@shipfox/api-workspaces 10.2.0 → 12.0.0

package/src/presentation/routes/invitations/revoke.test.ts

@@ -82,6 +82,20 @@ describe('DELETE /workspaces/:workspaceId/invitations/:invitationId', () => {
     expect(res.json().code).toBe('forbidden');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-invite-revoke@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/invitations/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-revoke-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/invitations/revoke.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -51,6 +51,7 @@ export const revokeInvitationRoute = defineRoute({
     }
 
     const {workspaceId, invitationId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await revokeWorkspaceInvitation({
       workspaceId,

package/src/presentation/routes/members/list.test.ts

@@ -1,5 +1,5 @@
 import type {FastifyInstance} from 'fastify';
-import {createWorkspace as createWorkspaceRow} from '#db/workspaces.js';
+import {createWorkspace as createWorkspaceRow, updateWorkspace} from '#db/workspaces.js';
 import {
   createInvite,
   createWorkspace,
@@ -50,6 +50,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     ).toEqual([guest.email, owner.email].sort());
   });
 
+  test('keeps an active claim usable when the workspace row is suspended', async () => {
+    const owner = await signupVerifyLogin(app, 'members-list-snapshot');
+    const workspaceId = await createWorkspace(app, owner.token);
+    await updateWorkspace({id: workspaceId, status: 'suspended'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+  });
+
   test('authorizes from a static membership claim without a membership row', async () => {
     const userId = crypto.randomUUID();
     const email = `members-list-claim-${crypto.randomUUID()}@example.com`;
@@ -66,6 +80,20 @@ describe('GET /workspaces/:workspaceId/members', () => {
     expect(res.json().members).toEqual([]);
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-list@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-list-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/list.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listMembersResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -40,6 +40,7 @@ export const listMembersRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
     const members = await listWorkspaceMembers({
       workspaceId,
       requesterUserId: client.userId,

package/src/presentation/routes/members/remove.test.ts

@@ -79,6 +79,20 @@ describe('DELETE /workspaces/:workspaceId/members/:userId', () => {
     expect(res.json().code).toBe('self-removal-not-allowed');
   });
 
+  test('returns workspace-suspended for a suspended membership claim', async () => {
+    const workspaceId = crypto.randomUUID();
+    const token = `claim:${crypto.randomUUID()}:suspended-member-remove@example.com:${workspaceId}:suspended`;
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('workspace-suspended');
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'members-remove-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/routes/members/remove.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
@@ -53,6 +53,7 @@ export const removeMemberRoute = defineRoute({
     }
 
     const {workspaceId, userId} = request.params;
+    requireWorkspaceAccess({request, workspaceId});
 
     await removeWorkspaceMember({
       workspaceId,

package/src/presentation/routes/rate-limit.ts

@@ -0,0 +1,45 @@
+import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';
+import {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';
+import {
+  checkWorkspacesRateLimit,
+  WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT,
+} from '#core/rate-limit.js';
+
+function routeName(request: FastifyRequest): string {
+  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
+}
+
+export function createWorkspaceSlugAvailabilityRateLimitPreHandler() {
+  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {
+    await enforceSharedRateLimit({
+      request,
+      reply,
+      check: () =>
+        checkWorkspacesRateLimit({
+          action: 'slug-availability',
+          scope: 'ip',
+          identifier: request.ip,
+          ...WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT,
+        }),
+      route: routeName(request),
+      unavailableCode: 'workspace-rate-limit-unavailable',
+      unavailableMessage: 'Workspace rate limiter unavailable',
+      setRetryAfter: (reply, retryAfterSeconds) => {
+        reply.header('Retry-After', String(retryAfterSeconds));
+      },
+      logWarn: (request, context) => {
+        request.log.warn(context, 'Workspace rate limit blocked request');
+      },
+      logError: (request, context) => {
+        request.log.error(context, 'Workspace rate limiter unavailable');
+      },
+      createClientError: (presentation, cause) =>
+        new ClientError(presentation.message, presentation.code, {
+          status: presentation.status,
+          ...(presentation.details ? {details: presentation.details} : {}),
+          data: presentation.data,
+          cause,
+        }),
+    });
+  };
+}

package/src/presentation/routes/workspaces/create.test.ts

@@ -47,13 +47,14 @@ describe('POST /workspaces', () => {
     const res = await app.inject({
       method: 'POST',
       url: '/workspaces',
-      payload: {name: '  Test Workspace  '},
+      payload: {name: '  Test Workspace  ', slug: 'test-workspace'},
     });
 
     expect(res.statusCode).toBe(201);
     const body = res.json();
     expect(body.id).toBeDefined();
     expect(body.name).toBe('Test Workspace');
+    expect(body.slug).toBe('test-workspace');
     expect(body.status).toBe('active');
 
     const membership = await findMembership({userId, workspaceId: body.id});
@@ -69,7 +70,7 @@ describe('POST /workspaces', () => {
     const res = await app.inject({
       method: 'POST',
       url: '/workspaces',
-      payload: {name},
+      payload: {name, slug: 'test-workspace'},
     });
 
     expect(res.statusCode).toBe(400);
@@ -79,9 +80,38 @@ describe('POST /workspaces', () => {
     const res = await app.inject({
       method: 'POST',
       url: '/workspaces',
-      payload: {},
+      payload: {slug: 'test-workspace'},
     });
 
     expect(res.statusCode).toBe(400);
   });
+
+  test('accepts a workspace slugged settings', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {name: 'Settings Workspace', slug: 'settings'},
+    });
+
+    expect(res.statusCode).toBe(201);
+    expect(res.json().slug).toBe('settings');
+  });
+
+  test('returns slug-conflict for a duplicate slug', async () => {
+    const slug = `duplicate-${crypto.randomUUID().slice(0, 8)}`;
+    const first = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {name: 'First Workspace', slug},
+    });
+    const second = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {name: 'Second Workspace', slug},
+    });
+
+    expect(first.statusCode).toBe(201);
+    expect(second.statusCode).toBe(409);
+    expect(second.json().code).toBe('slug-conflict');
+  });
 });

package/src/presentation/routes/workspaces/create.ts

@@ -1,6 +1,7 @@
 import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
 import {createWorkspaceBodySchema, workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {WorkspaceSlugConflictError} from '#core/errors.js';
 import {createWorkspaceForUser} from '#core/index.js';
 import {toWorkspaceDto} from '#presentation/dto/index.js';
 
@@ -15,16 +16,23 @@ export const createWorkspaceRoute = defineRoute({
       201: workspaceResponseSchema,
     },
   },
+  errorHandler: (error) => {
+    if (error instanceof WorkspaceSlugConflictError) {
+      throw new ClientError('Workspace slug is already taken', 'slug-conflict', {status: 409});
+    }
+    throw error;
+  },
   handler: async (request, reply) => {
     const client = getUserContext(request);
     if (!client) {
       throw new ClientError('Authentication required', 'unauthorized', {status: 401});
     }
 
-    const {name} = request.body;
+    const {name, slug} = request.body;
 
     const workspace = await createWorkspaceForUser({
       name,
+      slug,
       userId: client.userId,
       userEmail: client.email,
       userName: client.name,

package/src/presentation/routes/workspaces/index.ts

@@ -1,2 +1,4 @@
 export {createWorkspaceRoute} from './create.js';
 export {listUserWorkspacesRoute} from './list.js';
+export {workspaceSlugAvailabilityRoute} from './slug-availability.js';
+export {updateWorkspaceRoute} from './update.js';

package/src/presentation/routes/workspaces/list.test.ts

@@ -49,6 +49,7 @@ describe('GET /workspaces', () => {
           user_id: userId,
           workspace_id: workspace.id,
           workspace_name: 'Acme',
+          workspace_slug: workspace.slug,
         },
       ],
     });

package/src/presentation/routes/workspaces/slug-availability.test.ts

@@ -0,0 +1,159 @@
+import {sql} from 'drizzle-orm';
+import {
+  hashWorkspacesRateLimitIdentifier,
+  WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT,
+} from '#core/rate-limit.js';
+import {createWorkspaceForUser} from '#core/workspaces.js';
+import {db} from '#db/db.js';
+import {workspacesRateLimits} from '#db/schema/rate-limits.js';
+import {createWorkspacesTestApp, signupVerifyLogin} from '#test/routes.js';
+
+let ipSequence = 1;
+
+function uniqueIp(): string {
+  ipSequence += 1;
+  return `203.0.113.${ipSequence}`;
+}
+
+function windowStartFor(now: Date, windowSeconds: number): Date {
+  const windowMs = windowSeconds * 1000;
+  return new Date(Math.floor(now.getTime() / windowMs) * windowMs);
+}
+
+describe('GET /workspaces/slug-availability', () => {
+  test('returns true for an available slug and false for a taken slug', async () => {
+    const app = await createWorkspacesTestApp({fastifyOptions: {trustProxy: true}});
+    const user = await signupVerifyLogin(app, 'workspace-slug-availability');
+    const takenSlug = `taken-${crypto.randomUUID().slice(0, 8)}`;
+    await createWorkspaceForUser({
+      name: 'Taken Workspace',
+      slug: takenSlug,
+      userId: crypto.randomUUID(),
+    });
+
+    const headers = {
+      authorization: `Bearer ${user.token}`,
+      'x-forwarded-for': uniqueIp(),
+    };
+    const available = await app.inject({
+      method: 'GET',
+      url: `/workspaces/slug-availability?slug=available-${crypto.randomUUID().slice(0, 8)}`,
+      headers,
+    });
+    const taken = await app.inject({
+      method: 'GET',
+      url: `/workspaces/slug-availability?slug=${takenSlug}`,
+      headers: {...headers, 'x-forwarded-for': uniqueIp()},
+    });
+
+    expect(available.statusCode).toBe(200);
+    expect(available.json()).toEqual({available: true});
+    expect(taken.statusCode).toBe(200);
+    expect(taken.json()).toEqual({available: false});
+
+    await app.close();
+  });
+
+  test('rejects malformed slugs instead of reporting them as taken', async () => {
+    const app = await createWorkspacesTestApp({fastifyOptions: {trustProxy: true}});
+    const user = await signupVerifyLogin(app, 'workspace-slug-invalid');
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/workspaces/slug-availability?slug=Not%20A%20Slug',
+      headers: {
+        authorization: `Bearer ${user.token}`,
+        'x-forwarded-for': uniqueIp(),
+      },
+    });
+
+    expect(res.statusCode).toBe(400);
+
+    await app.close();
+  });
+
+  test('rejects unauthenticated callers', async () => {
+    const app = await createWorkspacesTestApp({fastifyOptions: {trustProxy: true}});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/workspaces/slug-availability?slug=available',
+    });
+
+    expect(res.statusCode).toBe(401);
+
+    await app.close();
+  });
+
+  test('rate-limits repeated availability checks by source IP', async () => {
+    const app = await createWorkspacesTestApp({fastifyOptions: {trustProxy: true}});
+    const user = await signupVerifyLogin(app, 'workspace-slug-rate-limit');
+    const headers = {
+      authorization: `Bearer ${user.token}`,
+      'x-forwarded-for': uniqueIp(),
+    };
+    const url = `/workspaces/slug-availability?slug=rate-limit-${crypto.randomUUID().slice(0, 8)}`;
+    let lastResponse = await app.inject({method: 'GET', url, headers});
+
+    for (let attempt = 1; attempt <= WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT.limit; attempt += 1) {
+      lastResponse = await app.inject({method: 'GET', url, headers});
+    }
+
+    expect(lastResponse.statusCode).toBe(429);
+    expect(lastResponse.json()).toMatchObject({
+      code: 'rate-limited',
+      details: {retry_after_seconds: expect.any(Number)},
+    });
+    expect(lastResponse.headers['retry-after']).toEqual(expect.any(String));
+
+    await app.close();
+  });
+
+  test('fails closed when limiter storage is unavailable', async () => {
+    const app = await createWorkspacesTestApp({fastifyOptions: {trustProxy: true}});
+    const user = await signupVerifyLogin(app, 'workspace-slug-rate-limit-unavailable');
+    const ip = uniqueIp();
+    const now = new Date();
+    const windowStart = windowStartFor(now, WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT.windowSeconds);
+    const identifierHmac = hashWorkspacesRateLimitIdentifier({
+      action: 'slug-availability',
+      scope: 'ip',
+      identifier: ip,
+    });
+
+    await db()
+      .insert(workspacesRateLimits)
+      .values({
+        action: 'slug-availability',
+        scope: 'ip',
+        identifierHmac,
+        windowStart,
+        count: 1,
+        expiresAt: new Date(
+          windowStart.getTime() + WORKSPACE_SLUG_AVAILABILITY_RATE_LIMIT.windowSeconds * 1000,
+        ),
+      });
+
+    await db().transaction(async (tx) => {
+      await tx.execute(sql`
+        SELECT 1
+        FROM workspaces_rate_limits
+        WHERE identifier_hmac = ${identifierHmac}
+        FOR UPDATE
+      `);
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/slug-availability?slug=unavailable-${crypto.randomUUID().slice(0, 8)}`,
+        headers: {
+          authorization: `Bearer ${user.token}`,
+          'x-forwarded-for': ip,
+        },
+      });
+
+      expect(res.statusCode).toBe(503);
+      expect(res.json()).toEqual({code: 'workspace-rate-limit-unavailable'});
+    });
+
+    await app.close();
+  });
+});

package/src/presentation/routes/workspaces/slug-availability.ts

@@ -0,0 +1,30 @@
+import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {
+  workspaceSlugAvailabilityQuerySchema,
+  workspaceSlugAvailabilityResponseSchema,
+} from '@shipfox/api-workspaces-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {checkWorkspaceSlugAvailability} from '#core/index.js';
+import {createWorkspaceSlugAvailabilityRateLimitPreHandler} from '../rate-limit.js';
+
+export const workspaceSlugAvailabilityRoute = defineRoute({
+  method: 'GET',
+  path: '/slug-availability',
+  description: 'Check whether a workspace slug is available.',
+  auth: AUTH_USER,
+  schema: {
+    querystring: workspaceSlugAvailabilityQuerySchema,
+    response: {
+      200: workspaceSlugAvailabilityResponseSchema,
+    },
+  },
+  preHandler: createWorkspaceSlugAvailabilityRateLimitPreHandler(),
+  handler: async (request) => {
+    const client = getUserContext(request);
+    if (!client) {
+      throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    }
+
+    return {available: await checkWorkspaceSlugAvailability(request.query.slug)};
+  },
+});

package/src/presentation/routes/workspaces/update.test.ts

@@ -0,0 +1,114 @@
+import {WORKSPACES_WORKSPACE_UPDATED} from '@shipfox/api-workspaces-dto';
+import {sql} from 'drizzle-orm';
+import {createWorkspaceForUser} from '#core/workspaces.js';
+import {db} from '#db/db.js';
+import {workspacesOutbox} from '#db/schema/outbox.js';
+import {createWorkspacesTestApp, signupVerifyLogin} from '#test/routes.js';
+
+describe('PATCH /workspaces/:workspaceId', () => {
+  test('updates workspace details and writes the updated event', async () => {
+    const app = await createWorkspacesTestApp();
+    const owner = await signupVerifyLogin(app, 'workspace-update-owner');
+    const workspace = await createWorkspaceForUser({
+      name: 'Before',
+      slug: `before-${crypto.randomUUID().slice(0, 8)}`,
+      userId: owner.userId,
+      userEmail: owner.email,
+    });
+
+    const res = await app.inject({
+      method: 'PATCH',
+      url: `/workspaces/${workspace.id}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+      payload: {name: 'After', slug: 'after'},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toMatchObject({id: workspace.id, name: 'After', slug: 'after'});
+
+    const [event] = await db()
+      .select()
+      .from(workspacesOutbox)
+      .where(sql`${workspacesOutbox.payload}->>'workspaceId' = ${workspace.id}`)
+      .orderBy(sql`${workspacesOutbox.createdAt} DESC`)
+      .limit(1);
+    expect(event).toMatchObject({
+      eventType: WORKSPACES_WORKSPACE_UPDATED,
+      payload: {workspaceId: workspace.id, name: 'After', slug: 'after'},
+    });
+  });
+
+  test('rejects an empty body instead of writing a no-op updated event', async () => {
+    const app = await createWorkspacesTestApp();
+    const owner = await signupVerifyLogin(app, 'workspace-update-empty');
+    const workspace = await createWorkspaceForUser({
+      name: 'Untouched',
+      slug: `untouched-${crypto.randomUUID().slice(0, 8)}`,
+      userId: owner.userId,
+      userEmail: owner.email,
+    });
+
+    const res = await app.inject({
+      method: 'PATCH',
+      url: `/workspaces/${workspace.id}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+      payload: {},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  test('returns slug-conflict for a taken slug', async () => {
+    const app = await createWorkspacesTestApp();
+    const owner = await signupVerifyLogin(app, 'workspace-update-conflict');
+    await createWorkspaceForUser({
+      name: 'Taken',
+      slug: 'taken',
+      userId: crypto.randomUUID(),
+    });
+    const workspace = await createWorkspaceForUser({
+      name: 'Available',
+      slug: `available-${crypto.randomUUID().slice(0, 8)}`,
+      userId: owner.userId,
+      userEmail: owner.email,
+    });
+
+    const res = await app.inject({
+      method: 'PATCH',
+      url: `/workspaces/${workspace.id}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+      payload: {slug: 'taken'},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('slug-conflict');
+  });
+
+  test('frees the old slug for immediate reuse', async () => {
+    const app = await createWorkspacesTestApp();
+    const owner = await signupVerifyLogin(app, 'workspace-update-reuse');
+    const oldSlug = `old-${crypto.randomUUID().slice(0, 8)}`;
+    const workspace = await createWorkspaceForUser({
+      name: 'Renamed',
+      slug: oldSlug,
+      userId: owner.userId,
+      userEmail: owner.email,
+    });
+
+    const renamed = await app.inject({
+      method: 'PATCH',
+      url: `/workspaces/${workspace.id}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+      payload: {slug: 'renamed'},
+    });
+
+    expect(renamed.statusCode).toBe(200);
+    await expect(
+      createWorkspaceForUser({
+        name: 'Reused',
+        slug: oldSlug,
+        userId: crypto.randomUUID(),
+      }),
+    ).resolves.toMatchObject({slug: oldSlug});
+  });
+});

package/src/presentation/routes/workspaces/update.ts

@@ -0,0 +1,41 @@
+import {AUTH_USER, requireWorkspaceAccess} from '@shipfox/api-auth-context';
+import {updateWorkspaceBodySchema, workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {WorkspaceNotFoundError, WorkspaceSlugConflictError} from '#core/errors.js';
+import {updateWorkspaceDetails} from '#core/index.js';
+import {toWorkspaceDto} from '#presentation/dto/index.js';
+
+export const updateWorkspaceRoute = defineRoute({
+  method: 'PATCH',
+  path: '/:workspaceId',
+  description: 'Update workspace details.',
+  auth: AUTH_USER,
+  schema: {
+    params: z.object({workspaceId: z.string().uuid()}),
+    body: updateWorkspaceBodySchema,
+    response: {
+      200: workspaceResponseSchema,
+    },
+  },
+  errorHandler: (error) => {
+    if (error instanceof WorkspaceNotFoundError) {
+      throw new ClientError('Workspace not found', 'not-found', {status: 404});
+    }
+    if (error instanceof WorkspaceSlugConflictError) {
+      throw new ClientError('Workspace slug is already taken', 'slug-conflict', {status: 409});
+    }
+    throw error;
+  },
+  handler: async (request) => {
+    requireWorkspaceAccess({request, workspaceId: request.params.workspaceId});
+
+    const workspace = await updateWorkspaceDetails({
+      workspaceId: request.params.workspaceId,
+      name: request.body.name,
+      slug: request.body.slug,
+    });
+
+    return toWorkspaceDto(workspace);
+  },
+});

package/test/env.ts

@@ -5,4 +5,5 @@ process.env.POSTGRES_PASSWORD ??= 'password';
 process.env.POSTGRES_DATABASE = 'api_test';
 process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
 process.env.WORKSPACE_JWT_SECRET = 'test-secret';
+process.env.AUTH_ROOT_KEY = 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
 process.env.TZ = 'UTC';

package/test/factories/workspace.ts

@@ -1,15 +1,17 @@
+import {withSlugSuffix} from '@shipfox/api-common-dto';
 import {Factory} from 'fishery';
 import type {Workspace} from '#core/entities/workspace.js';
 import {createWorkspace} from '#db/workspaces.js';
 
 export const workspaceFactory = Factory.define<Workspace>(({sequence, onCreate}) => {
   onCreate((workspace) => {
-    return createWorkspace({name: workspace.name});
+    return createWorkspace({name: workspace.name, slug: workspace.slug});
   });
 
   return {
     id: crypto.randomUUID(),
     name: `Test Workspace ${sequence}`,
+    slug: withSlugSuffix(`test-workspace-${crypto.randomUUID().slice(0, 8)}`, sequence + 1),
     status: 'active',
     settings: {},
     createdBy: null,

package/test/globalSetup.ts

@@ -9,7 +9,7 @@ export async function setup() {
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_workspaces');
   await db().execute(
-    sql`TRUNCATE workspaces_admin_command_results, workspaces_outbox, workspaces_workspaces CASCADE`,
+    sql`TRUNCATE workspaces_admin_command_results, workspaces_outbox, workspaces_rate_limits, workspaces_workspaces CASCADE`,
   );
 
   closeDb();