@varshylinc/team-management 0.1.0

package/tests/unit/role-permissions.test.ts

@@ -0,0 +1,236 @@
+import { describe, it, expect } from 'vitest';
+import { roleAtLeast } from '../../src/server/types.js';
+import type { OrgRole } from '../../src/server/types.js';
+
+// ---------------------------------------------------------------------------
+// Permission matrix from spec
+//
+// ACTION                              | OWNER | ADMIN | MEMBER | VIEWER
+// ------------------------------------|-------|-------|--------|--------
+// View org info                       | ✓     | ✓     | ✓      | ✓
+// List members                        | ✓     | ✓     | ✓      | ✓
+// View audit log                      | ✓     | ✓     | ✗      | ✗
+// Edit org settings (name/slug)       | ✓     | ✓     | ✗      | ✗
+// Invite member                       | ✓     | ✓     | ✗      | ✗
+// Revoke pending invite               | ✓     | ✓     | ✗      | ✗
+// Change member role (not owner)      | ✓     | ✓     | ✗      | ✗
+// Change another admin's role         | ✓     | ✗     | ✗      | ✗
+// Remove member (not owner)           | ✓     | ✓     | ✗      | ✗
+// Remove an admin                     | ✓     | ✗     | ✗      | ✗
+// Initiate ownership transfer         | ✓     | ✗     | ✗      | ✗
+// Delete org                          | ✓     | ✗     | ✗      | ✗
+// Change own email                    | ✓     | ✓     | ✓      | ✓
+// Reset own password                  | ✓     | ✓     | ✓      | ✓
+// ---------------------------------------------------------------------------
+
+const ALL_ROLES: OrgRole[] = ['owner', 'admin', 'member', 'viewer'];
+
+// Helper: given a minimum role, returns whether each role in ALL_ROLES can perform the action.
+function canDo(minRole: OrgRole): Record<OrgRole, boolean> {
+  return {
+    owner: roleAtLeast('owner', minRole),
+    admin: roleAtLeast('admin', minRole),
+    member: roleAtLeast('member', minRole),
+    viewer: roleAtLeast('viewer', minRole),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// View org info — minimum role: viewer (all roles allowed)
+// ---------------------------------------------------------------------------
+describe('View org info', () => {
+  const perms = canDo('viewer');
+
+  it('owner can view org info', () => expect(perms.owner).toBe(true));
+  it('admin can view org info', () => expect(perms.admin).toBe(true));
+  it('member can view org info', () => expect(perms.member).toBe(true));
+  it('viewer can view org info', () => expect(perms.viewer).toBe(true));
+});
+
+// ---------------------------------------------------------------------------
+// List members — minimum role: viewer (all roles allowed)
+// ---------------------------------------------------------------------------
+describe('List members', () => {
+  const perms = canDo('viewer');
+
+  it('owner can list members', () => expect(perms.owner).toBe(true));
+  it('admin can list members', () => expect(perms.admin).toBe(true));
+  it('member can list members', () => expect(perms.member).toBe(true));
+  it('viewer can list members', () => expect(perms.viewer).toBe(true));
+});
+
+// ---------------------------------------------------------------------------
+// View audit log — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('View audit log', () => {
+  const perms = canDo('admin');
+
+  it('owner can view audit log', () => expect(perms.owner).toBe(true));
+  it('admin can view audit log', () => expect(perms.admin).toBe(true));
+  it('member cannot view audit log', () => expect(perms.member).toBe(false));
+  it('viewer cannot view audit log', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Edit org settings (name/slug) — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('Edit org settings (name/slug)', () => {
+  const perms = canDo('admin');
+
+  it('owner can edit org settings', () => expect(perms.owner).toBe(true));
+  it('admin can edit org settings', () => expect(perms.admin).toBe(true));
+  it('member cannot edit org settings', () => expect(perms.member).toBe(false));
+  it('viewer cannot edit org settings', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Invite member — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('Invite member', () => {
+  const perms = canDo('admin');
+
+  it('owner can invite member', () => expect(perms.owner).toBe(true));
+  it('admin can invite member', () => expect(perms.admin).toBe(true));
+  it('member cannot invite member', () => expect(perms.member).toBe(false));
+  it('viewer cannot invite member', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Revoke pending invite — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('Revoke pending invite', () => {
+  const perms = canDo('admin');
+
+  it('owner can revoke pending invite', () => expect(perms.owner).toBe(true));
+  it('admin can revoke pending invite', () => expect(perms.admin).toBe(true));
+  it('member cannot revoke pending invite', () => expect(perms.member).toBe(false));
+  it('viewer cannot revoke pending invite', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Change member role (not owner) — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('Change member role (not owner)', () => {
+  const perms = canDo('admin');
+
+  it('owner can change member role', () => expect(perms.owner).toBe(true));
+  it('admin can change member role', () => expect(perms.admin).toBe(true));
+  it('member cannot change member role', () => expect(perms.member).toBe(false));
+  it('viewer cannot change member role', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Change another admin's role — minimum role: owner
+// ---------------------------------------------------------------------------
+describe("Change another admin's role", () => {
+  const perms = canDo('owner');
+
+  it("owner can change another admin's role", () => expect(perms.owner).toBe(true));
+  it("admin cannot change another admin's role", () => expect(perms.admin).toBe(false));
+  it("member cannot change another admin's role", () => expect(perms.member).toBe(false));
+  it("viewer cannot change another admin's role", () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Remove member (not owner) — minimum role: admin
+// ---------------------------------------------------------------------------
+describe('Remove member (not owner)', () => {
+  const perms = canDo('admin');
+
+  it('owner can remove member', () => expect(perms.owner).toBe(true));
+  it('admin can remove member', () => expect(perms.admin).toBe(true));
+  it('member cannot remove member', () => expect(perms.member).toBe(false));
+  it('viewer cannot remove member', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Remove an admin — minimum role: owner
+// ---------------------------------------------------------------------------
+describe('Remove an admin', () => {
+  const perms = canDo('owner');
+
+  it('owner can remove an admin', () => expect(perms.owner).toBe(true));
+  it('admin cannot remove an admin', () => expect(perms.admin).toBe(false));
+  it('member cannot remove an admin', () => expect(perms.member).toBe(false));
+  it('viewer cannot remove an admin', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Initiate ownership transfer — minimum role: owner
+// ---------------------------------------------------------------------------
+describe('Initiate ownership transfer', () => {
+  const perms = canDo('owner');
+
+  it('owner can initiate ownership transfer', () => expect(perms.owner).toBe(true));
+  it('admin cannot initiate ownership transfer', () => expect(perms.admin).toBe(false));
+  it('member cannot initiate ownership transfer', () => expect(perms.member).toBe(false));
+  it('viewer cannot initiate ownership transfer', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Delete org — minimum role: owner
+// ---------------------------------------------------------------------------
+describe('Delete org', () => {
+  const perms = canDo('owner');
+
+  it('owner can delete org', () => expect(perms.owner).toBe(true));
+  it('admin cannot delete org', () => expect(perms.admin).toBe(false));
+  it('member cannot delete org', () => expect(perms.member).toBe(false));
+  it('viewer cannot delete org', () => expect(perms.viewer).toBe(false));
+});
+
+// ---------------------------------------------------------------------------
+// Change own email — minimum role: viewer (all roles allowed)
+// ---------------------------------------------------------------------------
+describe('Change own email', () => {
+  const perms = canDo('viewer');
+
+  it('owner can change own email', () => expect(perms.owner).toBe(true));
+  it('admin can change own email', () => expect(perms.admin).toBe(true));
+  it('member can change own email', () => expect(perms.member).toBe(true));
+  it('viewer can change own email', () => expect(perms.viewer).toBe(true));
+});
+
+// ---------------------------------------------------------------------------
+// Reset own password — minimum role: viewer (all roles allowed)
+// ---------------------------------------------------------------------------
+describe('Reset own password', () => {
+  const perms = canDo('viewer');
+
+  it('owner can reset own password', () => expect(perms.owner).toBe(true));
+  it('admin can reset own password', () => expect(perms.admin).toBe(true));
+  it('member can reset own password', () => expect(perms.member).toBe(true));
+  it('viewer can reset own password', () => expect(perms.viewer).toBe(true));
+});
+
+// ---------------------------------------------------------------------------
+// Cross-cutting: exhaustive matrix spot-checks
+// ---------------------------------------------------------------------------
+describe('Full permission matrix — exhaustive spot-checks', () => {
+  it('owner has highest privilege (passes all checks)', () => {
+    for (const role of ALL_ROLES) {
+      expect(roleAtLeast('owner', role)).toBe(true);
+    }
+  });
+
+  it('viewer has lowest privilege (only passes viewer check)', () => {
+    expect(roleAtLeast('viewer', 'viewer')).toBe(true);
+    expect(roleAtLeast('viewer', 'member')).toBe(false);
+    expect(roleAtLeast('viewer', 'admin')).toBe(false);
+    expect(roleAtLeast('viewer', 'owner')).toBe(false);
+  });
+
+  it('admin passes admin and below, fails owner', () => {
+    expect(roleAtLeast('admin', 'viewer')).toBe(true);
+    expect(roleAtLeast('admin', 'member')).toBe(true);
+    expect(roleAtLeast('admin', 'admin')).toBe(true);
+    expect(roleAtLeast('admin', 'owner')).toBe(false);
+  });
+
+  it('member passes member and viewer, fails admin and owner', () => {
+    expect(roleAtLeast('member', 'viewer')).toBe(true);
+    expect(roleAtLeast('member', 'member')).toBe(true);
+    expect(roleAtLeast('member', 'admin')).toBe(false);
+    expect(roleAtLeast('member', 'owner')).toBe(false);
+  });
+});

package/tests/unit/validation.test.ts

@@ -0,0 +1,304 @@
+import { describe, it, expect } from 'vitest';
+
+// ---------------------------------------------------------------------------
+// Pure validation functions — no src imports needed.
+// These mirror the validation logic that the package enforces.
+// ---------------------------------------------------------------------------
+
+// Slug: lowercase alphanumeric + hyphens, 3-50 chars, no leading/trailing hyphens.
+function isValidSlug(slug: string): boolean {
+  if (slug.length < 3 || slug.length > 50) return false;
+  // Must start and end with alphanumeric, inner chars can include hyphens.
+  return /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]{1}$/.test(slug) && slug.length >= 3;
+}
+
+// Email: basic RFC-ish check — local@domain.tld
+function isValidEmail(email: string): boolean {
+  if (!email) return false;
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+// OrgRole: exactly one of the four valid roles.
+function isValidOrgRole(role: string): boolean {
+  return ['owner', 'admin', 'member', 'viewer'].includes(role);
+}
+
+// Token: hex string, exactly 64 characters.
+function isValidToken(token: string): boolean {
+  return /^[0-9a-f]{64}$/.test(token);
+}
+
+// ---------------------------------------------------------------------------
+// Slug validation
+// ---------------------------------------------------------------------------
+describe('Slug validation', () => {
+  describe('valid slugs', () => {
+    it('"demo-co" is valid', () => {
+      expect(isValidSlug('demo-co')).toBe(true);
+    });
+
+    it('"acme" is valid', () => {
+      expect(isValidSlug('acme')).toBe(true);
+    });
+
+    it('"my-org-123" is valid', () => {
+      expect(isValidSlug('my-org-123')).toBe(true);
+    });
+
+    it('exactly 3 chars "abc" is valid (lower boundary)', () => {
+      expect(isValidSlug('abc')).toBe(true);
+    });
+
+    it('exactly 50 chars is valid (upper boundary)', () => {
+      const slug = 'a' + 'b'.repeat(48) + 'c'; // 50 chars
+      expect(slug.length).toBe(50);
+      expect(isValidSlug(slug)).toBe(true);
+    });
+
+    it('alphanumeric with numbers "org123" is valid', () => {
+      expect(isValidSlug('org123')).toBe(true);
+    });
+
+    it('multiple hyphens in middle "my-big-org-2024" is valid', () => {
+      expect(isValidSlug('my-big-org-2024')).toBe(true);
+    });
+  });
+
+  describe('invalid slugs', () => {
+    it('empty string is invalid', () => {
+      expect(isValidSlug('')).toBe(false);
+    });
+
+    it('single char "a" is invalid (too short)', () => {
+      expect(isValidSlug('a')).toBe(false);
+    });
+
+    it('two chars "ab" is invalid (too short)', () => {
+      expect(isValidSlug('ab')).toBe(false);
+    });
+
+    it('leading hyphen "-start" is invalid', () => {
+      expect(isValidSlug('-start')).toBe(false);
+    });
+
+    it('trailing hyphen "end-" is invalid', () => {
+      expect(isValidSlug('end-')).toBe(false);
+    });
+
+    it('spaces "with spaces" is invalid', () => {
+      expect(isValidSlug('with spaces')).toBe(false);
+    });
+
+    it('51 chars is invalid (too long)', () => {
+      const slug = 'a'.repeat(51);
+      expect(slug.length).toBe(51);
+      expect(isValidSlug(slug)).toBe(false);
+    });
+
+    it('uppercase letters "MyOrg" is invalid', () => {
+      expect(isValidSlug('MyOrg')).toBe(false);
+    });
+
+    it('underscores "my_org" are invalid', () => {
+      expect(isValidSlug('my_org')).toBe(false);
+    });
+
+    it('special chars "org@co" are invalid', () => {
+      expect(isValidSlug('org@co')).toBe(false);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Email validation
+// ---------------------------------------------------------------------------
+describe('Email validation', () => {
+  describe('valid emails', () => {
+    it('"user@example.com" is valid', () => {
+      expect(isValidEmail('user@example.com')).toBe(true);
+    });
+
+    it('"a+b@x.co" is valid', () => {
+      expect(isValidEmail('a+b@x.co')).toBe(true);
+    });
+
+    it('"firstname.lastname@domain.org" is valid', () => {
+      expect(isValidEmail('firstname.lastname@domain.org')).toBe(true);
+    });
+
+    it('"user123@sub.domain.com" is valid', () => {
+      expect(isValidEmail('user123@sub.domain.com')).toBe(true);
+    });
+  });
+
+  describe('invalid emails', () => {
+    it('"notanemail" is invalid (no @ or domain)', () => {
+      expect(isValidEmail('notanemail')).toBe(false);
+    });
+
+    it('"@domain.com" is invalid (no local part)', () => {
+      expect(isValidEmail('@domain.com')).toBe(false);
+    });
+
+    it('"user@" is invalid (no domain)', () => {
+      expect(isValidEmail('user@')).toBe(false);
+    });
+
+    it('empty string is invalid', () => {
+      expect(isValidEmail('')).toBe(false);
+    });
+
+    it('"user@domain" is invalid (no TLD)', () => {
+      expect(isValidEmail('user@domain')).toBe(false);
+    });
+
+    it('"user @example.com" is invalid (space in local part)', () => {
+      expect(isValidEmail('user @example.com')).toBe(false);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// OrgRole enum validation
+// ---------------------------------------------------------------------------
+describe('OrgRole validation', () => {
+  describe('valid roles', () => {
+    it('"owner" is valid', () => {
+      expect(isValidOrgRole('owner')).toBe(true);
+    });
+
+    it('"admin" is valid', () => {
+      expect(isValidOrgRole('admin')).toBe(true);
+    });
+
+    it('"member" is valid', () => {
+      expect(isValidOrgRole('member')).toBe(true);
+    });
+
+    it('"viewer" is valid', () => {
+      expect(isValidOrgRole('viewer')).toBe(true);
+    });
+  });
+
+  describe('invalid roles', () => {
+    it('"superadmin" is invalid', () => {
+      expect(isValidOrgRole('superadmin')).toBe(false);
+    });
+
+    it('"Owner" is invalid (case-sensitive)', () => {
+      expect(isValidOrgRole('Owner')).toBe(false);
+    });
+
+    it('"ADMIN" is invalid (uppercase)', () => {
+      expect(isValidOrgRole('ADMIN')).toBe(false);
+    });
+
+    it('empty string is invalid', () => {
+      expect(isValidOrgRole('')).toBe(false);
+    });
+
+    it('"moderator" is invalid', () => {
+      expect(isValidOrgRole('moderator')).toBe(false);
+    });
+
+    it('"guest" is invalid', () => {
+      expect(isValidOrgRole('guest')).toBe(false);
+    });
+
+    it('"MEMBER" is invalid (uppercase)', () => {
+      expect(isValidOrgRole('MEMBER')).toBe(false);
+    });
+
+    it('"Viewer" is invalid (mixed case)', () => {
+      expect(isValidOrgRole('Viewer')).toBe(false);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Token format validation (hex, exactly 64 chars)
+// ---------------------------------------------------------------------------
+describe('Token format validation', () => {
+  describe('valid tokens', () => {
+    it('"a".repeat(64) is valid', () => {
+      const token = 'a'.repeat(64);
+      expect(token.length).toBe(64);
+      expect(isValidToken(token)).toBe(true);
+    });
+
+    it('"abc123".repeat(10) + "ab" (64 hex chars) is valid', () => {
+      // "abc123" * 10 = 60 chars + "ab" = 62? Let's compute correctly:
+      // "abc123".repeat(10) = 60 chars, need 4 more: "abcd" => 64 total
+      const token = 'abc123'.repeat(10) + 'abcd';
+      expect(token.length).toBe(64);
+      // all chars in 'abc123abcd' are hex (a,b,c,d,1,2,3)
+      expect(isValidToken(token)).toBe(true);
+    });
+
+    it('all-zeros token "0".repeat(64) is valid', () => {
+      const token = '0'.repeat(64);
+      expect(isValidToken(token)).toBe(true);
+    });
+
+    it('all-f token "f".repeat(64) is valid', () => {
+      const token = 'f'.repeat(64);
+      expect(isValidToken(token)).toBe(true);
+    });
+
+    it('mixed hex chars covering 0-9 and a-f is valid', () => {
+      // 64 chars using full hex alphabet
+      const token = '0123456789abcdef'.repeat(4);
+      expect(token.length).toBe(64);
+      expect(isValidToken(token)).toBe(true);
+    });
+  });
+
+  describe('invalid tokens', () => {
+    it('"short" is invalid (too few chars)', () => {
+      expect(isValidToken('short')).toBe(false);
+    });
+
+    it('"z".repeat(64) is invalid ("z" is not a hex digit)', () => {
+      const token = 'z'.repeat(64);
+      expect(token.length).toBe(64);
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('empty string is invalid', () => {
+      expect(isValidToken('')).toBe(false);
+    });
+
+    it('63 hex chars is invalid (one too short)', () => {
+      const token = 'a'.repeat(63);
+      expect(token.length).toBe(63);
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('65 hex chars is invalid (one too long)', () => {
+      const token = 'a'.repeat(65);
+      expect(token.length).toBe(65);
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('uppercase hex "A".repeat(64) is invalid (must be lowercase)', () => {
+      const token = 'A'.repeat(64);
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('token with hyphens is invalid', () => {
+      // UUID-style, 32 hex + 4 hyphens = not valid token
+      const token = 'a'.repeat(28) + '-' + 'b'.repeat(27) + '-' + 'cc';
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('token with spaces is invalid', () => {
+      const token = 'a'.repeat(32) + ' ' + 'b'.repeat(31);
+      expect(isValidToken(token)).toBe(false);
+    });
+
+    it('"g".repeat(64) is invalid ("g" is not hex)', () => {
+      const token = 'g'.repeat(64);
+      expect(isValidToken(token)).toBe(false);
+    });
+  });
+});

package/tsconfig.client.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "target": "ES2020",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "noEmit": true
+  },
+  "include": ["src/client/**/*", "src/shared/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "composite": true,
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext"
+  },
+  "include": ["src/server/**/*", "src/shared/**/*", "src/index.ts"],
+  "exclude": ["node_modules", "dist", "tests", "src/client"]
+}