@tuturuuu/utils 0.28.0 → 0.29.1

package/src/meet-creation-policy.test.ts

@@ -19,3 +19,14 @@ describe('online meeting creator domain', () => {
     expect(canCreateOnlineMeeting(email)).toBe(false);
   });
 });
+
+it.each(['PLUS', 'PRO', 'ENTERPRISE'])(
+  'allows verified external %s eligibility',
+  (tier) => {
+    expect(canCreateOnlineMeeting('host@example.test', tier)).toBe(true);
+    expect(canCreateOnlineMeeting('bad@@example.test', tier)).toBe(false);
+  }
+);
+it('does not unlock hosting for an unknown tier', () => {
+  expect(canCreateOnlineMeeting('host@example.test', 'UNKNOWN')).toBe(false);
+});

package/src/meet-creation-policy.ts

@@ -1,6 +1,12 @@
-/** Apply only to an authenticated account email, never editable profile metadata. */
+/** Use a current authenticated email and server-resolved personal subscription tier. */
 export function canCreateOnlineMeeting(
-  email: string | null | undefined
+  email: string | null | undefined,
+  tier: string = 'FREE'
 ): boolean {
-  return typeof email === 'string' && /^[^\s@]+@tuturuuu\.com$/iu.test(email);
+  if (typeof email !== 'string' || !/^[^\s@]+@[^\s@]+$/u.test(email))
+    return false;
+  return (
+    /^[^\s@]+@tuturuuu\.com$/iu.test(email) ||
+    ['PLUS', 'PRO', 'ENTERPRISE'].includes(tier)
+  );
 }

package/src/meet-duration.ts

@@ -0,0 +1,71 @@
+import 'server-only';
+import { createAdminClient } from '@tuturuuu/supabase/next/server';
+import type { WorkspaceProductTier } from '@tuturuuu/types';
+import { extractTierFromSubscriptions } from './workspace-helper';
+export class MeetDurationError extends Error {
+  readonly status = 503;
+}
+
+export function meetingDurationSeconds(tier: string) {
+  return (
+    (tier === 'PLUS' ? 10 : tier === 'PRO' || tier === 'ENTERPRISE' ? 24 : 2) *
+    3600
+  );
+}
+
+/** Entitlements belong to the host's personal account, never the joining guest. */
+export async function getHostMeetingTier(
+  hostId: string
+): Promise<WorkspaceProductTier> {
+  const db = await createAdminClient({ noCookie: true });
+  const { data, error } = await db
+    .from('workspaces')
+    .select('id')
+    .eq('creator_id', hostId)
+    .eq('personal', true)
+    .or('deleted.is.null,deleted.eq.false')
+    .maybeSingle();
+  if (error) throw new MeetDurationError('Meeting entitlement lookup failed');
+  if (!data) return 'FREE';
+  const subscriptions = await db
+    .from('workspace_subscriptions')
+    .select('created_at, status, product_id')
+    .eq('ws_id', data.id)
+    .eq('status', 'active');
+  if (subscriptions.error)
+    throw new MeetDurationError('Meeting entitlement lookup failed');
+  const ids = [
+    ...new Set(
+      subscriptions.data
+        .map((subscription) => subscription.product_id)
+        .filter((id): id is string => !!id)
+    ),
+  ];
+  if (!ids.length) return 'FREE';
+  const products = await db
+    .schema('private')
+    .from('workspace_subscription_products')
+    .select('id, tier')
+    .in('id', ids);
+  if (products.error)
+    throw new MeetDurationError('Meeting entitlement lookup failed');
+  const tiers = new Map(
+    products.data.map((product) => [product.id, product.tier])
+  );
+  if (ids.some((id) => !tiers.get(id)))
+    throw new MeetDurationError('Meeting entitlement product unavailable');
+  const tier = extractTierFromSubscriptions(
+    subscriptions.data.map((subscription) => ({
+      ...subscription,
+      product_tier: subscription.product_id
+        ? (tiers.get(subscription.product_id) ?? null)
+        : null,
+    }))
+  );
+
+  return tier ?? 'FREE';
+}
+
+export async function getHostMeetingDurationSeconds(hostId: string) {
+  return meetingDurationSeconds(await getHostMeetingTier(hostId));
+}

package/src/meet-hosting.test.ts

@@ -0,0 +1,58 @@
+import { beforeEach, expect, it, vi } from 'vitest';
+
+const tier = vi.hoisted(() => vi.fn());
+vi.mock('server-only', () => ({}));
+vi.mock('./meet-duration', () => ({ getHostMeetingTier: tier }));
+
+import { canVerifiedAccountHostMeeting } from './meet-hosting';
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  tier.mockResolvedValue('FREE');
+});
+it.each(['PLUS', 'PRO', 'ENTERPRISE'])(
+  'unlocks verified %s accounts',
+  async (value) => {
+    tier.mockResolvedValue(value);
+    expect(
+      await canVerifiedAccountHostMeeting('actor', {
+        email: 'host@example.com',
+        email_confirmed_at: '2026-01-01',
+      })
+    ).toBe(true);
+    expect(tier).toHaveBeenCalledWith('actor');
+  }
+);
+it('requires verification before considering a paid subscription', async () => {
+  tier.mockResolvedValue('PLUS');
+  expect(
+    await canVerifiedAccountHostMeeting('actor', { email: 'host@example.com' })
+  ).toBe(false);
+  expect(tier).not.toHaveBeenCalled();
+});
+it('preserves verified company hosting without paid entitlement', async () => {
+  expect(
+    await canVerifiedAccountHostMeeting('actor', {
+      email: 'host@tuturuuu.com',
+      email_confirmed_at: '2026-01-01',
+    })
+  ).toBe(true);
+  expect(tier).not.toHaveBeenCalled();
+});
+it('denies external Free accounts', async () => {
+  expect(
+    await canVerifiedAccountHostMeeting('actor', {
+      email: 'host@example.com',
+      email_confirmed_at: '2026-01-01',
+    })
+  ).toBe(false);
+});
+it('fails closed when entitlement cannot be resolved', async () => {
+  tier.mockRejectedValue(new Error('Unavailable'));
+  await expect(
+    canVerifiedAccountHostMeeting('actor', {
+      email: 'host@example.com',
+      email_confirmed_at: '2026-01-01',
+    })
+  ).rejects.toThrow('Unavailable');
+});

package/src/meet-hosting.ts

@@ -0,0 +1,19 @@
+import 'server-only';
+import { canCreateOnlineMeeting } from './meet-creation-policy';
+import { getHostMeetingTier } from './meet-duration';
+
+/** Pass only the current auth.admin.getUserById result, never handoff/profile metadata. */
+export async function canVerifiedAccountHostMeeting(
+  accountId: string,
+  identity:
+    | { email?: string | null; email_confirmed_at?: string | null }
+    | null
+    | undefined
+) {
+  if (!identity?.email_confirmed_at || !identity.email) return false;
+  if (canCreateOnlineMeeting(identity.email)) return true;
+  return canCreateOnlineMeeting(
+    identity.email,
+    await getHostMeetingTier(accountId)
+  );
+}

package/src/meeting-invitations.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, it } from 'vitest';
+import {
+  MeetingInvitationInputSchema,
+  normalizeGoogleResponse,
+  normalizeMicrosoftResponse,
+} from './meeting-invitations';
+
+describe('meeting invitation contract', () => {
+  it('normalizes internal and external guests without accepting response spoofing', () => {
+    const invitation = MeetingInvitationInputSchema.parse({
+      guests: [
+        { email: 'NAME@TUTURUUU.COM', response: 'accepted' },
+        { email: 'friend@gmail.com', optional: true },
+      ],
+      timeZone: 'Asia/Ho_Chi_Minh',
+    });
+    expect(invitation.guests[0]).toEqual({ email: 'name@tuturuuu.com' });
+    expect(invitation.guests[1]?.optional).toBe(true);
+  });
+  it.each([
+    { guests: [], timeZone: 'UTC' },
+    { guests: [{ email: 'invalid' }], timeZone: 'UTC' },
+    { guests: [{ email: 'a@example.com' }], timeZone: 'fake/zone' },
+    {
+      guests: [{ email: 'a@example.com' }, { email: 'A@EXAMPLE.COM' }],
+      timeZone: 'UTC',
+    },
+    {
+      guests: Array.from({ length: 101 }, (_, i) => ({
+        email: `${i}@example.com`,
+      })),
+      timeZone: 'UTC',
+    },
+  ])('rejects invalid or ambiguous invitation input', (input) => {
+    expect(MeetingInvitationInputSchema.safeParse(input).success).toBe(false);
+  });
+  it.each(['accepted', 'declined', 'tentative', 'needsAction'])(
+    'preserves Google %s',
+    (value) => {
+      expect(normalizeGoogleResponse(value)).toBe(value);
+    }
+  );
+  it.each([
+    ['accepted', 'accepted'],
+    ['declined', 'declined'],
+    ['tentativelyAccepted', 'tentative'],
+    ['notResponded', 'needsAction'],
+    ['none', 'needsAction'],
+    ['unexpected', 'needsAction'],
+  ])('normalizes Microsoft %s', (value, expected) => {
+    expect(normalizeMicrosoftResponse(value)).toBe(expected);
+  });
+});
+
+describe('untrusted invitation input boundaries', () => {
+  it.each([
+    null,
+    undefined,
+    'accepted',
+    [],
+    { guests: [{ email: 'a@example.com', optional: 'yes' }], timeZone: 'UTC' },
+    {
+      guests: [{ email: 'a@example.com', name: 'a'.repeat(201) }],
+      timeZone: 'UTC',
+    },
+    {
+      guests: [{ email: 'a@example.com\r\nBcc: victim@example.com' }],
+      timeZone: 'UTC',
+    },
+    { guests: [{ email: 'a@example.com' }], timeZone: null },
+  ])('rejects malformed input without throwing from safeParse', (input) => {
+    expect(MeetingInvitationInputSchema.safeParse(input).success).toBe(false);
+  });
+
+  it('accepts the maximum guest count and strips organizer-controlled provider state', () => {
+    const result = MeetingInvitationInputSchema.parse({
+      guests: Array.from({ length: 100 }, (_, i) => ({
+        email: `guest${i}@example.com`,
+        self: true,
+        response: 'accepted',
+      })),
+      timeZone: 'UTC',
+      organizer: { email: 'spoof@example.com' },
+      cancelled: true,
+    });
+    expect(result.guests).toHaveLength(100);
+    expect(result).not.toHaveProperty('organizer');
+    expect(result).not.toHaveProperty('cancelled');
+    for (const guest of result.guests) {
+      expect(guest).not.toHaveProperty('self');
+      expect(guest).not.toHaveProperty('response');
+    }
+  });
+
+  it.each([null, undefined, {}, [], 0, 'ACCEPTED', '<script>'])(
+    'treats unknown provider responses as unanswered',
+    (value) => {
+      expect(normalizeGoogleResponse(value)).toBe('needsAction');
+      expect(normalizeMicrosoftResponse(value)).toBe('needsAction');
+    }
+  );
+});

package/src/meeting-invitations.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+
+export const MeetingResponseSchema = z.enum([
+  'needsAction',
+  'accepted',
+  'declined',
+  'tentative',
+]);
+export type MeetingResponse = z.infer<typeof MeetingResponseSchema>;
+
+export const MeetingGuestSchema = z.object({
+  email: z
+    .email()
+    .max(254)
+    .transform((value) => value.trim().toLowerCase()),
+  name: z.string().trim().max(200).optional(),
+  optional: z.boolean().optional(),
+});
+
+/** Guest responses are provider-owned, never accepted from organizer input. */
+export const MeetingInvitationInputSchema = z
+  .object({
+    guests: z.array(MeetingGuestSchema).min(1).max(100),
+    timeZone: z
+      .string()
+      .max(100)
+      .refine((value) => {
+        try {
+          new Intl.DateTimeFormat('en', { timeZone: value });
+          return true;
+        } catch {
+          return false;
+        }
+      }, 'Invalid time zone'),
+  })
+  .superRefine((value, context) => {
+    const emails = new Set<string>();
+    value.guests.forEach((guest, index) => {
+      if (emails.has(guest.email))
+        context.addIssue({
+          code: 'custom',
+          message: 'Duplicate guest',
+          path: ['guests', index, 'email'],
+        });
+      emails.add(guest.email);
+    });
+  });
+export type MeetingInvitationInput = z.infer<
+  typeof MeetingInvitationInputSchema
+>;
+
+export type MeetingAttendee = z.infer<typeof MeetingGuestSchema> & {
+  response: MeetingResponse;
+  self?: boolean;
+};
+export interface MeetingInvitationState {
+  organizer: { email: string; name?: string; self: boolean };
+  attendees: MeetingAttendee[];
+  timeZone?: string;
+  iCalUid?: string;
+  cancelled: boolean;
+}
+
+export function normalizeGoogleResponse(value: unknown): MeetingResponse {
+  const parsed = MeetingResponseSchema.safeParse(value);
+  return parsed.success ? parsed.data : 'needsAction';
+}
+
+export function normalizeMicrosoftResponse(value: unknown): MeetingResponse {
+  switch (value) {
+    case 'accepted':
+    case 'organizer':
+      return 'accepted';
+    case 'declined':
+      return 'declined';
+    case 'tentativelyAccepted':
+      return 'tentative';
+    default:
+      return 'needsAction';
+  }
+}

package/src/onboarding.ts

@@ -109,6 +109,7 @@ const MISSIONS = [
     'confirmation_required',
     ['store', 'preview', 'checkout'],
   ],
+  ['lettin', 'build', 'confirmation_required', ['world', 'write', 'publish']],
   ['learn', 'learn', 'reversible', ['courses', 'study', 'progress']],
   ['mail', 'focus', 'confirmation_required', ['inbox', 'compose', 'follow_up']],
   ['meet', 'collaborate', 'confirmation_required', ['room', 'invite', 'meet']],

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.46.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.53.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.46.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.53.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/portless.ts

@@ -24,6 +24,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   infra: `https://infra.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   inventory: `https://inventory.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   learn: `https://learn.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  lettin: `https://lettin.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   mail: `https://mail.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   meet: `https://meet.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   mind: `https://mind.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/task-helper/task-sort.test.ts

@@ -22,7 +22,7 @@ describe('sortTasksByCriterion', () => {
     expect(parseTaskSortBy(null)).toBeUndefined();
   });
 
-  it('sorts every priority direction with unset priorities last', () => {
+  it('sorts every priority direction with unset priorities first by default', () => {
     const tasks = [
       task('none'),
       task('high', { priority: 'high' }),
@@ -33,12 +33,31 @@ describe('sortTasksByCriterion', () => {
 
     expect(
       sortTasksByCriterion(tasks, 'priority-high').map(({ id }) => id)
-    ).toEqual(['critical', 'high', 'normal', 'low', 'none']);
+    ).toEqual(['none', 'critical', 'high', 'normal', 'low']);
     expect(
       sortTasksByCriterion(tasks, 'priority-low').map(({ id }) => id)
-    ).toEqual(['low', 'normal', 'high', 'critical', 'none']);
+    ).toEqual(['none', 'low', 'normal', 'high', 'critical']);
   });
 
+  it.each(['priority-high', 'priority-low'] as const)(
+    'keeps null and undefined priorities last when requested: %s',
+    (sortBy) => {
+      const tasks = [
+        task('null', { priority: null }),
+        task('set', { priority: 'high' }),
+        task('undefined'),
+      ];
+      expect(
+        sortTasksByCriterion(tasks, sortBy, 'last').map((t) => t.id)
+      ).toEqual(['set', 'null', 'undefined']);
+      expect(sortTasksByCriterion(tasks, sortBy).map((t) => t.id)).toEqual([
+        'null',
+        'undefined',
+        'set',
+      ]);
+    }
+  );
+
   it('keeps missing due dates and estimations last in both directions', () => {
     const tasks = [
       task('none'),

package/src/task-helper/task-sort.ts

@@ -1,5 +1,14 @@
 import type { TaskPriority } from '@tuturuuu/types/primitives/Priority';
 
+export const TASK_UNPRIORITIZED_POSITION_CONFIG_ID =
+  'TASK_UNPRIORITIZED_POSITION';
+export type UnprioritizedPosition = 'first' | 'last';
+export function normalizeUnprioritizedPosition(
+  value: unknown
+): UnprioritizedPosition {
+  return value === 'last' ? 'last' : 'first';
+}
+
 export type TaskSortBy =
   | 'name-asc'
   | 'name-desc'
@@ -78,11 +87,29 @@ function compareCreatedFallback(a: SortableTask, b: SortableTask) {
   return created || a.id.localeCompare(b.id);
 }
 
+export function compareUnprioritizedPlacement(
+  a: TaskPriority | null | undefined,
+  b: TaskPriority | null | undefined,
+  position: UnprioritizedPosition = 'first'
+) {
+  if ((a == null) === (b == null)) return 0;
+  return (a == null ? -1 : 1) * (position === 'first' ? 1 : -1);
+}
+
 export function compareTasksByCriterion(
   a: SortableTask,
   b: SortableTask,
-  sortBy: TaskSortBy
+  sortBy: TaskSortBy,
+  unprioritizedPosition: UnprioritizedPosition = 'first'
 ) {
+  if (sortBy === 'priority-high' || sortBy === 'priority-low') {
+    const placement = compareUnprioritizedPlacement(
+      a.priority,
+      b.priority,
+      unprioritizedPosition
+    );
+    if (placement) return placement;
+  }
   let result = 0;
 
   switch (sortBy) {
@@ -155,8 +182,11 @@ export function compareTasksByCriterion(
 
 export function sortTasksByCriterion<T extends SortableTask>(
   tasks: readonly T[],
-  sortBy: TaskSortBy | null | undefined
+  sortBy: TaskSortBy | null | undefined,
+  unprioritizedPosition: UnprioritizedPosition = 'first'
 ) {
   if (!sortBy) return [...tasks];
-  return [...tasks].sort((a, b) => compareTasksByCriterion(a, b, sortBy));
+  return [...tasks].sort((a, b) =>
+    compareTasksByCriterion(a, b, sortBy, unprioritizedPosition)
+  );
 }

package/src/workspace-helper.ts

@@ -702,7 +702,6 @@ export async function resolveWorkspaceIdForPrincipal({
   if (wsId.trim().toLowerCase() !== PERSONAL_WORKSPACE_SLUG) {
     return normalizeWorkspaceId(wsId, authorizationClient);
   }
-
   const { data: creatorWorkspace, error: creatorWorkspaceError } =
     await authorizationClient
       .from('workspaces')
@@ -710,7 +709,6 @@ export async function resolveWorkspaceIdForPrincipal({
       .eq('personal', true)
       .eq('creator_id', principal.id)
       .maybeSingle();
-
   if (!creatorWorkspaceError && creatorWorkspace?.id) {
     return creatorWorkspace.id;
   }
@@ -725,7 +723,9 @@ export async function resolveWorkspaceIdForPrincipal({
       .maybeSingle();
 
   if (memberWorkspaceError || !memberWorkspace?.id) {
-    throw new Error('Personal workspace not found');
+    throw creatorWorkspaceError || memberWorkspaceError
+      ? new WorkspaceResolutionError('Personal workspace lookup failed')
+      : new WorkspaceNotFoundError('Personal workspace not found');
   }
 
   return memberWorkspace.id;

package/src/workspace-limits.ts

@@ -55,7 +55,7 @@ export async function checkWorkspaceCreationLimit(
       canCreate: false,
       currentCount,
       limit: MAX_WORKSPACES_FOR_FREE_USERS,
-      errorMessage: `You have reached the maximum limit of ${MAX_WORKSPACES_FOR_FREE_USERS} workspaces. Please upgrade to a paid plan or contact the Tuturuuu team for more information.`,
+      errorMessage: `You have reached the maximum limit of ${MAX_WORKSPACES_FOR_FREE_USERS} workspaces. Upgrading does not increase this account limit. Contact the Tuturuuu team if you need more workspaces.`,
       errorCode: WORKSPACE_LIMIT_ERROR_CODE,
     };
   }