alepha 0.19.2 → 0.19.4

package/package.json

@@ -2,7 +2,7 @@
   "name": "alepha",
   "description": "Easy-to-use modern TypeScript framework for building many kind of applications.",
   "author": "Feunard",
-  "version": "0.19.2",
+  "version": "0.19.4",
   "type": "module",
   "engines": {
     "node": ">=22.0.0"
@@ -24,38 +24,38 @@
     "@vitejs/plugin-react": "^6.0.1",
     "dayjs": "^1.11.20",
     "drizzle-orm": "^0.45.2",
-    "postgres": "^3.4.8",
+    "postgres": "^3.4.9",
     "tsx": "^4.21.0",
-    "typebox": "^1.1.7",
+    "typebox": "^1.1.23",
     "typescript": "^6.0.2",
-    "vite": "^8.0.3",
-    "vite-bundle-analyzer": "^1.3.6",
+    "vite-bundle-analyzer": "^1.3.7",
     "ws": "^8.20.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.9",
-    "@electric-sql/pglite": "^0.4.2",
+    "@biomejs/biome": "^2.4.11",
+    "@electric-sql/pglite": "^0.4.4",
     "@faker-js/faker": "^10.4.0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/bun": "^1.3.11",
-    "@types/node": "^25.5.0",
-    "@types/nodemailer": "^7.0.11",
+    "@types/node": "^25.6.0",
+    "@types/nodemailer": "^8.0.0",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@types/ws": "^8.18.1",
     "cron-schedule": "^6.0.0",
     "drizzle-kit": "^0.31.10",
     "jose": "^6.2.2",
-    "jsdom": "^29.0.1",
-    "nodemailer": "^8.0.4",
+    "jsdom": "^29.0.2",
+    "nodemailer": "^8.0.5",
     "openid-client": "^6.8.2",
     "prom-client": "^15.1.3",
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4",
-    "swagger-ui-dist": "^5.32.1",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "swagger-ui-dist": "^5.32.2",
     "tsdown": "^0.21.7",
-    "vitest": "^4.1.2"
+    "vite": "^8.0.8",
+    "vitest": "^4.1.4"
   },
   "peerDependencies": {
     "react": "^19",
@@ -108,6 +108,11 @@
       "import": "./dist/api/files/index.js",
       "default": "./dist/api/files/index.js"
     },
+    "./api/invitations": {
+      "types": "./dist/api/invitations/index.d.ts",
+      "import": "./dist/api/invitations/index.js",
+      "default": "./dist/api/invitations/index.js"
+    },
     "./api/jobs": {
       "types": "./dist/api/jobs/index.d.ts",
       "react-native": "./dist/api/jobs/index.browser.js",
@@ -141,6 +146,16 @@
       "import": "./dist/api/parameters/index.js",
       "default": "./dist/api/parameters/index.js"
     },
+    "./api/payments": {
+      "types": "./dist/api/payments/index.d.ts",
+      "import": "./dist/api/payments/index.js",
+      "default": "./dist/api/payments/index.js"
+    },
+    "./api/subscriptions": {
+      "types": "./dist/api/subscriptions/index.d.ts",
+      "import": "./dist/api/subscriptions/index.js",
+      "default": "./dist/api/subscriptions/index.js"
+    },
     "./api/users": {
       "types": "./dist/api/users/index.d.ts",
       "react-native": "./dist/api/users/index.browser.js",
@@ -155,16 +170,18 @@
       "import": "./dist/api/verifications/index.js",
       "default": "./dist/api/verifications/index.js"
     },
+    "./api/workflows": {
+      "types": "./dist/api/workflows/index.d.ts",
+      "react-native": "./dist/api/workflows/index.browser.js",
+      "browser": "./dist/api/workflows/index.browser.js",
+      "import": "./dist/api/workflows/index.js",
+      "default": "./dist/api/workflows/index.js"
+    },
     "./batch": {
       "types": "./dist/batch/index.d.ts",
       "import": "./dist/batch/index.js",
       "default": "./dist/batch/index.js"
     },
-    "./billing": {
-      "types": "./dist/billing/index.d.ts",
-      "import": "./dist/billing/index.js",
-      "default": "./dist/billing/index.js"
-    },
     "./bin": {
       "types": "./dist/bin/index.d.ts",
       "import": "./dist/bin/index.js",

package/src/api/invitations/__tests__/InvitationService.spec.ts

@@ -0,0 +1,439 @@
+import { Alepha } from "alepha";
+import { users } from "alepha/api/users";
+import { $repository } from "alepha/orm";
+import { AlephaOrmPostgres } from "alepha/orm/postgres";
+import { BadRequestError, ForbiddenError } from "alepha/server";
+import { describe, it } from "vitest";
+import type { InvitationEntity } from "../entities/invitations.ts";
+import { AlephaApiInvitations } from "../index.ts";
+import { InvitationProvider } from "../providers/InvitationProvider.ts";
+import { InvitationService } from "../services/InvitationService.ts";
+
+class TestInvitationProvider extends InvitationProvider {
+  protected members = new Map<string, Set<string>>();
+
+  async validateResource(
+    _resourceType: string,
+    _resourceId: string,
+    _inviter: { id: string; email?: string },
+  ): Promise<void> {
+    // Always succeeds
+  }
+
+  async isMember(
+    resourceType: string,
+    resourceId: string,
+    _email: string,
+    userId?: string,
+  ): Promise<boolean> {
+    if (!userId) {
+      return false;
+    }
+
+    const key = `${resourceType}:${resourceId}`;
+    return this.members.get(key)?.has(userId) ?? false;
+  }
+
+  async onAccept(
+    invitation: InvitationEntity,
+    acceptedBy: { id: string; email?: string },
+  ): Promise<void> {
+    const key = `${invitation.resourceType}:${invitation.resourceId}`;
+
+    if (!this.members.has(key)) {
+      this.members.set(key, new Set());
+    }
+
+    this.members.get(key)!.add(acceptedBy.id);
+  }
+
+  async getResourceInfo(
+    _resourceType: string,
+    _resourceId: string,
+  ): Promise<{ name: string; description?: string; url?: string }> {
+    return { name: "Test Project" };
+  }
+
+  addMember(resourceType: string, resourceId: string, userId: string): void {
+    const key = `${resourceType}:${resourceId}`;
+
+    if (!this.members.has(key)) {
+      this.members.set(key, new Set());
+    }
+
+    this.members.get(key)!.add(userId);
+  }
+}
+
+class TestRepositories {
+  users = $repository(users);
+}
+
+const setup = async () => {
+  const alepha = Alepha.create()
+    .with(AlephaOrmPostgres)
+    .with({ provide: InvitationProvider, use: TestInvitationProvider })
+    .with(AlephaApiInvitations);
+
+  const service = alepha.inject(InvitationService);
+  const provider = alepha.inject(
+    TestInvitationProvider,
+  ) as TestInvitationProvider;
+  const repos = alepha.inject(TestRepositories);
+  await alepha.start();
+
+  const createUser = async (email: string) => {
+    return repos.users.create({ email, roles: [] });
+  };
+
+  return { alepha, service, provider, createUser };
+};
+
+describe("InvitationService", () => {
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("create", () => {
+    it("should create a pending invitation", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      expect(invitation.status).toBe("pending");
+      expect(invitation.email).toBe("invitee@example.com");
+      expect(invitation.resourceType).toBe("project");
+      expect(invitation.resourceId).toBe("proj-1");
+      expect(invitation.invitedBy).toBe(inviter.id);
+      expect(invitation.token).toBeDefined();
+      expect(invitation.expiresAt).toBeDefined();
+    });
+
+    it("should reject self-invite", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("self@example.com");
+
+      await expect(
+        service.create(
+          {
+            email: "self@example.com",
+            resourceType: "project",
+            resourceId: "proj-1",
+          },
+          { id: inviter.id, email: inviter.email },
+        ),
+      ).rejects.toThrow(BadRequestError);
+    });
+
+    it("should reject duplicate pending invitation", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+
+      await service.create(
+        {
+          email: "dup@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await expect(
+        service.create(
+          {
+            email: "dup@example.com",
+            resourceType: "project",
+            resourceId: "proj-1",
+          },
+          { id: inviter.id, email: inviter.email },
+        ),
+      ).rejects.toThrow(BadRequestError);
+    });
+
+    it("should reject when already a member", async ({ expect }) => {
+      const { service, provider, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const existingMember = await createUser("member@example.com");
+
+      provider.addMember("project", "proj-1", existingMember.id);
+
+      await expect(
+        service.create(
+          {
+            email: "member@example.com",
+            resourceType: "project",
+            resourceId: "proj-1",
+          },
+          { id: inviter.id, email: inviter.email },
+        ),
+      ).rejects.toThrow(BadRequestError);
+    });
+  });
+
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("accept", () => {
+    it("should accept invitation and call onAccept", async ({ expect }) => {
+      const { service, provider, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const invitee = await createUser("invitee@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.accept(invitation.id, {
+        id: invitee.id,
+        email: invitee.email,
+      });
+
+      const updated = await service.getById(invitation.id);
+      expect(updated.status).toBe("accepted");
+      expect(updated.resolvedBy).toBe(invitee.id);
+      expect(updated.resolvedAt).toBeDefined();
+
+      const isMember = await provider.isMember(
+        "project",
+        "proj-1",
+        "invitee@example.com",
+        invitee.id,
+      );
+      expect(isMember).toBe(true);
+    });
+
+    it("should reject accept for wrong email", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const wrongUser = await createUser("wrong@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await expect(
+        service.accept(invitation.id, {
+          id: wrongUser.id,
+          email: wrongUser.email,
+        }),
+      ).rejects.toThrow(ForbiddenError);
+    });
+
+    it("should reject accept for non-pending invitation", async ({
+      expect,
+    }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const invitee = await createUser("invitee@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.accept(invitation.id, {
+        id: invitee.id,
+        email: invitee.email,
+      });
+
+      await expect(
+        service.accept(invitation.id, {
+          id: invitee.id,
+          email: invitee.email,
+        }),
+      ).rejects.toThrow(BadRequestError);
+    });
+  });
+
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("decline", () => {
+    it("should decline invitation", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const invitee = await createUser("invitee@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.decline(invitation.id, {
+        id: invitee.id,
+        email: invitee.email,
+      });
+
+      const updated = await service.getById(invitation.id);
+      expect(updated.status).toBe("declined");
+      expect(updated.resolvedBy).toBe(invitee.id);
+      expect(updated.resolvedAt).toBeDefined();
+    });
+
+    it("should reject decline for wrong email", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const wrongUser = await createUser("wrong@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await expect(
+        service.decline(invitation.id, {
+          id: wrongUser.id,
+          email: wrongUser.email,
+        }),
+      ).rejects.toThrow(ForbiddenError);
+    });
+  });
+
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("revoke", () => {
+    it("should revoke pending invitation", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.revoke(invitation.id, { id: inviter.id });
+
+      const updated = await service.getById(invitation.id);
+      expect(updated.status).toBe("revoked");
+      expect(updated.resolvedBy).toBe(inviter.id);
+      expect(updated.resolvedAt).toBeDefined();
+    });
+
+    it("should reject revoke for non-pending", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+      const invitee = await createUser("invitee@example.com");
+
+      const invitation = await service.create(
+        {
+          email: "invitee@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.accept(invitation.id, {
+        id: invitee.id,
+        email: invitee.email,
+      });
+
+      await expect(
+        service.revoke(invitation.id, { id: inviter.id }),
+      ).rejects.toThrow(BadRequestError);
+    });
+  });
+
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("findByEmail", () => {
+    it("should return enriched invitations with resource info", async ({
+      expect,
+    }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+
+      await service.create(
+        {
+          email: "lookup@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      const results = await service.findByEmail("lookup@example.com");
+
+      expect(results).toHaveLength(1);
+      expect(results[0].email).toBe("lookup@example.com");
+      expect(results[0].resourceName).toBe("Test Project");
+      expect(results[0].invitedBy).toBe(inviter.id);
+      expect(results[0].inviterEmail).toBe("inviter@example.com");
+    });
+  });
+
+  // -----------------------------------------------------------------------------------------------------------------
+
+  describe("findInvitations", () => {
+    it("should return paginated results", async ({ expect }) => {
+      const { service, createUser } = await setup();
+
+      const inviter = await createUser("inviter@example.com");
+
+      await service.create(
+        {
+          email: "page1@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      await service.create(
+        {
+          email: "page2@example.com",
+          resourceType: "project",
+          resourceId: "proj-1",
+        },
+        { id: inviter.id, email: inviter.email },
+      );
+
+      const page = await service.findInvitations({ size: 10 });
+
+      expect(page.content.length).toBeGreaterThanOrEqual(2);
+      expect(page.page.totalElements).toBeGreaterThanOrEqual(2);
+    });
+  });
+});

package/src/api/invitations/controllers/AdminInvitationController.ts

@@ -0,0 +1,86 @@
+import { $inject, t } from "alepha";
+import { $secure } from "alepha/security";
+import { $action, okSchema } from "alepha/server";
+import { invitationQuerySchema } from "../schemas/invitationQuerySchema.ts";
+import { invitationResourceSchema } from "../schemas/invitationResourceSchema.ts";
+import { InvitationService } from "../services/InvitationService.ts";
+
+export class AdminInvitationController {
+  protected readonly url = "/invitations";
+  protected readonly group = "admin:invitations";
+  protected readonly invitationService = $inject(InvitationService);
+
+  /**
+   * Find invitations with pagination and filtering.
+   */
+  public readonly findInvitations = $action({
+    path: this.url,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:invitation:read"] })],
+    description: "Find invitations with pagination and filtering",
+    schema: {
+      query: invitationQuerySchema,
+      response: t.page(invitationResourceSchema),
+    },
+    handler: ({ query }) => this.invitationService.findInvitations(query),
+  });
+
+  /**
+   * Get an invitation by ID.
+   */
+  public readonly getInvitation = $action({
+    path: `${this.url}/:id`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:invitation:read"] })],
+    description: "Get an invitation by ID",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      response: invitationResourceSchema,
+    },
+    handler: ({ params }) => this.invitationService.getById(params.id),
+  });
+
+  /**
+   * Revoke a pending invitation.
+   */
+  public readonly revokeInvitation = $action({
+    method: "POST",
+    path: `${this.url}/:id/revoke`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:invitation:delete"] })],
+    description: "Revoke a pending invitation",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      response: okSchema,
+    },
+    handler: async ({ params, user }) => {
+      await this.invitationService.revoke(params.id, { id: user.id });
+      return { ok: true };
+    },
+  });
+
+  /**
+   * Delete an invitation.
+   */
+  public readonly deleteInvitation = $action({
+    method: "DELETE",
+    path: `${this.url}/:id`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:invitation:delete"] })],
+    description: "Delete an invitation",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      response: okSchema,
+    },
+    handler: async ({ params }) => {
+      await this.invitationService.deleteInvitation(params.id);
+      return { ok: true, id: params.id };
+    },
+  });
+}