qarpeo 0.0.0-alpha.10

package/dist/runtime/server/routes/auth/organization/create.post.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    organization: import("../../../..").QarpeoOrganization;
+    member: import("../../../..").QarpeoMember;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/create.post.mjs

@@ -0,0 +1,10 @@
+import { defineEventHandler, readBody } from "nuxt/server";
+import { createOrganization } from "../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  return await createOrganization(event, {
+    name: body.name,
+    slug: body.slug,
+    logoUrl: body.logoUrl
+  });
+});

package/dist/runtime/server/routes/auth/organization/invite.post.d.ts

@@ -0,0 +1,9 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    invitationId: string;
+    token: string;
+    expiresAt: number;
+    inviteUrl: string;
+    sent: boolean;
+    error?: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/invite.post.mjs

@@ -0,0 +1,27 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { inviteOrganizationMember } from "../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  const session = await getAuthSession(event);
+  const organizationId = body.organizationId || session?.currentOrganizationId;
+  if (!organizationId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "organizationId is required (or set an active organization in session)"
+    });
+  }
+  const result = await inviteOrganizationMember(event, {
+    organizationId,
+    email: body.email,
+    role: body.role
+  });
+  if (!result.sent) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: result.error || "Failed to send organization invitation email"
+    });
+  }
+  return result;
+});

package/dist/runtime/server/routes/auth/organization/join.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    organizationId: string;
+    role: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/join.post.mjs

@@ -0,0 +1,15 @@
+import { defineEventHandler, readBody, getQuery, createError } from "nuxt/server";
+import { acceptOrganizationInvitation } from "../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  const query = getQuery(event);
+  const token = body.token || query.token;
+  if (!token) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invitation token is required"
+    });
+  }
+  return await acceptOrganizationInvitation(event, token);
+});

package/dist/runtime/server/routes/auth/organization/list.get.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<(import("../../../..").QarpeoOrganization & {
+    role: string;
+    memberId: string;
+})[]>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/list.get.mjs

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "nuxt/server";
+import { requireAuth } from "../../../utils/context.mjs";
+import { listUserOrganizations } from "../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const { user } = await requireAuth(event);
+  return await listUserOrganizations(event, user.id);
+});

package/dist/runtime/server/routes/auth/organization/members/[id].delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/members/[id].delete.mjs

@@ -0,0 +1,33 @@
+import { defineEventHandler, getRouterParam, getQuery, readBody, createError } from "nuxt/server";
+import { removeOrganizationMember } from "../../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const memberId = getRouterParam(event, "id");
+  if (!memberId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Member ID is required"
+    });
+  }
+  const query = getQuery(event);
+  let organizationId = query.organizationId;
+  if (!organizationId) {
+    try {
+      const body = await readBody(event);
+      organizationId = body?.organizationId;
+    } catch {
+    }
+  }
+  if (!organizationId) {
+    const session = await getAuthSession(event);
+    organizationId = session?.currentOrganizationId;
+  }
+  if (!organizationId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Organization ID is required"
+    });
+  }
+  return await removeOrganizationMember(event, { organizationId, memberId });
+});

package/dist/runtime/server/routes/auth/organization/members/index.get.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<(import("../../../../..").QarpeoMember & {
+    email?: string;
+    name?: string;
+    avatarUrl?: string;
+})[]>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/members/index.get.mjs

@@ -0,0 +1,18 @@
+import { defineEventHandler, getQuery, createError } from "nuxt/server";
+import { listOrganizationMembers } from "../../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  let organizationId = query.organizationId;
+  if (!organizationId) {
+    const session = await getAuthSession(event);
+    organizationId = session?.currentOrganizationId;
+  }
+  if (!organizationId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Organization ID is required"
+    });
+  }
+  return await listOrganizationMembers(event, organizationId);
+});

package/dist/runtime/server/routes/auth/organization/mfa.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    organizationId: any;
+    mfaRequired: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/mfa.post.mjs

@@ -0,0 +1,33 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../db.mjs";
+import { requireAuthSession } from "../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const orgId = session?.currentOrganizationId;
+  const userId = session?.user?.id;
+  if (!orgId || !userId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "No active organization selected in current session."
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const membership = await d1.prepare("SELECT role FROM _qarpeo_members WHERE organization_id = ? AND user_id = ? LIMIT 1").bind(orgId, userId).first();
+  if (!membership || membership.role !== "owner") {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Only organization owners can modify organization MFA security policies."
+    });
+  }
+  const body = await readBody(event);
+  const mfaRequired = Boolean(body?.mfaRequired);
+  await d1.prepare("UPDATE _qarpeo_organizations SET mfa_required = ? WHERE id = ?").bind(mfaRequired ? 1 : 0, orgId).run();
+  return {
+    success: true,
+    organizationId: orgId,
+    mfaRequired
+  };
+});

package/dist/runtime/server/routes/auth/organization/sso/[id].delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/sso/[id].delete.mjs

@@ -0,0 +1,28 @@
+import { defineEventHandler, getRouterParam, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { requireAuthSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const orgId = session?.currentOrganizationId;
+  const userId = session?.user?.id;
+  const connectionId = getRouterParam(event, "id");
+  if (!orgId || !userId || !connectionId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing organization or connectionId parameter."
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const membership = await d1.prepare("SELECT role FROM _qarpeo_members WHERE organization_id = ? AND user_id = ? LIMIT 1").bind(orgId, userId).first();
+  if (!membership || membership.role !== "owner" && membership.role !== "admin") {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Only organization owners and admins can delete SSO connections."
+    });
+  }
+  await d1.prepare("DELETE FROM _qarpeo_sso_connections WHERE id = ? AND organization_id = ?").bind(connectionId, orgId).run();
+  return { success: true };
+});

package/dist/runtime/server/routes/auth/organization/sso/index.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<Record<string, unknown>[]>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/sso/index.get.mjs

@@ -0,0 +1,23 @@
+import { defineEventHandler, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { requireAuthSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const orgId = session?.currentOrganizationId;
+  if (!orgId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "No active organization selected in current session."
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const connections = await d1.prepare(`
+      SELECT id, organization_id, provider_type, name, domain, client_id, issuer, sso_url, token_url, userinfo_url, enabled, created_at, updated_at
+      FROM _qarpeo_sso_connections
+      WHERE organization_id = ?
+      ORDER BY created_at DESC
+    `).bind(orgId).all();
+  return connections.results || [];
+});

package/dist/runtime/server/routes/auth/organization/sso/index.post.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    connectionId: any;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/sso/index.post.mjs

@@ -0,0 +1,84 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getD1Binding } from "../../../../../db.mjs";
+import { requireAuthSession } from "../../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const orgId = session?.currentOrganizationId;
+  const userId = session?.user?.id;
+  if (!orgId || !userId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "No active organization selected in current session."
+    });
+  }
+  const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+  const d1 = getD1Binding(bindingName, event);
+  const membership = await d1.prepare("SELECT role FROM _qarpeo_members WHERE organization_id = ? AND user_id = ? LIMIT 1").bind(orgId, userId).first();
+  if (!membership || membership.role !== "owner" && membership.role !== "admin") {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Only organization owners and admins can configure Enterprise SSO connections."
+    });
+  }
+  const body = await readBody(event);
+  const {
+    name,
+    providerType,
+    domain,
+    clientId,
+    clientSecret,
+    issuer,
+    ssoUrl,
+    tokenUrl,
+    userinfoUrl,
+    cert
+  } = body || {};
+  if (!name || !providerType || !ssoUrl) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Missing required fields: name, providerType, and ssoUrl are mandatory."
+    });
+  }
+  const id = body.id || crypto.randomUUID();
+  const now = Date.now();
+  const normalizedDomain = domain ? domain.toLowerCase().trim() : null;
+  await d1.prepare(`
+      INSERT INTO _qarpeo_sso_connections (
+        id, organization_id, provider_type, name, domain, client_id, client_secret, issuer, sso_url, token_url, userinfo_url, cert, enabled, created_at, updated_at
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        name = excluded.name,
+        domain = excluded.domain,
+        client_id = excluded.client_id,
+        client_secret = excluded.client_secret,
+        issuer = excluded.issuer,
+        sso_url = excluded.sso_url,
+        token_url = excluded.token_url,
+        userinfo_url = excluded.userinfo_url,
+        cert = excluded.cert,
+        updated_at = excluded.updated_at
+    `).bind(
+    id,
+    orgId,
+    providerType,
+    name,
+    normalizedDomain,
+    clientId || null,
+    clientSecret || null,
+    issuer || null,
+    ssoUrl,
+    tokenUrl || null,
+    userinfoUrl || null,
+    cert || null,
+    now,
+    now
+  ).run();
+  return {
+    success: true,
+    connectionId: id
+  };
+});

package/dist/runtime/server/routes/auth/organization/switch.post.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    organization: import("../../../..").QarpeoOrganization;
+    role: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/organization/switch.post.mjs

@@ -0,0 +1,14 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { switchActiveOrganization } from "../../../utils/organization.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event) || {};
+  const organizationId = body.organizationId || body.id;
+  if (!organizationId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Organization ID is required"
+    });
+  }
+  return await switchActiveOrganization(event, organizationId);
+});

package/dist/runtime/server/routes/auth/otp/send.post.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    sent: boolean;
+    expiresAt: number;
+    error: string;
+} | {
+    sent: boolean;
+    expiresAt: number;
+    error?: undefined;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/otp/send.post.mjs

@@ -0,0 +1,29 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getQarpeoConfig } from "../../../utils/config.mjs";
+import { sendOTPCode } from "../../../utils/passwordless.mjs";
+import { requireTurnstile } from "../../../utils/turnstile.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const email = body?.email;
+  if (!email || typeof email !== "string" || !email.includes("@")) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "A valid email address is required"
+    });
+  }
+  const authConfig = getQarpeoConfig(event).auth || {};
+  const turnstileProtect = typeof authConfig.turnstile === "object" ? authConfig.turnstile.protect?.otp : false;
+  if (turnstileProtect) {
+    await requireTurnstile(event, body?.turnstileToken);
+  }
+  const result = await sendOTPCode(event, email);
+  if (!result.sent) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: "Internal Server Error",
+      message: result.error || "Failed to send verification code"
+    });
+  }
+  return result;
+});

package/dist/runtime/server/routes/auth/otp/verify.post.d.ts

@@ -0,0 +1,6 @@
+import type { QarpeoUser } from "../../../../types/auth";
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    success: boolean;
+    user: QarpeoUser;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/otp/verify.post.mjs

@@ -0,0 +1,95 @@
+import { defineEventHandler, readBody, createError } from "nuxt/server";
+import { getQarpeoConfig } from "../../../utils/config.mjs";
+import { getD1Binding } from "../../../../db.mjs";
+import { ensureAuthTables } from "../../../utils/auth.mjs";
+import { verifyOTPCode } from "../../../utils/passwordless.mjs";
+import { createDeviceSession, setAuthSession } from "../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event);
+  const email = body?.email;
+  const code = body?.code;
+  if (!email || !code) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Email and verification code are required"
+    });
+  }
+  const result = await verifyOTPCode(event, email, code);
+  if (!result.valid) {
+    if (result.reason === "too_many_attempts") {
+      throw createError({
+        statusCode: 429,
+        statusMessage: "Too Many Requests",
+        message: "Maximum verification attempts exceeded. Please request a new code."
+      });
+    }
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Bad Request",
+      message: "Invalid or expired verification code"
+    });
+  }
+  const cleanEmail = email.trim().toLowerCase();
+  const now = Date.now();
+  let dbUser = null;
+  try {
+    const bindingName = globalThis.process?.env?.QARPEO_DEFAULT_DB_BINDING || "DB";
+    const d1 = getD1Binding(bindingName, event);
+    await ensureAuthTables(d1);
+    dbUser = await d1.prepare("SELECT * FROM _qarpeo_users WHERE email = ? LIMIT 1").bind(cleanEmail).first();
+    if (!dbUser) {
+      const userId = crypto.randomUUID();
+      await d1.prepare(`
+          INSERT INTO _qarpeo_users (id, email, email_verified, name, avatar_url, role, created_at, updated_at)
+          VALUES (?, ?, 1, ?, NULL, 'user', ?, ?)
+        `).bind(userId, cleanEmail, cleanEmail.split("@")[0], now, now).run();
+      dbUser = {
+        id: userId,
+        email: cleanEmail,
+        email_verified: 1,
+        name: cleanEmail.split("@")[0],
+        role: "user"
+      };
+    } else if (!dbUser.email_verified) {
+      await d1.prepare("UPDATE _qarpeo_users SET email_verified = 1, updated_at = ? WHERE id = ?").bind(now, dbUser.id).run();
+    }
+  } catch {
+  }
+  const finalUser = dbUser ? {
+    id: dbUser.id,
+    email: dbUser.email,
+    name: dbUser.name,
+    avatarUrl: dbUser.avatar_url,
+    emailVerified: true,
+    role: dbUser.role || "user"
+  } : {
+    id: crypto.randomUUID(),
+    email: cleanEmail,
+    name: cleanEmail.split("@")[0],
+    emailVerified: true,
+    role: "user"
+  };
+  const authConfig = getQarpeoConfig(event).auth;
+  const sessionConfig = authConfig.session || {};
+  let sessionId;
+  try {
+    const deviceSession = await createDeviceSession(event, finalUser, {
+      provider: "otp",
+      maxAge: sessionConfig.maxAge || 604800,
+      maxSessionsPerUser: sessionConfig.maxSessionsPerUser ?? 5,
+      backend: sessionConfig.backend || "cookie"
+    });
+    sessionId = deviceSession.sessionId;
+  } catch {
+  }
+  const sessionData = {
+    user: finalUser,
+    provider: "otp",
+    sessionId,
+    loggedInAt: now,
+    tenantId: event?.context?.tenant?.id ?? void 0
+  };
+  await setAuthSession(event, sessionData);
+  return { success: true, user: finalUser };
+});

package/dist/runtime/server/routes/auth/sessions/[id].delete.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    revoked: boolean;
+    sessionId: string;
+}>>;
+export default _default;

package/dist/runtime/server/routes/auth/sessions/[id].delete.mjs

@@ -0,0 +1,24 @@
+import { defineEventHandler, getRouterParam, createError } from "nuxt/server";
+import { revokeDeviceSession, requireAuthSession } from "../../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const userId = session.user?.id;
+  if (!userId) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
+  }
+  const sessionId = getRouterParam(event, "id");
+  if (!sessionId) {
+    throw createError({ statusCode: 400, statusMessage: "Missing session ID" });
+  }
+  if (session?.sessionId === sessionId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Cannot revoke current session. Use POST /api/auth/logout instead."
+    });
+  }
+  const ok = await revokeDeviceSession(event, userId, sessionId);
+  if (!ok) {
+    throw createError({ statusCode: 404, statusMessage: "Session not found or already revoked" });
+  }
+  return { revoked: true, sessionId };
+});

package/dist/runtime/server/routes/auth/sessions.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<import("../../utils/session").SessionListItem[]>>;
+export default _default;

package/dist/runtime/server/routes/auth/sessions.get.mjs

@@ -0,0 +1,11 @@
+import { defineEventHandler } from "nuxt/server";
+import { listDeviceSessions, requireAuthSession } from "../../utils/session.mjs";
+export default defineEventHandler(async (event) => {
+  const session = await requireAuthSession(event);
+  const userId = session.user?.id;
+  if (!userId) {
+    return [];
+  }
+  const currentSessionId = session?.sessionId;
+  return await listDeviceSessions(event, userId, currentSessionId);
+});

package/dist/runtime/server/routes/auth/sso/login.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<string>>;
+export default _default;