@simple-auth-kit/cli 1.0.0

package/registry/combos/express-prisma/variants/workspaces/src/workspace.repository.ts

@@ -0,0 +1,188 @@
+import { PrismaClient } from "../generated/prisma/client.js";
+import { HttpError } from "./http-error.js";
+import { provisionDefaultRoles, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import { RbacRepository } from "./rbac.repository.js";
+import { toId } from "./id.helper.js";
+
+export interface WorkspaceSummary {
+  id: string;
+  name: string;
+  createdAt: string;
+  /** The calling user's role slugs in this workspace. */
+  roles: string[];
+}
+
+export interface MembershipSummary {
+  memberId: string;
+  userId: string;
+  email: string;
+  roles: string[];
+  createdAt: string;
+}
+
+export class WorkspaceRepository {
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly rbac: RbacRepository,
+  ) {}
+
+  /**
+   * Creates a workspace, its creator's admin membership, *and* that workspace's default roles —
+   * all in one transaction, so a workspace is never left without an administrator.
+   *
+   * The role provisioning is not optional garnish. `Role` is unique per `[workspaceId, slug]`, so
+   * a new workspace genuinely has no `Role` rows: without them the creator's membership would
+   * point at nothing, resolve to zero permissions, and lock them out of the workspace they had
+   * just made the instant any route enforced a permission. The seeder only provisions the
+   * workspace *it* creates, so this path has to provision its own — from the same definition,
+   * which is why both call `provisionDefaultRoles` rather than each keeping a copy of the table.
+   */
+  async create(userId: string, name: string): Promise<WorkspaceSummary> {
+    const userIdBig = toId(userId);
+    const workspace = await this.prisma.$transaction(async (tx) => {
+      const created = await tx.workspace.create({ data: { name, createdBy: userIdBig, updatedBy: userIdBig } });
+      await provisionDefaultRoles(tx, created.id);
+      const roles = await tx.role.findMany({ where: { workspaceId: created.id, slug: { in: WORKSPACE_CREATOR_ROLES } }, select: { id: true } });
+      await tx.workspaceMember.create({
+        data: { workspaceId: created.id, userId: userIdBig, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+      });
+      return created;
+    });
+    return {
+      id: workspace.id.toString(),
+      name: workspace.name,
+      createdAt: workspace.createdAt.toISOString(),
+      roles: [...WORKSPACE_CREATOR_ROLES].sort(),
+    };
+  }
+
+  async listForUser(userId: string): Promise<WorkspaceSummary[]> {
+    const memberships = await this.prisma.workspaceMember.findMany({
+      where: { userId: toId(userId), workspace: { isDeleted: false } },
+      include: { workspace: true, roles: { select: { role: { select: { slug: true } } } } },
+      orderBy: { createdAt: "asc" },
+    });
+    return memberships.map((m) => ({
+      id: m.workspace.id.toString(),
+      name: m.workspace.name,
+      createdAt: m.workspace.createdAt.toISOString(),
+      roles: m.roles.map((r) => r.role.slug).sort(),
+    }));
+  }
+
+  async listMembers(workspaceId: string): Promise<MembershipSummary[]> {
+    const rows = await this.prisma.workspaceMember.findMany({
+      where: { workspaceId: toId(workspaceId), user: { isDeleted: false } },
+      include: { user: true, roles: { select: { role: { select: { slug: true } } } } },
+      orderBy: { createdAt: "asc" },
+    });
+    return rows.map((row) => ({
+      memberId: row.id.toString(),
+      userId: row.userId.toString(),
+      email: row.user.email,
+      roles: row.roles.map((r) => r.role.slug).sort(),
+      createdAt: row.createdAt.toISOString(),
+    }));
+  }
+
+  private async resolveMemberRoles(workspaceIdBig: bigint, roleSlugs?: string[]) {
+    const roles = await this.prisma.role.findMany({
+      where: roleSlugs
+        ? { workspaceId: workspaceIdBig, slug: { in: roleSlugs }, isDeleted: false }
+        : { workspaceId: workspaceIdBig, isDefault: true, isActive: true, isDeleted: false },
+      select: { id: true, slug: true },
+    });
+    const unknown = (roleSlugs ?? []).filter((slug) => !roles.some((role) => role.slug === slug));
+    if (unknown.length) throw new HttpError(404, `role(s) not defined in this workspace: ${unknown.join(", ")}`);
+    return roles;
+  }
+
+  /**
+   * Adds an existing user by email — there is no invite/email flow in this library, that is the
+   * consuming app's job. With no roles named, the new membership gets whichever of this
+   * workspace's roles are flagged `isDefault`, not a slug spelled in code.
+   */
+  async addMember(workspaceId: string, email: string, roleSlugs?: string[]): Promise<MembershipSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const user = await this.prisma.user.findUnique({ where: { email, isDeleted: false } });
+    if (!user) throw new HttpError(404, "no user with that email");
+
+    const existing = await this.prisma.workspaceMember.findUnique({ where: { userId_workspaceId: { userId: user.id, workspaceId: workspaceIdBig } } });
+    if (existing) throw new HttpError(409, "already a member of this workspace");
+
+    const roles = await this.resolveMemberRoles(workspaceIdBig, roleSlugs);
+    const member = await this.prisma.workspaceMember.create({
+      data: { workspaceId: workspaceIdBig, userId: user.id, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+    });
+    return {
+      memberId: member.id.toString(),
+      userId: user.id.toString(),
+      email: user.email,
+      roles: roles.map((role) => role.slug).sort(),
+      createdAt: member.createdAt.toISOString(),
+    };
+  }
+
+  /**
+   * An administrator provisioning a brand-new account and adding it to this workspace in one
+   * step — as distinct from `addMember`, which only ever attaches an account that already
+   * exists. No invite/email flow in this library either way: the password is usable immediately.
+   */
+  async createMember(
+    workspaceId: string,
+    input: {
+      email: string;
+      passwordHash: string;
+      firstName?: string;
+      lastName?: string;
+      displayName?: string;
+      phone?: string;
+      username?: string;
+      roles?: string[];
+    },
+    actorUserId: string | null,
+  ): Promise<MembershipSummary> {
+    const workspaceIdBig = toId(workspaceId);
+    const existing = await this.prisma.user.findUnique({ where: { email: input.email } });
+    if (existing) throw new HttpError(409, "email already registered");
+
+    const roles = await this.resolveMemberRoles(workspaceIdBig, input.roles);
+    const user = await this.prisma.user.create({
+      data: {
+        email: input.email,
+        passwordHash: input.passwordHash,
+        firstName: input.firstName,
+        lastName: input.lastName,
+        displayName: input.displayName,
+        phone: input.phone,
+        username: input.username,
+        createdBy: actorUserId ? toId(actorUserId) : null,
+      },
+    });
+    const member = await this.prisma.workspaceMember.create({
+      data: { workspaceId: workspaceIdBig, userId: user.id, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+    });
+    return {
+      memberId: member.id.toString(),
+      userId: user.id.toString(),
+      email: user.email,
+      roles: roles.map((role) => role.slug).sort(),
+      createdAt: member.createdAt.toISOString(),
+    };
+  }
+
+  async removeMember(workspaceId: string, memberId: string): Promise<void> {
+    const workspaceIdBig = toId(workspaceId);
+    const memberIdBig = toId(memberId);
+    const member = await this.prisma.workspaceMember.findUnique({ where: { id: memberIdBig } });
+    if (!member || member.workspaceId !== workspaceIdBig) throw new HttpError(404, "member not found in this workspace");
+
+    // Role assignments and direct grants belong to the membership, so they go with it — that is
+    // the point of hanging them off the member row. `onDelete: Cascade` on both join tables is
+    // what makes that a database guarantee rather than two deletes someone has to remember.
+    await this.prisma.workspaceMember.delete({ where: { id: memberIdBig } });
+    // A removed member must lose access on their very next request, so their entry has to become
+    // unreachable — the resolution that replaces it returns "not a member", which is never cached.
+    await this.rbac.invalidateMember(member.userId.toString(), workspaceId);
+  }
+}

package/registry/combos/express-prisma/variants/workspaces/src/workspace.router.ts

@@ -0,0 +1,123 @@
+import { Router } from "express";
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import { HttpError } from "./http-error.js";
+import { RbacRepository } from "./rbac.repository.js";
+import { ability, authenticated, createTieredRouter } from "./route-tiers.js";
+import { WorkspaceRepository } from "./workspace.repository.js";
+import "./request-context.js";
+
+function requireString(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
+  return value;
+}
+
+function requireStringArray(value: unknown, field: string): string[] {
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new HttpError(400, `${field} must be an array of strings`);
+  return value as string[];
+}
+
+export interface WorkspaceRouterDeps {
+  workspaces: WorkspaceRepository;
+  rbac: RbacRepository;
+  authentication: RequestHandler;
+  /** Resolves a workspace when the request names one, and does nothing when it does not. */
+  authorization: RequestHandler;
+  /** The same resolution, but the `X-Workspace-Id` header is mandatory. */
+  workspaceScope: RequestHandler;
+}
+
+/**
+ * Workspace membership. Every route below that acts *inside* a workspace names it with the
+ * `X-Workspace-Id` header rather than a path segment — the same rule the `/auth/admin/*` routes
+ * follow, so there is exactly one way a request says which workspace it means.
+ *
+ * Three routes here are deliberately tier 2 — `authenticated()`, any logged-in caller — and the
+ * permission catalog mints no slugs for them. That is a decision written on each route, not an
+ * omission: the tier is a required argument, so a route with none is a compile error
+ * (route-tiers.ts).
+ *   • `POST /workspaces` and `GET /workspaces` are outside every workspace — any authenticated
+ *     user may create one or list their own. There is no workspace whose permissions could be
+ *     checked, and gating them on a permission granted *inside* some other workspace would mean
+ *     your first workspace could only be created by someone who already had one.
+ *   • `GET /workspaces/members` is gated on membership itself: the workspace middleware already
+ *     proved the caller belongs to the workspace, and seeing who else is in a room you are in is
+ *     not an administrative capability.
+ * The three that mutate membership are permission-gated — see `rbac.defaults.ts` for the catalog.
+ *
+ * Two tiered routers, because the tier's middleware is what enforces the tier: the unscoped
+ * routes resolve a workspace only if one is named, while everything under a workspace uses the
+ * mandatory resolution. Mounting them in this order matters — the scoped router is consulted
+ * first, so `/workspaces/members` reaches it rather than falling through.
+ *
+ * Replaces the reference combo's `WorkspaceController`.
+ */
+export function createWorkspaceRouter(deps: WorkspaceRouterDeps): RequestHandler {
+  const { workspaces, rbac, authentication, authorization, workspaceScope } = deps;
+
+  const scoped = createTieredRouter({ authentication, authorization: workspaceScope });
+  const unscoped = createTieredRouter({ authentication, authorization });
+
+  unscoped.route("post", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const body = req.body as Record<string, unknown>;
+      res.status(201).json(await workspaces.create(req.auth!.sub, requireString(body.name, "name")));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  unscoped.route("get", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      res.status(200).json(await workspaces.listForUser(req.auth!.sub));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("get", "/members", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      res.status(200).json(await workspaces.listMembers(req.authz!.workspaceId));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("post", "/members", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const body = req.body as Record<string, unknown>;
+      // No `roles` in the body means "whatever this workspace flags as the default role" — the
+      // default lives in a row, not in this line.
+      const roles = body.roles === undefined ? undefined : requireStringArray(body.roles, "roles");
+      res.status(201).json(await workspaces.addMember(req.authz!.workspaceId, requireString(body.email, "email"), roles));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("put", "/members/:memberId/roles", ability("roles:assign"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const memberId = requireString(req.params.memberId, "memberId");
+      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot change your own roles");
+      const body = req.body as Record<string, unknown>;
+      res.status(200).json(await rbac.setMemberRoles(req.authz!.workspaceId, memberId, requireStringArray(body.roles, "roles")));
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  scoped.route("delete", "/members/:memberId", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const memberId = requireString(req.params.memberId, "memberId");
+      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot remove yourself from a workspace you administer");
+      await workspaces.removeMember(req.authz!.workspaceId, memberId);
+      res.status(200).json({ ok: true });
+    } catch (err) {
+      next(err);
+    }
+  });
+
+  const router = Router();
+  router.use(scoped.handler);
+  router.use(unscoped.handler);
+  return router;
+}