@varshylinc/team-management 0.1.0

package/dist/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AA2IA,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAA4B,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAExG,MAAM,UAAU,WAAW,CAAC,QAAiB,EAAE,QAAiB;IAC9D,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC"}

package/dist/shared/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared types used by both server and client sides of team-management.
+ * No Node.js or browser-specific APIs here.
+ */
+/** A team member as returned by the module's public API. */
+export interface TeamMember {
+    id: number;
+    userId: number;
+    organizationId: number;
+    role: 'owner' | 'admin' | 'member';
+    joinedAt: string;
+}
+/** An invite as returned by the module's public API (stub shape). */
+export interface TeamInvite {
+    id: number;
+    organizationId: number;
+    email: string;
+    role: 'admin' | 'member';
+    status: 'pending' | 'accepted' | 'expired';
+    createdAt: string;
+    expiresAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/shared/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/shared/types.js

@@ -0,0 +1,6 @@
+/**
+ * Shared types used by both server and client sides of team-management.
+ * No Node.js or browser-specific APIs here.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/shared/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@varshylinc/team-management",
+  "version": "0.1.0",
+  "description": "Team management shared module for Varshyl products.",
+  "private": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./server": {
+      "import": "./dist/server/index.js",
+      "types": "./dist/server/index.d.ts"
+    },
+    "./client": {
+      "import": "./dist/client/index.js",
+      "types": "./dist/client/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "express": "^4.18.3"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.12.7",
+    "@types/pg": "^8.11.5",
+    "@types/react": "^18.3.1",
+    "@types/react-dom": "^18.3.0",
+    "@types/supertest": "^6.0.2",
+    "@typescript-eslint/eslint-plugin": "^7.8.0",
+    "@typescript-eslint/parser": "^7.8.0",
+    "eslint": "^8.57.0",
+    "pg": "^8.11.5",
+    "react": "^18.3.1",
+    "supertest": "^7.0.0",
+    "typescript": "^5.4.5",
+    "vitest": "^1.5.0"
+  },
+  "peerDependencies": {
+    "express": "^4.18.3",
+    "pg": "^8.11.5"
+  },
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && mkdir -p dist/server/migrations && cp src/server/migrations/*.sql dist/server/migrations/",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json",
+    "test": "vitest run",
+    "lint": "eslint src --ext .ts,.tsx --max-warnings 0"
+  }
+}

package/src/client/api.ts

@@ -0,0 +1,314 @@
+import type {
+  PublicOrg,
+  PublicMember,
+  PendingInvitation,
+  CurrentMembership,
+  OwnershipTransfer,
+  AuditEvent,
+  SuperAdminOrgSummary,
+  OrgRole,
+  ApiError,
+} from './types.js';
+
+export let TM_API_BASE = '/api/team';
+
+export function setTmApiBase(base: string): void {
+  TM_API_BASE = base;
+}
+
+async function fetchTm<T>(
+  path: string,
+  options: RequestInit = {}
+): Promise<T> {
+  const res = await fetch(`${TM_API_BASE}${path}`, {
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...(options.headers ?? {}),
+    },
+  });
+
+  if (res.status === 204) {
+    return undefined as unknown as T;
+  }
+
+  const data = await res.json().catch(() => ({ error: res.statusText }));
+
+  if (!res.ok) {
+    const err = data as ApiError;
+    const msg = err.details ? `${err.error}: ${err.details.join(', ')}` : err.error;
+    throw new Error(msg ?? `HTTP ${res.status}`);
+  }
+
+  return data as T;
+}
+
+// ─── Orgs ────────────────────────────────────────────────────────────────────
+
+export async function getOrg(orgId: number): Promise<PublicOrg> {
+  return fetchTm<PublicOrg>(`/orgs/${orgId}`);
+}
+
+export async function updateOrg(
+  orgId: number,
+  data: { name?: string; slug?: string }
+): Promise<PublicOrg> {
+  return fetchTm<PublicOrg>(`/orgs/${orgId}`, {
+    method: 'PATCH',
+    body: JSON.stringify(data),
+  });
+}
+
+export async function deleteOrg(orgId: number, confirmName: string): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}`, {
+    method: 'DELETE',
+    body: JSON.stringify({ confirmName }),
+  });
+}
+
+export async function listMembers(
+  orgId: number,
+  opts?: { includeFormer?: boolean }
+): Promise<PublicMember[]> {
+  const qs = opts?.includeFormer ? '?includeFormer=true' : '';
+  return fetchTm<PublicMember[]>(`/orgs/${orgId}/members${qs}`);
+}
+
+export async function removeMember(
+  orgId: number,
+  userId: number,
+  reason?: string
+): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}/members/${userId}`, {
+    method: 'DELETE',
+    body: JSON.stringify({ reason }),
+  });
+}
+
+export async function changeMemberRole(
+  orgId: number,
+  userId: number,
+  newRole: OrgRole
+): Promise<PublicMember> {
+  return fetchTm<PublicMember>(`/orgs/${orgId}/members/${userId}/role`, {
+    method: 'PATCH',
+    body: JSON.stringify({ role: newRole }),
+  });
+}
+
+// ─── Invitations ─────────────────────────────────────────────────────────────
+
+export async function listInvitations(orgId: number): Promise<PendingInvitation[]> {
+  return fetchTm<PendingInvitation[]>(`/orgs/${orgId}/invitations`);
+}
+
+export async function createInvitation(
+  orgId: number,
+  data: { email: string; role: OrgRole }
+): Promise<PendingInvitation> {
+  return fetchTm<PendingInvitation>(`/orgs/${orgId}/invitations`, {
+    method: 'POST',
+    body: JSON.stringify(data),
+  });
+}
+
+export async function revokeInvitation(orgId: number, invitationId: number): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}/invitations/${invitationId}`, {
+    method: 'DELETE',
+  });
+}
+
+export async function resendInvitation(orgId: number, invitationId: number): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}/invitations/${invitationId}/resend`, {
+    method: 'POST',
+  });
+}
+
+export async function getInvitationCode(
+  orgId: number,
+  invitationId: number
+): Promise<{ code: string }> {
+  return fetchTm<{ code: string }>(`/orgs/${orgId}/invitations/${invitationId}/code`);
+}
+
+export async function acceptInvitationByToken(
+  token: string
+): Promise<{ orgId: number; role: OrgRole }> {
+  return fetchTm<{ orgId: number; role: OrgRole }>(`/invitations/accept`, {
+    method: 'POST',
+    body: JSON.stringify({ token }),
+  });
+}
+
+export async function acceptInvitationByCode(
+  email: string,
+  code: string
+): Promise<{ orgId: number; role: OrgRole }> {
+  return fetchTm<{ orgId: number; role: OrgRole }>(`/invitations/accept-code`, {
+    method: 'POST',
+    body: JSON.stringify({ email, code }),
+  });
+}
+
+// ─── Me / self-service ───────────────────────────────────────────────────────
+
+export async function getMyMembership(): Promise<CurrentMembership> {
+  return fetchTm<CurrentMembership>(`/me/membership`);
+}
+
+export async function requestEmailChange(newEmail: string): Promise<void> {
+  return fetchTm<void>(`/me/email-change`, {
+    method: 'POST',
+    body: JSON.stringify({ newEmail }),
+  });
+}
+
+export async function verifyEmailChange(token: string): Promise<void> {
+  return fetchTm<void>(`/me/email-change/verify`, {
+    method: 'POST',
+    body: JSON.stringify({ token }),
+  });
+}
+
+export async function cancelEmailChange(token: string): Promise<void> {
+  return fetchTm<void>(`/me/email-change/cancel`, {
+    method: 'POST',
+    body: JSON.stringify({ token }),
+  });
+}
+
+export async function requestPasswordReset(email: string): Promise<void> {
+  return fetchTm<void>(`/password-reset/request`, {
+    method: 'POST',
+    body: JSON.stringify({ email }),
+  });
+}
+
+export async function resetPassword(token: string, newPassword: string): Promise<void> {
+  return fetchTm<void>(`/password-reset/confirm`, {
+    method: 'POST',
+    body: JSON.stringify({ token, newPassword }),
+  });
+}
+
+// ─── Ownership transfer ───────────────────────────────────────────────────────
+
+export async function getPendingTransfer(orgId: number): Promise<OwnershipTransfer | null> {
+  return fetchTm<OwnershipTransfer | null>(`/orgs/${orgId}/transfer`);
+}
+
+export async function initiateTransfer(
+  orgId: number,
+  toUserId: number
+): Promise<OwnershipTransfer> {
+  return fetchTm<OwnershipTransfer>(`/orgs/${orgId}/transfer`, {
+    method: 'POST',
+    body: JSON.stringify({ toUserId }),
+  });
+}
+
+export async function acceptTransfer(orgId: number): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}/transfer/accept`, {
+    method: 'POST',
+  });
+}
+
+export async function cancelTransfer(orgId: number): Promise<void> {
+  return fetchTm<void>(`/orgs/${orgId}/transfer/cancel`, {
+    method: 'POST',
+  });
+}
+
+// ─── Audit log ───────────────────────────────────────────────────────────────
+
+export async function getAuditLog(
+  orgId: number,
+  opts?: { page?: number; limit?: number; action?: string }
+): Promise<{ events: AuditEvent[]; total: number; page: number }> {
+  const params = new URLSearchParams();
+  if (opts?.page !== undefined) params.set('page', String(opts.page));
+  if (opts?.limit !== undefined) params.set('limit', String(opts.limit));
+  if (opts?.action) params.set('action', opts.action);
+  const qs = params.toString() ? `?${params.toString()}` : '';
+  return fetchTm<{ events: AuditEvent[]; total: number; page: number }>(
+    `/orgs/${orgId}/audit-log${qs}`
+  );
+}
+
+// ─── Super-admin ─────────────────────────────────────────────────────────────
+
+export async function adminListOrgs(): Promise<SuperAdminOrgSummary[]> {
+  return fetchTm<SuperAdminOrgSummary[]>(`/admin/orgs`);
+}
+
+export async function adminGetOrg(
+  orgId: number
+): Promise<SuperAdminOrgSummary & { members: PublicMember[] }> {
+  return fetchTm<SuperAdminOrgSummary & { members: PublicMember[] }>(`/admin/orgs/${orgId}`);
+}
+
+export async function adminRestoreOrg(orgId: number): Promise<void> {
+  return fetchTm<void>(`/admin/orgs/${orgId}/restore`, { method: 'POST' });
+}
+
+export async function adminAppointOwner(
+  orgId: number,
+  targetUserId: number,
+  reason: string
+): Promise<void> {
+  return fetchTm<void>(`/admin/orgs/${orgId}/appoint-owner`, {
+    method: 'POST',
+    body: JSON.stringify({ targetUserId, reason }),
+  });
+}
+
+export async function adminHardDeleteOrg(orgId: number, legalBasis: string): Promise<void> {
+  return fetchTm<void>(`/admin/orgs/${orgId}/hard-delete`, {
+    method: 'DELETE',
+    body: JSON.stringify({ legalBasis }),
+  });
+}
+
+export async function adminAddMember(
+  orgId: number,
+  userId: number,
+  role: OrgRole,
+  reason: string
+): Promise<void> {
+  return fetchTm<void>(`/admin/orgs/${orgId}/members`, {
+    method: 'POST',
+    body: JSON.stringify({ userId, role, reason }),
+  });
+}
+
+export async function adminRemoveMember(
+  orgId: number,
+  userId: number,
+  reason: string
+): Promise<void> {
+  return fetchTm<void>(`/admin/orgs/${orgId}/members/${userId}`, {
+    method: 'DELETE',
+    body: JSON.stringify({ reason }),
+  });
+}
+
+export async function adminLockUser(userId: number, reason: string): Promise<void> {
+  return fetchTm<void>(`/admin/users/${userId}/lock`, {
+    method: 'POST',
+    body: JSON.stringify({ reason }),
+  });
+}
+
+export async function adminUnlockUser(userId: number, reason: string): Promise<void> {
+  return fetchTm<void>(`/admin/users/${userId}/unlock`, {
+    method: 'POST',
+    body: JSON.stringify({ reason }),
+  });
+}
+
+export async function adminResetPassword(userId: number, reason: string): Promise<void> {
+  return fetchTm<void>(`/admin/users/${userId}/reset-password`, {
+    method: 'POST',
+    body: JSON.stringify({ reason }),
+  });
+}

package/src/client/components/AuditEventRow.tsx

@@ -0,0 +1,59 @@
+import React from 'react';
+import type { AuditEvent } from '../types.js';
+
+interface AuditEventRowProps {
+  event: AuditEvent;
+}
+
+function humanizeAction(action: string): string {
+  return action
+    .replace(/_/g, ' ')
+    .replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+function formatTimestamp(iso: string): string {
+  return new Date(iso).toLocaleString(undefined, {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+    hour: '2-digit',
+    minute: '2-digit',
+  });
+}
+
+export function AuditEventRow({ event }: AuditEventRowProps) {
+  const isAdminAction = event.actor_type === 'super_admin';
+
+  return (
+    <tr className="border-b border-slate-100 last:border-0 hover:bg-slate-50 transition-colors">
+      <td className="py-3 px-4">
+        <div className="flex items-center gap-2">
+          <span className={`text-sm font-medium ${isAdminAction ? 'text-purple-700' : 'text-slate-900'}`}>
+            {event.actor_display_name}
+          </span>
+          {isAdminAction && (
+            <span className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium bg-purple-100 text-purple-700">
+              Support
+            </span>
+          )}
+        </div>
+      </td>
+      <td className="py-3 px-4">
+        <span className="text-sm text-slate-700">{humanizeAction(event.action)}</span>
+      </td>
+      <td className="py-3 px-4">
+        {event.target_type && event.target_id ? (
+          <span className="text-xs text-slate-500">
+            {event.target_type} #{event.target_id}
+          </span>
+        ) : (
+          <span className="text-slate-300">—</span>
+        )}
+      </td>
+      <td className="py-3 px-4 text-xs text-slate-500 whitespace-nowrap">
+        {formatTimestamp(event.created_at)}
+      </td>
+    </tr>
+  );
+}
+

package/src/client/components/CascadePreview.tsx

@@ -0,0 +1,36 @@
+import React from 'react';
+
+interface CascadeItem {
+  label: string;
+  count: number;
+  description: string;
+}
+
+interface CascadePreviewProps {
+  items: CascadeItem[];
+}
+
+export function CascadePreview({ items }: CascadePreviewProps) {
+  if (items.length === 0) return null;
+
+  return (
+    <div className="rounded-lg border border-amber-200 bg-amber-50 p-4">
+      <p className="text-sm font-semibold text-amber-800 mb-3">
+        The following will be affected:
+      </p>
+      <ul className="space-y-2">
+        {items.map((item, i) => (
+          <li key={i} className="flex items-start gap-3">
+            <span className="mt-0.5 flex h-5 w-5 shrink-0 items-center justify-center rounded-full bg-amber-200 text-xs font-bold text-amber-800">
+              {item.count}
+            </span>
+            <div>
+              <span className="text-sm font-medium text-amber-900">{item.label}</span>
+              <p className="text-xs text-amber-700">{item.description}</p>
+            </div>
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}

package/src/client/components/DangerZoneCard.tsx

@@ -0,0 +1,103 @@
+import React, { useState } from 'react';
+
+interface DangerZoneCardProps {
+  title: string;
+  description: string;
+  buttonLabel: string;
+  onConfirm: () => Promise<void> | void;
+  confirmPrompt?: string;
+}
+
+export function DangerZoneCard({
+  title,
+  description,
+  buttonLabel,
+  onConfirm,
+  confirmPrompt,
+}: DangerZoneCardProps) {
+  const [showModal, setShowModal] = useState(false);
+  const [confirmText, setConfirmText] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const isConfirmed = !confirmPrompt || confirmText === confirmPrompt;
+
+  async function handleConfirm() {
+    if (!isConfirmed) return;
+    setSubmitting(true);
+    setError(null);
+    try {
+      await onConfirm();
+      setShowModal(false);
+      setConfirmText('');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Action failed');
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return (
+    <>
+      <div className="border border-red-200 rounded-lg p-5 bg-red-50">
+        <div className="flex flex-col sm:flex-row sm:items-center gap-4">
+          <div className="flex-1">
+            <h3 className="text-sm font-semibold text-red-800">{title}</h3>
+            <p className="mt-1 text-sm text-red-700">{description}</p>
+          </div>
+          <button
+            onClick={() => setShowModal(true)}
+            className="shrink-0 rounded-md border border-red-600 bg-white px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-600 hover:text-white focus:outline-none focus:ring-2 focus:ring-red-500 focus:ring-offset-1 transition-colors"
+          >
+            {buttonLabel}
+          </button>
+        </div>
+      </div>
+
+      {showModal && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4">
+          <div className="bg-white rounded-xl shadow-2xl w-full max-w-md p-6">
+            <h2 className="text-lg font-semibold text-slate-900 mb-2">{title}</h2>
+            <p className="text-sm text-slate-600 mb-4">{description}</p>
+
+            {confirmPrompt && (
+              <div className="mb-4">
+                <p className="text-sm text-slate-700 mb-1">
+                  Type <strong className="font-mono">{confirmPrompt}</strong> to confirm:
+                </p>
+                <input
+                  type="text"
+                  value={confirmText}
+                  onChange={(e) => setConfirmText(e.target.value)}
+                  placeholder={confirmPrompt}
+                  className="w-full rounded-md border border-slate-300 px-3 py-2 text-sm focus:border-red-500 focus:outline-none focus:ring-1 focus:ring-red-500"
+                />
+              </div>
+            )}
+
+            {error && (
+              <p className="mb-3 text-sm text-red-600">{error}</p>
+            )}
+
+            <div className="flex gap-3 justify-end">
+              <button
+                onClick={() => { setShowModal(false); setConfirmText(''); setError(null); }}
+                disabled={submitting}
+                className="rounded-md border border-slate-300 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50 disabled:opacity-50 transition-colors"
+              >
+                Cancel
+              </button>
+              <button
+                onClick={handleConfirm}
+                disabled={!isConfirmed || submitting}
+                className="rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white hover:bg-red-700 focus:outline-none focus:ring-2 focus:ring-red-500 focus:ring-offset-1 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+              >
+                {submitting ? 'Processing…' : buttonLabel}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+    </>
+  );
+}

package/src/client/components/InvitationCodeDisplay.tsx

@@ -0,0 +1,48 @@
+import React, { useState } from 'react';
+import { getInvitationCode } from '../api.js';
+
+interface InvitationCodeDisplayProps {
+  orgId: number;
+  invitationId: number;
+}
+
+export function InvitationCodeDisplay({ orgId, invitationId }: InvitationCodeDisplayProps) {
+  const [code, setCode] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function handleShowCode() {
+    if (code) return;
+    setLoading(true);
+    setError(null);
+    try {
+      const result = await getInvitationCode(orgId, invitationId);
+      setCode(result.code);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load code');
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <div className="inline-flex items-center gap-2">
+      {code ? (
+        <span className="font-mono text-sm font-semibold tracking-widest text-slate-900 bg-slate-100 border border-slate-300 rounded px-3 py-1 select-all">
+          {code}
+        </span>
+      ) : (
+        <button
+          onClick={handleShowCode}
+          disabled={loading}
+          className="text-xs text-blue-600 hover:text-blue-800 underline disabled:opacity-50 transition-colors"
+        >
+          {loading ? 'Loading…' : 'Show Code'}
+        </button>
+      )}
+      {error && (
+        <span className="text-xs text-red-600">{error}</span>
+      )}
+    </div>
+  );
+}