@verii/endpoints-organizations-registrar 1.0.0-pre.1752076816

package/src/controllers/organizations/_did/invitations/_invitationId/controller.js

@@ -0,0 +1,217 @@
+const { isEmpty } = require('lodash/fp');
+const newError = require('http-errors');
+const { nanoid } = require('nanoid/non-secure');
+const { addSeconds } = require('date-fns/fp');
+const {
+  verifyUserOrganizationWriteAuthorized,
+} = require('../../../../../plugins/authorization');
+const { initGetOrCreateAuth0User } = require('../../../../../entities/users');
+const {
+  RegistrarScopes,
+  getInvitationResponseBodySchema,
+  buildInvitationUrl,
+  initSendEmailInvitee,
+  validateInviteeEmail,
+} = require('../../../../../entities');
+
+const invitationController = async (fastify) => {
+  const sendEmailToInvitee = initSendEmailInvitee(fastify);
+
+  const getOrCreateAuth0User = initGetOrCreateAuth0User(fastify);
+
+  fastify.get(
+    '/',
+    {
+      onRequest: fastify.verifyAccessToken([
+        RegistrarScopes.ReadOrganizations,
+        RegistrarScopes.AdminOrganizations,
+      ]),
+      preHandler: [verifyUserOrganizationWriteAuthorized],
+      schema: fastify.autoSchema({
+        security: [
+          {
+            RegistrarOAuth2: [
+              RegistrarScopes.ReadOrganizations,
+              RegistrarScopes.AdminOrganizations,
+            ],
+          },
+        ],
+        response: {
+          200: getInvitationResponseBodySchema,
+        },
+      }),
+    },
+    async (req) => {
+      const {
+        params: { did, invitationId },
+        repos,
+      } = req;
+      await repos.organizations.findOneByDid(did, {
+        _id: 1,
+      });
+      const invitation = await repos.invitations.findOne({
+        filter: {
+          _id: invitationId,
+          inviterDid: did,
+        },
+      });
+
+      if (isEmpty(invitation)) {
+        throw newError(404, 'Invitation not found', {
+          errorCode: 'invitation_not_found',
+        });
+      }
+
+      return {
+        invitation,
+      };
+    }
+  );
+
+  fastify.put(
+    '/',
+    {
+      onRequest: fastify.verifyAccessToken([
+        RegistrarScopes.WriteOrganizations,
+        RegistrarScopes.AdminOrganizations,
+      ]),
+      preHandler: [verifyUserOrganizationWriteAuthorized],
+      schema: fastify.autoSchema({
+        security: [
+          {
+            RegistrarOAuth2: [
+              RegistrarScopes.WriteOrganizations,
+              RegistrarScopes.AdminOrganizations,
+            ],
+          },
+        ],
+        body: {
+          type: 'object',
+          properties: {
+            inviteeEmail: {
+              type: 'string',
+            },
+          },
+          required: ['inviteeEmail'],
+        },
+        response: {
+          200: getInvitationResponseBodySchema,
+        },
+      }),
+    },
+    async (req) => {
+      const {
+        body: { inviteeEmail },
+        params: { did, invitationId },
+        config: { registrarResendInvitationTtl },
+        repos,
+      } = req;
+      const inviterOrganization = await repos.organizations.findOneByDid(did);
+      validateInviteeEmail(inviteeEmail);
+
+      const code = nanoid(16);
+      const expiresAt = addSeconds(registrarResendInvitationTtl, new Date());
+      const invitationUrl = buildInvitationUrl({ code }, req);
+
+      const invitation = await repos.invitations.findOne({
+        filter: {
+          _id: invitationId,
+          inviterDid: did,
+        },
+      });
+
+      if (isEmpty(invitation)) {
+        throw newError(404, 'Invitation not found', {
+          errorCode: 'invitation_not_found',
+        });
+      }
+
+      const { ticket } = await getOrCreateAuth0User(
+        inviteeEmail,
+        invitation.keyIndividuals.adminGivenName,
+        invitation.keyIndividuals.adminFamilyName,
+        req
+      );
+
+      await repos.invitations.update(invitation._id, {
+        code,
+        inviteeEmail,
+        invitationUrl,
+        expiresAt,
+      });
+
+      const messageCode = await sendEmailToInvitee(
+        {
+          inviteeEmail,
+          inviterOrganization,
+          ticket,
+          code,
+        },
+        req
+      );
+      return {
+        invitation: {
+          ...invitation,
+          code,
+          expiresAt,
+          invitationUrl,
+          inviteeEmail,
+        },
+        messageCode,
+      };
+    }
+  );
+
+  fastify.delete(
+    '/',
+    {
+      onRequest: fastify.verifyAccessToken([
+        RegistrarScopes.WriteOrganizations,
+        RegistrarScopes.AdminOrganizations,
+      ]),
+      preHandler: [verifyUserOrganizationWriteAuthorized],
+      schema: fastify.autoSchema({
+        security: [
+          {
+            RegistrarOAuth2: [
+              RegistrarScopes.WriteOrganizations,
+              RegistrarScopes.AdminOrganizations,
+            ],
+          },
+        ],
+        response: {
+          204: { type: 'null' },
+        },
+      }),
+    },
+    async (req, rep) => {
+      const {
+        params: { did, invitationId },
+        repos,
+        user,
+      } = req;
+      await repos.organizations.findOneByDid(did, { _id: 1 });
+      const deletedAt = new Date();
+      const invitation = await repos.invitations.findOne({
+        filter: {
+          _id: invitationId,
+          inviterDid: did,
+        },
+      });
+
+      if (isEmpty(invitation)) {
+        throw newError(404, 'Invitation not found', {
+          errorCode: 'invitation_not_found',
+        });
+      }
+
+      await repos.invitations.update(invitation._id, {
+        deletedAt,
+        deletedBy: user.sub,
+      });
+      return rep.status(204).send();
+    }
+  );
+};
+
+module.exports = invitationController;

package/src/controllers/organizations/_did/invitations/controller.js

@@ -0,0 +1,197 @@
+const { find, forEach, isEmpty } = require('lodash/fp');
+const { addSeconds } = require('date-fns/fp');
+const newError = require('http-errors');
+const { nanoid } = require('nanoid/non-secure');
+const { initTransformToFinder } = require('@verii/rest-queries');
+const { tableRegistry } = require('@spencejs/spence-mongo-repos');
+const {
+  verifyUserOrganizationWriteAuthorized,
+} = require('../../../../plugins/authorization');
+const { initGetOrCreateAuth0User } = require('../../../../entities/users');
+const {
+  RegistrarScopes,
+  initSendEmailInvitee,
+  invitationResponseItemBodySchema,
+  isCaoService,
+  addInvitationBodySchema,
+  buildInvitationUrl,
+  validateInviteeEmail,
+  validateInviteeService,
+  buildReferenceCaoServices,
+  extractCaoServiceRefs,
+} = require('../../../../entities');
+const { registeredCredentialTypesPreHandler } = require('../../plugins');
+
+const invitationsController = async (fastify) => {
+  const transformToFinder = initTransformToFinder(
+    await tableRegistry.invitations()
+  );
+
+  const getOrCreateAuth0User = initGetOrCreateAuth0User(fastify);
+  const sendEmailToInvitee = initSendEmailInvitee(fastify);
+
+  fastify.post(
+    '/',
+    {
+      onRequest: fastify.verifyAccessToken([
+        RegistrarScopes.WriteOrganizations,
+        RegistrarScopes.AdminOrganizations,
+      ]),
+      preHandler: [
+        verifyUserOrganizationWriteAuthorized,
+        registeredCredentialTypesPreHandler,
+      ],
+      schema: fastify.autoSchema({
+        security: [
+          {
+            RegistrarOAuth2: [
+              RegistrarScopes.WriteOrganizations,
+              RegistrarScopes.AdminOrganizations,
+            ],
+          },
+        ],
+        body: addInvitationBodySchema,
+        response: {
+          200: {
+            type: 'object',
+            properties: {
+              invitation: invitationResponseItemBodySchema,
+              messageCode: { type: 'string' },
+            },
+            required: ['invitation'],
+          },
+        },
+      }),
+    },
+    async (req) => {
+      const {
+        params: { did },
+        body,
+        repos,
+        config: { registrarInvitationTtl },
+        user,
+      } = req;
+      const { inviteeEmail, inviteeService, inviteeProfile, keyIndividuals } =
+        body;
+
+      // validate inviter
+      const inviterOrganization = await repos.organizations.findOneByDid(did);
+      const caoService = find(isCaoService, inviterOrganization.services);
+      if (isEmpty(caoService)) {
+        throw newError(400, 'CAO service does not exist', {
+          errorCode: 'invitations_not_supported',
+        });
+      }
+
+      // validate invitation details
+      validateInviteeEmail(inviteeEmail);
+
+      const caoServiceRefs = await buildReferenceCaoServices({
+        caoServiceIds: extractCaoServiceRefs(inviteeService),
+        caoOrganizations: [inviterOrganization],
+      });
+
+      forEach(
+        (service) => validateInviteeService(service, caoServiceRefs, req),
+        inviteeService
+      );
+
+      // create auth0 user
+      const { ticket } = await getOrCreateAuth0User(
+        inviteeEmail,
+        keyIndividuals.adminGivenName,
+        keyIndividuals.adminFamilyName,
+        req
+      );
+
+      // send invitation to user
+      const code = nanoid(16);
+      const expiresAt = addSeconds(registrarInvitationTtl, new Date());
+      const invitation = await repos.invitations.insert({
+        invitationUrl: buildInvitationUrl({ code }, req),
+        inviterDid: did,
+        inviteeEmail,
+        inviteeService,
+        inviteeProfile,
+        keyIndividuals,
+        code,
+        expiresAt,
+        createdBy: user.sub,
+        updatedBy: user.sub,
+      });
+
+      const messageCode = await sendEmailToInvitee(
+        {
+          inviteeEmail,
+          inviterOrganization,
+          ticket,
+          code,
+        },
+        req
+      );
+      return {
+        invitation,
+        messageCode,
+      };
+    }
+  );
+
+  fastify.get(
+    '/',
+    {
+      onRequest: fastify.verifyAccessToken([
+        RegistrarScopes.ReadOrganizations,
+        RegistrarScopes.AdminOrganizations,
+      ]),
+      preHandler: [verifyUserOrganizationWriteAuthorized],
+      schema: fastify.autoSchema({
+        security: [
+          {
+            RegistrarOAuth2: [
+              RegistrarScopes.ReadOrganizations,
+              RegistrarScopes.AdminOrganizations,
+            ],
+          },
+        ],
+        querystring: {
+          $ref: 'https://velocitynetwork.foundation/schemas/page-query.schema.json#',
+        },
+        response: {
+          200: {
+            type: 'object',
+            properties: {
+              invitations: {
+                type: 'array',
+                items: {
+                  type: 'object',
+                  properties: invitationResponseItemBodySchema.properties,
+                  required: invitationResponseItemBodySchema.required,
+                },
+              },
+            },
+            required: ['invitations'],
+          },
+        },
+      }),
+    },
+    async (req) => {
+      const {
+        params: { did },
+        query: { page, sort = [] },
+        repos,
+      } = req;
+      await repos.organizations.findOneByDid(did, { _id: 1 });
+      const filter = transformToFinder({
+        filter: { inviterDid: did },
+        page,
+        sort,
+      });
+      const invitations = await repos.invitations.find(filter);
+      return {
+        invitations,
+      };
+    }
+  );
+};
+
+module.exports = invitationsController;

package/src/controllers/organizations/_did/keys/controller.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright 2025 Velocity Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+const {
+  verifyUserOrganizationWriteAuthorized,
+  verifyUserOrganizationReadAuthorized,
+} = require('../../../../plugins/authorization');
+const {
+  addKey,
+  deleteKey,
+  getKey,
+  RegistrarScopes,
+} = require('../../../../entities');
+
+const keysController = async (fastify) => {
+  fastify
+    .post(
+      '/',
+      {
+        onRequest: fastify.verifyAccessToken([
+          RegistrarScopes.AdminOrganizations,
+          RegistrarScopes.WriteOrganizations,
+        ]),
+        preHandler: [verifyUserOrganizationWriteAuthorized],
+        schema: fastify.autoSchema({
+          security: [
+            {
+              RegistrarOAuth2: [
+                RegistrarScopes.WriteOrganizations,
+                RegistrarScopes.AdminOrganizations,
+              ],
+            },
+          ],
+          body: { $ref: 'https://velocitycareerlabs.io/add-key-body.json#' },
+          response: {
+            201: {
+              type: 'object',
+              properties: {
+                key: {
+                  $ref: 'did-key#',
+                },
+              },
+              required: ['key'],
+            },
+          },
+        }),
+      },
+      async (req, reply) => {
+        const response = await addKey(req.params.did, req.body, req);
+        reply.code(201);
+        return response;
+      }
+    )
+    .get(
+      '/:kid',
+      {
+        onRequest: fastify.verifyAccessToken([
+          RegistrarScopes.AdminOrganizations,
+          RegistrarScopes.ReadOrganizations,
+        ]),
+        preHandler: [verifyUserOrganizationReadAuthorized],
+        schema: fastify.autoSchema({
+          security: [
+            {
+              RegistrarOAuth2: [
+                RegistrarScopes.ReadOrganizations,
+                RegistrarScopes.AdminOrganizations,
+              ],
+            },
+          ],
+          response: {
+            200: {
+              type: 'object',
+              properties: {
+                key: {
+                  $ref: 'did-key#',
+                },
+              },
+              required: ['key'],
+            },
+          },
+        }),
+      },
+      async (req) => {
+        const { params } = req;
+        return getKey(params.did, params.kid, req);
+      }
+    )
+    .delete(
+      '/:keyId',
+      {
+        onRequest: fastify.verifyAccessToken([
+          RegistrarScopes.AdminOrganizations,
+          RegistrarScopes.WriteOrganizations,
+        ]),
+        preHandler: [verifyUserOrganizationWriteAuthorized],
+        schema: fastify.autoSchema({
+          security: [
+            {
+              RegistrarOAuth2: [
+                RegistrarScopes.WriteOrganizations,
+                RegistrarScopes.AdminOrganizations,
+              ],
+            },
+          ],
+          params: {
+            type: 'object',
+            properties: {
+              keyId: { type: 'string' },
+            },
+          },
+          response: {
+            204: {
+              type: 'null',
+            },
+            ...fastify.BadRequestResponse,
+          },
+        }),
+      },
+      async (req, reply) => {
+        await deleteKey(req.params.did, req.params.keyId, req);
+        reply.code(204);
+        return {};
+      }
+    );
+};
+
+module.exports = keysController;