@somewhatintelligent/guestlist 0.0.1-beta.1783705886.297c5be

package/src/ops/orgs.ts

@@ -0,0 +1,326 @@
+/**
+ * Operator org-provisioning operations, exposed only as admin-gated
+ * WorkerEntrypoint methods.
+ *
+ * BA-API-vs-direct-Drizzle split: BA's auto-mounted organization routes
+ * bind to the calling user's session. Operator flows call `auth.api.*`
+ * server-side WITHOUT session headers where BA tolerates it
+ * (`createOrganization`, `addMember` — both accept an explicit `userId`
+ * on a headerless call). The endpoints that hard-require headers in BA
+ * v1.6 (`updateMemberRole`, `removeMember`, `createInvitation`,
+ * `cancelInvitation`) fall back to direct Drizzle writes with the same
+ * invariants BA enforces (last-owner guards, pending-only cancellation).
+ */
+import { and, count, desc, eq, like } from "drizzle-orm";
+import { ulid } from "@somewhatintelligent/kit/ids";
+
+import type { GuestlistInstances } from "../instances";
+import { user, organization, member, invitation } from "../schema";
+import { err, type Authed, type RpcResult } from "../rpc";
+
+const SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+
+/**
+ * Roles are configurable (config.organization.roles), so RPC inputs carry
+ * plain strings and every write path validates against the configured
+ * role set at runtime — a binding caller is not bound by TS types.
+ */
+function invalidRole(inst: GuestlistInstances, role: string) {
+  return inst.orgRoleNames.includes(role)
+    ? null
+    : err("validation", `unknown role "${role}" (valid: ${inst.orgRoleNames.join(", ")})`);
+}
+
+export async function createOrg(
+  inst: GuestlistInstances,
+  input: { name: string; slug: string; ownerUserId: string },
+) {
+  if (input.name.length < 2 || input.name.length > 60) {
+    return err("validation", "name must be 2-60 chars");
+  }
+  // Kebab-case: lowercase letters, digits, single hyphens. 2–48 chars.
+  if (input.slug.length < 2 || input.slug.length > 48 || !SLUG_RE.test(input.slug)) {
+    return err("validation", "slug must be kebab-case, 2-48 chars");
+  }
+  try {
+    const org = await inst.auth.api.createOrganization({
+      body: { name: input.name, slug: input.slug, userId: input.ownerUserId },
+      // intentionally no `headers:` — that's the BA-documented trigger that
+      // makes `userId` meaningful and bypasses the session user check.
+    });
+    return { ok: true as const, organization: org };
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    // BA's slug-collision path throws BAD_REQUEST with the
+    // ORGANIZATION_ALREADY_EXISTS code; translate so the operator UI can
+    // distinguish "slug taken" from generic validation failures.
+    if (/already.?exists|slug/i.test(message)) return err("slug_taken", message);
+    throw e;
+  }
+}
+
+export async function listOrgs(inst: GuestlistInstances) {
+  const { db } = inst;
+  // BA has no "list all orgs across the platform" surface — its
+  // `listOrganizations` scopes to caller memberships. Direct join.
+  const orgs = await db
+    .select({
+      id: organization.id,
+      slug: organization.slug,
+      name: organization.name,
+      logo: organization.logo,
+      createdAt: organization.createdAt,
+      memberCount: count(member.id),
+    })
+    .from(organization)
+    .leftJoin(member, eq(member.organizationId, organization.id))
+    .groupBy(organization.id)
+    .orderBy(desc(organization.createdAt))
+    .limit(100);
+  // One pass for owner names: earliest creator-role member per org (the
+  // original creator wins when multiple owners exist).
+  const ownerRows = await db
+    .select({
+      organizationId: member.organizationId,
+      name: user.name,
+      createdAt: member.createdAt,
+    })
+    .from(member)
+    .leftJoin(user, eq(member.userId, user.id))
+    .where(eq(member.role, inst.orgCreatorRole));
+  const ownerByOrg = new Map<string, { name: string | null; createdAt: Date }>();
+  for (const row of ownerRows) {
+    const prior = ownerByOrg.get(row.organizationId);
+    if (!prior || row.createdAt < prior.createdAt) {
+      ownerByOrg.set(row.organizationId, { name: row.name, createdAt: row.createdAt });
+    }
+  }
+  return {
+    ok: true as const,
+    organizations: orgs.map((o) => ({
+      ...o,
+      ownerName: ownerByOrg.get(o.id)?.name ?? null,
+    })),
+  };
+}
+
+/** Email-prefix user search for the operator's owner/member pickers. */
+export async function searchUsersByEmail(inst: GuestlistInstances, emailPrefix: string) {
+  // Min prefix length 2 — anything shorter would be a no-op scan.
+  const prefix = emailPrefix.trim();
+  if (prefix.length < 2) return { ok: true as const, users: [] };
+  // Escape LIKE metacharacters — missing this would let `_` match every email.
+  const escaped = prefix.replace(/[\\%_]/g, "\\$&");
+  const rows = await inst.db
+    .select({ id: user.id, name: user.name, email: user.email, image: user.image })
+    .from(user)
+    .where(like(user.email, escaped + "%"))
+    .orderBy(user.email)
+    .limit(10);
+  return { ok: true as const, users: rows };
+}
+
+export async function getOrg(inst: GuestlistInstances, id: string) {
+  const { db } = inst;
+  const orgRows = await db.select().from(organization).where(eq(organization.id, id)).limit(1);
+  const org = orgRows[0];
+  if (!org) return err("not_found");
+  const memberRows = await db
+    .select({
+      memberId: member.id,
+      userId: member.userId,
+      name: user.name,
+      email: user.email,
+      image: user.image,
+      role: member.role,
+      joinedAt: member.createdAt,
+    })
+    .from(member)
+    .leftJoin(user, eq(member.userId, user.id))
+    .where(eq(member.organizationId, id));
+  // Sort: creator role first, then admin/member, custom roles after,
+  // alphabetically by name within a rank. Creator entry comes LAST so it
+  // wins the object-literal collision when creatorRole IS "admin"/"member".
+  const ROLE_RANK: Record<string, number> = { admin: 1, member: 2, [inst.orgCreatorRole]: 0 };
+  memberRows.sort((a, b) => {
+    const ra = ROLE_RANK[a.role] ?? 99;
+    const rb = ROLE_RANK[b.role] ?? 99;
+    if (ra !== rb) return ra - rb;
+    return (a.name ?? "").localeCompare(b.name ?? "");
+  });
+  const invitationRows = await db
+    .select({
+      id: invitation.id,
+      email: invitation.email,
+      role: invitation.role,
+      status: invitation.status,
+      expiresAt: invitation.expiresAt,
+      inviterName: user.name,
+    })
+    .from(invitation)
+    .leftJoin(user, eq(invitation.inviterId, user.id))
+    .where(and(eq(invitation.organizationId, id), eq(invitation.status, "pending")));
+  return { ok: true as const, organization: org, members: memberRows, invitations: invitationRows };
+}
+
+export async function addMember(
+  inst: GuestlistInstances,
+  orgId: string,
+  input: { userId: string; role: string },
+) {
+  const bad = invalidRole(inst, input.role);
+  if (bad) return bad;
+  // BA's `addMember` tolerates no-headers when `body.userId` is set —
+  // operator-as-superuser path, same pattern as createOrganization.
+  try {
+    const created = await inst.auth.api.addMember({
+      // BA types `role` as its DEFAULT three-role union (the plugin's
+      // custom-roles generic doesn't reach auth.api's static types); the
+      // server accepts any configured role, and invalidRole() above
+      // already rejected anything not in the configured set.
+      body: { userId: input.userId, organizationId: orgId, role: input.role as "member" },
+    });
+    return { ok: true as const, member: created };
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    if (/already a member/i.test(message)) return err("already_member", message);
+    if (/not.?found|user not found/i.test(message)) return err("not_found", message);
+    throw e;
+  }
+}
+
+export async function updateMemberRole(
+  inst: GuestlistInstances,
+  orgId: string,
+  userId: string,
+  role: string,
+): Promise<RpcResult<Record<never, never>>> {
+  const bad = invalidRole(inst, role);
+  if (bad) return bad;
+  const { db } = inst;
+  // BA's `updateMemberRole` has `requireHeaders: true`; direct Drizzle
+  // UPDATE is the documented fallback.
+  const targetRows = await db
+    .select({ id: member.id, role: member.role })
+    .from(member)
+    .where(and(eq(member.organizationId, orgId), eq(member.userId, userId)))
+    .limit(1);
+  const target = targetRows[0];
+  if (!target) return err("member_not_found");
+  // Last-owner guard: refuse to demote the only creator-role member. Run
+  // BEFORE mutating.
+  if (target.role === inst.orgCreatorRole && role !== inst.orgCreatorRole) {
+    const owners = await db
+      .select({ count: count() })
+      .from(member)
+      .where(and(eq(member.organizationId, orgId), eq(member.role, inst.orgCreatorRole)));
+    if ((owners[0]?.count ?? 0) <= 1) return err("cannot_demote_last_owner");
+  }
+  await db
+    .update(member)
+    .set({ role })
+    .where(and(eq(member.organizationId, orgId), eq(member.userId, userId)));
+  return { ok: true };
+}
+
+export async function removeMember(
+  inst: GuestlistInstances,
+  orgId: string,
+  userId: string,
+): Promise<RpcResult<Record<never, never>>> {
+  const { db } = inst;
+  // Same fallback rationale as updateMemberRole: BA's removeMember has
+  // `requireHeaders: true`.
+  const targetRows = await db
+    .select({ id: member.id, role: member.role })
+    .from(member)
+    .where(and(eq(member.organizationId, orgId), eq(member.userId, userId)))
+    .limit(1);
+  const target = targetRows[0];
+  if (!target) return err("member_not_found");
+  // Never let the org end up with zero creator-role members through this
+  // surface.
+  if (target.role === inst.orgCreatorRole) {
+    const owners = await db
+      .select({ count: count() })
+      .from(member)
+      .where(and(eq(member.organizationId, orgId), eq(member.role, inst.orgCreatorRole)));
+    if ((owners[0]?.count ?? 0) <= 1) return err("cannot_remove_last_owner");
+  }
+  await db
+    .delete(member)
+    .where(and(eq(member.organizationId, orgId), eq(member.userId, userId)));
+  return { ok: true };
+}
+
+export async function createInvitation(
+  inst: GuestlistInstances,
+  operator: Authed,
+  orgId: string,
+  input: { email: string; role: string },
+) {
+  const bad = invalidRole(inst, input.role);
+  if (bad) return bad;
+  const { db } = inst;
+  if (input.email.length < 3 || input.email.length > 254 || !input.email.includes("@")) {
+    return err("validation", "invalid email");
+  }
+  // BA's `createInvitation` has `requireHeaders: true` and derives the
+  // inviter from the session. Operator path: the operator becomes the
+  // inviter; direct insert. `sendInvitationEmail` is NOT invoked here —
+  // operator-issued invitations surface the raw link in the UI.
+  const orgRows = await db
+    .select({ id: organization.id })
+    .from(organization)
+    .where(eq(organization.id, orgId))
+    .limit(1);
+  if (!orgRows[0]) return err("org_not_found");
+  const now = new Date();
+  // Operator-issued invitations expire after 7 days, longer than BA's
+  // default 48h window.
+  const expiresAt = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+  const id = ulid();
+  await db.insert(invitation).values({
+    id,
+    organizationId: orgId,
+    email: input.email,
+    role: input.role,
+    status: "pending",
+    inviterId: operator.user.id,
+    createdAt: now,
+    expiresAt,
+  });
+  return {
+    ok: true as const,
+    invitation: {
+      id,
+      organizationId: orgId,
+      email: input.email,
+      role: input.role,
+      status: "pending" as const,
+      inviterId: operator.user.id,
+      createdAt: now.getTime(),
+      expiresAt: expiresAt.getTime(),
+    },
+  };
+}
+
+export async function cancelInvitation(
+  inst: GuestlistInstances,
+  orgId: string,
+  invitationId: string,
+) {
+  const { db } = inst;
+  // BA's `cancelInvitation` also has `requireHeaders: true`. Direct UPDATE
+  // with status transitions; not_found if missing, conflict if terminal.
+  const rows = await db
+    .select({ id: invitation.id, status: invitation.status })
+    .from(invitation)
+    .where(and(eq(invitation.id, invitationId), eq(invitation.organizationId, orgId)))
+    .limit(1);
+  const inv = rows[0];
+  if (!inv) return err("invitation_not_found");
+  if (inv.status !== "pending") return err("invitation_not_pending", inv.status);
+  await db.update(invitation).set({ status: "cancelled" }).where(eq(invitation.id, invitationId));
+  return { ok: true as const };
+}

package/src/ops/users.ts

@@ -0,0 +1,96 @@
+/**
+ * User-directory operations (mentions, member pickers, display-name
+ * resolution) + the caller's own OAuth connections. Session-gated by the
+ * entrypoint.
+ */
+import { eq, inArray, like, or } from "drizzle-orm";
+
+import type { GuestlistInstances } from "../instances";
+import { user, oauthClient, oauthConsent } from "../schema";
+import type { Authed } from "../rpc";
+
+export interface DirectoryUser {
+  id: string;
+  name: string;
+  email?: string;
+  image?: string;
+}
+
+/**
+ * Search the user directory by name OR email substring.
+ * - Empty query returns `[]` (not all users — that'd be a data leak).
+ * - `limit` defaults to 20, max 50.
+ * - `email` is returned on every hit (v1 trust model — identity already
+ *   exposes email to org admins; tighten if a less-trusted caller appears).
+ */
+export async function searchUsers(
+  inst: GuestlistInstances,
+  input: { query: string; limit?: number },
+) {
+  const raw = input.query.trim().toLowerCase().slice(0, 200);
+  if (raw.length === 0) return { ok: true as const, users: [] as DirectoryUser[] };
+  const limit = Math.min(Math.max(input.limit ?? 20, 1), 50);
+  const escaped = raw.replace(/[\\%_]/g, "\\$&");
+  const pattern = `%${escaped}%`;
+  const rows = await inst.db
+    .select({ id: user.id, name: user.name, email: user.email, image: user.image })
+    .from(user)
+    .where(or(like(user.name, pattern), like(user.email, pattern)))
+    .orderBy(user.name)
+    .limit(limit);
+  return {
+    ok: true as const,
+    users: rows.map(
+      (r): DirectoryUser => ({
+        id: r.id,
+        name: r.name,
+        email: r.email,
+        ...(r.image !== null && { image: r.image }),
+      }),
+    ),
+  };
+}
+
+/**
+ * Batch-resolve user records by id.
+ * - Max 100 ids per call.
+ * - Return order matches input order; missing ids are omitted (not nulled).
+ */
+export async function getUsersByIds(inst: GuestlistInstances, ids: string[]) {
+  const wanted = ids.filter((id) => id.length > 0).slice(0, 100);
+  if (wanted.length === 0) return { ok: true as const, users: [] as DirectoryUser[] };
+  const rows = await inst.db
+    .select({ id: user.id, name: user.name, email: user.email, image: user.image })
+    .from(user)
+    .where(inArray(user.id, wanted));
+  const byId = new Map(rows.map((r) => [r.id, r]));
+  const ordered: DirectoryUser[] = [];
+  for (const id of wanted) {
+    const r = byId.get(id);
+    if (!r) continue;
+    ordered.push({
+      id: r.id,
+      name: r.name,
+      email: r.email,
+      ...(r.image !== null && { image: r.image }),
+    });
+  }
+  return { ok: true as const, users: ordered };
+}
+
+/** The calling user's OAuth consents (identity's "connections" page). */
+export async function getConnections(inst: GuestlistInstances, authed: Authed) {
+  const rows = await inst.db
+    .select({
+      consentId: oauthConsent.id,
+      clientId: oauthConsent.clientId,
+      scopes: oauthConsent.scopes,
+      createdAt: oauthConsent.createdAt,
+      clientName: oauthClient.name,
+      clientIcon: oauthClient.icon,
+    })
+    .from(oauthConsent)
+    .leftJoin(oauthClient, eq(oauthConsent.clientId, oauthClient.clientId))
+    .where(eq(oauthConsent.userId, authed.user.id));
+  return { ok: true as const, connections: rows };
+}

package/src/rpc.ts

@@ -0,0 +1,64 @@
+/**
+ * Shared shapes for the `Guestlist` WorkerEntrypoint surface.
+ *
+ * Guestlist's only HTTP routes are the ones better-auth itself provides
+ * (`/api/auth/*`, the OIDC well-known metadata) plus the public avatar
+ * read broker (`/u/avatar/:refId` — browsers hit it from `<img>` tags).
+ * EVERYTHING else — admin, orgs, user directory, avatar mutations — is a
+ * typed RPC method on the entrypoint, callable only over a service
+ * binding. There is no HTTP spelling of those operations at all.
+ *
+ * Authorization: methods that act on behalf of a user take the caller's
+ * raw `Cookie` header (`cookie`). Identity is derived from the cookie via
+ * better-auth — the cookie remains the sole credential; being able to
+ * reach the binding does not by itself grant user/admin powers.
+ *
+ * Expected failures return `{ ok: false, error }` (never throw) so
+ * consumers can switch on error codes without parsing serialized
+ * exception messages.
+ */
+import type { GuestlistAuth } from "./instances";
+
+export type RpcErr =
+  | { ok: false; error: "unauthorized" }
+  | { ok: false; error: "forbidden" }
+  | { ok: false; error: string; message?: string };
+
+export type RpcResult<T> = ({ ok: true } & T) | RpcErr;
+
+export const unauthorized = { ok: false, error: "unauthorized" } as const;
+export const forbidden = { ok: false, error: "forbidden" } as const;
+
+export function err(error: string, message?: string): RpcErr {
+  return message === undefined ? { ok: false, error } : { ok: false, error, message };
+}
+
+/** Rebuild request headers from the caller-forwarded Cookie header. */
+export function cookieHeaders(cookie: string | undefined): Headers {
+  const headers = new Headers();
+  if (cookie) headers.set("cookie", cookie);
+  return headers;
+}
+
+type SessionResult = NonNullable<Awaited<ReturnType<GuestlistAuth["api"]["getSession"]>>>;
+export type Authed = { user: SessionResult["user"]; session: SessionResult["session"] };
+
+export async function resolveUser(auth: GuestlistAuth, cookie: string | undefined) {
+  const session = await auth.api.getSession({ headers: cookieHeaders(cookie) });
+  if (!session) return null;
+  return { user: session.user, session: session.session } as Authed;
+}
+
+export async function resolveAdmin(
+  auth: GuestlistAuth,
+  cookie: string | undefined,
+): Promise<Authed | RpcErr> {
+  const authed = await resolveUser(auth, cookie);
+  if (!authed) return unauthorized;
+  if (authed.user.role !== "admin") return forbidden;
+  return authed;
+}
+
+export function isErr(x: unknown): x is RpcErr {
+  return typeof x === "object" && x !== null && "ok" in x && (x as { ok: unknown }).ok === false;
+}