@shipfox/api-workspaces 2.0.0

package/src/presentation/routes/members/list.ts

@@ -0,0 +1,53 @@
+import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {listMembersResponseSchema} from '@shipfox/api-workspaces-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {
+  MembershipRequiredError,
+  WorkspaceInactiveError,
+  WorkspaceNotFoundError,
+} from '#core/errors.js';
+import {listWorkspaceMembers} from '#core/index.js';
+import {toMembershipWithUserDto} from '#presentation/dto/index.js';
+
+export const listMembersRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'List the members of a workspace.',
+  auth: AUTH_USER,
+  schema: {
+    params: z.object({workspaceId: z.string().uuid()}),
+    response: {
+      200: listMembersResponseSchema,
+    },
+  },
+  errorHandler: (error) => {
+    if (error instanceof WorkspaceNotFoundError) {
+      throw new ClientError('Workspace not found', 'not-found', {status: 404});
+    }
+    if (error instanceof MembershipRequiredError) {
+      throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
+    }
+    if (error instanceof WorkspaceInactiveError) {
+      throw new ClientError('Workspace is not active', 'workspace-inactive', {status: 403});
+    }
+    throw error;
+  },
+  handler: async (request) => {
+    const client = getUserContext(request);
+    if (!client) {
+      throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    }
+
+    const {workspaceId} = request.params;
+    const members = await listWorkspaceMembers({
+      workspaceId,
+      requesterUserId: client.userId,
+      requesterMemberships: client.memberships,
+    });
+
+    return {
+      members: members.map(toMembershipWithUserDto),
+    };
+  },
+});

package/src/presentation/routes/members/remove.test.ts

@@ -0,0 +1,110 @@
+import type {FastifyInstance} from 'fastify';
+import {
+  createInvite,
+  createWorkspace,
+  createWorkspacesTestApp,
+  resetCapturedMail,
+  signupVerifyLogin,
+} from '#test/routes.js';
+
+describe('DELETE /workspaces/:workspaceId/members/:userId', () => {
+  let app: FastifyInstance;
+
+  beforeAll(async () => {
+    app = await createWorkspacesTestApp();
+  });
+
+  beforeEach(() => {
+    resetCapturedMail();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  test('returns 204 and removes a non-owner member', async () => {
+    const owner = await signupVerifyLogin(app, 'members-remove-owner');
+    const guest = await signupVerifyLogin(app, 'members-remove-guest');
+    const workspaceId = await createWorkspace(app, owner.token);
+    const invite = await createInvite(app, {token: owner.token, workspaceId, email: guest.email});
+    await app.inject({
+      method: 'POST',
+      url: '/invitations/accept',
+      headers: {authorization: `Bearer ${guest.token}`},
+      payload: {token: invite.rawToken},
+    });
+
+    const remove = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${guest.userId}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+    const members = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(remove.statusCode).toBe(204);
+    expect(members.statusCode).toBe(200);
+    expect(members.json().members).toHaveLength(1);
+    expect(members.json().members[0].user_id).toBe(owner.userId);
+  });
+
+  test('transforms missing member into 404', async () => {
+    const owner = await signupVerifyLogin(app, 'members-remove-missing');
+    const workspaceId = await createWorkspace(app, owner.token);
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${crypto.randomUUID()}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().code).toBe('not-found');
+  });
+
+  test('transforms removing yourself into 409 self-removal-not-allowed', async () => {
+    const owner = await signupVerifyLogin(app, 'members-remove-self');
+    const workspaceId = await createWorkspace(app, owner.token);
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${owner.userId}`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('self-removal-not-allowed');
+  });
+
+  test('transforms missing membership into 403', async () => {
+    const outsider = await signupVerifyLogin(app, 'members-remove-outsider');
+    const workspaceId = crypto.randomUUID();
+    const userId = crypto.randomUUID();
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${userId}`,
+      headers: {authorization: `Bearer ${outsider.token}`},
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(res.json().code).toBe('forbidden');
+  });
+
+  test('checks workspace membership before self-removal', async () => {
+    const outsider = await signupVerifyLogin(app, 'members-remove-self-outsider');
+    const workspaceId = crypto.randomUUID();
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/workspaces/${workspaceId}/members/${outsider.userId}`,
+      headers: {authorization: `Bearer ${outsider.token}`},
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(res.json().code).toBe('forbidden');
+  });
+});

package/src/presentation/routes/members/remove.ts

@@ -0,0 +1,66 @@
+import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {
+  LastMemberError,
+  MembershipNotFoundError,
+  MembershipRequiredError,
+  SelfRemovalNotAllowedError,
+  WorkspaceInactiveError,
+  WorkspaceNotFoundError,
+} from '#core/errors.js';
+import {removeWorkspaceMember} from '#core/index.js';
+
+export const removeMemberRoute = defineRoute({
+  method: 'DELETE',
+  path: '/:userId',
+  description: 'Remove a member from a workspace.',
+  auth: AUTH_USER,
+  schema: {
+    params: z.object({
+      workspaceId: z.string().uuid(),
+      userId: z.string().uuid(),
+    }),
+    response: {
+      204: z.void(),
+    },
+  },
+  errorHandler: (error) => {
+    if (error instanceof WorkspaceNotFoundError) {
+      throw new ClientError('Workspace not found', 'not-found', {status: 404});
+    }
+    if (error instanceof MembershipRequiredError) {
+      throw new ClientError('Not a member of this workspace', 'forbidden', {status: 403});
+    }
+    if (error instanceof MembershipNotFoundError) {
+      throw new ClientError('Member not found', 'not-found', {status: 404});
+    }
+    if (error instanceof LastMemberError) {
+      throw new ClientError(error.message, 'last-member', {status: 409});
+    }
+    if (error instanceof SelfRemovalNotAllowedError) {
+      throw new ClientError(error.message, 'self-removal-not-allowed', {status: 409});
+    }
+    if (error instanceof WorkspaceInactiveError) {
+      throw new ClientError('Workspace is not active', 'workspace-inactive', {status: 403});
+    }
+    throw error;
+  },
+  handler: async (request, reply) => {
+    const client = getUserContext(request);
+    if (!client) {
+      throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    }
+
+    const {workspaceId, userId} = request.params;
+
+    await removeWorkspaceMember({
+      workspaceId,
+      userId,
+      requesterUserId: client.userId,
+      requesterMemberships: client.memberships,
+    });
+
+    reply.code(204);
+  },
+});

package/src/presentation/routes/workspaces/create.test.ts

@@ -0,0 +1,87 @@
+import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
+import type {FastifyInstance} from 'fastify';
+import Fastify from 'fastify';
+import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';
+import {findMembership} from '#db/memberships.js';
+import {createWorkspaceRoute} from './create.js';
+
+function emailFor(suffix: string): string {
+  return `${suffix}-${crypto.randomUUID()}@example.com`;
+}
+
+async function createUser(params: {email: string; hashedPassword?: string; name?: string}) {
+  await Promise.resolve();
+  return {userId: crypto.randomUUID(), email: params.email};
+}
+
+describe('POST /workspaces', () => {
+  let app: FastifyInstance;
+  let userId: string;
+
+  beforeAll(async () => {
+    app = Fastify();
+    app.setValidatorCompiler(validatorCompiler);
+    app.setSerializerCompiler(serializerCompiler);
+    app.addHook('onRequest', (request, _reply, done) => {
+      setUserContext(
+        request,
+        buildUserContext({
+          userId,
+          email: 'caller@example.com',
+          name: 'Caller Person',
+          memberships: [],
+        }),
+      );
+      done();
+    });
+    app.post('/workspaces', createWorkspaceRoute);
+    await app.ready();
+  });
+
+  beforeEach(async () => {
+    const user = await createUser({email: emailFor('caller'), hashedPassword: 'h'});
+    userId = user.userId;
+  });
+
+  test('valid body returns 201 with workspace and creates membership', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {name: '  Test Workspace  '},
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.id).toBeDefined();
+    expect(body.name).toBe('Test Workspace');
+    expect(body.status).toBe('active');
+
+    const membership = await findMembership({userId, workspaceId: body.id});
+    expect(membership).toBeDefined();
+    expect(membership?.userName).toBe('Caller Person');
+  });
+
+  test.each([
+    ['blank after trimming', '   '],
+    ['with control characters', 'Test\nWorkspace'],
+    ['with format characters', 'Test\u202eWorkspace'],
+  ])('invalid body with %s returns 400', async (_case, name) => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {name},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  test('missing name returns 400', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/workspaces',
+      payload: {},
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+});

package/src/presentation/routes/workspaces/create.ts

@@ -0,0 +1,36 @@
+import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {createWorkspaceBodySchema, workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {createWorkspaceForUser} from '#core/index.js';
+import {toWorkspaceDto} from '#presentation/dto/index.js';
+
+export const createWorkspaceRoute = defineRoute({
+  method: 'POST',
+  path: '/',
+  description: 'Create a workspace for the signed-in user.',
+  auth: AUTH_USER,
+  schema: {
+    body: createWorkspaceBodySchema,
+    response: {
+      201: workspaceResponseSchema,
+    },
+  },
+  handler: async (request, reply) => {
+    const client = getUserContext(request);
+    if (!client) {
+      throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    }
+
+    const {name} = request.body;
+
+    const workspace = await createWorkspaceForUser({
+      name,
+      userId: client.userId,
+      userEmail: client.email,
+      userName: client.name,
+    });
+
+    reply.code(201);
+    return toWorkspaceDto(workspace);
+  },
+});

package/src/presentation/routes/workspaces/index.ts

@@ -0,0 +1,2 @@
+export {createWorkspaceRoute} from './create.js';
+export {listUserWorkspacesRoute} from './list.js';

package/src/presentation/routes/workspaces/list.test.ts

@@ -0,0 +1,56 @@
+import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
+import type {FastifyInstance} from 'fastify';
+import Fastify from 'fastify';
+import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';
+import {createMembership} from '#db/memberships.js';
+import {createWorkspace} from '#db/workspaces.js';
+import {listUserWorkspacesRoute} from './list.js';
+
+describe('GET /workspaces', () => {
+  let app: FastifyInstance;
+  let userId: string;
+
+  beforeAll(async () => {
+    app = Fastify();
+    app.setValidatorCompiler(validatorCompiler);
+    app.setSerializerCompiler(serializerCompiler);
+    app.addHook('onRequest', (request, _reply, done) => {
+      setUserContext(
+        request,
+        buildUserContext({userId, email: 'caller@example.com', memberships: []}),
+      );
+      done();
+    });
+    app.get('/workspaces', listUserWorkspacesRoute);
+    await app.ready();
+  });
+
+  beforeEach(() => {
+    userId = crypto.randomUUID();
+  });
+
+  test('returns the signed-in user workspace memberships', async () => {
+    const workspace = await createWorkspace({name: 'Acme'});
+    await createMembership({
+      userId,
+      userEmail: 'caller@example.com',
+      workspaceId: workspace.id,
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/workspaces',
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toMatchObject({
+      memberships: [
+        {
+          user_id: userId,
+          workspace_id: workspace.id,
+          workspace_name: 'Acme',
+        },
+      ],
+    });
+  });
+});

package/src/presentation/routes/workspaces/list.ts

@@ -0,0 +1,29 @@
+import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {listUserWorkspacesResponseSchema} from '@shipfox/api-workspaces-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {listUserWorkspaceMemberships} from '#core/index.js';
+import {toMembershipWithWorkspaceDto} from '#presentation/dto/index.js';
+
+export const listUserWorkspacesRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'List workspace memberships for the signed-in user.',
+  auth: AUTH_USER,
+  schema: {
+    response: {
+      200: listUserWorkspacesResponseSchema,
+    },
+  },
+  handler: async (request) => {
+    const client = getUserContext(request);
+    if (!client) {
+      throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    }
+
+    const memberships = await listUserWorkspaceMemberships({userId: client.userId});
+
+    return {
+      memberships: memberships.map(toMembershipWithWorkspaceDto),
+    };
+  },
+});

package/src/presentation/subscribers/index.ts

@@ -0,0 +1 @@
+export {onInvitationSendRequested} from './on-invitation-send-requested.js';

package/src/presentation/subscribers/invitation-send-requested.test.ts

@@ -0,0 +1,64 @@
+import type {Mailer, MailMessage} from '@shipfox/node-mailer';
+import {onInvitationSendRequested} from './index.js';
+
+const testMailer = vi.hoisted(
+  (): {
+    captured: MailMessage[];
+    send: ReturnType<typeof vi.fn<Mailer['send']>>;
+    mailer: Mailer;
+  } => {
+    const captured: MailMessage[] = [];
+    const send = vi.fn<Mailer['send']>((message) => {
+      captured.push(message);
+      return Promise.resolve();
+    });
+    return {captured, send, mailer: {send}};
+  },
+);
+
+vi.mock('#config.js', () => ({
+  mailer: testMailer.mailer,
+}));
+
+describe('workspace invitation email subscriber', () => {
+  beforeEach(() => {
+    testMailer.captured.length = 0;
+    testMailer.send.mockReset();
+    testMailer.send.mockImplementation((message) => {
+      testMailer.captured.push(message);
+      return Promise.resolve();
+    });
+  });
+
+  test('sends a rendered workspace invitation message', async () => {
+    await onInvitationSendRequested({
+      email: 'invitee@example.com',
+      workspaceName: 'Acme Ops',
+      inviterName: 'Dana Scully',
+      inviteLink: 'https://app.example.test/invitations/accept?token=invite-token',
+    });
+
+    expect(testMailer.captured).toHaveLength(1);
+    expect(testMailer.captured[0]).toMatchObject({
+      to: 'invitee@example.com',
+      subject: 'Join Acme Ops on Shipfox',
+    });
+    expect(testMailer.captured[0]?.text).toContain('Dana Scully has invited you');
+    expect(testMailer.captured[0]?.text).toContain('/invitations/accept?token=invite-token');
+    expect(testMailer.captured[0]?.html).toContain('Dana Scully');
+  });
+
+  test('rethrows mailer failures so the outbox dispatcher retries', async () => {
+    const failure = new Error('smtp unavailable');
+    testMailer.send.mockRejectedValueOnce(failure);
+
+    const promise = onInvitationSendRequested({
+      email: 'invite-failure@example.com',
+      workspaceName: 'Acme Ops',
+      inviterName: 'Dana Scully',
+      inviteLink: 'https://app.example.test/invitations/accept?token=invite-token',
+    });
+
+    await expect(promise).rejects.toBe(failure);
+  });
+});

package/src/presentation/subscribers/on-invitation-send-requested.ts

@@ -0,0 +1,15 @@
+import type {WorkspacesInvitationSendRequestedEvent} from '@shipfox/api-workspaces-dto';
+import {renderEmail} from '@shipfox/node-email';
+import {mailer} from '#config.js';
+
+export async function onInvitationSendRequested(
+  payload: WorkspacesInvitationSendRequestedEvent,
+): Promise<void> {
+  const email = await renderEmail('workspace-invitation', {
+    email: payload.email,
+    workspaceName: payload.workspaceName,
+    inviterName: payload.inviterName,
+    inviteLink: payload.inviteLink,
+  });
+  await mailer.send({to: payload.email, ...email});
+}

package/test/env.ts

@@ -0,0 +1,8 @@
+process.env.POSTGRES_HOST ??= 'localhost';
+process.env.POSTGRES_PORT ??= '5432';
+process.env.POSTGRES_USERNAME ??= 'shipfox';
+process.env.POSTGRES_PASSWORD ??= 'password';
+process.env.POSTGRES_DATABASE = 'api_test';
+process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
+process.env.WORKSPACE_JWT_SECRET = 'test-secret';
+process.env.TZ = 'UTC';

package/test/factories/index.ts

@@ -0,0 +1,3 @@
+export {membershipFactory} from './membership.js';
+export {userFactory} from './user.js';
+export {workspaceFactory} from './workspace.js';

package/test/factories/membership.ts

@@ -0,0 +1,24 @@
+import {Factory} from 'fishery';
+import type {Membership} from '#core/entities/membership.js';
+import {createMembership} from '#db/memberships.js';
+
+export const membershipFactory = Factory.define<Membership>(({onCreate}) => {
+  onCreate((membership) =>
+    createMembership({
+      userId: membership.userId,
+      userEmail: membership.userEmail,
+      userName: membership.userName,
+      workspaceId: membership.workspaceId,
+    }),
+  );
+
+  return {
+    id: crypto.randomUUID(),
+    userId: crypto.randomUUID(),
+    userEmail: `member-${crypto.randomUUID()}@example.com`,
+    userName: null,
+    workspaceId: crypto.randomUUID(),
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+});

package/test/factories/user.ts

@@ -0,0 +1,15 @@
+import {Factory} from 'fishery';
+
+export interface TestUser {
+  userId: string;
+  email: string;
+  name: string | null;
+}
+
+export const userFactory = Factory.define<TestUser>(({sequence}) => {
+  return {
+    userId: crypto.randomUUID(),
+    email: `user-${sequence}-${crypto.randomUUID()}@example.com`,
+    name: `User ${sequence}`,
+  };
+});

package/test/factories/workspace.ts

@@ -0,0 +1,18 @@
+import {Factory} from 'fishery';
+import type {Workspace} from '#core/entities/workspace.js';
+import {createWorkspace} from '#db/workspaces.js';
+
+export const workspaceFactory = Factory.define<Workspace>(({sequence, onCreate}) => {
+  onCreate((workspace) => {
+    return createWorkspace({name: workspace.name});
+  });
+
+  return {
+    id: crypto.randomUUID(),
+    name: `Test Workspace ${sequence}`,
+    status: 'active',
+    settings: {},
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+});

package/test/globalSetup.ts

@@ -0,0 +1,15 @@
+import './env.js';
+import {runMigrations} from '@shipfox/node-drizzle';
+import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
+import {sql} from 'drizzle-orm';
+import {closeDb, db, migrationsPath} from '#db/index.js';
+
+export async function setup() {
+  createPostgresClient();
+
+  await runMigrations(db(), migrationsPath, '__drizzle_migrations_workspaces');
+  await db().execute(sql`TRUNCATE workspaces_outbox, workspaces CASCADE`);
+
+  closeDb();
+  await closePostgresClient();
+}

package/test/index.ts

@@ -0,0 +1,3 @@
+export {membershipFactory} from './factories/membership.js';
+export {userFactory} from './factories/user.js';
+export {workspaceFactory} from './factories/workspace.js';