@shipfox/api-workspaces 5.0.0 → 7.0.1

package/src/db/invitations.ts

@@ -1,5 +1,7 @@
 import {
   WORKSPACES_INVITATION_SEND_REQUESTED,
+  WORKSPACES_MEMBER_INVITED,
+  WORKSPACES_MEMBER_JOINED,
   type WorkspacesEventMap,
 } from '@shipfox/api-workspaces-dto';
 import {writeOutboxEvent} from '@shipfox/node-outbox';
@@ -49,6 +51,7 @@ export async function createInvitation(params: CreateInvitationParams): Promise<
           eq(invitations.workspaceId, params.workspaceId),
           eq(invitations.email, params.email),
           isNull(invitations.acceptedAt),
+          isNull(invitations.revokedAt),
           lt(invitations.expiresAt, sql`now()`),
         ),
       );
@@ -61,6 +64,7 @@ export async function createInvitation(params: CreateInvitationParams): Promise<
           eq(invitations.workspaceId, params.workspaceId),
           eq(invitations.email, params.email),
           isNull(invitations.acceptedAt),
+          isNull(invitations.revokedAt),
         ),
       )
       .limit(1);
@@ -83,6 +87,15 @@ export async function createInvitation(params: CreateInvitationParams): Promise<
 
     const row = rows[0];
     if (!row) throw new Error('Insert returned no rows');
+    await writeOutboxEvent<WorkspacesEventMap>(tx, workspacesOutbox, {
+      type: WORKSPACES_MEMBER_INVITED,
+      payload: {
+        workspaceId: params.workspaceId,
+        invitedEmail: params.email,
+        inviterUserId: params.invitedByUserId,
+        role: 'admin',
+      },
+    });
     if (params.sendEmail) {
       await writeOutboxEvent<WorkspacesEventMap>(tx, workspacesOutbox, {
         type: WORKSPACES_INVITATION_SEND_REQUESTED,
@@ -134,6 +147,7 @@ export async function listOpenInvitationsByWorkspace(params: {
       and(
         eq(invitations.workspaceId, params.workspaceId),
         isNull(invitations.acceptedAt),
+        isNull(invitations.revokedAt),
         gt(invitations.expiresAt, sql`now()`),
       ),
     );
@@ -142,73 +156,84 @@ export async function listOpenInvitationsByWorkspace(params: {
 }
 
 export async function revokeInvitation(params: {invitationId: string}): Promise<void> {
-  await db().delete(invitations).where(eq(invitations.id, params.invitationId));
+  await db()
+    .update(invitations)
+    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(and(eq(invitations.id, params.invitationId), isNull(invitations.acceptedAt)));
 }
 
-export interface AcceptInvitationParams {
+export type ReconcileInvitationAcceptanceResult =
+  | {status: 'accepted'; invitation: Invitation; membership: Membership; alreadyMember: boolean}
+  | {status: 'already_accepted'; invitation: Invitation; membership: Membership}
+  | {status: 'invalid' | 'expired' | 'revoked' | 'consumed_by_another_user' | 'email_mismatch'};
+
+export async function reconcileInvitationAcceptance(params: {
   invitationId: string;
   acceptedByUserId: string;
+  email: string;
   acceptedByUserName?: string | null | undefined;
-}
-
-export interface AcceptInvitationResult {
-  invitation: Invitation;
-  membership: Membership;
-  alreadyMember: boolean;
-}
-
-export async function acceptInvitation(
-  params: AcceptInvitationParams,
-): Promise<AcceptInvitationResult | undefined> {
+}): Promise<ReconcileInvitationAcceptanceResult> {
   const result = await db().transaction(async (tx) => {
-    const inv = await tx
+    const findMembership = async (userId: string, workspaceId: string) => {
+      const rows = await tx
+        .select()
+        .from(memberships)
+        .where(and(eq(memberships.userId, userId), eq(memberships.workspaceId, workspaceId)))
+        .limit(1);
+      const row = rows[0];
+      return row ? toMembership(row) : undefined;
+    };
+    const rows = await tx
       .select()
       .from(invitations)
-      .where(
-        and(
-          eq(invitations.id, params.invitationId),
-          isNull(invitations.acceptedAt),
-          gt(invitations.expiresAt, sql`now()`),
-        ),
-      )
-      .limit(1);
-
-    const invRow = inv[0];
-    if (!invRow) return undefined;
-
-    const existing = await tx
-      .select()
-      .from(memberships)
-      .where(
-        and(
-          eq(memberships.userId, params.acceptedByUserId),
-          eq(memberships.workspaceId, invRow.workspaceId),
-        ),
-      )
-      .limit(1);
+      .where(eq(invitations.id, params.invitationId))
+      .limit(1)
+      .for('update');
+    const row = rows[0];
+    if (!row) return {status: 'invalid'} as const;
 
-    let membership: Membership;
-    let alreadyMember = false;
-    const existingRow = existing[0];
+    const invitation = toInvitation(row);
+    if (invitation.acceptedAt !== null) {
+      if (invitation.acceptedByUserId !== params.acceptedByUserId) {
+        return {status: 'consumed_by_another_user'} as const;
+      }
+      const membership = await findMembership(params.acceptedByUserId, invitation.workspaceId);
+      if (!membership) throw new Error('Accepted invitation has no membership');
+      return {status: 'already_accepted', invitation, membership} as const;
+    }
+    if (invitation.revokedAt !== null) return {status: 'revoked'} as const;
+    if (invitation.expiresAt.getTime() <= Date.now()) return {status: 'expired'} as const;
+    if (invitation.email !== params.email) return {status: 'email_mismatch'} as const;
 
-    if (existingRow) {
-      alreadyMember = true;
-      membership = toMembership(existingRow);
-    } else {
+    const existingMembership = await findMembership(
+      params.acceptedByUserId,
+      invitation.workspaceId,
+    );
+    let membership = existingMembership;
+    if (!membership) {
       const created = await tx
         .insert(memberships)
         .values(
           membershipValues({
             userId: params.acceptedByUserId,
-            userEmail: invRow.email,
+            userEmail: invitation.email,
             userName: params.acceptedByUserName ?? null,
-            workspaceId: invRow.workspaceId,
+            workspaceId: invitation.workspaceId,
           }),
         )
         .returning();
       const createdRow = created[0];
       if (!createdRow) throw new Error('Insert returned no rows');
       membership = toMembership(createdRow);
+      await writeOutboxEvent<WorkspacesEventMap>(tx, workspacesOutbox, {
+        type: WORKSPACES_MEMBER_JOINED,
+        payload: {
+          workspaceId: invitation.workspaceId,
+          userId: params.acceptedByUserId,
+          email: invitation.email,
+          viaInvitation: true,
+        },
+      });
     }
 
     const updated = await tx
@@ -220,15 +245,18 @@ export async function acceptInvitation(
       })
       .where(eq(invitations.id, params.invitationId))
       .returning();
-
     const updatedRow = updated[0];
     if (!updatedRow) throw new Error('Update returned no rows');
-
-    return {invitation: toInvitation(updatedRow), membership, alreadyMember};
+    return {
+      status: 'accepted',
+      invitation: toInvitation(updatedRow),
+      membership,
+      alreadyMember: existingMembership !== undefined,
+    } as const;
   });
 
-  if (result && !result.alreadyMember) recordWorkspaceMembershipChanged('added');
-  if (result) {
+  if (result.status === 'accepted') {
+    if (!result.alreadyMember) recordWorkspaceMembershipChanged('added');
     recordWorkspaceInvitationAccepted(result.alreadyMember ? 'already_member' : 'added');
   }
   return result;

package/src/db/schema/invitations.ts

@@ -14,6 +14,7 @@ export const invitations = pgTable(
     email: text('email').notNull(),
     hashedToken: text('hashed_token').notNull(),
     expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
     acceptedAt: timestamp('accepted_at', {withTimezone: true}),
     acceptedByUserId: uuid('accepted_by_user_id'),
     invitedByUserId: uuid('invited_by_user_id').notNull(),
@@ -37,6 +38,7 @@ export function toInvitation(row: InvitationDb): Invitation {
     email: row.email,
     hashedToken: row.hashedToken,
     expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt,
     acceptedAt: row.acceptedAt,
     acceptedByUserId: row.acceptedByUserId,
     invitedByUserId: row.invitedByUserId,

package/src/db/workspaces.test.ts

@@ -1,4 +1,4 @@
-import {acceptInvitation, createInvitation} from './invitations.js';
+import {createInvitation, reconcileInvitationAcceptance} from './invitations.js';
 import {createMembership} from './memberships.js';
 import {
   createWorkspace,
@@ -98,9 +98,10 @@ describe('workspace queries', () => {
         invitedByUserId: crypto.randomUUID(),
         skipEmail: true,
       });
-      await acceptInvitation({
+      await reconcileInvitationAcceptance({
         invitationId: acceptedInvitation.id,
         acceptedByUserId: crypto.randomUUID(),
+        email: acceptedInvitation.email,
       });
 
       const metrics = await getWorkspaceServiceMetrics();

package/src/index.test.ts

@@ -1,5 +1,8 @@
 import {
   WORKSPACES_INVITATION_SEND_REQUESTED,
+  WORKSPACES_MEMBER_INVITED,
+  WORKSPACES_MEMBER_JOINED,
+  WORKSPACES_WORKSPACE_CREATED,
   workspacesEventSchemas,
 } from '@shipfox/api-workspaces-dto';
 import {workspacesModule} from './index.js';
@@ -8,17 +11,23 @@ vi.mock('#config.js', () => ({
   config: {
     CLIENT_BASE_URL: 'https://app.example.test',
   },
+}));
+
+vi.mock('@shipfox/node-mailer', () => ({
   mailer: {send: vi.fn()},
 }));
 
 describe('workspacesModule', () => {
-  test('registers workspace invitation outbox publisher and subscriber', () => {
+  test('registers workspace outbox publisher and invitation subscriber', () => {
     const publisher = workspacesModule.publishers?.find((pub) => pub.name === 'workspaces');
     const events = workspacesModule.subscribers?.map((subscriber) => subscriber.event);
 
     expect(publisher?.eventSchemas).toBe(workspacesEventSchemas);
     expect(Object.keys(publisher?.eventSchemas ?? {})).toEqual([
       WORKSPACES_INVITATION_SEND_REQUESTED,
+      WORKSPACES_WORKSPACE_CREATED,
+      WORKSPACES_MEMBER_INVITED,
+      WORKSPACES_MEMBER_JOINED,
     ]);
     expect(events).toContain(WORKSPACES_INVITATION_SEND_REQUESTED);
   });

package/src/index.ts

@@ -8,6 +8,7 @@ import {subscriberFactory} from '@shipfox/node-module';
 import {db, migrationsPath, workspacesOutbox} from '#db/index.js';
 import {registerWorkspacesServiceMetrics} from '#metrics/index.js';
 import {workspacesE2eRoutes} from '#presentation/e2eRoutes/index.js';
+import {createWorkspacesInterModulePresentation} from '#presentation/inter-module.js';
 import {workspacesRoutes} from '#presentation/routes/index.js';
 import {onInvitationSendRequested} from '#presentation/subscribers/index.js';
 
@@ -21,7 +22,12 @@ export {
   TokenInvalidError,
   WorkspaceNotFoundError,
 } from '#core/errors.js';
-export {acceptWorkspaceInvitation, peekInvitationByRawToken} from '#core/invitations.js';
+export {
+  acceptWorkspaceInvitation,
+  peekInvitationByRawToken,
+  reconcileWorkspaceInvitationAcceptance,
+  type WorkspaceInvitationReconciliation,
+} from '#core/invitations.js';
 export {type EnsureMembershipParams, ensureMembership} from '#core/memberships.js';
 export {getWorkspace, requireWorkspaceMembership} from '#core/workspaces.js';
 export {db, migrationsPath} from '#db/index.js';
@@ -40,4 +46,5 @@ export const workspacesModule: ShipfoxModule = {
   ],
   subscribers: [subscriber(WORKSPACES_INVITATION_SEND_REQUESTED, onInvitationSendRequested)],
   metrics: registerWorkspacesServiceMetrics,
+  interModulePresentations: [createWorkspacesInterModulePresentation()],
 };

package/src/presentation/inter-module.ts

@@ -0,0 +1,94 @@
+import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
+import {
+  createInterModuleKnownError,
+  defineInterModulePresentation,
+  type InterModulePresentation,
+} from '@shipfox/inter-module';
+import {
+  InvitationEmailMismatchError,
+  MembershipRequiredError,
+  TokenAlreadyUsedError,
+  TokenExpiredError,
+  TokenInvalidError,
+  WorkspaceInactiveError,
+  WorkspaceNotFoundError,
+} from '#core/errors.js';
+import {acceptWorkspaceInvitation, peekInvitationByRawToken} from '#core/invitations.js';
+import {requireWorkspaceMembership} from '#core/workspaces.js';
+import {listMembershipsByUser} from '#db/memberships.js';
+
+export function createWorkspacesInterModulePresentation(): InterModulePresentation<
+  typeof workspacesInterModuleContract
+> {
+  return defineInterModulePresentation(workspacesInterModuleContract, {
+    listMembershipsForTokenClaims: async ({userId}) => ({
+      memberships: (await listMembershipsByUser({userId})).map(({workspaceId}) => ({
+        workspaceId,
+        role: 'admin' as const,
+      })),
+    }),
+    preflightInvitationAcceptance: async (input) => {
+      try {
+        const invitation = await peekInvitationByRawToken({token: input.token});
+        if (!invitation) throw new TokenInvalidError('Invitation token is invalid');
+        if (invitation.acceptedAt !== null) throw new TokenAlreadyUsedError();
+        if (invitation.expiresAt.getTime() <= Date.now()) throw new TokenExpiredError();
+        if (invitation.email !== input.email) throw new InvitationEmailMismatchError();
+        return {};
+      } catch (error) {
+        throw toInvitationKnownError('preflightInvitationAcceptance', error);
+      }
+    },
+    acceptInvitation: async (input) => {
+      try {
+        const result = await acceptWorkspaceInvitation(input);
+        return {
+          membership: {
+            id: result.membership.id,
+            userId: result.membership.userId,
+            workspaceId: result.membership.workspaceId,
+          },
+        };
+      } catch (error) {
+        throw toInvitationKnownError('acceptInvitation', error);
+      }
+    },
+    requireActiveMembership: async (input) => {
+      try {
+        await requireWorkspaceMembership(input);
+        return {};
+      } catch (error) {
+        const method = workspacesInterModuleContract.methods.requireActiveMembership;
+        if (error instanceof MembershipRequiredError)
+          throw createInterModuleKnownError(method, 'membership-required', {
+            workspaceId: input.workspaceId,
+          });
+        if (error instanceof WorkspaceNotFoundError)
+          throw createInterModuleKnownError(method, 'workspace-not-found', {
+            workspaceId: input.workspaceId,
+          });
+        if (error instanceof WorkspaceInactiveError)
+          throw createInterModuleKnownError(method, 'workspace-inactive', {
+            workspaceId: input.workspaceId,
+          });
+        throw error;
+      }
+    },
+  });
+}
+
+function toInvitationKnownError(
+  methodName: 'preflightInvitationAcceptance' | 'acceptInvitation',
+  error: unknown,
+): unknown {
+  const method = workspacesInterModuleContract.methods[methodName];
+  if (error instanceof TokenInvalidError)
+    return createInterModuleKnownError(method, 'invitation-token-invalid', {});
+  if (error instanceof TokenAlreadyUsedError)
+    return createInterModuleKnownError(method, 'invitation-token-used', {});
+  if (error instanceof TokenExpiredError)
+    return createInterModuleKnownError(method, 'invitation-token-expired', {});
+  if (error instanceof InvitationEmailMismatchError)
+    return createInterModuleKnownError(method, 'invitation-email-mismatch', {});
+  return error;
+}

package/src/presentation/routes/invitations/create.test.ts

@@ -34,7 +34,7 @@ describe('POST /workspaces/:workspaceId/invitations', () => {
       method: 'POST',
       url: `/workspaces/${workspaceId}/invitations`,
       headers: {authorization: `Bearer ${owner.token}`},
-      payload: {email: inviteeEmail.toUpperCase()},
+      payload: {email: `  ${inviteeEmail.toUpperCase()}  `},
     });
 
     expect(res.statusCode).toBe(201);
@@ -66,6 +66,24 @@ describe('POST /workspaces/:workspaceId/invitations', () => {
     expect(await invitationOutboxEventsTo(inviteeEmail)).toHaveLength(1);
   });
 
+  test('transforms a whitespace/case-equivalent duplicate open invitation into 409', async () => {
+    const owner = await signupVerifyLogin(app, 'invite-create-duplicate-equivalent');
+    const workspaceId = await createWorkspace(app, owner.token);
+    const inviteeEmail = uniqueEmail('duplicate-invite-equivalent');
+    await createInvite(app, {token: owner.token, workspaceId, email: inviteeEmail});
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${owner.token}`},
+      payload: {email: `  ${inviteeEmail.toUpperCase()}  `},
+    });
+
+    expect(res.statusCode).toBe(409);
+    expect(res.json().code).toBe('open-invitation-exists');
+    expect(await invitationOutboxEventsTo(inviteeEmail)).toHaveLength(1);
+  });
+
   test('transforms missing membership into 403', async () => {
     const outsider = await signupVerifyLogin(app, 'invite-create-outsider');
     const workspaceId = crypto.randomUUID();

package/src/presentation/subscribers/invitation-send-requested.test.ts

@@ -16,7 +16,7 @@ const testMailer = vi.hoisted(
   },
 );
 
-vi.mock('#config.js', () => ({
+vi.mock('@shipfox/node-mailer', () => ({
   mailer: testMailer.mailer,
 }));
 

package/src/presentation/subscribers/on-invitation-send-requested.ts

@@ -1,6 +1,6 @@
 import type {WorkspacesInvitationSendRequestedEvent} from '@shipfox/api-workspaces-dto';
 import {renderEmail} from '@shipfox/node-email';
-import {mailer} from '#config.js';
+import {mailer} from '@shipfox/node-mailer';
 
 export async function onInvitationSendRequested(
   payload: WorkspacesInvitationSendRequestedEvent,