@simple-auth-kit/cli 1.0.0

package/registry/combos/express-drizzle/variants/workspaces/src/workspace.repository.ts

@@ -0,0 +1,254 @@
+import { and, asc, eq, inArray } from "drizzle-orm";
+import type { Database } from "./db.js";
+import { provisionDefaultRoles, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import { RbacRepository } from "./rbac.repository.js";
+import { roleMember, roles, users, workspaceMembers, workspaces } from "./schema.js";
+import { HttpError } from "./http-error.js";
+import { toId } from "./id.helper.js";
+
+export interface WorkspaceSummary {
+  id: string;
+  name: string;
+  createdAt: string;
+  /** The calling user's role slugs in this workspace. */
+  roles: string[];
+}
+
+export interface MembershipSummary {
+  memberId: string;
+  userId: string;
+  email: string;
+  roles: string[];
+  createdAt: string;
+}
+
+export class WorkspaceRepository {
+  constructor(
+    private readonly db: Database,
+    private readonly rbac: RbacRepository,
+  ) {}
+
+  /**
+   * Creates a workspace, its creator's admin membership, *and* that workspace's default roles —
+   * all in one transaction, so a workspace is never left without an administrator.
+   *
+   * The role provisioning is not optional garnish. `roles` is unique per `[workspaceId, slug]`, so
+   * a new workspace genuinely has no role rows: without them the creator's membership would point
+   * at nothing, resolve to zero permissions, and lock them out of the workspace they had just made
+   * the instant any route enforced a permission. The seeder only provisions the workspace *it*
+   * creates, so this path has to provision its own — from the same definition, which is why both
+   * call `provisionDefaultRoles` rather than each keeping a copy of the table.
+   */
+  async create(userId: string, name: string): Promise<WorkspaceSummary> {
+    const userIdBig = toId(userId);
+    const workspace = await this.db.transaction(async (tx) => {
+      const [created] = await tx.insert(workspaces).values({ name, createdBy: userIdBig, updatedBy: userIdBig }).returning();
+      await provisionDefaultRoles(tx, created.id);
+
+      const creatorRoles = await tx
+        .select({ id: roles.id })
+        .from(roles)
+        .where(and(eq(roles.workspaceId, created.id), inArray(roles.slug, WORKSPACE_CREATOR_ROLES)));
+      const [member] = await tx.insert(workspaceMembers).values({ workspaceId: created.id, userId: userIdBig }).returning({ id: workspaceMembers.id });
+      if (creatorRoles.length) {
+        await tx.insert(roleMember).values(creatorRoles.map((role) => ({ memberId: member.id, roleId: role.id })));
+      }
+      return created;
+    });
+    return {
+      id: workspace.id.toString(),
+      name: workspace.name,
+      createdAt: workspace.createdAt.toISOString(),
+      roles: [...WORKSPACE_CREATOR_ROLES].sort(),
+    };
+  }
+
+  async listForUser(userId: string): Promise<WorkspaceSummary[]> {
+    const memberships = await this.db
+      .select({
+        memberId: workspaceMembers.id,
+        memberCreatedAt: workspaceMembers.createdAt,
+        id: workspaces.id,
+        name: workspaces.name,
+        createdAt: workspaces.createdAt,
+      })
+      .from(workspaceMembers)
+      .innerJoin(workspaces, and(eq(workspaces.id, workspaceMembers.workspaceId), eq(workspaces.isDeleted, false)))
+      .where(eq(workspaceMembers.userId, toId(userId)))
+      .orderBy(asc(workspaceMembers.createdAt));
+
+    const rolesByMember = await this.rolesByMember(memberships.map((m) => m.memberId));
+    return memberships.map((m) => ({
+      id: m.id.toString(),
+      name: m.name,
+      createdAt: m.createdAt.toISOString(),
+      roles: (rolesByMember.get(m.memberId.toString()) ?? []).sort(),
+    }));
+  }
+
+  async listMembers(workspaceId: string): Promise<MembershipSummary[]> {
+    const rows = await this.db
+      .select({
+        memberId: workspaceMembers.id,
+        userId: workspaceMembers.userId,
+        createdAt: workspaceMembers.createdAt,
+        email: users.email,
+      })
+      .from(workspaceMembers)
+      .innerJoin(users, and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)))
+      .where(eq(workspaceMembers.workspaceId, toId(workspaceId)))
+      .orderBy(asc(workspaceMembers.createdAt));
+
+    const rolesByMember = await this.rolesByMember(rows.map((r) => r.memberId));
+    return rows.map((row) => ({
+      memberId: row.memberId.toString(),
+      userId: row.userId.toString(),
+      email: row.email,
+      roles: (rolesByMember.get(row.memberId.toString()) ?? []).sort(),
+      createdAt: row.createdAt.toISOString(),
+    }));
+  }
+
+  /**
+   * Resolves the roles a new membership should get: the named slugs if any were given, else
+   * whichever of this workspace's roles are flagged `isDefault` — not a slug spelled in code.
+   * Shared by `addMember` (an existing account) and `createMember` (a brand-new one), so both
+   * fail the same way against an unknown role slug.
+   */
+  private async resolveMemberRoles(workspaceIdBig: bigint, roleSlugs?: string[]): Promise<Array<{ id: bigint; slug: string }>> {
+    const granted = await this.db
+      .select({ id: roles.id, slug: roles.slug })
+      .from(roles)
+      .where(
+        roleSlugs
+          ? and(eq(roles.workspaceId, workspaceIdBig), inArray(roles.slug, roleSlugs))
+          : and(eq(roles.workspaceId, workspaceIdBig), eq(roles.isDefault, true), eq(roles.isActive, true)),
+      );
+    const unknown = (roleSlugs ?? []).filter((slug) => !granted.some((role) => role.slug === slug));
+    if (unknown.length) throw new HttpError(404, `role(s) not defined in this workspace: ${unknown.join(", ")}`);
+    return granted;
+  }
+
+  /**
+   * Adds an existing user by email — there is no invite/email flow in this library, that is the
+   * consuming app's job. With no roles named, the new membership gets whichever of this
+   * workspace's roles are flagged `isDefault`, not a slug spelled in code.
+   */
+  async addMember(workspaceId: string, email: string, roleSlugs?: string[]): Promise<MembershipSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const [user] = await this.db.select({ id: users.id, email: users.email }).from(users).where(eq(users.email, email)).limit(1);
+    if (!user) throw new HttpError(404, "no user with that email");
+
+    const [existing] = await this.db
+      .select({ id: workspaceMembers.id })
+      .from(workspaceMembers)
+      .where(and(eq(workspaceMembers.userId, user.id), eq(workspaceMembers.workspaceId, workspaceIdBig)))
+      .limit(1);
+    if (existing) throw new HttpError(409, "already a member of this workspace");
+
+    const granted = await this.resolveMemberRoles(workspaceIdBig, roleSlugs);
+
+    const member = await this.db.transaction(async (tx) => {
+      const [created] = await tx.insert(workspaceMembers).values({ workspaceId: workspaceIdBig, userId: user.id }).returning();
+      if (granted.length) await tx.insert(roleMember).values(granted.map((role) => ({ memberId: created.id, roleId: role.id })));
+      return created;
+    });
+
+    return {
+      memberId: member.id.toString(),
+      userId: user.id.toString(),
+      email: user.email,
+      roles: granted.map((role) => role.slug).sort(),
+      createdAt: member.createdAt.toISOString(),
+    };
+  }
+
+  /**
+   * An administrator provisioning a brand-new account and adding it to this workspace in one
+   * step — as distinct from `addMember`, which only ever attaches an account that already
+   * exists. No invite/email flow in this library either way: the password is usable immediately.
+   */
+  async createMember(
+    workspaceId: string,
+    input: {
+      email: string;
+      passwordHash: string;
+      firstName?: string;
+      lastName?: string;
+      displayName?: string;
+      phone?: string;
+      username?: string;
+      roles?: string[];
+    },
+    actorUserId: string | null,
+  ): Promise<MembershipSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const [existing] = await this.db.select({ id: users.id }).from(users).where(eq(users.email, input.email)).limit(1);
+    if (existing) throw new HttpError(409, "email already registered");
+
+    const granted = await this.resolveMemberRoles(workspaceIdBig, input.roles);
+
+    const member = await this.db.transaction(async (tx) => {
+      const [user] = await tx
+        .insert(users)
+        .values({
+          email: input.email,
+          passwordHash: input.passwordHash,
+          firstName: input.firstName,
+          lastName: input.lastName,
+          displayName: input.displayName,
+          phone: input.phone,
+          username: input.username,
+          createdBy: actorUserId ? toId(actorUserId) : null,
+        })
+        .returning();
+      const [created] = await tx.insert(workspaceMembers).values({ workspaceId: workspaceIdBig, userId: user.id }).returning();
+      if (granted.length) await tx.insert(roleMember).values(granted.map((role) => ({ memberId: created.id, roleId: role.id })));
+      return { member: created, user };
+    });
+
+    return {
+      memberId: member.member.id.toString(),
+      userId: member.user.id.toString(),
+      email: member.user.email,
+      roles: granted.map((role) => role.slug).sort(),
+      createdAt: member.member.createdAt.toISOString(),
+    };
+  }
+
+  async removeMember(workspaceId: string, memberId: string): Promise<void> {
+    const workspaceIdBig = toId(workspaceId);
+    const memberIdBig = toId(memberId);
+    const [member] = await this.db
+      .select({ id: workspaceMembers.id, userId: workspaceMembers.userId, workspaceId: workspaceMembers.workspaceId })
+      .from(workspaceMembers)
+      .where(eq(workspaceMembers.id, memberIdBig))
+      .limit(1);
+    if (!member || member.workspaceId !== workspaceIdBig) throw new HttpError(404, "member not found in this workspace");
+
+    // Role assignments and direct grants belong to the membership, so they go with it — that is
+    // the point of hanging them off the member row. `onDelete: "cascade"` on both join tables is
+    // what makes that a database guarantee rather than two deletes someone has to remember.
+    await this.db.delete(workspaceMembers).where(eq(workspaceMembers.id, memberIdBig));
+    // A removed member must lose access on their very next request, so their entry has to become
+    // unreachable — the resolution that replaces it returns "not a member", which is never cached.
+    await this.rbac.invalidateMember(member.userId.toString(), workspaceId);
+  }
+
+  /** One read for a page's role assignments rather than one per membership. */
+  private async rolesByMember(memberIds: bigint[]): Promise<Map<string, string[]>> {
+    if (!memberIds.length) return new Map();
+    const rows = await this.db
+      .select({ memberId: roleMember.memberId, slug: roles.slug })
+      .from(roleMember)
+      .innerJoin(roles, eq(roles.id, roleMember.roleId))
+      .where(inArray(roleMember.memberId, memberIds));
+
+    const byMember = new Map<string, string[]>();
+    for (const row of rows) {
+      const key = row.memberId.toString();
+      byMember.set(key, [...(byMember.get(key) ?? []), row.slug]);
+    }
+    return byMember;
+  }
+}

package/registry/combos/express-drizzle/variants/workspaces/src/workspace.router.ts

@@ -0,0 +1,123 @@
+import { Router } from "express";
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import { HttpError } from "./http-error.js";
+import { RbacRepository } from "./rbac.repository.js";
+import { ability, authenticated, createTieredRouter } from "./route-tiers.js";
+import { WorkspaceRepository } from "./workspace.repository.js";
+import "./request-context.js";
+
+function requireString(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
+  return value;
+}
+
+function requireStringArray(value: unknown, field: string): string[] {
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new HttpError(400, `${field} must be an array of strings`);
+  return value as string[];
+}
+
+export interface WorkspaceRouterDeps {
+  workspaces: WorkspaceRepository;
+  rbac: RbacRepository;
+  authentication: RequestHandler;
+  /** Resolves a workspace when the request names one, and does nothing when it does not. */
+  authorization: RequestHandler;
+  /** The same resolution, but the `X-Workspace-Id` header is mandatory. */
+  workspaceScope: RequestHandler;
+}
+
+/**
+ * Workspace membership. Every route below that acts *inside* a workspace names it with the
+ * `X-Workspace-Id` header rather than a path segment — the same rule the `/auth/admin/*` routes
+ * follow, so there is exactly one way a request says which workspace it means.
+ *
+ * Three routes here are deliberately tier 2 — `authenticated()`, any logged-in caller — and the
+ * permission catalog mints no slugs for them. That is a decision written on each route, not an
+ * omission: the tier is a required argument, so a route with none is a compile error
+ * (route-tiers.ts).
+ *   • `POST /workspaces` and `GET /workspaces` are outside every workspace — any authenticated
+ *     user may create one or list their own. There is no workspace whose permissions could be
+ *     checked, and gating them on a permission granted *inside* some other workspace would mean
+ *     your first workspace could only be created by someone who already had one.
+ *   • `GET /workspaces/members` is gated on membership itself: the workspace middleware already
+ *     proved the caller belongs to the workspace, and seeing who else is in a room you are in is
+ *     not an administrative capability.
+ * The three that mutate membership are permission-gated — see `rbac.defaults.ts` for the catalog.
+ *
+ * Two tiered routers, because the tier's middleware is what enforces the tier: the unscoped
+ * routes resolve a workspace only if one is named, while everything under a workspace uses the
+ * mandatory resolution. Mounting them in this order matters — the scoped router is consulted
+ * first, so `/workspaces/members` reaches it rather than falling through.
+ *
+ * Replaces the reference combo's `WorkspaceController`.
+ */
+export function createWorkspaceRouter(deps: WorkspaceRouterDeps): RequestHandler {
+  const { workspaces, rbac, authentication, authorization, workspaceScope } = deps;
+
+  const scoped = createTieredRouter({ authentication, authorization: workspaceScope });
+  const unscoped = createTieredRouter({ authentication, authorization });
+
+  unscoped.route("post", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const body = req.body as Record<string, unknown>;
+      res.status(201).json(await workspaces.create(req.auth!.sub, requireString(body.name, "name")));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  unscoped.route("get", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      res.status(200).json(await workspaces.listForUser(req.auth!.sub));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("get", "/members", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      res.status(200).json(await workspaces.listMembers(req.authz!.workspaceId));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("post", "/members", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const body = req.body as Record<string, unknown>;
+      // No `roles` in the body means "whatever this workspace flags as the default role" — the
+      // default lives in a row, not in this line.
+      const roles = body.roles === undefined ? undefined : requireStringArray(body.roles, "roles");
+      res.status(201).json(await workspaces.addMember(req.authz!.workspaceId, requireString(body.email, "email"), roles));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("put", "/members/:memberId/roles", ability("roles:assign"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const memberId = requireString(req.params.memberId, "memberId");
+      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot change your own roles");
+      const body = req.body as Record<string, unknown>;
+      res.status(200).json(await rbac.setMemberRoles(req.authz!.workspaceId, memberId, requireStringArray(body.roles, "roles")));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("delete", "/members/:memberId", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const memberId = requireString(req.params.memberId, "memberId");
+      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot remove yourself from a workspace you administer");
+      await workspaces.removeMember(req.authz!.workspaceId, memberId);
+      res.status(200).json({ ok: true });
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  const router = Router();
+  router.use(scoped.handler);
+  router.use(unscoped.handler);
+  return router;
+}