@varshylinc/team-management 0.1.0 → 0.2.0

package/tests/unit/role-permissions.test.ts

@@ -1,236 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { roleAtLeast } from '../../src/server/types.js';
-import type { OrgRole } from '../../src/server/types.js';
-
-// ---------------------------------------------------------------------------
-// Permission matrix from spec
-//
-// ACTION                              | OWNER | ADMIN | MEMBER | VIEWER
-// ------------------------------------|-------|-------|--------|--------
-// View org info                       | ✓     | ✓     | ✓      | ✓
-// List members                        | ✓     | ✓     | ✓      | ✓
-// View audit log                      | ✓     | ✓     | ✗      | ✗
-// Edit org settings (name/slug)       | ✓     | ✓     | ✗      | ✗
-// Invite member                       | ✓     | ✓     | ✗      | ✗
-// Revoke pending invite               | ✓     | ✓     | ✗      | ✗
-// Change member role (not owner)      | ✓     | ✓     | ✗      | ✗
-// Change another admin's role         | ✓     | ✗     | ✗      | ✗
-// Remove member (not owner)           | ✓     | ✓     | ✗      | ✗
-// Remove an admin                     | ✓     | ✗     | ✗      | ✗
-// Initiate ownership transfer         | ✓     | ✗     | ✗      | ✗
-// Delete org                          | ✓     | ✗     | ✗      | ✗
-// Change own email                    | ✓     | ✓     | ✓      | ✓
-// Reset own password                  | ✓     | ✓     | ✓      | ✓
-// ---------------------------------------------------------------------------
-
-const ALL_ROLES: OrgRole[] = ['owner', 'admin', 'member', 'viewer'];
-
-// Helper: given a minimum role, returns whether each role in ALL_ROLES can perform the action.
-function canDo(minRole: OrgRole): Record<OrgRole, boolean> {
-  return {
-    owner: roleAtLeast('owner', minRole),
-    admin: roleAtLeast('admin', minRole),
-    member: roleAtLeast('member', minRole),
-    viewer: roleAtLeast('viewer', minRole),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// View org info — minimum role: viewer (all roles allowed)
-// ---------------------------------------------------------------------------
-describe('View org info', () => {
-  const perms = canDo('viewer');
-
-  it('owner can view org info', () => expect(perms.owner).toBe(true));
-  it('admin can view org info', () => expect(perms.admin).toBe(true));
-  it('member can view org info', () => expect(perms.member).toBe(true));
-  it('viewer can view org info', () => expect(perms.viewer).toBe(true));
-});
-
-// ---------------------------------------------------------------------------
-// List members — minimum role: viewer (all roles allowed)
-// ---------------------------------------------------------------------------
-describe('List members', () => {
-  const perms = canDo('viewer');
-
-  it('owner can list members', () => expect(perms.owner).toBe(true));
-  it('admin can list members', () => expect(perms.admin).toBe(true));
-  it('member can list members', () => expect(perms.member).toBe(true));
-  it('viewer can list members', () => expect(perms.viewer).toBe(true));
-});
-
-// ---------------------------------------------------------------------------
-// View audit log — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('View audit log', () => {
-  const perms = canDo('admin');
-
-  it('owner can view audit log', () => expect(perms.owner).toBe(true));
-  it('admin can view audit log', () => expect(perms.admin).toBe(true));
-  it('member cannot view audit log', () => expect(perms.member).toBe(false));
-  it('viewer cannot view audit log', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Edit org settings (name/slug) — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('Edit org settings (name/slug)', () => {
-  const perms = canDo('admin');
-
-  it('owner can edit org settings', () => expect(perms.owner).toBe(true));
-  it('admin can edit org settings', () => expect(perms.admin).toBe(true));
-  it('member cannot edit org settings', () => expect(perms.member).toBe(false));
-  it('viewer cannot edit org settings', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Invite member — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('Invite member', () => {
-  const perms = canDo('admin');
-
-  it('owner can invite member', () => expect(perms.owner).toBe(true));
-  it('admin can invite member', () => expect(perms.admin).toBe(true));
-  it('member cannot invite member', () => expect(perms.member).toBe(false));
-  it('viewer cannot invite member', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Revoke pending invite — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('Revoke pending invite', () => {
-  const perms = canDo('admin');
-
-  it('owner can revoke pending invite', () => expect(perms.owner).toBe(true));
-  it('admin can revoke pending invite', () => expect(perms.admin).toBe(true));
-  it('member cannot revoke pending invite', () => expect(perms.member).toBe(false));
-  it('viewer cannot revoke pending invite', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Change member role (not owner) — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('Change member role (not owner)', () => {
-  const perms = canDo('admin');
-
-  it('owner can change member role', () => expect(perms.owner).toBe(true));
-  it('admin can change member role', () => expect(perms.admin).toBe(true));
-  it('member cannot change member role', () => expect(perms.member).toBe(false));
-  it('viewer cannot change member role', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Change another admin's role — minimum role: owner
-// ---------------------------------------------------------------------------
-describe("Change another admin's role", () => {
-  const perms = canDo('owner');
-
-  it("owner can change another admin's role", () => expect(perms.owner).toBe(true));
-  it("admin cannot change another admin's role", () => expect(perms.admin).toBe(false));
-  it("member cannot change another admin's role", () => expect(perms.member).toBe(false));
-  it("viewer cannot change another admin's role", () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Remove member (not owner) — minimum role: admin
-// ---------------------------------------------------------------------------
-describe('Remove member (not owner)', () => {
-  const perms = canDo('admin');
-
-  it('owner can remove member', () => expect(perms.owner).toBe(true));
-  it('admin can remove member', () => expect(perms.admin).toBe(true));
-  it('member cannot remove member', () => expect(perms.member).toBe(false));
-  it('viewer cannot remove member', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Remove an admin — minimum role: owner
-// ---------------------------------------------------------------------------
-describe('Remove an admin', () => {
-  const perms = canDo('owner');
-
-  it('owner can remove an admin', () => expect(perms.owner).toBe(true));
-  it('admin cannot remove an admin', () => expect(perms.admin).toBe(false));
-  it('member cannot remove an admin', () => expect(perms.member).toBe(false));
-  it('viewer cannot remove an admin', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Initiate ownership transfer — minimum role: owner
-// ---------------------------------------------------------------------------
-describe('Initiate ownership transfer', () => {
-  const perms = canDo('owner');
-
-  it('owner can initiate ownership transfer', () => expect(perms.owner).toBe(true));
-  it('admin cannot initiate ownership transfer', () => expect(perms.admin).toBe(false));
-  it('member cannot initiate ownership transfer', () => expect(perms.member).toBe(false));
-  it('viewer cannot initiate ownership transfer', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Delete org — minimum role: owner
-// ---------------------------------------------------------------------------
-describe('Delete org', () => {
-  const perms = canDo('owner');
-
-  it('owner can delete org', () => expect(perms.owner).toBe(true));
-  it('admin cannot delete org', () => expect(perms.admin).toBe(false));
-  it('member cannot delete org', () => expect(perms.member).toBe(false));
-  it('viewer cannot delete org', () => expect(perms.viewer).toBe(false));
-});
-
-// ---------------------------------------------------------------------------
-// Change own email — minimum role: viewer (all roles allowed)
-// ---------------------------------------------------------------------------
-describe('Change own email', () => {
-  const perms = canDo('viewer');
-
-  it('owner can change own email', () => expect(perms.owner).toBe(true));
-  it('admin can change own email', () => expect(perms.admin).toBe(true));
-  it('member can change own email', () => expect(perms.member).toBe(true));
-  it('viewer can change own email', () => expect(perms.viewer).toBe(true));
-});
-
-// ---------------------------------------------------------------------------
-// Reset own password — minimum role: viewer (all roles allowed)
-// ---------------------------------------------------------------------------
-describe('Reset own password', () => {
-  const perms = canDo('viewer');
-
-  it('owner can reset own password', () => expect(perms.owner).toBe(true));
-  it('admin can reset own password', () => expect(perms.admin).toBe(true));
-  it('member can reset own password', () => expect(perms.member).toBe(true));
-  it('viewer can reset own password', () => expect(perms.viewer).toBe(true));
-});
-
-// ---------------------------------------------------------------------------
-// Cross-cutting: exhaustive matrix spot-checks
-// ---------------------------------------------------------------------------
-describe('Full permission matrix — exhaustive spot-checks', () => {
-  it('owner has highest privilege (passes all checks)', () => {
-    for (const role of ALL_ROLES) {
-      expect(roleAtLeast('owner', role)).toBe(true);
-    }
-  });
-
-  it('viewer has lowest privilege (only passes viewer check)', () => {
-    expect(roleAtLeast('viewer', 'viewer')).toBe(true);
-    expect(roleAtLeast('viewer', 'member')).toBe(false);
-    expect(roleAtLeast('viewer', 'admin')).toBe(false);
-    expect(roleAtLeast('viewer', 'owner')).toBe(false);
-  });
-
-  it('admin passes admin and below, fails owner', () => {
-    expect(roleAtLeast('admin', 'viewer')).toBe(true);
-    expect(roleAtLeast('admin', 'member')).toBe(true);
-    expect(roleAtLeast('admin', 'admin')).toBe(true);
-    expect(roleAtLeast('admin', 'owner')).toBe(false);
-  });
-
-  it('member passes member and viewer, fails admin and owner', () => {
-    expect(roleAtLeast('member', 'viewer')).toBe(true);
-    expect(roleAtLeast('member', 'member')).toBe(true);
-    expect(roleAtLeast('member', 'admin')).toBe(false);
-    expect(roleAtLeast('member', 'owner')).toBe(false);
-  });
-});

package/tests/unit/validation.test.ts

@@ -1,304 +0,0 @@
-import { describe, it, expect } from 'vitest';
-
-// ---------------------------------------------------------------------------
-// Pure validation functions — no src imports needed.
-// These mirror the validation logic that the package enforces.
-// ---------------------------------------------------------------------------
-
-// Slug: lowercase alphanumeric + hyphens, 3-50 chars, no leading/trailing hyphens.
-function isValidSlug(slug: string): boolean {
-  if (slug.length < 3 || slug.length > 50) return false;
-  // Must start and end with alphanumeric, inner chars can include hyphens.
-  return /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]{1}$/.test(slug) && slug.length >= 3;
-}
-
-// Email: basic RFC-ish check — local@domain.tld
-function isValidEmail(email: string): boolean {
-  if (!email) return false;
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
-}
-
-// OrgRole: exactly one of the four valid roles.
-function isValidOrgRole(role: string): boolean {
-  return ['owner', 'admin', 'member', 'viewer'].includes(role);
-}
-
-// Token: hex string, exactly 64 characters.
-function isValidToken(token: string): boolean {
-  return /^[0-9a-f]{64}$/.test(token);
-}
-
-// ---------------------------------------------------------------------------
-// Slug validation
-// ---------------------------------------------------------------------------
-describe('Slug validation', () => {
-  describe('valid slugs', () => {
-    it('"demo-co" is valid', () => {
-      expect(isValidSlug('demo-co')).toBe(true);
-    });
-
-    it('"acme" is valid', () => {
-      expect(isValidSlug('acme')).toBe(true);
-    });
-
-    it('"my-org-123" is valid', () => {
-      expect(isValidSlug('my-org-123')).toBe(true);
-    });
-
-    it('exactly 3 chars "abc" is valid (lower boundary)', () => {
-      expect(isValidSlug('abc')).toBe(true);
-    });
-
-    it('exactly 50 chars is valid (upper boundary)', () => {
-      const slug = 'a' + 'b'.repeat(48) + 'c'; // 50 chars
-      expect(slug.length).toBe(50);
-      expect(isValidSlug(slug)).toBe(true);
-    });
-
-    it('alphanumeric with numbers "org123" is valid', () => {
-      expect(isValidSlug('org123')).toBe(true);
-    });
-
-    it('multiple hyphens in middle "my-big-org-2024" is valid', () => {
-      expect(isValidSlug('my-big-org-2024')).toBe(true);
-    });
-  });
-
-  describe('invalid slugs', () => {
-    it('empty string is invalid', () => {
-      expect(isValidSlug('')).toBe(false);
-    });
-
-    it('single char "a" is invalid (too short)', () => {
-      expect(isValidSlug('a')).toBe(false);
-    });
-
-    it('two chars "ab" is invalid (too short)', () => {
-      expect(isValidSlug('ab')).toBe(false);
-    });
-
-    it('leading hyphen "-start" is invalid', () => {
-      expect(isValidSlug('-start')).toBe(false);
-    });
-
-    it('trailing hyphen "end-" is invalid', () => {
-      expect(isValidSlug('end-')).toBe(false);
-    });
-
-    it('spaces "with spaces" is invalid', () => {
-      expect(isValidSlug('with spaces')).toBe(false);
-    });
-
-    it('51 chars is invalid (too long)', () => {
-      const slug = 'a'.repeat(51);
-      expect(slug.length).toBe(51);
-      expect(isValidSlug(slug)).toBe(false);
-    });
-
-    it('uppercase letters "MyOrg" is invalid', () => {
-      expect(isValidSlug('MyOrg')).toBe(false);
-    });
-
-    it('underscores "my_org" are invalid', () => {
-      expect(isValidSlug('my_org')).toBe(false);
-    });
-
-    it('special chars "org@co" are invalid', () => {
-      expect(isValidSlug('org@co')).toBe(false);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Email validation
-// ---------------------------------------------------------------------------
-describe('Email validation', () => {
-  describe('valid emails', () => {
-    it('"user@example.com" is valid', () => {
-      expect(isValidEmail('user@example.com')).toBe(true);
-    });
-
-    it('"a+b@x.co" is valid', () => {
-      expect(isValidEmail('a+b@x.co')).toBe(true);
-    });
-
-    it('"firstname.lastname@domain.org" is valid', () => {
-      expect(isValidEmail('firstname.lastname@domain.org')).toBe(true);
-    });
-
-    it('"user123@sub.domain.com" is valid', () => {
-      expect(isValidEmail('user123@sub.domain.com')).toBe(true);
-    });
-  });
-
-  describe('invalid emails', () => {
-    it('"notanemail" is invalid (no @ or domain)', () => {
-      expect(isValidEmail('notanemail')).toBe(false);
-    });
-
-    it('"@domain.com" is invalid (no local part)', () => {
-      expect(isValidEmail('@domain.com')).toBe(false);
-    });
-
-    it('"user@" is invalid (no domain)', () => {
-      expect(isValidEmail('user@')).toBe(false);
-    });
-
-    it('empty string is invalid', () => {
-      expect(isValidEmail('')).toBe(false);
-    });
-
-    it('"user@domain" is invalid (no TLD)', () => {
-      expect(isValidEmail('user@domain')).toBe(false);
-    });
-
-    it('"user @example.com" is invalid (space in local part)', () => {
-      expect(isValidEmail('user @example.com')).toBe(false);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// OrgRole enum validation
-// ---------------------------------------------------------------------------
-describe('OrgRole validation', () => {
-  describe('valid roles', () => {
-    it('"owner" is valid', () => {
-      expect(isValidOrgRole('owner')).toBe(true);
-    });
-
-    it('"admin" is valid', () => {
-      expect(isValidOrgRole('admin')).toBe(true);
-    });
-
-    it('"member" is valid', () => {
-      expect(isValidOrgRole('member')).toBe(true);
-    });
-
-    it('"viewer" is valid', () => {
-      expect(isValidOrgRole('viewer')).toBe(true);
-    });
-  });
-
-  describe('invalid roles', () => {
-    it('"superadmin" is invalid', () => {
-      expect(isValidOrgRole('superadmin')).toBe(false);
-    });
-
-    it('"Owner" is invalid (case-sensitive)', () => {
-      expect(isValidOrgRole('Owner')).toBe(false);
-    });
-
-    it('"ADMIN" is invalid (uppercase)', () => {
-      expect(isValidOrgRole('ADMIN')).toBe(false);
-    });
-
-    it('empty string is invalid', () => {
-      expect(isValidOrgRole('')).toBe(false);
-    });
-
-    it('"moderator" is invalid', () => {
-      expect(isValidOrgRole('moderator')).toBe(false);
-    });
-
-    it('"guest" is invalid', () => {
-      expect(isValidOrgRole('guest')).toBe(false);
-    });
-
-    it('"MEMBER" is invalid (uppercase)', () => {
-      expect(isValidOrgRole('MEMBER')).toBe(false);
-    });
-
-    it('"Viewer" is invalid (mixed case)', () => {
-      expect(isValidOrgRole('Viewer')).toBe(false);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Token format validation (hex, exactly 64 chars)
-// ---------------------------------------------------------------------------
-describe('Token format validation', () => {
-  describe('valid tokens', () => {
-    it('"a".repeat(64) is valid', () => {
-      const token = 'a'.repeat(64);
-      expect(token.length).toBe(64);
-      expect(isValidToken(token)).toBe(true);
-    });
-
-    it('"abc123".repeat(10) + "ab" (64 hex chars) is valid', () => {
-      // "abc123" * 10 = 60 chars + "ab" = 62? Let's compute correctly:
-      // "abc123".repeat(10) = 60 chars, need 4 more: "abcd" => 64 total
-      const token = 'abc123'.repeat(10) + 'abcd';
-      expect(token.length).toBe(64);
-      // all chars in 'abc123abcd' are hex (a,b,c,d,1,2,3)
-      expect(isValidToken(token)).toBe(true);
-    });
-
-    it('all-zeros token "0".repeat(64) is valid', () => {
-      const token = '0'.repeat(64);
-      expect(isValidToken(token)).toBe(true);
-    });
-
-    it('all-f token "f".repeat(64) is valid', () => {
-      const token = 'f'.repeat(64);
-      expect(isValidToken(token)).toBe(true);
-    });
-
-    it('mixed hex chars covering 0-9 and a-f is valid', () => {
-      // 64 chars using full hex alphabet
-      const token = '0123456789abcdef'.repeat(4);
-      expect(token.length).toBe(64);
-      expect(isValidToken(token)).toBe(true);
-    });
-  });
-
-  describe('invalid tokens', () => {
-    it('"short" is invalid (too few chars)', () => {
-      expect(isValidToken('short')).toBe(false);
-    });
-
-    it('"z".repeat(64) is invalid ("z" is not a hex digit)', () => {
-      const token = 'z'.repeat(64);
-      expect(token.length).toBe(64);
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('empty string is invalid', () => {
-      expect(isValidToken('')).toBe(false);
-    });
-
-    it('63 hex chars is invalid (one too short)', () => {
-      const token = 'a'.repeat(63);
-      expect(token.length).toBe(63);
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('65 hex chars is invalid (one too long)', () => {
-      const token = 'a'.repeat(65);
-      expect(token.length).toBe(65);
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('uppercase hex "A".repeat(64) is invalid (must be lowercase)', () => {
-      const token = 'A'.repeat(64);
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('token with hyphens is invalid', () => {
-      // UUID-style, 32 hex + 4 hyphens = not valid token
-      const token = 'a'.repeat(28) + '-' + 'b'.repeat(27) + '-' + 'cc';
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('token with spaces is invalid', () => {
-      const token = 'a'.repeat(32) + ' ' + 'b'.repeat(31);
-      expect(isValidToken(token)).toBe(false);
-    });
-
-    it('"g".repeat(64) is invalid ("g" is not hex)', () => {
-      const token = 'g'.repeat(64);
-      expect(isValidToken(token)).toBe(false);
-    });
-  });
-});

package/tsconfig.client.json

@@ -1,13 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "target": "ES2020",
-    "lib": ["ES2020", "DOM", "DOM.Iterable"],
-    "module": "ESNext",
-    "moduleResolution": "Bundler",
-    "jsx": "react-jsx",
-    "noEmit": true
-  },
-  "include": ["src/client/**/*", "src/shared/**/*"],
-  "exclude": ["node_modules", "dist"]
-}

package/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true,
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext"
-  },
-  "include": ["src/server/**/*", "src/shared/**/*", "src/index.ts"],
-  "exclude": ["node_modules", "dist", "tests", "src/client"]
-}