@useatlas/create 0.0.5 → 0.0.7

package/templates/docker/src/api/routes/admin-model-config.ts

@@ -0,0 +1,252 @@
+/**
+ * Admin workspace model configuration routes.
+ *
+ * Mounted under /api/v1/admin/model-config. All routes require admin role AND
+ * enterprise license (enforced within the model-routing service layer).
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { hasInternalDB } from "@atlas/api/lib/db/internal";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { RequestContext, AuthContext } from "@atlas/api/lib/effect/services";
+import {
+  getWorkspaceModelConfig,
+  setWorkspaceModelConfig,
+  deleteWorkspaceModelConfig,
+  testModelConfig,
+  ModelConfigError,
+} from "@atlas/ee/platform/model-routing";
+import { ErrorSchema, AuthErrorSchema } from "./shared-schemas";
+import { createAdminRouter } from "./admin-router";
+
+const MODEL_CONFIG_ERROR_STATUS = { validation: 400, not_found: 404, test_failed: 422 } as const;
+
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+const ModelConfigSchema = z.object({
+  id: z.string(),
+  orgId: z.string(),
+  provider: z.enum(["anthropic", "openai", "azure-openai", "custom"]),
+  model: z.string(),
+  baseUrl: z.string().nullable(),
+  apiKeyMasked: z.string(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+});
+
+const SetModelConfigBodySchema = z.object({
+  provider: z.enum(["anthropic", "openai", "azure-openai", "custom"]).openapi({
+    description: "LLM provider. Use 'custom' for any OpenAI-compatible endpoint.",
+    example: "anthropic",
+  }),
+  model: z.string().min(1).openapi({
+    description: "Model identifier (e.g. claude-opus-4-6, gpt-4o).",
+    example: "claude-opus-4-6",
+  }),
+  apiKey: z.string().min(1).optional().openapi({
+    description: "Provider API key. Will be stored encrypted. Omit to keep existing key on update.",
+    example: "sk-ant-...",
+  }),
+  baseUrl: z.string().optional().openapi({
+    description: "Base URL for Azure OpenAI or custom endpoints. Required for azure-openai and custom providers.",
+    example: "https://my-deployment.openai.azure.com/openai/deployments/gpt-4o/",
+  }),
+});
+
+const TestModelConfigBodySchema = z.object({
+  provider: z.enum(["anthropic", "openai", "azure-openai", "custom"]),
+  model: z.string().min(1),
+  apiKey: z.string().min(1),
+  baseUrl: z.string().optional(),
+});
+
+const TestResultSchema = z.object({
+  success: z.boolean(),
+  message: z.string(),
+  modelName: z.string().optional(),
+});
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+const getConfigRoute = createRoute({
+  method: "get",
+  path: "/",
+  tags: ["Admin — Model Config"],
+  summary: "Get workspace model configuration",
+  description:
+    "Returns the workspace's custom LLM provider configuration, or null if using platform defaults.",
+  responses: {
+    200: { description: "Workspace model configuration (null if using platform default)", content: { "application/json": { schema: z.object({ config: ModelConfigSchema.nullable() }) } } },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    429: { description: "Rate limit exceeded", content: { "application/json": { schema: AuthErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const setConfigRoute = createRoute({
+  method: "put",
+  path: "/",
+  tags: ["Admin — Model Config"],
+  summary: "Set workspace model configuration",
+  description:
+    "Configures a custom LLM provider for the workspace. Overrides the platform default. API key is encrypted at rest.",
+  request: { body: { required: true, content: { "application/json": { schema: SetModelConfigBodySchema } } } },
+  responses: {
+    200: { description: "Model configuration saved", content: { "application/json": { schema: z.object({ config: ModelConfigSchema }) } } },
+    400: { description: "Invalid configuration or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    429: { description: "Rate limit exceeded", content: { "application/json": { schema: AuthErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const deleteConfigRoute = createRoute({
+  method: "delete",
+  path: "/",
+  tags: ["Admin — Model Config"],
+  summary: "Reset workspace model configuration",
+  description:
+    "Removes the workspace's custom model configuration. The workspace reverts to using the platform default.",
+  responses: {
+    200: { description: "Configuration reset to platform default", content: { "application/json": { schema: z.object({ message: z.string() }) } } },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "No custom configuration found or internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    429: { description: "Rate limit exceeded", content: { "application/json": { schema: AuthErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const testConfigRoute = createRoute({
+  method: "post",
+  path: "/test",
+  tags: ["Admin — Model Config"],
+  summary: "Test model configuration",
+  description:
+    "Tests a model configuration by making a minimal API call to the provider. Does not save the configuration.",
+  request: { body: { required: true, content: { "application/json": { schema: TestModelConfigBodySchema } } } },
+  responses: {
+    200: { description: "Test result", content: { "application/json": { schema: TestResultSchema } } },
+    400: { description: "Invalid configuration or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    429: { description: "Rate limit exceeded", content: { "application/json": { schema: AuthErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+const adminModelConfig = createAdminRouter();
+
+// GET / — get workspace model configuration
+adminModelConfig.openapi(getConfigRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { requestId } = yield* RequestContext;
+    const { orgId } = yield* AuthContext;
+
+    if (!hasInternalDB()) {
+      return c.json({ error: "not_available", message: "No internal database configured.", requestId }, 404);
+    }
+
+    if (!orgId) {
+      return c.json({ error: "bad_request", message: "No active organization. Set an active org first.", requestId }, 400);
+    }
+
+    const config = yield* Effect.promise(() => getWorkspaceModelConfig(orgId));
+    return c.json({ config }, 200);
+  }), { label: "get workspace model config", domainErrors: [[ModelConfigError, MODEL_CONFIG_ERROR_STATUS]] });
+});
+
+// PUT / — set workspace model configuration
+adminModelConfig.openapi(setConfigRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { requestId } = yield* RequestContext;
+    const { orgId } = yield* AuthContext;
+
+    if (!hasInternalDB()) {
+      return c.json({ error: "not_available", message: "No internal database configured.", requestId }, 404);
+    }
+
+    if (!orgId) {
+      return c.json({ error: "bad_request", message: "No active organization. Set an active org first.", requestId }, 400);
+    }
+
+    const body = c.req.valid("json");
+
+    // If apiKey is omitted, require an existing config to preserve the key
+    if (!body.apiKey) {
+      const existing = yield* Effect.promise(() => getWorkspaceModelConfig(orgId));
+      if (!existing) {
+        return c.json({ error: "validation", message: "API key is required when no existing configuration exists." }, 400);
+      }
+    }
+
+    const config = yield* Effect.promise(() => setWorkspaceModelConfig(orgId, {
+      provider: body.provider,
+      model: body.model,
+      apiKey: body.apiKey,
+      baseUrl: body.baseUrl,
+    }));
+    return c.json({ config }, 200);
+  }), { label: "set workspace model config", domainErrors: [[ModelConfigError, MODEL_CONFIG_ERROR_STATUS]] });
+});
+
+// DELETE / — reset workspace model configuration
+adminModelConfig.openapi(deleteConfigRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { requestId } = yield* RequestContext;
+    const { orgId } = yield* AuthContext;
+
+    if (!hasInternalDB()) {
+      return c.json({ error: "not_available", message: "No internal database configured.", requestId }, 404);
+    }
+
+    if (!orgId) {
+      return c.json({ error: "bad_request", message: "No active organization. Set an active org first.", requestId }, 400);
+    }
+
+    const deleted = yield* Effect.promise(() => deleteWorkspaceModelConfig(orgId));
+    if (!deleted) {
+      return c.json({ error: "not_found", message: "No custom model configuration found." }, 404);
+    }
+    return c.json({ message: "Model configuration reset to platform default." }, 200);
+  }), { label: "delete workspace model config", domainErrors: [[ModelConfigError, MODEL_CONFIG_ERROR_STATUS]] });
+});
+
+// POST /test — test model configuration (no hasInternalDB — tests external APIs only)
+adminModelConfig.openapi(testConfigRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { requestId } = yield* RequestContext;
+    const { orgId } = yield* AuthContext;
+
+    if (!orgId) {
+      return c.json({ error: "bad_request", message: "No active organization. Set an active org first.", requestId }, 400);
+    }
+
+    const body = c.req.valid("json");
+
+    const result = yield* Effect.promise(() => testModelConfig({
+      provider: body.provider,
+      model: body.model,
+      apiKey: body.apiKey,
+      baseUrl: body.baseUrl,
+    }));
+    return c.json(result, 200);
+  }), { label: "test model config", domainErrors: [[ModelConfigError, MODEL_CONFIG_ERROR_STATUS]] });
+});
+
+export { adminModelConfig };

package/templates/docker/src/api/routes/admin-onboarding-emails.ts

@@ -0,0 +1,145 @@
+/**
+ * Admin onboarding email routes.
+ *
+ * Mounted under /api/v1/admin/onboarding-emails. All routes require admin role.
+ * Provides visibility into the onboarding email sequence for workspace users.
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { AuthContext } from "@atlas/api/lib/effect/services";
+import { hasInternalDB } from "@atlas/api/lib/db/internal";
+import {
+  getOnboardingStatuses,
+  isOnboardingEmailEnabled,
+} from "@atlas/api/lib/email/engine";
+import { ONBOARDING_SEQUENCE } from "@atlas/api/lib/email/sequence";
+import { ONBOARDING_EMAIL_STEPS, ONBOARDING_MILESTONES } from "@useatlas/types";
+import { ErrorSchema, AuthErrorSchema, parsePagination } from "./shared-schemas";
+import { createAdminRouter } from "./admin-router";
+
+const stepEnum = z.enum(ONBOARDING_EMAIL_STEPS);
+const milestoneEnum = z.enum(ONBOARDING_MILESTONES);
+
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+const OnboardingEmailStatusSchema = z.object({
+  userId: z.string(),
+  email: z.string(),
+  orgId: z.string(),
+  sentSteps: z.array(stepEnum),
+  pendingSteps: z.array(stepEnum),
+  unsubscribed: z.boolean(),
+  createdAt: z.string(),
+});
+
+const SequenceStepSchema = z.object({
+  step: stepEnum,
+  trigger: milestoneEnum,
+  fallbackHours: z.number(),
+  subject: z.string(),
+  description: z.string(),
+});
+
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+
+const listStatusesRoute = createRoute({
+  method: "get",
+  path: "/",
+  tags: ["Admin — Onboarding Emails"],
+  summary: "List onboarding email statuses",
+  description: "SaaS only. Returns onboarding email progress for users in the authenticated admin's organization.",
+  request: {
+    query: z.object({
+      limit: z.string().optional().openapi({ description: "Max results (default 50)" }),
+      offset: z.string().optional().openapi({ description: "Pagination offset (default 0)" }),
+    }),
+  },
+  responses: {
+    200: {
+      description: "List of user onboarding email statuses",
+      content: {
+        "application/json": {
+          schema: z.object({
+            enabled: z.boolean(),
+            statuses: z.array(OnboardingEmailStatusSchema),
+            total: z.number(),
+          }),
+        },
+      },
+    },
+    401: { description: "Unauthorized", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const getSequenceRoute = createRoute({
+  method: "get",
+  path: "/sequence",
+  tags: ["Admin — Onboarding Emails"],
+  summary: "Get onboarding email sequence definition",
+  description: "SaaS only. Returns the configured onboarding email sequence steps with triggers and timing.",
+  responses: {
+    200: {
+      description: "Sequence steps",
+      content: {
+        "application/json": {
+          schema: z.object({
+            enabled: z.boolean(),
+            steps: z.array(SequenceStepSchema),
+          }),
+        },
+      },
+    },
+    401: { description: "Unauthorized", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+export const adminOnboardingEmails = createAdminRouter();
+
+adminOnboardingEmails.openapi(listStatusesRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    if (!orgId || !hasInternalDB()) {
+      return c.json({
+        enabled: false,
+        statuses: [],
+        total: 0,
+      }, 200);
+    }
+
+    const { limit, offset } = parsePagination(c);
+
+    const result = yield* Effect.promise(() => getOnboardingStatuses(orgId, limit, offset));
+    return c.json({
+      enabled: isOnboardingEmailEnabled(),
+      statuses: result.statuses,
+      total: result.total,
+    }, 200);
+  }), { label: "fetch onboarding statuses" });
+});
+
+adminOnboardingEmails.openapi(getSequenceRoute, async (c) => {
+  return c.json({
+    enabled: isOnboardingEmailEnabled(),
+    steps: ONBOARDING_SEQUENCE.map((s) => ({
+      step: s.step,
+      trigger: s.trigger,
+      fallbackHours: s.fallbackHours,
+      subject: s.subject,
+      description: s.description,
+    })),
+  }, 200);
+});