@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/routers/workspace.router.ts

@@ -0,0 +1,194 @@
+import { Router } from "express";
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import { HttpError } from "../http-error.js";
+import { RbacRepository } from "../repositories/rbac.repository.js";
+import { ability, authenticated, createTieredRouter } from "../route-tiers.js";
+import { WorkspaceRepository } from "../repositories/workspace.repository.js";
+import "../request-context.js";
+
+function requireString(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.length === 0)
+    throw new HttpError(400, `${field} is required`);
+  return value;
+}
+
+function requireStringArray(value: unknown, field: string): string[] {
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string"))
+    throw new HttpError(400, `${field} must be an array of strings`);
+  return value as string[];
+}
+
+export interface WorkspaceRouterDeps {
+  workspaces: WorkspaceRepository;
+  rbac: RbacRepository;
+  authentication: RequestHandler;
+  /** Resolves a workspace when the request names one, and does nothing when it does not. */
+  authorization: RequestHandler;
+  /** The same resolution, but the `X-Workspace-Id` header is mandatory. */
+  workspaceScope: RequestHandler;
+}
+
+/**
+ * Workspace membership. Every route below that acts *inside* a workspace names it with the
+ * `X-Workspace-Id` header rather than a path segment — the same rule the `/auth/admin/*` routes
+ * follow, so there is exactly one way a request says which workspace it means.
+ *
+ * Three routes here are deliberately tier 2 — `authenticated()`, any logged-in caller — and the
+ * permission catalog mints no slugs for them. That is a decision written on each route, not an
+ * omission: the tier is a required argument, so a route with none is a compile error
+ * (route-tiers.ts).
+ *   • `POST /workspaces` and `GET /workspaces` are outside every workspace — any authenticated
+ *     user may create one or list their own. There is no workspace whose permissions could be
+ *     checked, and gating them on a permission granted *inside* some other workspace would mean
+ *     your first workspace could only be created by someone who already had one.
+ *   • `GET /workspaces/members` is gated on membership itself: the workspace middleware already
+ *     proved the caller belongs to the workspace, and seeing who else is in a room you are in is
+ *     not an administrative capability.
+ * The three that mutate membership are permission-gated — see `rbac.defaults.ts` for the catalog.
+ *
+ * Two tiered routers, because the tier's middleware is what enforces the tier: the unscoped
+ * routes resolve a workspace only if one is named, while everything under a workspace uses the
+ * mandatory resolution. Mounting them in this order matters — the scoped router is consulted
+ * first, so `/workspaces/members` reaches it rather than falling through.
+ *
+ * Replaces the reference combo's `WorkspaceController`.
+ */
+export function createWorkspaceRouter(
+  deps: WorkspaceRouterDeps,
+): RequestHandler {
+  const { workspaces, rbac, authentication, authorization, workspaceScope } =
+    deps;
+
+  const scoped = createTieredRouter({
+    authentication,
+    authorization: workspaceScope,
+  });
+  const unscoped = createTieredRouter({ authentication, authorization });
+
+  unscoped.route(
+    "post",
+    "/",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        res
+          .status(201)
+          .json(
+            await workspaces.create(
+              req.auth!.sub,
+              requireString(body.name, "name"),
+            ),
+          );
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  unscoped.route(
+    "get",
+    "/",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res.status(200).json(await workspaces.listForUser(req.auth!.sub));
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  scoped.route(
+    "get",
+    "/members",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        res
+          .status(200)
+          .json(await workspaces.listMembers(req.authz!.workspaceId));
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  scoped.route(
+    "post",
+    "/members",
+    ability("members:manage"),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        // No `roles` in the body means "whatever this workspace flags as the default role" — the
+        // default lives in a row, not in this line.
+        const roles =
+          body.roles === undefined
+            ? undefined
+            : requireStringArray(body.roles, "roles");
+        res
+          .status(201)
+          .json(
+            await workspaces.addMember(
+              req.authz!.workspaceId,
+              requireString(body.email, "email"),
+              roles,
+            ),
+          );
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  scoped.route(
+    "put",
+    "/members/:memberId/roles",
+    ability("roles:assign"),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const memberId = requireString(req.params.memberId, "memberId");
+        if (memberId === req.authz!.memberId)
+          throw new HttpError(403, "cannot change your own roles");
+        const body = req.body as Record<string, unknown>;
+        res
+          .status(200)
+          .json(
+            await rbac.setMemberRoles(
+              req.authz!.workspaceId,
+              memberId,
+              requireStringArray(body.roles, "roles"),
+            ),
+          );
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  scoped.route(
+    "delete",
+    "/members/:memberId",
+    ability("members:manage"),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const memberId = requireString(req.params.memberId, "memberId");
+        if (memberId === req.authz!.memberId)
+          throw new HttpError(
+            403,
+            "cannot remove yourself from a workspace you administer",
+          );
+        await workspaces.removeMember(req.authz!.workspaceId, memberId);
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  const router = Router();
+  router.use(scoped.handler);
+  router.use(unscoped.handler);
+  return router;
+}

package/registry/combos/express-prisma/variants/workspaces/src/seed.ts

@@ -29,21 +29,35 @@
 // gets, whichever path created it, and the permissions the routes demand cannot drift apart.
 import { PrismaPg } from "@prisma/adapter-pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, provisionDefaultRoles, SEED_SUPERADMIN_ROLES, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import { PrismaClient } from "./../generated/prisma/client.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  provisionDefaultRoles,
+  SEED_SUPERADMIN_ROLES,
+  WORKSPACE_CREATOR_ROLES,
+} from "./rbac.defaults.js";
 
 const DEFAULT_WORKSPACE_NAME = "Default workspace";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
 /** Workspace names are not unique in the schema, so re-running adopts the one it made last time rather than making another. */
-async function seedWorkspace(prisma: PrismaClient): Promise<{ id: bigint; name: string }> {
+async function seedWorkspace(
+  prisma: PrismaClient,
+): Promise<{ id: bigint; name: string }> {
   const name = process.env["SEED_WORKSPACE_NAME"] || DEFAULT_WORKSPACE_NAME;
-  const existing = await prisma.workspace.findFirst({ where: { name }, orderBy: { createdAt: "asc" } });
+  const existing = await prisma.workspace.findFirst({
+    where: { name },
+    orderBy: { createdAt: "asc" },
+  });
   if (existing) {
     console.log(`workspace: "${name}" already exists (${existing.id})`);
     return existing;
@@ -54,70 +68,134 @@ async function seedWorkspace(prisma: PrismaClient): Promise<{ id: bigint; name:
 }
 
 /** The catalog and this workspace's roles come from rbac.defaults.ts; this only reports what it wrote. */
-async function seedRbacDefaults(prisma: PrismaClient, workspaceId: bigint): Promise<void> {
+async function seedRbacDefaults(
+  prisma: PrismaClient,
+  workspaceId: bigint,
+): Promise<void> {
   await provisionDefaultRoles(prisma, workspaceId);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`,
+    );
 
   // Slugs that exist in the database but not in this build's catalog. They are not an error —
   // `POST /auth/admin/permissions` exists so a deployment can define its own, and a grant can
   // create one — but a slug no route names grants nothing, so a typo would otherwise be a
   // permission that mysteriously never works. Printing them is what makes it visible.
-  const rows = await prisma.permission.findMany({ select: { slug: true, isActive: true } });
-  const unknown = rows.filter((row) => !(PERMISSION_SLUGS as string[]).includes(row.slug));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
+  const rows = await prisma.permission.findMany({
+    select: { slug: true, isActive: true },
+  });
+  const unknown = rows.filter(
+    (row) => !(PERMISSION_SLUGS as string[]).includes(row.slug),
+  );
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
   const inactive = rows.filter((row) => !row.isActive);
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
 /** The user is the authentication principal; the membership below is the authorization one. */
-async function seedAdminUser(prisma: PrismaClient, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedAdminUser(
+  prisma: PrismaClient,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`);
-    console.log(`admin: "${workspace.name}" has no members until you re-run with them set`);
+    console.log(
+      `admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`,
+    );
+    console.log(
+      `admin: "${workspace.name}" has no members until you re-run with them set`,
+    );
     return;
   }
 
   const existing = await prisma.user.findUnique({ where: { email } });
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const user = existing ?? (await prisma.user.create({ data: { email, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
   const membership = await prisma.workspaceMember.upsert({
-    where: { userId_workspaceId: { userId: user.id, workspaceId: workspace.id } },
+    where: {
+      userId_workspaceId: { userId: user.id, workspaceId: workspace.id },
+    },
     create: { userId: user.id, workspaceId: workspace.id },
     update: {},
   });
-  const roles = await prisma.role.findMany({ where: { workspaceId: workspace.id, slug: { in: WORKSPACE_CREATOR_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleMember.createMany({ data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })), skipDuplicates: true });
-  console.log(`admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`);
+  const roles = await prisma.role.findMany({
+    where: { workspaceId: workspace.id, slug: { in: WORKSPACE_CREATOR_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleMember.createMany({
+    data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 /** A second seeded account and membership, held by the "superadmin" role — same full-catalog authority as admin. */
-async function seedSuperAdminUser(prisma: PrismaClient, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedSuperAdminUser(
+  prisma: PrismaClient,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`);
+    console.log(
+      `super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`,
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   const existing = await prisma.user.findUnique({ where: { email } });
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const user = existing ?? (await prisma.user.create({ data: { email, username, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, username, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
   const membership = await prisma.workspaceMember.upsert({
-    where: { userId_workspaceId: { userId: user.id, workspaceId: workspace.id } },
+    where: {
+      userId_workspaceId: { userId: user.id, workspaceId: workspace.id },
+    },
     create: { userId: user.id, workspaceId: workspace.id },
     update: {},
   });
-  const roles = await prisma.role.findMany({ where: { workspaceId: workspace.id, slug: { in: SEED_SUPERADMIN_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleMember.createMany({ data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })), skipDuplicates: true });
-  console.log(`super admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`);
+  const roles = await prisma.role.findMany({
+    where: { workspaceId: workspace.id, slug: { in: SEED_SUPERADMIN_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleMember.createMany({
+    data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `super admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {
@@ -129,7 +207,9 @@ async function main(): Promise<void> {
     // No .env here — the environment is expected to carry the variables itself (docker, CI, ...).
   }
 
-  const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }) });
+  const prisma = new PrismaClient({
+    adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }),
+  });
   try {
     const workspace = await seedWorkspace(prisma);
     await seedRbacDefaults(prisma, workspace.id);