session_id, owner_type, owner_id)
+     SELECT id, 'team', $teamId FROM sessions WHERE environment_id = $envId`,
+  ).run({ $teamId: toTeamId, $envId: envId })
+
+  return c.json({ ok: true }, 200)
+})
+
+export default app