@shipfox/api-workspaces 10.1.0 → 11.0.0

package/src/presentation/routes/invitations/revoke.test.ts

@@ -82,6 +82,20 @@ describe('DELETE /workspaces/:workspaceId/invitations/:invitationId', () => {
     expect(res.json().code).toBe('forbidden');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-revoke@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/invitations/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-revoke-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/invitations/revoke.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -51,6 +51,7 @@ export const revokeInvitationRoute = defineRoute({
     }
 
     const {workspaceId, invitationId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await revokeWorkspaceInvitation({
       workspaceId,

package/src/presentation/routes/members/list.test.ts

@@ -1,5 +1,5 @@
 import type {FastifyInstance} from 'fastify';
-import {createWorkspace as createWorkspaceRow} from '#db/workspaces.js';
+import {createWorkspace as createWorkspaceRow, updateWorkspace} from '#db/workspaces.js';
 import {
   createInvite,
   createWorkspace,
@@ -50,6 +50,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     ).toEqual([guest.email, owner.email].sort());
   });
 
+  test('keeps an active claim usable when the workspace row is suspended', async () => {
+    const owner = await signupVerifyLogin(app, 'members-list-snapshot');
+    const workspaceId = await createWorkspace(app, owner.token);
+    await updateWorkspace({id: workspaceId, status: 'suspended'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
   test('authorizes from a static membership claim without a membership row', async () => {
     const userId = crypto.randomUUID();
     const email = `members-list-claim-${crypto.randomUUID()}@example.com`;
@@ -66,6 +80,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     expect(res.json().members).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-list@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-list-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/list.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listMembersResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -40,6 +40,7 @@ export const listMembersRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const members = await listWorkspaceMembers({
       workspaceId,
       requesterUserId: client.userId,

package/src/presentation/routes/members/remove.test.ts

@@ -79,6 +79,20 @@ describe('DELETE /workspaces/:workspaceId/members/:userId', () => {
     expect(res.json().code).toBe('self-removal-not-allowed');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-member-remove@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-remove-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/remove.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -53,6 +53,7 @@ export const removeMemberRoute = defineRoute({
     }
 
     const {workspaceId, userId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await removeWorkspaceMember({
       workspaceId,

package/test/globalSetup.ts

@@ -8,7 +8,9 @@ export async function setup() {
   createPostgresClient();
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_workspaces');
-  await db().execute(sql`TRUNCATE workspaces_outbox, workspaces_workspaces CASCADE`);
+  await db().execute(
+    sql`TRUNCATE workspaces_admin_command_results, workspaces_outbox, workspaces_workspaces CASCADE`,
+  );
 
   closeDb();
   await closePostgresClient();

package/test/routes.ts

@@ -52,14 +52,15 @@ const fakeUserAuth: AuthMethod = {
   authenticate: async (request) => {
     const raw = request.headers.authorization?.replace(BEARER_RE, '');
     if (raw?.startsWith('claim:')) {
-      const [, userId, email, workspaceId] = raw.split(':');
+      const [, userId, email, workspaceId, status] = raw.split(':');
       if (!userId || !email || !workspaceId) throw new Error('Invalid test user claim token');
+      const workspaceStatus = status === 'suspended' || status === 'deleted' ? status : 'active';
       setUserContext(
         request,
         buildUserContext({
           userId,
           email,
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus}],
         }),
       );
       return;
@@ -74,7 +75,11 @@ const fakeUserAuth: AuthMethod = {
         userId,
         email,
         name: encodedName ? decodeURIComponent(encodedName) : null,
-        memberships: memberships.map((m) => ({workspaceId: m.workspaceId, role: 'admin' as const})),
+        memberships: memberships.map((m) => ({
+          workspaceId: m.workspaceId,
+          role: 'admin' as const,
+          workspaceStatus: 'active' as const,
+        })),
       }),
     );
   },