@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/core/EntitlementsPolicy.test.js

@@ -3,6 +3,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { TaskforceCore, TaskforceRuleError } from './Taskforce';
+import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 function makeProjectRoot() {
     return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-entitlements-'));
 }
@@ -20,24 +21,24 @@ function openCore(projectRoot) {
             ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `).run('default', planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
     };
-    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter' });
-    addFreeMapping('starter-v1');
-    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
-    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab' });
-    addFreeMapping('collab-v1');
-    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free' });
+    addFreeMapping('free-v1');
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5' });
+    addFreeMapping('team-5-v1');
+    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5', status: 'active' });
     core.createPlanVersion({
-        planId: 'collab',
+        planId: 'team-5',
         versionNumber: 2,
         isDefault: true,
         seatLimit: 5
     });
     core.updatePlanVersionFeatures({
-        planVersionId: 'collab-v2',
+        planVersionId: 'team-5-v2',
         features: [
             { featureKey: 'collaboration.invites', access: 'enabled' },
             { featureKey: 'collaboration.team_management', access: 'enabled' },
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
     return core;
@@ -139,13 +140,13 @@ describe('Taskforce entitlements policy engine', () => {
                 email: 'owner@example.com'
             });
             core.createPlanVersion({
-                planId: 'collab',
+                planId: 'team-5',
                 versionNumber: 3,
                 isDefault: false,
                 seatLimit: 2
             });
             core.updatePlanVersionFeatures({
-                planVersionId: 'collab-v3',
+                planVersionId: 'team-5-v3',
                 features: [
                     { featureKey: 'collaboration.invites', access: 'enabled' },
                     { featureKey: 'collaboration.team_management', access: 'enabled' },
@@ -154,7 +155,7 @@ describe('Taskforce entitlements policy engine', () => {
             });
             core.updateAccountEntitlement({
                 accountId: 'owner-u1',
-                planVersionId: 'collab-v3',
+                planVersionId: 'team-5-v3',
                 entitlementState: 'active',
                 actorUserId: 'system-admin',
                 actorRole: 'system_admin'
@@ -184,9 +185,9 @@ describe('Taskforce entitlements policy engine', () => {
         const core = openCore(projectRoot);
         try {
             core.updatePlanVersionFeatures({
-                planVersionId: 'starter-v1',
+                planVersionId: 'free-v1',
                 features: [
-                    { featureKey: 'workspace.switching', access: 'limited', config: { maxWorkspaces: 1 } }
+                    { featureKey: 'workspace.workspaces', access: 'limited', config: { maxWorkspaces: 1 } }
                 ]
             });
             core.createWorkspace({ workspaceId: 'workspace-one', name: 'Workspace One' });
@@ -198,7 +199,7 @@ describe('Taskforce entitlements policy engine', () => {
             });
             core.updateAccountEntitlement({
                 accountId: 'owner-u1',
-                planVersionId: 'starter-v1',
+                planVersionId: 'free-v1',
                 entitlementState: 'active',
                 actorUserId: 'system-admin',
                 actorRole: 'system_admin'
@@ -215,4 +216,65 @@ describe('Taskforce entitlements policy engine', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('enforces limited document cloud storage allowances by current usage plus requested upload size', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.updatePlanVersionFeatures({
+                planVersionId: 'free-v1',
+                features: [
+                    { featureKey: 'context.uploads', access: 'limited', config: { storageLimitMb: 1 } }
+                ]
+            });
+            core.createWorkspace({ workspaceId: 'workspace-storage', name: 'Storage Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-u1',
+                workspaceId: 'workspace-storage',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.updateAccountEntitlement({
+                accountId: 'owner-u1',
+                planVersionId: 'free-v1',
+                entitlementState: 'active',
+                actorUserId: 'system-admin',
+                actorRole: 'system_admin'
+            });
+            const store = new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId());
+            store.upsertAsset({
+                assetId: 'asset-storage-1',
+                workspaceId: 'workspace-storage',
+                kind: 'document',
+                originalFilename: 'existing.pdf',
+                mimeType: 'application/pdf',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-storage/assets/documents/asset-storage-1-existing.pdf',
+                contentSha256: 'existing-hash',
+                sizeBytes: 900_000,
+                documentId: 'document-storage-1',
+                version: 1,
+                isLatest: true
+            });
+            const withinLimit = core.evaluateFeatureAccess({
+                userId: 'owner-u1',
+                workspaceId: 'workspace-storage',
+                featureKey: 'context.uploads',
+                context: { requestedBytes: 100_000 }
+            });
+            expect(withinLimit.allowed).toBe(true);
+            expect(withinLimit.reasonCode).toBe('OK');
+            const overLimit = core.evaluateFeatureAccess({
+                userId: 'owner-u1',
+                workspaceId: 'workspace-storage',
+                featureKey: 'context.uploads',
+                context: { requestedBytes: 200_000 }
+            });
+            expect(overLimit.allowed).toBe(false);
+            expect(overLimit.reasonCode).toBe('UPLOAD_STORAGE_LIMIT_REACHED');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
 });

package/dist/core/GlobalSettingsService.js

@@ -17,6 +17,12 @@ function splitGlobalSettingsPayload(settings) {
     if (settings.setup && typeof settings.setup === 'object') {
         system.setup = { ...settings.setup };
     }
+    if (settings.objectStorage && typeof settings.objectStorage === 'object') {
+        system.objectStorage = { ...settings.objectStorage };
+    }
+    if (settings.oauthProviders && typeof settings.oauthProviders === 'object') {
+        system.oauthProviders = { ...settings.oauthProviders };
+    }
     const normalizedTheme = normalizeTaskforceTheme(settings.theme);
     if (normalizedTheme) {
         userPreferences.theme = normalizedTheme;
@@ -107,8 +113,8 @@ export function getGlobalSettingsService(deps) {
             || global.billing.onboardingPolicy.mode === 'auto_start_trial')
         ? {
             mode: global.billing.onboardingPolicy.mode,
-            planVersionId: typeof global.billing.onboardingPolicy.planVersionId === 'string'
-                ? (global.billing.onboardingPolicy.planVersionId.trim() || null)
+            planId: typeof global.billing.onboardingPolicy.planId === 'string'
+                ? (global.billing.onboardingPolicy.planId.trim() || null)
                 : null
         }
         : null;
@@ -231,6 +237,57 @@ export function getGlobalSettingsService(deps) {
                         : {})
                 }
             }
+            : {}),
+        ...(global.oauthProviders && typeof global.oauthProviders === 'object'
+            ? {
+                oauthProviders: {
+                    ...(global.oauthProviders.google && typeof global.oauthProviders.google === 'object'
+                        ? {
+                            google: {
+                                ...(typeof global.oauthProviders.google.enabled === 'boolean' ? { enabled: global.oauthProviders.google.enabled } : {}),
+                                ...(typeof global.oauthProviders.google.clientId === 'string' && global.oauthProviders.google.clientId.trim()
+                                    ? { clientId: global.oauthProviders.google.clientId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.google.clientSecret === 'string' && global.oauthProviders.google.clientSecret.trim()
+                                    ? { clientSecret: global.oauthProviders.google.clientSecret.trim() }
+                                    : {})
+                            }
+                        }
+                        : {}),
+                    ...(global.oauthProviders.github && typeof global.oauthProviders.github === 'object'
+                        ? {
+                            github: {
+                                ...(typeof global.oauthProviders.github.enabled === 'boolean' ? { enabled: global.oauthProviders.github.enabled } : {}),
+                                ...(typeof global.oauthProviders.github.clientId === 'string' && global.oauthProviders.github.clientId.trim()
+                                    ? { clientId: global.oauthProviders.github.clientId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.github.clientSecret === 'string' && global.oauthProviders.github.clientSecret.trim()
+                                    ? { clientSecret: global.oauthProviders.github.clientSecret.trim() }
+                                    : {})
+                            }
+                        }
+                        : {}),
+                    ...(global.oauthProviders.apple && typeof global.oauthProviders.apple === 'object'
+                        ? {
+                            apple: {
+                                ...(typeof global.oauthProviders.apple.enabled === 'boolean' ? { enabled: global.oauthProviders.apple.enabled } : {}),
+                                ...(typeof global.oauthProviders.apple.servicesId === 'string' && global.oauthProviders.apple.servicesId.trim()
+                                    ? { servicesId: global.oauthProviders.apple.servicesId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.teamId === 'string' && global.oauthProviders.apple.teamId.trim()
+                                    ? { teamId: global.oauthProviders.apple.teamId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.keyId === 'string' && global.oauthProviders.apple.keyId.trim()
+                                    ? { keyId: global.oauthProviders.apple.keyId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.privateKeyPem === 'string' && global.oauthProviders.apple.privateKeyPem.trim()
+                                    ? { privateKeyPem: global.oauthProviders.apple.privateKeyPem.trim() }
+                                    : {})
+                            }
+                        }
+                        : {})
+                }
+            }
             : {})
     };
 }
@@ -362,8 +419,8 @@ export function updateGlobalSettingsService(deps, settings) {
                 || currentBilling.onboardingPolicy.mode === 'auto_start_trial')
             ? {
                 mode: currentBilling.onboardingPolicy.mode,
-                planVersionId: typeof currentBilling.onboardingPolicy.planVersionId === 'string'
-                    ? (currentBilling.onboardingPolicy.planVersionId.trim() || null)
+                planId: typeof currentBilling.onboardingPolicy.planId === 'string'
+                    ? (currentBilling.onboardingPolicy.planId.trim() || null)
                     : null
             }
             : null;
@@ -373,8 +430,8 @@ export function updateGlobalSettingsService(deps, settings) {
                 || incoming.onboardingPolicy.mode === 'auto_start_trial')
             ? {
                 mode: incoming.onboardingPolicy.mode,
-                planVersionId: typeof incoming.onboardingPolicy.planVersionId === 'string'
-                    ? (incoming.onboardingPolicy.planVersionId.trim() || null)
+                planId: typeof incoming.onboardingPolicy.planId === 'string'
+                    ? (incoming.onboardingPolicy.planId.trim() || null)
                     : null
             }
             : null;
@@ -426,5 +483,57 @@ export function updateGlobalSettingsService(deps, settings) {
                 : {})
         };
     }
+    if (settings.oauthProviders && typeof settings.oauthProviders === 'object') {
+        const currentProviders = next.oauthProviders && typeof next.oauthProviders === 'object' ? next.oauthProviders : {};
+        const incoming = settings.oauthProviders;
+        next.oauthProviders = { ...currentProviders };
+        if (incoming.google && typeof incoming.google === 'object') {
+            const cur = currentProviders.google && typeof currentProviders.google === 'object' ? currentProviders.google : {};
+            next.oauthProviders.google = {
+                ...cur,
+                ...(typeof incoming.google.enabled === 'boolean' ? { enabled: incoming.google.enabled } : {}),
+                ...(typeof incoming.google.clientId === 'string' ? { clientId: incoming.google.clientId.trim() } : {}),
+                ...(typeof incoming.google.clientSecret === 'string'
+                    ? (incoming.google.clientSecret.trim()
+                        ? { clientSecret: incoming.google.clientSecret.trim() }
+                        : { clientSecret: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.google.clientSecret)
+                delete next.oauthProviders.google.clientSecret;
+        }
+        if (incoming.github && typeof incoming.github === 'object') {
+            const cur = currentProviders.github && typeof currentProviders.github === 'object' ? currentProviders.github : {};
+            next.oauthProviders.github = {
+                ...cur,
+                ...(typeof incoming.github.enabled === 'boolean' ? { enabled: incoming.github.enabled } : {}),
+                ...(typeof incoming.github.clientId === 'string' ? { clientId: incoming.github.clientId.trim() } : {}),
+                ...(typeof incoming.github.clientSecret === 'string'
+                    ? (incoming.github.clientSecret.trim()
+                        ? { clientSecret: incoming.github.clientSecret.trim() }
+                        : { clientSecret: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.github.clientSecret)
+                delete next.oauthProviders.github.clientSecret;
+        }
+        if (incoming.apple && typeof incoming.apple === 'object') {
+            const cur = currentProviders.apple && typeof currentProviders.apple === 'object' ? currentProviders.apple : {};
+            next.oauthProviders.apple = {
+                ...cur,
+                ...(typeof incoming.apple.enabled === 'boolean' ? { enabled: incoming.apple.enabled } : {}),
+                ...(typeof incoming.apple.servicesId === 'string' ? { servicesId: incoming.apple.servicesId.trim() } : {}),
+                ...(typeof incoming.apple.teamId === 'string' ? { teamId: incoming.apple.teamId.trim() } : {}),
+                ...(typeof incoming.apple.keyId === 'string' ? { keyId: incoming.apple.keyId.trim() } : {}),
+                ...(typeof incoming.apple.privateKeyPem === 'string'
+                    ? (incoming.apple.privateKeyPem.trim()
+                        ? { privateKeyPem: incoming.apple.privateKeyPem.trim() }
+                        : { privateKeyPem: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.apple.privateKeyPem)
+                delete next.oauthProviders.apple.privateKeyPem;
+        }
+    }
     writeGlobalConfigService(deps, next);
 }

package/dist/core/PlanEntitlementService.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
-import type { EntitlementState, PlanFeatureAccess, PlanFeatureSnapshot, PlanFeatureCatalogItem, PlanVersionSnapshot, PlanCatalogSnapshot, AccountEntitlementSnapshot, SeatUsageSnapshot, FeatureEvaluationResult, AccountAccessStatus, GlobalTaskforceSettings, OnboardingPolicy, OnboardingPolicyValidationResult } from './types.js';
+import type { EntitlementState, PlanFeatureAccess, PlanFeatureSnapshot, PlanFeatureCatalogItem, PlanVersionSnapshot, PlanCatalogSnapshot, OnboardingPlanOption, AccountEntitlementSnapshot, SeatUsageSnapshot, FeatureEvaluationResult, AccountAccessStatus, GlobalTaskforceSettings, OnboardingPolicy, OnboardingPolicyValidationResult } from './types.js';
 export interface PlanEntitlementServiceDeps {
     getWorkspaceOwnerUserId: (workspaceId: string) => string | null;
     readGlobalConfig: () => GlobalTaskforceSettings;
@@ -17,6 +17,10 @@ export declare class PlanEntitlementService {
     constructor(db: DatabaseAdapter, tenantId: string, deps: PlanEntitlementServiceDeps);
     private generateEntityId;
     private parseJsonObject;
+    private normalizeOptionalCatalogMarketingCopy;
+    private canonicalizePlanFeatureKey;
+    private normalizeOptionalCatalogDisplayOrder;
+    private listPlanFeatureCatalogOverrideMap;
     normalizeEntitlementState(value: unknown): EntitlementState;
     private normalizeFeatureAccess;
     private readPositiveIntegerConfig;
@@ -27,14 +31,16 @@ export declare class PlanEntitlementService {
     private isEntitlementStateAllowed;
     private isIsoTimestampExpired;
     private readAccountEntitlementRow;
-    private normalizeExpiredCheckoutPendingRow;
+    private normalizeExpiredLifecycleRow;
     private isBillingConfirmedTransitionSource;
+    private countWorkspaceStorageUsageBytes;
     private resolveCanonicalTransitionSource;
     private resolvePendingPlanVersionId;
     private buildBlockedAccessStatus;
     private repairPlanDefaultVersionIfNeeded;
     repairPlanCatalogDefaultsIfNeeded(): void;
     normalizeLegacyPlanDataIfNeeded(): void;
+    private renameLegacyWorkspacesFeatureKey;
     private removeLegacyPlanFeatureRows;
     private migrateLegacySeatLimitFeatureConfigToVersionSeatLimit;
     private normalizeLegacyBillingMirrorRows;
@@ -73,6 +79,10 @@ export declare class PlanEntitlementService {
         limit: number | null;
         feature: PlanFeatureSnapshot | null;
     };
+    resolveAiProfileLimitForWorkspace(workspaceId: string): {
+        limit: number | null;
+        feature: PlanFeatureSnapshot | null;
+    };
     private planHasAnyActivePricing;
     private planVersionHasActiveFreePricing;
     private planVersionIsTrialEligible;
@@ -80,7 +90,7 @@ export declare class PlanEntitlementService {
     private getActiveDefaultPlanVersions;
     private getDefaultPlanVersionByMode;
     private tryGetDefaultPlanVersionByMode;
-    private tryGetImplicitFreeOnboardingPlanVersion;
+    private getOnboardingPlanSnapshot;
     getOnboardingPolicy(): OnboardingPolicy;
     validateOnboardingPolicy(input?: Partial<OnboardingPolicy>): OnboardingPolicyValidationResult;
     resolveRegistrationOnboardingOutcome(selectedPlanVersionIdRaw?: string): {
@@ -90,6 +100,7 @@ export declare class PlanEntitlementService {
         planVersionId: string | null;
         planId: string | null;
     };
+    listOnboardingPlanOptions(): OnboardingPlanOption[];
     createUserBillingRecord(userId: string, options?: {
         entitlementState?: string;
         planId?: string | null;
@@ -101,12 +112,15 @@ export declare class PlanEntitlementService {
     };
     hasAccountEntitlement(accountId: string): boolean;
     private tryGetAccountEntitlement;
+    private tryAutoHealLegacyPersonalFreeEntitlement;
+    private tryAutoHealCommercialEntitlementFromBillingMirror;
     getAccountAccessStatus(accountId: string): AccountAccessStatus;
     getEffectivePlanVersion(accountId: string): PlanVersionSnapshot;
     getAccountEntitlement(accountId: string): AccountEntitlementSnapshot;
     countWorkspaceSeatUsage(workspaceId: string, options?: {
         includeInvited?: boolean;
     }): SeatUsageSnapshot;
+    countAiProfileUsage(workspaceId: string): SeatUsageSnapshot;
     assertSeatAvailable(workspaceId: string): void;
     evaluateFeatureAccess(input: {
         userId: string;
@@ -125,6 +139,11 @@ export declare class PlanEntitlementService {
         planId: string;
         entitlementState: EntitlementState;
     };
+    resolveInviteAcceptanceDefaultEntitlement(): {
+        planVersionId: string;
+        planId: string;
+        commercialState: 'active';
+    } | null;
     private isValidEntitlementTransition;
     addEntitlementAuditLog(input: {
         actorUserId: string;
@@ -139,6 +158,7 @@ export declare class PlanEntitlementService {
     upsertPlanCatalog(input: {
         planId: string;
         displayName: string;
+        description?: string | null;
         status?: 'active' | 'archived';
         initialMode?: 'personal' | 'team';
         initialSeatLimit?: number | null;
@@ -146,10 +166,17 @@ export declare class PlanEntitlementService {
     }): {
         planId: string;
         displayName: string;
+        description: string | null;
         status: 'active' | 'archived';
     };
     listPlanCatalog(): PlanCatalogSnapshot[];
     listPlanFeatureCatalog(): PlanFeatureCatalogItem[];
+    updatePlanFeatureCatalogMarketingCopy(input: {
+        featureKey: string;
+        publicLabel?: string | null;
+        publicDescription?: string | null;
+        publicDisplayOrder?: number | null;
+    }): PlanFeatureCatalogItem;
     listPlanVersions(planId: string): PlanVersionSnapshot[];
     getPlanVersionFeatures(planId: string, versionId: string): PlanVersionSnapshot;
     searchAccountsByEmail(query: string, limit?: number): Array<{