spine-framework 0.3.56 → 0.3.58

package/.framework/functions/_shared/index.ts

@@ -76,7 +76,7 @@ export type { RequestContext, HandlerFunction, HandlerResult } from './middlewar
  * createHandler — wraps a handler function with auth, principal resolution, and audit.
  * Use this when writing Netlify function handlers.
  */
-export { createHandler, requireUserContext, requireSystemContextWithAudit, json, error as errorResponse, cors } from './middleware'
+export { createHandler, createPublicHandler, requireUserContext, requireSystemContextWithAudit, json, error as errorResponse, cors } from './middleware'
 
 // ============================================
 // Identity — Principal model

package/.framework/functions/_shared/middleware.ts

@@ -274,6 +274,96 @@ export function createHandler(handler: HandlerFunction) {
   }
 }
 
+// ─── PUBLIC HANDLER FACTORY ────────────────────────────────────────────────────
+
+/**
+ * Wraps a handler function without requiring authentication.
+ * Used for public endpoints like check-first-user, check-domain, validate-token.
+ * 
+ * Similar to createHandler but allows anonymous principals.
+ */
+export function createPublicHandler(handler: HandlerFunction) {
+  return async (event: any, context: any) => {
+    // Detect nested call: if event is already a RequestContext with a principal,
+    // skip event parsing and call the raw handler directly
+    if (event && event.requestId && event.principal) {
+      return handler(event, context)
+    }
+
+    const requestId = crypto.randomUUID()
+    const startTime = Date.now()
+    
+    try {
+      // Parse headers
+      const appId = event.headers?.['x-app-id'] || event.headers?.['X-App-Id']
+      
+      // Parse query string parameters
+      const queryParams: Record<string, string> = {}
+      if (event.queryStringParameters) {
+        Object.assign(queryParams, event.queryStringParameters)
+      }
+      if (!queryParams.method && event.httpMethod) {
+        queryParams.method = event.httpMethod
+      }
+
+      // Resolve principal - may be anonymous for public endpoints
+      const principal = await resolvePrincipal(event)
+      
+      // Get RLS-scoped database client based on principal type
+      // For anonymous users, this returns adminDb (service role)
+      const ctxDb = getPrincipalDb(principal)
+      
+      // Build request context
+      const ctx: RequestContext = {
+        requestId,
+        principal,
+        db: ctxDb,
+        accountId: principal?.accountId || null,
+        appId: appId || null,
+        query: queryParams,
+        requestPath: event.path || '/',
+      }
+      
+      // Parse body
+      let body = null
+      if (event.body) {
+        try {
+          body = JSON.parse(event.body)
+        } catch (e) {
+          return error('Invalid JSON in request body', 400)
+        }
+      }
+      if (ctx.query.id) {
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+          body = {}
+        }
+        if (!('id' in body)) {
+          body.id = ctx.query.id
+        }
+      }
+      
+      // Execute handler
+      const result = await handler(ctx, body)
+      const durationMs = Date.now() - startTime
+      
+      // Return success response
+      return json({
+        data: result,
+        error: null,
+        meta: {
+          requestId,
+          duration: durationMs
+        }
+      })
+      
+    } catch (err: any) {
+      console.error(`[${requestId}] Public handler error:`, err)
+      const status = typeof err.statusCode === 'number' ? err.statusCode : 500
+      return error(err.message || 'Internal server error', status)
+    }
+  }
+}
+
 // ─── RESPONSE HELPERS ────────────────────────────────────────────────────────
 
 /**

package/.framework/functions/invites.ts

@@ -52,7 +52,7 @@
  * @seeAlso src/components/shared/InviteManager.tsx  (UI)
  */
 
-import { createHandler } from './_shared/middleware'
+import { createHandler, createPublicHandler } from './_shared/middleware'
 import { adminDb } from './_shared/db'
 import { emitLog } from './_shared/audit'
 
@@ -213,7 +213,7 @@ export const validateToken = createHandler(async (_ctx, _body) => {
  *   (invite path is handled entirely in the DB trigger)
  */
 export const completeRegistration = createHandler(async (ctx, body) => {
-  const { path, account_name, email } = body
+  const { path, account_name, email, role_slug } = body
 
   if (!path || !email) {
     throw new Error('path and email are required')
@@ -238,14 +238,45 @@ export const completeRegistration = createHandler(async (ctx, body) => {
       .eq('slug', 'account')
       .single()
 
-    // Resolve member_admin role (fall back to member if not seeded yet)
-    const { data: role } = await adminDb
+    // Resolve role from role_slug param, or fall back to member_admin/member lookup
+    const targetRoleSlug = role_slug || 'member'
+    let { data: roles } = await adminDb
       .from('roles')
       .select('id')
-      .in('slug', ['member_admin', 'member'])
-      .order('slug')   // member_admin sorts before member
+      .eq('slug', targetRoleSlug)
       .limit(1)
-      .single()
+
+    let role = roles?.[0]
+
+    // If specific role not found, try member_admin or member as fallback
+    if (!role) {
+      const { data: fallbackRoles } = await adminDb
+        .from('roles')
+        .select('id')
+        .in('slug', ['member_admin', 'member'])
+        .order('slug')
+        .limit(1)
+      role = fallbackRoles?.[0]
+    }
+
+    // If no roles exist yet (apps not installed), create a default member role
+    if (!role) {
+      const { data: newRole, error: roleErr } = await adminDb
+        .from('roles')
+        .insert({
+          slug: 'member',
+          name: 'Member',
+          description: 'Default member role with basic permissions',
+          permissions: { items: ['read', 'create'], accounts: ['read'] },
+          is_active: true,
+        })
+        .select('id')
+        .single()
+
+      if (!roleErr && newRole) {
+        role = newRole
+      }
+    }
 
     // Create account
     const slug = generateAccountSlug(account_name)
@@ -281,15 +312,28 @@ export const completeRegistration = createHandler(async (ctx, body) => {
   }
 
   if (path === 'join_request') {
-    const { target_account_id } = body
+    const { target_account_id, role_slug } = body
     if (!target_account_id) throw new Error('target_account_id is required for join_request')
 
-    // Resolve member role
-    const { data: role } = await adminDb
+    // Resolve role from role_slug param, or fall back to member
+    const targetRoleSlug = role_slug || 'member'
+    let { data: roles } = await adminDb
       .from('roles')
       .select('id')
-      .eq('slug', 'member')
-      .single()
+      .eq('slug', targetRoleSlug)
+      .limit(1)
+
+    let role = roles?.[0]
+
+    // Fallback to member if specific role not found
+    if (!role) {
+      const { data: fallbackRoles } = await adminDb
+        .from('roles')
+        .select('id')
+        .eq('slug', 'member')
+        .limit(1)
+      role = fallbackRoles?.[0]
+    }
 
     // Resolve type_id
     const { data: personType } = await adminDb
@@ -633,16 +677,16 @@ export const deny = createHandler(async (ctx, body) => {
 
 // ─── MAIN HANDLER ────────────────────────────────────────────────────────────
 
-export const handler = createHandler(async (ctx, body) => {
+export const handler = createPublicHandler(async (ctx, body) => {
   const action = ctx.query?.action
 
   switch (action) {
-    // Public
+    // Public endpoints (no auth required)
     case 'check-first-user':    return await checkFirstUser(ctx, body)
     case 'check-domain':        return await checkDomain(ctx, body)
     case 'validate-token':      return await validateToken(ctx, body)
     case 'complete-registration': return await completeRegistration(ctx, body)
-    // Protected
+    // Protected endpoints (require auth)
     case 'create-invite':       return await createInvite(ctx, body)
     case 'list-invites':        return await listInvites(ctx, body)
     case 'revoke-invite':       return await revokeInvite(ctx, body)

package/.framework/src/pages/auth/RegisterPage.tsx

@@ -234,11 +234,17 @@ export function RegisterPage() {
       // 4. Walk-up paths — call complete-registration
       const resolvedEmail = email
 
+      // Determine role from URL params or config
+      const urlRole = searchParams.get('role')
+      const urlApp = searchParams.get('app')
+      const effectiveRole = urlRole || (urlApp && regConfig?.apps[urlApp]?.role) || regConfig?.default_role || 'member'
+
       if (domainMatchChoice === 'join') {
         // Join existing account as access_request
         const joinResult = await callInvitesApi('complete-registration', {
           path: 'join_request',
           email: resolvedEmail,
+          role_slug: effectiveRole,
         }, 'POST')
 
         if (joinResult.error) {
@@ -255,6 +261,7 @@ export function RegisterPage() {
         path: 'new_account',
         email: resolvedEmail,
         account_name: accountName,
+        role_slug: effectiveRole,
       }, 'POST')
 
       if (newResult.error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.56",
+  "version": "0.3.58",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {