@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/server/routes/workspaces.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Workspace route module.
+ *
+ * Handles workspace lifecycle (list, create, delete) and session-level
+ * workspace switching. Cloud-runtime only endpoints gated behind
+ * isWorkspaceSwitchingEnabledForRuntime.
+ *
+ * Routes registered here:
+ *   GET    /api/taskforce/workspaces
+ *   POST   /api/taskforce/workspaces
+ *   DELETE /api/taskforce/workspaces/:id
+ *   POST   /api/taskforce/session/workspace
+ */
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { TaskforceCore } from '../../core/Taskforce.js';
+import type { RouteHandler, RouteContext } from '../routes.js';
+import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
+export interface WorkspaceRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    core: TaskforceCore;
+    context: RouteContext;
+    requestWorkspaceId: (req: IncomingMessage) => string;
+    requestUserId: (req: IncomingMessage) => string;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+    getObjectStorageClient: () => ObjectStorageClient | null;
+    ensureWithinDir: (candidatePath: string, rootDir: string) => string | null;
+    sanitizeStorageSegment: (valueRaw: unknown, fallback: string) => string;
+    sanitizeTaskIdForPath: (taskIdRaw: unknown) => string;
+    normalizeDocumentPathInput: (rawPath: unknown) => string | null;
+}
+export declare function registerWorkspaceRoutes(deps: WorkspaceRouteDependencies): void;

package/dist/server/routes/workspaces.js

@@ -0,0 +1,307 @@
+/**
+ * Workspace route module.
+ *
+ * Handles workspace lifecycle (list, create, delete) and session-level
+ * workspace switching. Cloud-runtime only endpoints gated behind
+ * isWorkspaceSwitchingEnabledForRuntime.
+ *
+ * Routes registered here:
+ *   GET    /api/taskforce/workspaces
+ *   POST   /api/taskforce/workspaces
+ *   DELETE /api/taskforce/workspaces/:id
+ *   POST   /api/taskforce/session/workspace
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { parseJsonBody } from '../routes.js';
+import { resolveRequestAccess, createSessionTokenCookie, resolveSessionCookieAttributesForRequest, } from '../auth.js';
+import { isWorkspaceSwitchingEnabledForRuntime } from '../../shared/runtimeContract.js';
+import { resolveErrorStatusCode } from './shared.js';
+// === SECTION: Registration ===
+export function registerWorkspaceRoutes(deps) {
+    const { addRoute, core, context, ensureAppAccess, auditAuthAction, getObjectStorageClient, ensureWithinDir, sanitizeStorageSegment, sanitizeTaskIdForPath, normalizeDocumentPathInput, } = deps;
+    // === SECTION: Storage cleanup helper ===
+    const cleanupDeletedWorkspaceStorage = async (summary) => {
+        const warnings = [];
+        const { basePath } = core.getPaths();
+        const objectStorageClient = getObjectStorageClient();
+        const deleteFileIfPresent = (candidatePath, label) => {
+            const safePath = ensureWithinDir(candidatePath, basePath);
+            if (!safePath) {
+                warnings.push(`Skipped unsafe path for ${label}.`);
+                return;
+            }
+            try {
+                if (fs.existsSync(safePath) && fs.statSync(safePath).isFile()) {
+                    fs.unlinkSync(safePath);
+                }
+            }
+            catch (error) {
+                warnings.push(`${label}: ${String(error?.message || error)}`);
+            }
+        };
+        const deleteDirIfPresent = (candidatePath, label) => {
+            const safePath = ensureWithinDir(candidatePath, basePath);
+            if (!safePath) {
+                warnings.push(`Skipped unsafe path for ${label}.`);
+                return;
+            }
+            try {
+                if (fs.existsSync(safePath) && fs.statSync(safePath).isDirectory()) {
+                    fs.rmSync(safePath, { recursive: true, force: true });
+                }
+            }
+            catch (error) {
+                warnings.push(`${label}: ${String(error?.message || error)}`);
+            }
+        };
+        deleteDirIfPresent(path.join(basePath, 'workspaces', summary.deletedWorkspaceId), `workspace dir ${summary.deletedWorkspaceId}`);
+        const sanitizedWorkspaceId = sanitizeStorageSegment(summary.deletedWorkspaceId, summary.deletedWorkspaceId);
+        if (sanitizedWorkspaceId && sanitizedWorkspaceId !== summary.deletedWorkspaceId) {
+            deleteDirIfPresent(path.join(basePath, 'workspaces', sanitizedWorkspaceId), `workspace dir ${sanitizedWorkspaceId}`);
+        }
+        for (const docPath of summary.deletedDocumentPaths) {
+            const normalizedDocPath = normalizeDocumentPathInput(docPath);
+            if (!normalizedDocPath)
+                continue;
+            if (core.hasDocumentPathInOtherWorkspaces(summary.deletedWorkspaceId, normalizedDocPath))
+                continue;
+            deleteFileIfPresent(path.join(basePath, normalizedDocPath), `document ${normalizedDocPath}`);
+        }
+        for (const asset of summary.deletedAssets) {
+            const normalizedPath = normalizeDocumentPathInput(asset.path) || String(asset.path || '').trim();
+            if (!normalizedPath)
+                continue;
+            if (core.hasTaskAssetPathInOtherWorkspaces(summary.deletedWorkspaceId, normalizedPath))
+                continue;
+            if (asset.provider === 'r2') {
+                if (!objectStorageClient) {
+                    warnings.push(`asset ${normalizedPath}: object storage client unavailable`);
+                    continue;
+                }
+                try {
+                    await objectStorageClient.deleteObject(normalizedPath);
+                }
+                catch (error) {
+                    warnings.push(`asset ${normalizedPath}: ${String(error?.message || error)}`);
+                }
+                continue;
+            }
+            deleteFileIfPresent(path.join(basePath, normalizedPath), `asset ${normalizedPath}`);
+        }
+        return warnings;
+    };
+    // === SECTION: Workspace CRUD routes ===
+    // GET /api/taskforce/workspaces - List authenticated user's accessible workspaces
+    addRoute('GET', '/api/taskforce/workspaces', async (req, res) => {
+        const authConfig = context.authConfig;
+        if (!isWorkspaceSwitchingEnabledForRuntime(authConfig?.runtimeMode)) {
+            res.writeHead(501, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace switching is unavailable in local mode.' }));
+            return;
+        }
+        if (!authConfig || !authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace switching is only available in authenticated runtime.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        if (!access.authenticated || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        if (!ensureAppAccess(req, res))
+            return;
+        const workspaces = core.listUserWorkspaces(access.userId);
+        const requestedCurrentWorkspaceId = String(access.workspaceId || '').trim();
+        const currentWorkspaceId = workspaces.some((workspace) => workspace.id === requestedCurrentWorkspaceId)
+            ? requestedCurrentWorkspaceId
+            : (workspaces[0]?.id || 'default');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            workspaces,
+            currentWorkspaceId: currentWorkspaceId || access.workspaceId
+        }));
+    });
+    // POST /api/taskforce/workspaces - Create workspace for current authenticated user
+    addRoute('POST', '/api/taskforce/workspaces', async (req, res) => {
+        const authConfig = context.authConfig;
+        if (!isWorkspaceSwitchingEnabledForRuntime(authConfig?.runtimeMode)) {
+            res.writeHead(501, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace management is unavailable in local mode.' }));
+            return;
+        }
+        if (!authConfig || !authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace creation is only available in authenticated runtime.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        if (!access.authenticated || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        if (!ensureAppAccess(req, res))
+            return;
+        const body = await parseJsonBody(req);
+        const name = String(body?.name || '').trim();
+        const description = typeof body?.description === 'string' ? body.description : undefined;
+        try {
+            const workspace = core.createWorkspaceForUser({
+                userId: access.userId,
+                name,
+                description,
+                role: 'owner'
+            });
+            auditAuthAction(req, 'workspace-created', {
+                workspaceId: workspace.id,
+                workspaceName: workspace.name
+            });
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, workspace }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: false,
+                error: String(error?.message || 'Unable to create workspace'),
+                code: error?.code
+            }));
+        }
+    });
+    // DELETE /api/taskforce/workspaces/:id - Delete a workspace (cloud runtime, owner only)
+    addRoute('DELETE', '/api/taskforce/workspaces/:id', async (req, res, params) => {
+        const authConfig = context.authConfig;
+        if (authConfig?.runtimeMode !== 'cloud') {
+            res.writeHead(501, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace deletion is unavailable in local mode.' }));
+            return;
+        }
+        if (!authConfig || !authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace deletion is only available in authenticated runtime.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        if (!access.authenticated || !access.sessionId || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        if (!ensureAppAccess(req, res))
+            return;
+        const targetWorkspaceId = String(params.id || '').trim();
+        if (!targetWorkspaceId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'workspaceId is required.', code: 'WORKSPACE_ID_REQUIRED' }));
+            return;
+        }
+        const resolvedAccess = core.resolveUserAccess(access.userId, targetWorkspaceId, 'member');
+        if (!resolvedAccess || resolvedAccess.role !== 'owner' || resolvedAccess.disabled) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Only workspace owners can delete this workspace.' }));
+            return;
+        }
+        try {
+            const deleted = core.deleteWorkspace({ workspaceId: targetWorkspaceId });
+            const cleanupWarnings = await cleanupDeletedWorkspaceStorage(deleted);
+            const remainingWorkspaces = core.listUserWorkspaces(access.userId);
+            const nextWorkspace = remainingWorkspaces[0];
+            const nextWorkspaceId = String(nextWorkspace?.id || 'default').trim() || 'default';
+            const nextRole = String(nextWorkspace?.role || authConfig.defaultRole || 'member').trim() || 'member';
+            const workspaceSetupRequired = remainingWorkspaces.length === 0;
+            const cookie = createSessionTokenCookie(access.sessionId, authConfig, {
+                role: nextRole,
+                workspaceId: nextWorkspaceId,
+                userId: access.userId,
+                ...resolveSessionCookieAttributesForRequest(req, authConfig)
+            });
+            res.setHeader('Set-Cookie', cookie);
+            auditAuthAction(req, 'workspace-deleted', {
+                deletedWorkspaceId: targetWorkspaceId,
+                nextWorkspaceId,
+                workspaceSetupRequired,
+                cleanupWarningsCount: cleanupWarnings.length,
+                counts: deleted.counts
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                deletedWorkspaceId: targetWorkspaceId,
+                nextWorkspaceId,
+                workspaceSetupRequired,
+                cleanupWarnings
+            }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: false,
+                error: String(error?.message || 'Unable to delete workspace'),
+                code: error?.code
+            }));
+        }
+    });
+    // === SECTION: Session workspace switch ===
+    // POST /api/taskforce/session/workspace - Switch active workspace in auth session
+    addRoute('POST', '/api/taskforce/session/workspace', async (req, res) => {
+        const authConfig = context.authConfig;
+        if (!isWorkspaceSwitchingEnabledForRuntime(authConfig?.runtimeMode)) {
+            res.writeHead(501, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace switching is unavailable in local mode.' }));
+            return;
+        }
+        if (!authConfig || !authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace switching is only available in authenticated runtime.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        if (!access.authenticated || !access.sessionId || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const workspaceId = String(body?.workspaceId || '').trim();
+        if (!workspaceId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'workspaceId is required.' }));
+            return;
+        }
+        const allowed = core.listUserWorkspaces(access.userId).find((workspace) => workspace.id === workspaceId);
+        if (!allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'You do not have access to this workspace.' }));
+            return;
+        }
+        const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
+        if (!resolved || resolved.role === 'read-only') {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace access is not active for this user.' }));
+            return;
+        }
+        const cookie = createSessionTokenCookie(access.sessionId, authConfig, {
+            role: resolved.role,
+            workspaceId: resolved.workspaceId,
+            userId: resolved.userId,
+            ...resolveSessionCookieAttributesForRequest(req, authConfig)
+        });
+        auditAuthAction(req, 'workspace-switched', {
+            fromWorkspaceId: access.workspaceId,
+            toWorkspaceId: resolved.workspaceId
+        });
+        res.setHeader('Set-Cookie', cookie);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            workspaceId: resolved.workspaceId,
+            role: resolved.role
+        }));
+    });
+}

package/dist/server/routes.d.ts

@@ -36,26 +36,25 @@ export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number):
  * - POST /api/taskforce/bulk-update-fields
  * - POST /api/taskforce/bulk-update-fields/preview
  *
- * **Configuration Management (10 routes)**
+ * **Configuration Management**
  * - GET /api/taskforce/categories
  * - POST /api/taskforce/categories
  * - GET /api/taskforce/types
  * - POST /api/taskforce/types
  * - GET /api/taskforce/priorities
  * - POST /api/taskforce/priorities
- * - GET /api/taskforce/approaches
- * - POST /api/taskforce/approaches
  * - GET /api/taskforce/taxonomies
  * - POST /api/taskforce/taxonomies
+ *
+ * **Workflow Settings**
+ * - GET /api/taskforce/approaches
+ * - POST /api/taskforce/approaches
+ *
+ * **Templates & Setup**
  * - GET /api/taskforce/initiative-templates
  * - POST /api/taskforce/initiative-templates/create
- * - POST /api/taskforce/initiative-templates/clone-checklists
  *
- * **Advanced Features (7 routes)**
- * - POST /api/taskforce/screenshot
- * - GET /api/taskforce/screenshot/:filename
- * - DELETE /api/taskforce/screenshot/:filename
- * - GET /api/taskforce/specialists
+ * **Advanced Features (3 routes)**
  * - GET /api/taskforce/folders
  * - POST /api/taskforce/validate-paths
  * - POST /api/taskforce/export-resources