@shipfox/api-triggers 10.2.0 → 11.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-triggers",
   "license": "MIT",
-  "version": "10.2.0",
+  "version": "11.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -22,23 +22,23 @@
     "cron-parser": "^5.6.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-definitions-dto": "10.0.0",
-    "@shipfox/api-auth-context": "10.2.0",
+    "@shipfox/api-auth-context": "11.0.0",
+    "@shipfox/api-definitions-dto": "11.0.0",
     "@shipfox/api-integration-core-dto": "9.0.2",
-    "@shipfox/api-workflows-dto": "10.0.0",
     "@shipfox/api-triggers-dto": "9.0.2",
+    "@shipfox/api-workflows-dto": "10.0.0",
     "@shipfox/config": "1.2.4",
-    "@shipfox/expression": "1.2.0",
+    "@shipfox/expression": "1.2.1",
     "@shipfox/inter-module": "0.2.2",
+    "@shipfox/node-drizzle": "0.3.4",
     "@shipfox/node-error-monitoring": "0.3.0",
     "@shipfox/node-fastify": "0.4.0",
-    "@shipfox/node-drizzle": "0.3.4",
     "@shipfox/node-module": "1.0.4",
-    "@shipfox/node-postgres": "0.4.4",
     "@shipfox/node-opentelemetry": "0.6.3",
     "@shipfox/node-outbox": "0.2.6",
-    "@shipfox/workflow-document": "2.1.3",
-    "@shipfox/node-temporal": "0.4.4"
+    "@shipfox/node-postgres": "0.4.4",
+    "@shipfox/node-temporal": "0.4.4",
+    "@shipfox/workflow-document": "2.1.3"
   },
   "imports": {
     "#*": "./dist/*"

package/src/presentation/routes/fire-manual.test.ts

@@ -22,7 +22,11 @@ const workflows = {} as WorkflowsModuleClient;
 describe('POST /:definitionId/fire-manual', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -41,7 +45,7 @@ describe('POST /:definitionId/fire-manual', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
     fireManualSubscriptionMock.mockReset();
   });
 
@@ -89,6 +93,22 @@ describe('POST /:definitionId/fire-manual', () => {
     });
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const definitionId = crypto.randomUUID();
+    await triggerSubscriptionFactory.create({workspaceId, workflowDefinitionId: definitionId});
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/${definitionId}/fire-manual`,
+      payload: {},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+    expect(fireManualSubscriptionMock).not.toHaveBeenCalled();
+  });
+
   test('maps suspended workspace to 409', async () => {
     const definitionId = crypto.randomUUID();
     await triggerSubscriptionFactory.create({workspaceId, workflowDefinitionId: definitionId});

package/src/presentation/routes/fire-manual.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireUserContext, requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {
   fireManualTriggerBodySchema,
   fireManualTriggerResponseSchema,
@@ -81,10 +81,18 @@ export function createFireManualTriggerRoute(workflows: WorkflowsModuleClient) {
       const userContext = requireUserContext(request);
 
       const subscription = await getManualSubscriptionByDefinitionId(definitionId);
-      // 404 covers both "no such manual trigger" and "not your workspace" to avoid leaking existence.
-      if (!subscription || !userContext.canAccess(subscription.workspaceId)) {
+      // Missing triggers and memberships remain 404 to avoid leaking existence; lifecycle claims
+      // propagate their stable access errors.
+      if (!subscription) {
         throw new ManualTriggerNotFoundError(definitionId);
       }
+      requireWorkspaceResourceAccess({
+        request,
+        workspaceId: subscription.workspaceId,
+        notFoundError: new ClientError('Manual trigger not found', 'manual-trigger-not-found', {
+          status: 404,
+        }),
+      });
 
       const run = await fireManualSubscription({
         workflows,

package/src/presentation/routes/get-trigger-event.test.ts

@@ -10,7 +10,11 @@ import {getTriggerEventRoute} from './get-trigger-event.js';
 describe('GET /trigger-events/:id', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -29,7 +33,7 @@ describe('GET /trigger-events/:id', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
   });
 
   test('returns the event with its decisions and full payload', async () => {
@@ -160,6 +164,16 @@ describe('GET /trigger-events/:id', () => {
     expect(res.json().decisions).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const event = await receivedEventFactory.create({workspaceId});
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({method: 'GET', url: `/trigger-events/${event.id}`});
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('returns 404 for an unknown event id', async () => {
     const res = await app.inject({method: 'GET', url: `/trigger-events/${crypto.randomUUID()}`});
 

package/src/presentation/routes/get-trigger-event.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';
 import {triggerEventDetailResponseSchema} from '@shipfox/api-triggers-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -19,13 +19,18 @@ export const getTriggerEventRoute = defineRoute({
   },
   handler: async (request) => {
     const {id} = request.params;
-    const userContext = requireUserContext(request);
 
     const event = await getTriggerEventById(id);
-    // 404 covers both "no such event" and "not your workspace" to avoid leaking existence.
-    if (!event || !userContext.canAccess(event.workspaceId)) {
+    // Missing events and memberships remain 404 to avoid leaking existence; lifecycle claims
+    // propagate their stable access errors.
+    if (!event) {
       throw new ClientError('Trigger event not found', 'not-found', {status: 404});
     }
+    requireWorkspaceResourceAccess({
+      request,
+      workspaceId: event.workspaceId,
+      notFoundError: new ClientError('Trigger event not found', 'not-found', {status: 404}),
+    });
 
     const decisions = await listDecisionsByReceivedEventId(event.id);
 

package/src/presentation/routes/list-trigger-event-facets.test.ts

@@ -13,7 +13,11 @@ const facets = (res: {
 describe('GET /trigger-events/facets', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -32,7 +36,7 @@ describe('GET /trigger-events/facets', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
   });
 
   test('returns distinct sources and events with counts, ordered by count desc', async () => {
@@ -93,6 +97,18 @@ describe('GET /trigger-events/facets', () => {
     expect(res.json()).toEqual({sources: [], events: []});
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/trigger-events/facets?workspace_id=${workspaceId}`,
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('denies a workspace the caller does not belong to', async () => {
     const otherWorkspaceId = crypto.randomUUID();
 

package/src/presentation/routes/list-trigger-event-facets.ts

@@ -1,9 +1,9 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {
   triggerEventFacetsQuerySchema,
   triggerEventFacetsResponseSchema,
 } from '@shipfox/api-triggers-dto';
-import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {defineRoute} from '@shipfox/node-fastify';
 import {listTriggerEventFacets} from '#db/index.js';
 
 export const listTriggerEventFacetsRoute = defineRoute({
@@ -19,10 +19,7 @@ export const listTriggerEventFacetsRoute = defineRoute({
   handler: async (request) => {
     const {workspace_id: workspaceId} = request.query;
 
-    const userContext = requireUserContext(request);
-    if (!userContext.canAccess(workspaceId)) {
-      throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
-    }
+    requireWorkspaceAccess({request, workspaceId});
 
     return await listTriggerEventFacets({workspaceId});
   },

package/src/presentation/routes/list-trigger-events.test.ts

@@ -12,7 +12,11 @@ const eventIds = (res: {json: () => {trigger_events: Array<{id: string}>}}) =>
 describe('GET /trigger-events', () => {
   let app: FastifyInstance;
   let workspaceId: string;
-  let memberships: Array<{workspaceId: string; role: 'admin'}>;
+  let memberships: Array<{
+    workspaceId: string;
+    role: 'admin';
+    workspaceStatus: 'active' | 'suspended' | 'deleted';
+  }>;
 
   beforeAll(async () => {
     app = Fastify();
@@ -31,7 +35,7 @@ describe('GET /trigger-events', () => {
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
-    memberships = [{workspaceId, role: 'admin'}];
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'active'}];
   });
 
   test('returns a workspace events newest first, isolated and payload-free', async () => {
@@ -318,6 +322,18 @@ describe('GET /trigger-events', () => {
     expect(res.json()).toEqual({trigger_events: [], next_cursor: null});
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    memberships = [{workspaceId, role: 'admin', workspaceStatus: 'suspended'}];
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/trigger-events?workspace_id=${workspaceId}`,
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('denies a workspace the caller does not belong to', async () => {
     const otherWorkspaceId = crypto.randomUUID();
 

package/src/presentation/routes/list-trigger-events.ts

@@ -1,4 +1,4 @@
-import {requireUserContext} from '@shipfox/api-auth-context';
+import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {
   triggerEventListQuerySchema,
   triggerEventListResponseSchema,
@@ -30,10 +30,7 @@ export const listTriggerEventsRoute = defineRoute({
       cursor,
     } = request.query;
 
-    const userContext = requireUserContext(request);
-    if (!userContext.canAccess(workspaceId)) {
-      throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
-    }
+    requireWorkspaceAccess({request, workspaceId});
 
     const decodedCursor = decodeTimestampIdCursor(cursor);
     if (cursor && !decodedCursor) {