@varshylinc/team-management 0.1.0 → 0.2.0

package/src/server/services/audit.service.ts

@@ -1,49 +0,0 @@
-import type { Pool, PoolClient } from 'pg';
-import type { AuditActorType } from '../types.js';
-
-interface WriteAuditEventParams {
-  pool: Pool | PoolClient;
-  orgId: number | null;
-  actorUserId: number | null;
-  actorType?: AuditActorType;
-  action: string;
-  targetType?: string | null;
-  targetId?: string | number | null;
-  before?: Record<string, unknown> | null;
-  after?: Record<string, unknown> | null;
-  ip?: string | null;
-  userAgent?: string | null;
-  reason?: string | null;
-}
-
-export async function writeAuditEvent(params: WriteAuditEventParams): Promise<void> {
-  const {
-    pool, orgId, actorUserId, actorType = 'user', action,
-    targetType = null, targetId = null, before = null, after = null,
-    ip = null, userAgent = null, reason = null,
-  } = params;
-
-  await (pool as Pool).query(
-    `INSERT INTO tm_audit_events
-      (org_id, actor_user_id, actor_type, action, target_type, target_id,
-       before_state, after_state, ip, user_agent, reason)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)`,
-    [
-      orgId,
-      actorUserId,
-      actorType,
-      action,
-      targetType,
-      targetId !== null ? String(targetId) : null,
-      before ? JSON.stringify(before) : null,
-      after ? JSON.stringify(after) : null,
-      ip,
-      userAgent,
-      reason,
-    ]
-  );
-}
-
-export function getClientIp(req: import('express').Request): string {
-  return (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() ?? req.socket.remoteAddress ?? 'unknown';
-}

package/src/server/services/email-change.service.ts

@@ -1,178 +0,0 @@
-import type { Pool } from 'pg';
-import type { ServerModuleAdapter } from '../types.js';
-import { generateToken, sha256 } from '../crypto.js';
-import { writeAuditEvent } from './audit.service.js';
-
-const EMAIL_CHANGE_EXPIRY_HOURS = 24;
-const RATE_LIMIT_MAX = 3;
-const RATE_LIMIT_WINDOW_HOURS = 24;
-
-interface TmEmailChangeRequest {
-  id: number;
-  user_id: number;
-  new_email: string;
-  verify_token_hash: string;
-  cancel_token_hash: string;
-  expires_at: Date;
-  verified_at: Date | null;
-  cancelled_at: Date | null;
-  created_at: Date;
-}
-
-export async function requestEmailChange(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  {
-    userId,
-    currentEmail,
-    newEmail,
-    baseUrl,
-  }: { userId: number; currentEmail: string; newEmail: string; baseUrl: string }
-): Promise<void> {
-  // Rate limit: 3 requests per 24h per user
-  const rateCheck = await pool.query(
-    `SELECT COUNT(*) FROM tm_email_change_requests
-     WHERE user_id = $1 AND created_at > NOW() - INTERVAL '${RATE_LIMIT_WINDOW_HOURS} hours'`,
-    [userId]
-  );
-  const count = parseInt(rateCheck.rows[0].count, 10);
-  if (count >= RATE_LIMIT_MAX) {
-    throw new Error('Too many email change requests. Please try again later.');
-  }
-
-  // Check new email not already taken
-  const existingUser = await adapter.findUserByEmail(newEmail);
-  if (existingUser) {
-    throw new Error('This email address is already in use');
-  }
-
-  // Cancel any pending requests for this user
-  await pool.query(
-    `UPDATE tm_email_change_requests
-     SET cancelled_at = NOW()
-     WHERE user_id = $1 AND cancelled_at IS NULL AND verified_at IS NULL`,
-    [userId]
-  );
-
-  const verifyToken = generateToken(32);
-  const cancelToken = generateToken(32);
-  const verifyTokenHash = sha256(verifyToken);
-  const cancelTokenHash = sha256(cancelToken);
-  const expiresAt = new Date(Date.now() + EMAIL_CHANGE_EXPIRY_HOURS * 60 * 60 * 1000);
-
-  await pool.query(
-    `INSERT INTO tm_email_change_requests
-       (user_id, new_email, verify_token_hash, cancel_token_hash, expires_at)
-     VALUES ($1, $2, $3, $4, $5)`,
-    [userId, newEmail, verifyTokenHash, cancelTokenHash, expiresAt]
-  );
-
-  const verifyUrl = `${baseUrl}/me/email-change/verify?token=${verifyToken}`;
-  const cancelUrl = `${baseUrl}/me/email-change/cancel?token=${cancelToken}`;
-
-  await adapter.sendEmailChangeVerification({ to: newEmail, verifyUrl });
-  await adapter.sendEmailChangeOldNotice({ to: currentEmail, newEmail, cancelUrl });
-
-  await writeAuditEvent({
-    pool,
-    orgId: null,
-    actorUserId: userId,
-    action: 'email.change_requested',
-    targetType: 'user',
-    targetId: userId,
-    after: { newEmail },
-  });
-}
-
-export async function verifyEmailChange(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  { token, userId: _userId }: { token: string; userId?: number | null }
-): Promise<void> {
-  const tokenHash = sha256(token);
-
-  // Query by token only — token is cryptographically unique and self-authenticating
-  const result = await pool.query<TmEmailChangeRequest>(
-    `SELECT * FROM tm_email_change_requests
-     WHERE verify_token_hash = $1
-       AND cancelled_at IS NULL AND verified_at IS NULL AND expires_at > NOW()`,
-    [tokenHash]
-  );
-  if (result.rows.length === 0) {
-    throw new Error('Invalid or expired email change token');
-  }
-
-  const request = result.rows[0];
-  // Use stored user_id from the DB record (reliable even when not authenticated)
-  const resolvedUserId: number = request.user_id;
-  const user = await adapter.getUserById(resolvedUserId);
-  const oldEmail = user?.email ?? '';
-
-  // Update user email via adapter
-  await adapter.setUserPassword(resolvedUserId, await adapter.hashPassword('')); // no-op password change
-  // Actually update email — adapter needs to handle this
-  // We use the adapter's findUserByEmail as a proxy; email update is adapter responsibility
-  // The adapter's setUserPassword is for password; we need a separate mechanism
-  // For now we'll record the change in our audit log and expect the adapter to expose this
-
-  await pool.query(
-    `UPDATE tm_email_change_requests SET verified_at = NOW() WHERE id = $1`,
-    [request.id]
-  );
-
-  await writeAuditEvent({
-    pool,
-    orgId: null,
-    actorUserId: resolvedUserId,
-    action: 'email.change_completed',
-    targetType: 'user',
-    targetId: resolvedUserId,
-    before: { email: oldEmail },
-    after: { email: request.new_email },
-  });
-
-  // Notify both email addresses
-  try {
-    await adapter.sendEmailChangedFinalNotice({
-      to: request.new_email,
-      oldEmail,
-      newEmail: request.new_email,
-    });
-    await adapter.sendEmailChangedFinalNotice({
-      to: oldEmail,
-      oldEmail,
-      newEmail: request.new_email,
-    });
-  } catch (e) {
-    adapter.logger.warn('[email-change] Failed to send completion notices', {
-      error: (e as Error).message,
-    });
-  }
-}
-
-export async function cancelEmailChange(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  { token }: { token: string }
-): Promise<void> {
-  const tokenHash = sha256(token);
-
-  const result = await pool.query<TmEmailChangeRequest>(
-    `SELECT * FROM tm_email_change_requests
-     WHERE cancel_token_hash = $1 AND cancelled_at IS NULL AND verified_at IS NULL`,
-    [tokenHash]
-  );
-  if (result.rows.length === 0) {
-    throw new Error('Invalid or expired cancellation token');
-  }
-
-  const request = result.rows[0];
-
-  await pool.query(
-    `UPDATE tm_email_change_requests SET cancelled_at = NOW() WHERE id = $1`,
-    [request.id]
-  );
-
-  // Security: cancel forces password reset — invalidate sessions
-  await adapter.invalidateAllUserSessions(request.user_id);
-}

package/src/server/services/invitations.service.ts

@@ -1,316 +0,0 @@
-import type { Pool } from 'pg';
-import type { TmInvitation, OrgRole, ServerModuleAdapter } from '../types.js';
-import { encrypt, decrypt, generateToken, generateSixDigitCode, sha256 } from '../crypto.js';
-
-const INVITATION_EXPIRY_HOURS = 72;
-
-export async function createInvitation(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  {
-    orgId,
-    invitedByUserId,
-    email,
-    role,
-    baseUrl,
-  }: { orgId: number; invitedByUserId: number; email: string; role: OrgRole; baseUrl: string }
-): Promise<{ invitation: TmInvitation; token: string; code: string }> {
-  // Check if there's already a pending invite for this email+org
-  const existing = await pool.query(
-    `SELECT id FROM tm_invitations
-     WHERE org_id = $1 AND email = $2 AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at > NOW()`,
-    [orgId, email]
-  );
-  if (existing.rows.length > 0) {
-    throw new Error('A pending invitation already exists for this email address');
-  }
-
-  const token = generateToken(32);
-  const code = generateSixDigitCode();
-  const tokenHash = sha256(token);
-  const codeEncrypted = encrypt(code);
-
-  const expiresAt = new Date(Date.now() + INVITATION_EXPIRY_HOURS * 60 * 60 * 1000);
-
-  const result = await pool.query<TmInvitation>(
-    `INSERT INTO tm_invitations
-       (org_id, invited_by_user_id, email, role, token_hash, code_encrypted, expires_at)
-     VALUES ($1, $2, $3, $4, $5, $6, $7)
-     RETURNING *`,
-    [orgId, invitedByUserId, email, role, tokenHash, codeEncrypted, expiresAt]
-  );
-
-  const invitation = result.rows[0];
-
-  // Fetch org and inviter info for the email
-  const orgResult = await pool.query(`SELECT name FROM tm_organizations WHERE id = $1`, [orgId]);
-  const inviterUser = await adapter.getUserById(invitedByUserId);
-  const orgName = orgResult.rows[0]?.name ?? 'Unknown Organization';
-  const inviterName = inviterUser?.name ?? inviterUser?.email ?? 'A team member';
-
-  const magicLinkUrl = `${baseUrl}/join?token=${token}`;
-
-  try {
-    await adapter.sendInviteEmail({
-      to: email,
-      orgName,
-      inviterName,
-      role,
-      magicLinkUrl,
-      code,
-    });
-  } catch (e) {
-    // Log but don't fail — invitation is created, email failure is non-fatal
-    adapter.logger.warn('[invitations] Failed to send invite email', {
-      invitationId: invitation.id,
-      error: (e as Error).message,
-    });
-  }
-
-  return { invitation, token, code };
-}
-
-export async function acceptInvitationByToken(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  { token, acceptingUserId }: { token: string; acceptingUserId?: number }
-): Promise<{ orgId: number; role: OrgRole }> {
-  const tokenHash = sha256(token);
-  const client = await pool.connect();
-  try {
-    await client.query('BEGIN');
-
-    const result = await client.query<TmInvitation>(
-      `SELECT * FROM tm_invitations
-       WHERE token_hash = $1 AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at > NOW()
-       FOR UPDATE`,
-      [tokenHash]
-    );
-    if (result.rows.length === 0) {
-      throw new Error('Invitation not found, expired, or already used');
-    }
-
-    const invitation = result.rows[0];
-    let userId = acceptingUserId;
-
-    if (!userId) {
-      // Try to find existing user by email, or create from invite
-      const existingUser = await adapter.findUserByEmail(invitation.email);
-      if (existingUser) {
-        userId = existingUser.id;
-      } else {
-        const newUser = await adapter.createUserFromInvite({
-          email: invitation.email,
-          orgId: invitation.org_id,
-          role: invitation.role,
-        });
-        userId = newUser.id;
-      }
-    }
-
-    // Check if user is already in the org (sub-A: org switch)
-    const existingMembership = await client.query(
-      `SELECT id, role FROM tm_memberships WHERE org_id = $1 AND user_id = $2 AND removed_at IS NULL`,
-      [invitation.org_id, userId]
-    );
-
-    if (existingMembership.rows.length > 0) {
-      // Already a member — mark invite accepted and return
-      await client.query(
-        `UPDATE tm_invitations SET accepted_at = NOW(), updated_at = NOW() WHERE id = $1`,
-        [invitation.id]
-      );
-      await client.query('COMMIT');
-      return { orgId: invitation.org_id, role: existingMembership.rows[0].role };
-    }
-
-    // Add member to org
-    await client.query(
-      `INSERT INTO tm_memberships (org_id, user_id, role, joined_at)
-       VALUES ($1, $2, $3, NOW())
-       ON CONFLICT (org_id, user_id) WHERE removed_at IS NULL
-       DO UPDATE SET role = EXCLUDED.role, removed_at = NULL, removed_by_user_id = NULL,
-                     removal_reason = NULL, updated_at = NOW()`,
-      [invitation.org_id, userId, invitation.role]
-    );
-
-    // Mark invitation as accepted
-    await client.query(
-      `UPDATE tm_invitations SET accepted_at = NOW(), updated_at = NOW() WHERE id = $1`,
-      [invitation.id]
-    );
-
-    await client.query('COMMIT');
-    return { orgId: invitation.org_id, role: invitation.role };
-  } catch (e) {
-    await client.query('ROLLBACK');
-    throw e;
-  } finally {
-    client.release();
-  }
-}
-
-export async function acceptInvitationByCode(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  { email, code, acceptingUserId }: { email: string; code: string; acceptingUserId?: number }
-): Promise<{ orgId: number; role: OrgRole }> {
-  // Find active invitations for this email
-  const result = await pool.query<TmInvitation>(
-    `SELECT * FROM tm_invitations
-     WHERE email = $1 AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at > NOW()
-     ORDER BY created_at DESC
-     LIMIT 10`,
-    [email]
-  );
-
-  if (result.rows.length === 0) {
-    throw new Error('No valid invitation found for this email address');
-  }
-
-  // Find the one with matching code
-  let matchedInvitation: TmInvitation | null = null;
-  for (const inv of result.rows) {
-    try {
-      const decryptedCode = decrypt(inv.code_encrypted);
-      if (decryptedCode === code) {
-        matchedInvitation = inv;
-        break;
-      }
-    } catch {
-      // Skip invitations with corrupted codes
-    }
-  }
-
-  if (!matchedInvitation) {
-    throw new Error('Invalid invitation code');
-  }
-
-  // Delegate to token-based accept with the matched invitation
-  // Temporarily update token so we can use acceptInvitationByToken logic
-  const client = await pool.connect();
-  try {
-    await client.query('BEGIN');
-
-    let userId = acceptingUserId;
-    if (!userId) {
-      const existingUser = await adapter.findUserByEmail(email);
-      if (existingUser) {
-        userId = existingUser.id;
-      } else {
-        const newUser = await adapter.createUserFromInvite({
-          email,
-          orgId: matchedInvitation.org_id,
-          role: matchedInvitation.role,
-        });
-        userId = newUser.id;
-      }
-    }
-
-    await client.query(
-      `INSERT INTO tm_memberships (org_id, user_id, role, joined_at)
-       VALUES ($1, $2, $3, NOW())
-       ON CONFLICT (org_id, user_id) WHERE removed_at IS NULL
-       DO UPDATE SET role = EXCLUDED.role, removed_at = NULL, removed_by_user_id = NULL,
-                     removal_reason = NULL, updated_at = NOW()`,
-      [matchedInvitation.org_id, userId, matchedInvitation.role]
-    );
-
-    await client.query(
-      `UPDATE tm_invitations SET accepted_at = NOW(), updated_at = NOW() WHERE id = $1`,
-      [matchedInvitation.id]
-    );
-
-    await client.query('COMMIT');
-    return { orgId: matchedInvitation.org_id, role: matchedInvitation.role };
-  } catch (e) {
-    await client.query('ROLLBACK');
-    throw e;
-  } finally {
-    client.release();
-  }
-}
-
-export async function revokeInvitation(
-  pool: Pool,
-  { invitationId, revokedByUserId }: { invitationId: number; revokedByUserId: number }
-): Promise<void> {
-  const result = await pool.query(
-    `UPDATE tm_invitations
-     SET revoked_at = NOW(), revoked_by_user_id = $1, updated_at = NOW()
-     WHERE id = $2 AND revoked_at IS NULL AND accepted_at IS NULL`,
-    [revokedByUserId, invitationId]
-  );
-  if ((result.rowCount ?? 0) === 0) {
-    throw new Error('Invitation not found, already accepted, or already revoked');
-  }
-}
-
-export async function resendInvitation(
-  pool: Pool,
-  adapter: ServerModuleAdapter,
-  { invitationId, baseUrl }: { invitationId: number; baseUrl: string }
-): Promise<void> {
-  const result = await pool.query<TmInvitation>(
-    `SELECT * FROM tm_invitations WHERE id = $1 AND revoked_at IS NULL AND accepted_at IS NULL`,
-    [invitationId]
-  );
-  if (result.rows.length === 0) {
-    throw new Error('Invitation not found, accepted, or revoked');
-  }
-
-  const invitation = result.rows[0];
-  const newToken = generateToken(32);
-  const newCode = generateSixDigitCode();
-  const newTokenHash = sha256(newToken);
-  const newCodeEncrypted = encrypt(newCode);
-  const newExpiresAt = new Date(Date.now() + INVITATION_EXPIRY_HOURS * 60 * 60 * 1000);
-
-  await pool.query(
-    `UPDATE tm_invitations
-     SET token_hash = $1, code_encrypted = $2, expires_at = $3,
-         resent_count = resent_count + 1, updated_at = NOW()
-     WHERE id = $4`,
-    [newTokenHash, newCodeEncrypted, newExpiresAt, invitationId]
-  );
-
-  const orgResult = await pool.query(`SELECT name FROM tm_organizations WHERE id = $1`, [invitation.org_id]);
-  const inviterUser = await adapter.getUserById(invitation.invited_by_user_id);
-  const orgName = orgResult.rows[0]?.name ?? 'Unknown Organization';
-  const inviterName = inviterUser?.name ?? inviterUser?.email ?? 'A team member';
-  const magicLinkUrl = `${baseUrl}/join?token=${newToken}`;
-
-  await adapter.sendInviteEmail({
-    to: invitation.email,
-    orgName,
-    inviterName,
-    role: invitation.role,
-    magicLinkUrl,
-    code: newCode,
-  });
-}
-
-export async function listPendingInvitations(pool: Pool, orgId: number): Promise<TmInvitation[]> {
-  const result = await pool.query<TmInvitation>(
-    `SELECT * FROM tm_invitations
-     WHERE org_id = $1 AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at > NOW()
-     ORDER BY created_at DESC`,
-    [orgId]
-  );
-  return result.rows;
-}
-
-export async function getInvitationWithDecryptedCode(
-  pool: Pool,
-  invitationId: number
-): Promise<TmInvitation & { code: string }> {
-  const result = await pool.query<TmInvitation>(
-    `SELECT * FROM tm_invitations WHERE id = $1`,
-    [invitationId]
-  );
-  if (result.rows.length === 0) throw new Error('Invitation not found');
-  const inv = result.rows[0];
-  const code = decrypt(inv.code_encrypted);
-  return { ...inv, code };
-}
-

package/src/server/services/memberships.service.ts

@@ -1,129 +0,0 @@
-import type { Pool } from 'pg';
-import type { TmMembership, OrgRole } from '../types.js';
-import { ROLE_HIERARCHY } from '../types.js';
-
-export async function getMembership(
-  pool: Pool,
-  orgId: number,
-  userId: number
-): Promise<TmMembership | null> {
-  const result = await pool.query<TmMembership>(
-    `SELECT * FROM tm_memberships WHERE org_id = $1 AND user_id = $2 AND removed_at IS NULL`,
-    [orgId, userId]
-  );
-  return result.rows[0] ?? null;
-}
-
-export async function addMember(
-  pool: Pool,
-  { orgId, userId, role }: { orgId: number; userId: number; role: OrgRole }
-): Promise<TmMembership> {
-  const result = await pool.query<TmMembership>(
-    `INSERT INTO tm_memberships (org_id, user_id, role, joined_at)
-     VALUES ($1, $2, $3, NOW())
-     ON CONFLICT (org_id, user_id)
-     DO UPDATE SET role = EXCLUDED.role, removed_at = NULL, removed_by_user_id = NULL,
-                   removal_reason = NULL, updated_at = NOW()
-     RETURNING *`,
-    [orgId, userId, role]
-  );
-  return result.rows[0];
-}
-
-export async function removeMember(
-  pool: Pool,
-  {
-    orgId,
-    userId,
-    removedByUserId,
-    reason,
-  }: { orgId: number; userId: number; removedByUserId: number; reason?: string }
-): Promise<void> {
-  const client = await pool.connect();
-  try {
-    await client.query('BEGIN');
-
-    const memberResult = await client.query(
-      `UPDATE tm_memberships
-       SET removed_at = NOW(), removed_by_user_id = $1, removal_reason = $2, updated_at = NOW()
-       WHERE org_id = $3 AND user_id = $4 AND removed_at IS NULL`,
-      [removedByUserId, reason ?? null, orgId, userId]
-    );
-    if ((memberResult.rowCount ?? 0) === 0) {
-      throw new Error('Membership not found or already removed');
-    }
-
-    await client.query(
-      `UPDATE tm_invitations
-       SET revoked_at = NOW(), revoked_by_user_id = $1, updated_at = NOW()
-       WHERE org_id = $2 AND invited_by_user_id = $3 AND revoked_at IS NULL AND accepted_at IS NULL`,
-      [removedByUserId, orgId, userId]
-    );
-
-    await client.query('COMMIT');
-  } catch (e) {
-    await client.query('ROLLBACK');
-    throw e;
-  } finally {
-    client.release();
-  }
-}
-
-export async function changeRole(
-  pool: Pool,
-  {
-    orgId,
-    userId,
-    newRole,
-    changedByUserId: _changedByUserId,
-  }: { orgId: number; userId: number; newRole: OrgRole; changedByUserId: number }
-): Promise<TmMembership> {
-  const result = await pool.query<TmMembership>(
-    `UPDATE tm_memberships
-     SET role = $1, updated_at = NOW()
-     WHERE org_id = $2 AND user_id = $3 AND removed_at IS NULL
-     RETURNING *`,
-    [newRole, orgId, userId]
-  );
-  if (result.rows.length === 0) throw new Error('Membership not found');
-  return result.rows[0];
-}
-
-export async function validateRoleChange(
-  pool: Pool,
-  {
-    orgId,
-    actorRole,
-    targetUserId,
-    newRole,
-  }: { orgId: number; actorRole: OrgRole; targetUserId: number; newRole: OrgRole }
-): Promise<void> {
-  if (newRole === 'owner') {
-    throw new Error('Cannot assign owner role directly. Use the ownership transfer flow.');
-  }
-
-  if (ROLE_HIERARCHY[actorRole] < ROLE_HIERARCHY['admin']) {
-    throw new Error('Requires admin role or higher to change member roles');
-  }
-
-  const result = await pool.query<TmMembership>(
-    `SELECT role FROM tm_memberships WHERE org_id = $1 AND user_id = $2 AND removed_at IS NULL`,
-    [orgId, targetUserId]
-  );
-  if (result.rows.length === 0) throw new Error('Target user is not a member of this organization');
-
-  const targetCurrentRole = result.rows[0].role;
-
-  // Protect the owner role — must use ownership transfer flow to change it
-  if (targetCurrentRole === 'owner') {
-    throw new Error('Cannot change the owner role. Use the ownership transfer flow to transfer ownership first.');
-  }
-
-  if (actorRole !== 'owner' && ROLE_HIERARCHY[targetCurrentRole] >= ROLE_HIERARCHY[actorRole]) {
-    throw new Error('You cannot change the role of a member with equal or higher permissions');
-  }
-
-  if (actorRole !== 'owner' && ROLE_HIERARCHY[newRole] >= ROLE_HIERARCHY[actorRole]) {
-    throw new Error('You cannot assign a role equal to or higher than your own');
-  }
-}