@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/src/api/routes/admin-branding.ts

@@ -0,0 +1,252 @@
+/**
+ * Admin workspace branding routes.
+ *
+ * Mounted under /api/v1/admin/branding. All routes require admin role AND
+ * enterprise license (enforced within the branding service layer).
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { AuthContext } from "@atlas/api/lib/effect/services";
+import {
+  getWorkspaceBranding,
+  setWorkspaceBranding,
+  deleteWorkspaceBranding,
+  BrandingError,
+} from "@atlas/ee/branding/white-label";
+import { ErrorSchema, AuthErrorSchema } from "./shared-schemas";
+import { createAdminRouter, requireOrgContext } from "./admin-router";
+
+const BRANDING_ERROR_STATUS = { validation: 400, not_found: 404 } as const;
+
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+
+const BrandingSchema = z.object({
+  id: z.string(),
+  orgId: z.string(),
+  logoUrl: z.string().nullable(),
+  logoText: z.string().nullable(),
+  primaryColor: z.string().nullable(),
+  faviconUrl: z.string().nullable(),
+  hideAtlasBranding: z.boolean(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+});
+
+const SetBrandingBodySchema = z.object({
+  logoUrl: z.string().nullable().optional().openapi({
+    description: "URL to custom logo image. Set to null to clear.",
+    example: "https://example.com/logo.png",
+  }),
+  logoText: z.string().nullable().optional().openapi({
+    description: "Text to show next to/instead of logo (e.g. company name). Set to null to clear.",
+    example: "Acme Corp",
+  }),
+  primaryColor: z.string().nullable().optional().openapi({
+    description: "Hex color to replace Atlas brand color. Must be 6-digit hex (e.g. #FF5500). Set to null to clear.",
+    example: "#FF5500",
+  }),
+  faviconUrl: z.string().nullable().optional().openapi({
+    description: "URL to custom favicon. Set to null to clear.",
+    example: "https://example.com/favicon.ico",
+  }),
+  hideAtlasBranding: z.boolean().optional().openapi({
+    description: "When true, remove 'Atlas' / 'Powered by Atlas' text from the UI.",
+    example: true,
+  }),
+});
+
+// ---------------------------------------------------------------------------
+// Route definitions
+// ---------------------------------------------------------------------------
+
+const getBrandingRoute = createRoute({
+  method: "get",
+  path: "/",
+  tags: ["Admin — Branding"],
+  summary: "Get workspace branding",
+  description:
+    "Returns the workspace's custom branding configuration, or null if using Atlas defaults.",
+  responses: {
+    200: {
+      description: "Workspace branding (null if using Atlas defaults)",
+      content: {
+        "application/json": {
+          schema: z.object({ branding: BrandingSchema.nullable() }),
+        },
+      },
+    },
+    400: {
+      description: "No active organization",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    403: {
+      description: "Forbidden — admin role or enterprise license required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    404: {
+      description: "Internal database not configured",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    429: {
+      description: "Rate limit exceeded",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+const setBrandingRoute = createRoute({
+  method: "put",
+  path: "/",
+  tags: ["Admin — Branding"],
+  summary: "Update workspace branding",
+  description:
+    "Sets custom branding for the workspace. Overwrites all fields. Enterprise license required.",
+  request: {
+    body: {
+      required: true,
+      content: {
+        "application/json": { schema: SetBrandingBodySchema },
+      },
+    },
+  },
+  responses: {
+    200: {
+      description: "Branding saved",
+      content: {
+        "application/json": {
+          schema: z.object({ branding: BrandingSchema }),
+        },
+      },
+    },
+    400: {
+      description: "Invalid branding configuration or no active organization",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    403: {
+      description: "Forbidden — admin role or enterprise license required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    404: {
+      description: "Internal database not configured",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    429: {
+      description: "Rate limit exceeded",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+const deleteBrandingRoute = createRoute({
+  method: "delete",
+  path: "/",
+  tags: ["Admin — Branding"],
+  summary: "Reset workspace branding",
+  description:
+    "Removes custom branding for the workspace. Reverts to Atlas defaults.",
+  responses: {
+    200: {
+      description: "Branding reset to Atlas defaults",
+      content: {
+        "application/json": {
+          schema: z.object({ message: z.string() }),
+        },
+      },
+    },
+    400: {
+      description: "No active organization",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    401: {
+      description: "Authentication required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    403: {
+      description: "Forbidden — admin role or enterprise license required",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    404: {
+      description: "No custom branding found or internal database not configured",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+    429: {
+      description: "Rate limit exceeded",
+      content: { "application/json": { schema: AuthErrorSchema } },
+    },
+    500: {
+      description: "Internal server error",
+      content: { "application/json": { schema: ErrorSchema } },
+    },
+  },
+});
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+const adminBranding = createAdminRouter();
+
+adminBranding.use(requireOrgContext());
+
+// GET / — get workspace branding
+adminBranding.openapi(getBrandingRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const branding = yield* Effect.promise(() => getWorkspaceBranding(orgId!));
+    return c.json({ branding }, 200);
+  }), { label: "get workspace branding", domainErrors: [[BrandingError, BRANDING_ERROR_STATUS]] });
+});
+
+// PUT / — set workspace branding
+adminBranding.openapi(setBrandingRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const body = c.req.valid("json");
+
+    const branding = yield* Effect.promise(() => setWorkspaceBranding(orgId!, {
+      logoUrl: body.logoUrl,
+      logoText: body.logoText,
+      primaryColor: body.primaryColor,
+      faviconUrl: body.faviconUrl,
+      hideAtlasBranding: body.hideAtlasBranding,
+    }));
+    return c.json({ branding }, 200);
+  }), { label: "save workspace branding", domainErrors: [[BrandingError, BRANDING_ERROR_STATUS]] });
+});
+
+// DELETE / — reset workspace branding
+adminBranding.openapi(deleteBrandingRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+
+    const deleted = yield* Effect.promise(() => deleteWorkspaceBranding(orgId!));
+    if (!deleted) {
+      return c.json({ error: "not_found", message: "No custom branding found." }, 404);
+    }
+    return c.json({ message: "Branding reset to Atlas defaults." }, 200);
+  }), { label: "reset workspace branding", domainErrors: [[BrandingError, BRANDING_ERROR_STATUS]] });
+});
+
+export { adminBranding };

package/templates/nextjs-standalone/src/api/routes/admin-compliance.ts

@@ -0,0 +1,352 @@
+/**
+ * Admin compliance routes (PII classifications + reporting).
+ *
+ * Mounted under /api/v1/admin/compliance. All routes require admin role AND
+ * enterprise license (enforced within the compliance service layer).
+ *
+ * Provides:
+ * - GET    /classifications             — list PII column classifications
+ * - PUT    /classifications/:id         — update a classification (category, strategy, dismiss)
+ * - DELETE /classifications/:id         — delete a classification
+ * - GET    /reports/data-access         — data access compliance report
+ * - GET    /reports/user-activity       — user activity compliance report
+ */
+
+import { Effect } from "effect";
+import { createRoute, z } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+import { runEffect } from "@atlas/api/lib/effect/hono";
+import { AuthContext } from "@atlas/api/lib/effect/services";
+import {
+  listPIIClassifications,
+  updatePIIClassification,
+  deletePIIClassification,
+  invalidateClassificationCache,
+  ComplianceError,
+} from "@atlas/ee/compliance/masking";
+import {
+  generateDataAccessReport,
+  generateUserActivityReport,
+  dataAccessReportToCSV,
+  userActivityReportToCSV,
+  ReportError,
+  type ReportErrorCode,
+} from "@atlas/ee/compliance/reports";
+import type { PIICategory, MaskingStrategy } from "@useatlas/types";
+import { ErrorSchema, AuthErrorSchema, DeletedResponseSchema } from "./shared-schemas";
+import { createAdminRouter, requireOrgContext } from "./admin-router";
+
+const COMPLIANCE_ERROR_STATUS = { validation: 400, not_found: 404, conflict: 409 } as const;
+const REPORT_ERROR_STATUS = { validation: 400, not_available: 404 } as const satisfies Record<ReportErrorCode, number>;
+
+// ── Schemas ─────────────────────────────────────────────────────
+
+const PIIClassificationSchema = z.object({
+  id: z.string(),
+  orgId: z.string(),
+  tableName: z.string(),
+  columnName: z.string(),
+  connectionId: z.string(),
+  category: z.string(),
+  confidence: z.string(),
+  maskingStrategy: z.string(),
+  reviewed: z.boolean(),
+  dismissed: z.boolean(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+});
+
+const UpdateClassificationBodySchema = z.object({
+  category: z.enum(["email", "phone", "ssn", "credit_card", "name", "ip_address", "date_of_birth", "address", "passport", "driver_license", "other"]).optional().openapi({
+    description: "Override PII category",
+    example: "email",
+  }),
+  maskingStrategy: z.enum(["full", "partial", "hash", "redact"]).optional().openapi({
+    description: "Masking strategy for this column",
+    example: "partial",
+  }),
+  dismissed: z.boolean().optional().openapi({
+    description: "Dismiss as false positive",
+    example: false,
+  }),
+  reviewed: z.boolean().optional().openapi({
+    description: "Mark as reviewed",
+    example: true,
+  }),
+});
+
+// ── Route definitions ───────────────────────────────────────────
+
+const listRoute = createRoute({
+  method: "get",
+  path: "/classifications",
+  tags: ["Admin — Compliance"],
+  summary: "List PII column classifications",
+  request: {
+    query: z.object({
+      connectionId: z.string().optional().openapi({ description: "Filter by connection ID" }),
+    }),
+  },
+  responses: {
+    200: { description: "PII classifications", content: { "application/json": { schema: z.object({ classifications: z.array(PIIClassificationSchema) }) } } },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const updateRoute = createRoute({
+  method: "put",
+  path: "/classifications/:id",
+  tags: ["Admin — Compliance"],
+  summary: "Update a PII classification",
+  request: {
+    body: { required: true, content: { "application/json": { schema: UpdateClassificationBodySchema } } },
+  },
+  responses: {
+    200: { description: "Updated classification", content: { "application/json": { schema: z.object({ classification: PIIClassificationSchema }) } } },
+    400: { description: "Invalid input or no active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Not found", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const deleteRoute = createRoute({
+  method: "delete",
+  path: "/classifications/:id",
+  tags: ["Admin — Compliance"],
+  summary: "Delete a PII classification",
+  responses: {
+    200: { description: "Deleted", content: { "application/json": { schema: DeletedResponseSchema } } },
+    400: { description: "No active organization", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Not found", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+// ── Router ──────────────────────────────────────────────────────
+
+export const adminCompliance = createAdminRouter();
+
+adminCompliance.use(requireOrgContext());
+
+// GET /classifications
+adminCompliance.openapi(listRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const { connectionId } = c.req.valid("query");
+
+    const classifications = yield* Effect.promise(() => listPIIClassifications(orgId!, connectionId));
+    return c.json({ classifications }, 200);
+  }), { label: "list PII classifications", domainErrors: [[ComplianceError, COMPLIANCE_ERROR_STATUS], [ReportError, REPORT_ERROR_STATUS]] });
+});
+
+// PUT /classifications/:id
+adminCompliance.openapi(updateRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const id = c.req.param("id");
+    const body = c.req.valid("json");
+
+    const updated = yield* Effect.promise(() => updatePIIClassification(orgId!, id, {
+      category: body.category as PIICategory | undefined,
+      maskingStrategy: body.maskingStrategy as MaskingStrategy | undefined,
+      dismissed: body.dismissed,
+      reviewed: body.reviewed,
+    }));
+    invalidateClassificationCache(orgId!);
+    return c.json({ classification: updated }, 200);
+  }), { label: "update PII classification", domainErrors: [[ComplianceError, COMPLIANCE_ERROR_STATUS], [ReportError, REPORT_ERROR_STATUS]] });
+});
+
+// DELETE /classifications/:id
+adminCompliance.openapi(deleteRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const id = c.req.param("id");
+
+    yield* Effect.promise(() => deletePIIClassification(orgId!, id));
+    invalidateClassificationCache(orgId!);
+    return c.json({ deleted: true }, 200);
+  }), { label: "delete PII classification", domainErrors: [[ComplianceError, COMPLIANCE_ERROR_STATUS], [ReportError, REPORT_ERROR_STATUS]] });
+});
+
+// ── Report schemas ──────────────────────────────────────────────
+
+const ReportQuerySchema = z.object({
+  startDate: z.string().openapi({ description: "Start date (ISO 8601)", example: "2026-01-01" }),
+  endDate: z.string().openapi({ description: "End date (ISO 8601)", example: "2026-03-01" }),
+  userId: z.string().optional().openapi({ description: "Filter by user ID" }),
+  role: z.string().optional().openapi({ description: "Filter by role" }),
+  table: z.string().optional().openapi({ description: "Filter by table name" }),
+  format: z.enum(["json", "csv"]).optional().default("json").openapi({ description: "Response format", example: "json" }),
+});
+
+const DataAccessRowSchema = z.object({
+  tableName: z.string(),
+  userId: z.string(),
+  userEmail: z.string().nullable(),
+  userRole: z.string().nullable(),
+  queryCount: z.number(),
+  uniqueColumns: z.array(z.string()),
+  hasPII: z.boolean(),
+  firstAccess: z.string(),
+  lastAccess: z.string(),
+});
+
+const DataAccessReportSchema = z.object({
+  rows: z.array(DataAccessRowSchema),
+  summary: z.object({
+    totalQueries: z.number(),
+    uniqueUsers: z.number(),
+    uniqueTables: z.number(),
+    piiTablesAccessed: z.number(),
+  }),
+  filters: z.object({
+    startDate: z.string(),
+    endDate: z.string(),
+    userId: z.string().optional(),
+    role: z.string().optional(),
+    table: z.string().optional(),
+  }),
+  generatedAt: z.string(),
+});
+
+const UserActivityRowSchema = z.object({
+  userId: z.string(),
+  userEmail: z.string().nullable(),
+  role: z.string().nullable(),
+  totalQueries: z.number(),
+  tablesAccessed: z.array(z.string()),
+  lastActiveAt: z.string().nullable(),
+  lastLoginAt: z.string().nullable(),
+});
+
+const UserActivityReportSchema = z.object({
+  rows: z.array(UserActivityRowSchema),
+  summary: z.object({
+    totalUsers: z.number(),
+    activeUsers: z.number(),
+    totalQueries: z.number(),
+  }),
+  filters: z.object({
+    startDate: z.string(),
+    endDate: z.string(),
+    userId: z.string().optional(),
+    role: z.string().optional(),
+    table: z.string().optional(),
+  }),
+  generatedAt: z.string(),
+});
+
+// ── Report route definitions ────────────────────────────────────
+
+const dataAccessReportRoute = createRoute({
+  method: "get",
+  path: "/reports/data-access",
+  tags: ["Admin — Compliance"],
+  summary: "Generate data access compliance report",
+  description: "Returns a report of who queried what tables, when, and how often within the specified date range.",
+  request: { query: ReportQuerySchema },
+  responses: {
+    200: { description: "Data access report", content: { "application/json": { schema: DataAccessReportSchema } } },
+    400: { description: "Invalid parameters", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+const userActivityReportRoute = createRoute({
+  method: "get",
+  path: "/reports/user-activity",
+  tags: ["Admin — Compliance"],
+  summary: "Generate user activity compliance report",
+  description: "Returns a report of user query activity, last login timestamp, and role information within the specified date range.",
+  request: { query: ReportQuerySchema },
+  responses: {
+    200: { description: "User activity report", content: { "application/json": { schema: UserActivityReportSchema } } },
+    400: { description: "Invalid parameters", content: { "application/json": { schema: ErrorSchema } } },
+    401: { description: "Authentication required", content: { "application/json": { schema: AuthErrorSchema } } },
+    403: { description: "Forbidden — admin role or enterprise license required", content: { "application/json": { schema: AuthErrorSchema } } },
+    404: { description: "Internal database not configured", content: { "application/json": { schema: ErrorSchema } } },
+    500: { description: "Internal server error", content: { "application/json": { schema: ErrorSchema } } },
+  },
+});
+
+// ── Report handlers ─────────────────────────────────────────────
+
+// GET /reports/data-access
+adminCompliance.openapi(dataAccessReportRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const query = c.req.valid("query");
+
+    const report = yield* Effect.promise(() => generateDataAccessReport(orgId!, {
+      startDate: query.startDate,
+      endDate: query.endDate,
+      userId: query.userId,
+      role: query.role,
+      table: query.table,
+    }));
+
+    if (query.format === "csv") {
+      const csv = dataAccessReportToCSV(report);
+      const safeOrgId = orgId!.replace(/[^a-zA-Z0-9_-]/g, "");
+      const filename = `data-access-report-${safeOrgId}-${new Date().toISOString().slice(0, 10)}.csv`;
+      // CSV responses bypass OpenAPI typed returns via HTTPException + res
+      throw new HTTPException(200, {
+        res: new Response(csv, {
+          status: 200,
+          headers: {
+            "Content-Type": "text/csv; charset=utf-8",
+            "Content-Disposition": `attachment; filename="${filename}"`,
+          },
+        }),
+      });
+    }
+
+    return c.json(report, 200);
+  }), { label: "generate data access report", domainErrors: [[ComplianceError, COMPLIANCE_ERROR_STATUS], [ReportError, REPORT_ERROR_STATUS]] });
+});
+
+// GET /reports/user-activity
+adminCompliance.openapi(userActivityReportRoute, async (c) => {
+  return runEffect(c, Effect.gen(function* () {
+    const { orgId } = yield* AuthContext;
+    const query = c.req.valid("query");
+
+    const report = yield* Effect.promise(() => generateUserActivityReport(orgId!, {
+      startDate: query.startDate,
+      endDate: query.endDate,
+      userId: query.userId,
+      role: query.role,
+      table: query.table,
+    }));
+
+    if (query.format === "csv") {
+      const csv = userActivityReportToCSV(report);
+      const safeOrgId = orgId!.replace(/[^a-zA-Z0-9_-]/g, "");
+      const filename = `user-activity-report-${safeOrgId}-${new Date().toISOString().slice(0, 10)}.csv`;
+      // CSV responses bypass OpenAPI typed returns via HTTPException + res
+      throw new HTTPException(200, {
+        res: new Response(csv, {
+          status: 200,
+          headers: {
+            "Content-Type": "text/csv; charset=utf-8",
+            "Content-Disposition": `attachment; filename="${filename}"`,
+          },
+        }),
+      });
+    }
+
+    return c.json(report, 200);
+  }), { label: "generate user activity report", domainErrors: [[ComplianceError, COMPLIANCE_ERROR_STATUS], [ReportError, REPORT_ERROR_STATUS]] });
+});