ta_data_mas 0.0.2

package/apps/api/src/auth/guards/jwt-auth-guard.ts

@@ -0,0 +1,40 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Request } from 'express';
+import { COOKIE_KEYS } from '@apiDatabase/constants';
+import type { JwtPayload } from '@apiDatabase/types';
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+
+    const token = request.cookies?.[COOKIE_KEYS.ACCESS_TOKEN] as
+      string | undefined;
+
+    if (!token) {
+      throw new UnauthorizedException('Not authenticated');
+    }
+
+    try {
+      const payload = this.jwtService.verify<JwtPayload>(token, {
+        secret: this.configService.get<string>('JWT_ACCESS_SECRET'),
+      });
+      request['user'] = payload;
+      return true;
+    } catch {
+      throw new UnauthorizedException('Invalid or expired token');
+    }
+  }
+}

package/apps/api/src/auth/guards/org-role.guards.ts

@@ -0,0 +1,60 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { and, eq, isNull } from 'drizzle-orm';
+import { DrizzleService } from '../../db/drizzle.service';
+import { organizations, orgMembers } from '../../db/schema';
+import { ORG_ROLE_KEY } from '../decorators/require-org-role-decorator';
+import type { OrgRole, JwtPayload } from '@apiDatabase/types';
+import { Request } from 'express';
+
+interface AuthenticatedRequest extends Request {
+  user: JwtPayload;
+  memberRole?: string;
+}
+
+@Injectable()
+export class OrgRoleGuard implements CanActivate {
+  constructor(
+    private drizzle: DrizzleService,
+    private reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const requiredRole = this.reflector.get<OrgRole>(
+      ORG_ROLE_KEY,
+      context.getHandler(),
+    );
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const user = request.user;
+    const orgSlug = request.params['slug'] as string;
+
+    const [member] = await this.drizzle.db
+      .select({ role: orgMembers.role })
+      .from(orgMembers)
+      .innerJoin(organizations, eq(orgMembers.orgId, organizations.id))
+      .where(
+        and(
+          eq(organizations.slug, orgSlug),
+          eq(orgMembers.userId, user.sub),
+          isNull(orgMembers.removedAt),
+        ),
+      )
+      .limit(1);
+
+    if (!member) throw new NotFoundException('Organization not found');
+
+    if (requiredRole && member.role !== requiredRole) {
+      throw new ForbiddenException('Insufficient permissions');
+    }
+
+    request.memberRole = member.role;
+    return true;
+  }
+}

package/apps/api/src/db/db.module.ts

@@ -0,0 +1,9 @@
+import { Module, Global } from '@nestjs/common';
+import { DrizzleService } from './drizzle.service';
+
+@Global()
+@Module({
+  providers: [DrizzleService],
+  exports: [DrizzleService],
+})
+export class DbModule {}

package/apps/api/src/db/drizzle.service.ts

@@ -0,0 +1,16 @@
+import { Injectable, OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { drizzle } from 'drizzle-orm/neon-http';
+import * as schema from './schema';
+
+@Injectable()
+export class DrizzleService implements OnModuleInit {
+  public db!: ReturnType<typeof drizzle<typeof schema>>;
+
+  constructor(private config: ConfigService) {}
+
+  onModuleInit() {
+    const databaseUrl = this.config.get<string>('DATABASE_URL')!;
+    this.db = drizzle(databaseUrl, { schema });
+  }
+}

package/apps/api/src/db/schema/index.ts

@@ -0,0 +1,6 @@
+export * from './users';
+export * from './organizations';
+export * from './projects';
+export * from './query-history';
+export * from './storage-buckets';
+export * from './storage-objects';

package/apps/api/src/db/schema/organizations.ts

@@ -0,0 +1,30 @@
+import { pgEnum, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { users } from './users';
+
+export const orgRoleEnum = pgEnum('org_role', ['admin', 'developer']);
+
+export const organizations = pgTable('organizations', {
+  id: uuid().defaultRandom().primaryKey(),
+  name: text('name').notNull(),
+  slug: text('slug').notNull().unique(),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+
+export const orgMembers = pgTable('org_members', {
+  id: uuid().defaultRandom().primaryKey(),
+  orgId: uuid('org_id')
+    .notNull()
+    .references(() => organizations.id, { onDelete: 'cascade' }),
+  userId: uuid('user_id')
+    .notNull()
+    .references(() => users.id, { onDelete: 'cascade' }),
+  role: orgRoleEnum('role').notNull().default('developer'),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  removedAt: timestamp('removed_at'),
+});
+
+export type Organization = typeof organizations.$inferSelect;
+export type NewOrganization = typeof organizations.$inferInsert;
+export type OrgMember = typeof orgMembers.$inferSelect;
+export type NewOrgMember = typeof orgMembers.$inferInsert;

package/apps/api/src/db/schema/projects.ts

@@ -0,0 +1,26 @@
+import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { organizations } from './organizations';
+
+export const projects = pgTable('projects', {
+  id: uuid().defaultRandom().primaryKey(),
+  orgId: uuid('org_id')
+    .notNull()
+    .references(() => organizations.id, { onDelete: 'cascade' }),
+  name: text('name').notNull(),
+  slug: text('slug').notNull().unique(),
+  dbSchema: text('db_schema').notNull().unique(),
+  projectUrl: text('project_url').notNull().unique(),
+  anonKey: text('anon_key').notNull(),
+  serviceRoleKey: text('service_role_key').notNull(),
+  googleClientId: text('google_client_id'),
+  googleClientSecret: text('google_client_secret'),
+  githubClientId: text('github_client_id'),
+  githubClientSecret: text('github_client_secret'),
+  authJwtSecret: text('auth_jwt_secret').notNull(),
+  siteUrl: text('site_url'),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+
+export type Project = typeof projects.$inferSelect;
+export type NewProject = typeof projects.$inferInsert;

package/apps/api/src/db/schema/query-history.ts

@@ -0,0 +1,16 @@
+import { pgTable, text, timestamp, uuid, integer } from 'drizzle-orm/pg-core';
+import { projects } from './projects';
+
+export const queryHistory = pgTable('query_history', {
+  id: uuid().defaultRandom().primaryKey(),
+  projectId: uuid('project_id')
+    .notNull()
+    .references(() => projects.id, { onDelete: 'cascade' }),
+  sql: text('sql').notNull(),
+  executionTimeMs: integer('execution_time_ms').notNull(),
+  rowCount: integer('row_count').notNull(),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+});
+
+export type QueryHistoryItem = typeof queryHistory.$inferSelect;
+export type NewQueryHistoryItem = typeof queryHistory.$inferInsert;

package/apps/api/src/db/schema/storage-buckets.ts

@@ -0,0 +1,17 @@
+import { pgEnum, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { projects } from './projects';
+
+export const bucketAccessEnum = pgEnum('bucket_access', ['public', 'private']);
+
+export const storageBuckets = pgTable('storage_buckets', {
+  id: uuid().defaultRandom().primaryKey(),
+  projectId: uuid('project_id')
+    .notNull()
+    .references(() => projects.id, { onDelete: 'cascade' }),
+  name: text('name').notNull(),
+  access: bucketAccessEnum('access').notNull().default('public'),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+});
+
+export type StorageBucket = typeof storageBuckets.$inferSelect;
+export type NewStorageBucket = typeof storageBuckets.$inferInsert;

package/apps/api/src/db/schema/storage-objects.ts

@@ -0,0 +1,18 @@
+import { integer, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { storageBuckets } from './storage-buckets';
+
+export const storageObjects = pgTable('storage_objects', {
+  id: uuid().defaultRandom().primaryKey(),
+  bucketId: uuid('bucket_id')
+    .notNull()
+    .references(() => storageBuckets.id, { onDelete: 'cascade' }),
+  name: text('name').notNull(),
+  size: integer('size').notNull(),
+  mimeType: text('mime_type').notNull(),
+  utKey: text('ut_key').notNull(),
+  url: text('url').notNull().default(''),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+});
+
+export type StorageObject = typeof storageObjects.$inferSelect;
+export type NewStorageObject = typeof storageObjects.$inferInsert;

package/apps/api/src/db/schema/users.ts

@@ -0,0 +1,14 @@
+import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+
+export const users = pgTable('users', {
+  id: uuid().defaultRandom().primaryKey(),
+  email: text('email').notNull().unique(),
+  name: text('name'),
+  avatarUrl: text('avatar_url'),
+  passwordHash: text('password_hash'),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;

package/apps/api/src/main.ts

@@ -0,0 +1,51 @@
+import { NestFactory } from '@nestjs/core';
+import { AppModule } from './app.module';
+import { ValidationPipe } from '@nestjs/common';
+import cookieParser from 'cookie-parser';
+import { IoAdapter } from '@nestjs/platform-socket.io';
+
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule);
+
+  app.useWebSocketAdapter(new IoAdapter(app));
+
+  app.use(cookieParser());
+
+  app.setGlobalPrefix('api'); // /api/....
+
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  );
+
+  app.enableCors({
+    origin: process.env.WEB_URL ?? 'http://localhost:3001',
+    credentials: true,
+  });
+
+  // app.enableCors({
+  //   origin: (origin, callback) => {
+  //     // allow server-to-server / curl (no Origin header)
+  //     if (!origin) return callback(null, true);
+
+  //     const webUrl = process.env.WEB_URL ?? 'http://localhost:3001';
+  //     if (origin === webUrl) return callback(null, true);
+
+  //     // SDK demo: npx serve . from packages/apiDatabase-js (any localhost port)
+  //     if (/^http:\/\/localhost(:\d+)?$/.test(origin)) {
+  //       return callback(null, true);
+  //     }
+
+  //     callback(new Error(`CORS blocked: ${origin}`));
+  //   },
+  //   credentials: true,
+  // });
+
+  const port = process.env.PORT ?? 3001;
+  await app.listen(port);
+  console.log(`API running on http://localhost:${port}/api`);
+}
+void bootstrap();

package/apps/api/src/members/dto/invite-member-dto.ts

@@ -0,0 +1,6 @@
+import { IsEmail } from 'class-validator';
+
+export class InviteMemberDto {
+  @IsEmail()
+  email!: string;
+}

package/apps/api/src/members/dto/update-role.dto.ts

@@ -0,0 +1,8 @@
+import { IsEnum } from 'class-validator';
+import { ORG_ROLES } from '@apiDatabase/constants';
+import type { OrgRole } from '@apiDatabase/types';
+
+export class UpdateRoleDto {
+  @IsEnum(ORG_ROLES)
+  role!: OrgRole;
+}

package/apps/api/src/members/invite.service.ts

@@ -0,0 +1,147 @@
+import { Injectable, BadRequestException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Resend } from 'resend';
+import { and, eq, isNull } from 'drizzle-orm';
+import { DrizzleService } from '../db/drizzle.service';
+import { organizations, orgMembers, users } from '../db/schema';
+import { INVITE_EXPIRES_IN } from '@apiDatabase/constants';
+
+interface InvitePayload {
+  email: string;
+  orgId: string;
+  orgName: string;
+}
+
+@Injectable()
+export class InviteService {
+  private resend: Resend;
+
+  constructor(
+    private drizzle: DrizzleService,
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {
+    this.resend = new Resend(this.configService.get('RESEND_API_KEY'));
+  }
+
+  async sendInvite(orgSlug: string, email: string) {
+    // get the org
+    const [org] = await this.drizzle.db
+      .select()
+      .from(organizations)
+      .where(eq(organizations.slug, orgSlug))
+      .limit(1);
+
+    if (!org) throw new BadRequestException('Organization not found');
+
+    // check if user is already an active member
+    const existingUser = await this.drizzle.db
+      .select({ id: users.id })
+      .from(users)
+      .where(eq(users.email, email))
+      .limit(1);
+
+    if (existingUser.length > 0) {
+      const existingMember = await this.drizzle.db
+        .select()
+        .from(orgMembers)
+        .where(
+          and(
+            eq(orgMembers.orgId, org.id),
+            eq(orgMembers.userId, existingUser[0].id),
+            isNull(orgMembers.removedAt),
+          ),
+        )
+        .limit(1);
+
+      if (existingMember.length > 0) {
+        throw new BadRequestException(
+          'User is already a member of this organization',
+        );
+      }
+    }
+
+    // sign invite token — expires in 24h
+    const token = this.jwtService.sign(
+      { email, orgId: org.id, orgName: org.name } satisfies InvitePayload,
+      {
+        secret: this.configService.get('INVITE_SECRET'),
+        expiresIn: INVITE_EXPIRES_IN,
+      },
+    );
+
+    const inviteUrl = `${this.configService.get<string>('API_URL')}/auth/invite/accept?token=${token}`;
+
+    // send the email via Resend
+    await this.resend.emails.send({
+      from: 'onboarding@resend.dev',
+      to: email,
+      subject: `You've been invited to join ${org.name} on Api_Database`,
+      html: `
+        <div style="font-family: sans-serif; max-width: 480px; margin: 0 auto;">
+          <h2>You're invited to join ${org.name}</h2>
+          <p>Someone has invited you to collaborate on Api_Database.</p>
+          <a
+            href="${inviteUrl}"
+            style="display: inline-block; background: #000; color: #fff; padding: 12px 24px; border-radius: 8px; text-decoration: none; font-weight: 600; margin: 16px 0;">
+            Accept invite
+          </a>
+          <p style="color: #999; font-size: 13px;">This link expires in 24 hours.</p>
+        </div>
+      `,
+    });
+
+    return { message: 'Invite sent' };
+  }
+
+  async acceptInvite(token: string) {
+    let payload: InvitePayload;
+
+    try {
+      payload = this.jwtService.verify<InvitePayload>(token, {
+        secret: this.configService.get('INVITE_SECRET'),
+      });
+    } catch {
+      throw new BadRequestException('Invalid or expired invite link');
+    }
+
+    let [user] = await this.drizzle.db
+      .select()
+      .from(users)
+      .where(eq(users.email, payload.email))
+      .limit(1);
+
+    if (!user) {
+      const [newUser] = await this.drizzle.db
+        .insert(users)
+        .values({ email: payload.email })
+        .returning();
+      user = newUser;
+    }
+
+    const existing = await this.drizzle.db
+      .select()
+      .from(orgMembers)
+      .where(
+        and(
+          eq(orgMembers.orgId, payload.orgId),
+          eq(orgMembers.userId, user.id),
+          isNull(orgMembers.removedAt),
+        ),
+      )
+      .limit(1);
+
+    if (existing.length > 0) {
+      return { message: 'Already a member' };
+    }
+
+    await this.drizzle.db.insert(orgMembers).values({
+      orgId: payload.orgId,
+      userId: user.id,
+      role: 'developer',
+    });
+
+    return { message: 'Invite accepted', email: user.email };
+  }
+}

package/apps/api/src/members/members.controller.ts

@@ -0,0 +1,56 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { MembersService } from './members.service';
+import { InviteService } from './invite.service';
+import { UpdateRoleDto } from './dto/update-role.dto';
+import { InviteMemberDto } from './dto/invite-member-dto';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+import { RequireOrgRole } from '../auth/decorators/require-org-role-decorator';
+
+@Controller('orgs/:slug/members')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class MembersController {
+  constructor(
+    private membersService: MembersService,
+    private inviteService: InviteService,
+  ) {}
+
+  @Get()
+  getMembers(@Param('slug') slug: string) {
+    return this.membersService.getMembers(slug);
+  }
+
+  @Patch(':memberId/role')
+  @RequireOrgRole('admin')
+  updateRole(
+    @Param('slug') slug: string,
+    @Param('memberId') memberId: string,
+    @Body() dto: UpdateRoleDto,
+  ) {
+    return this.membersService.updateRole(slug, memberId, dto);
+  }
+
+  @Delete(':memberId')
+  @RequireOrgRole('admin')
+  removeMember(
+    @Param('slug') slug: string,
+    @Param('memberId') memberId: string,
+  ) {
+    return this.membersService.removeMember(slug, memberId);
+  }
+
+  @Post('invite')
+  @RequireOrgRole('admin')
+  sendInvite(@Param('slug') slug: string, @Body() dto: InviteMemberDto) {
+    return this.inviteService.sendInvite(slug, dto.email);
+  }
+}

package/apps/api/src/members/members.module.ts

@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { MembersService } from './members.service';
+import { InviteService } from './invite.service';
+import { MembersController } from './members.controller';
+
+@Module({
+  imports: [JwtModule.register({})],
+  providers: [MembersService, InviteService],
+  controllers: [MembersController],
+  exports: [InviteService],
+})
+export class MembersModule {}

package/apps/api/src/members/members.service.ts

@@ -0,0 +1,85 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { and, eq, isNull } from 'drizzle-orm';
+import { DrizzleService } from '../db/drizzle.service';
+import { orgMembers, organizations, users } from '../db/schema';
+import { UpdateRoleDto } from './dto/update-role.dto';
+
+@Injectable()
+export class MembersService {
+  constructor(private drizzle: DrizzleService) {}
+
+  async getMembers(orgSlug: string) {
+    return this.drizzle.db
+      .select({
+        id: orgMembers.id,
+        role: orgMembers.role,
+        createdAt: orgMembers.createdAt,
+        user: {
+          id: users.id,
+          name: users.name,
+          email: users.email,
+          avatarUrl: users.avatarUrl,
+        },
+      })
+      .from(orgMembers)
+      .innerJoin(organizations, eq(orgMembers.orgId, organizations.id))
+      .innerJoin(users, eq(orgMembers.userId, users.id))
+      .where(
+        and(eq(organizations.slug, orgSlug), isNull(orgMembers.removedAt)),
+      );
+  }
+
+  async updateRole(orgSlug: string, memberId: string, dto: UpdateRoleDto) {
+    if (dto.role === 'developer') {
+      await this.ensureNotLastAdmin(orgSlug, memberId);
+    }
+
+    const [updated] = await this.drizzle.db
+      .update(orgMembers)
+      .set({ role: dto.role })
+      .where(eq(orgMembers.id, memberId))
+      .returning();
+
+    if (!updated) throw new NotFoundException('Member not found');
+    return updated;
+  }
+
+  async removeMember(orgSlug: string, memberId: string) {
+    await this.ensureNotLastAdmin(orgSlug, memberId);
+
+    const [updated] = await this.drizzle.db
+      .update(orgMembers)
+      .set({ removedAt: new Date() })
+      .where(eq(orgMembers.id, memberId))
+      .returning();
+
+    if (!updated) throw new NotFoundException('Member not found');
+    return { message: 'Member removed' };
+  }
+
+  private async ensureNotLastAdmin(orgSlug: string, memberId: string) {
+    const admins = await this.drizzle.db
+      .select({ id: orgMembers.id })
+      .from(orgMembers)
+      .innerJoin(organizations, eq(orgMembers.orgId, organizations.id))
+      .where(
+        and(
+          eq(organizations.slug, orgSlug),
+          eq(orgMembers.role, 'admin'),
+          isNull(orgMembers.removedAt),
+        ),
+      );
+
+    const targetIsAdmin = admins.some((a) => a.id === memberId);
+
+    if (targetIsAdmin && admins.length === 1) {
+      throw new BadRequestException(
+        'Cannot remove or demote the last admin of an organization',
+      );
+    }
+  }
+}

package/apps/api/src/orgs/dto/create-org.dto.ts

@@ -0,0 +1,8 @@
+import { IsString, MinLength } from 'class-validator';
+import type { CreateOrgInput } from '@apiDatabase/types';
+
+export class CreateOrgDto implements CreateOrgInput {
+  @IsString()
+  @MinLength(2)
+  name!: string;
+}

package/apps/api/src/orgs/orgs.controller.ts

@@ -0,0 +1,27 @@
+import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
+import { OrgsService } from './orgs.service';
+import { CreateOrgDto } from './dto/create-org.dto';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { CurrentUser } from '../auth/decorators/current-user-decorator';
+import type { JwtPayload } from '@apiDatabase/types';
+
+@Controller('orgs')
+@UseGuards(JwtAuthGuard)
+export class OrgsController {
+  constructor(private orgsService: OrgsService) {}
+
+  @Get()
+  getMyOrgs(@CurrentUser() user: JwtPayload) {
+    return this.orgsService.getMyOrgs(user.sub);
+  }
+
+  @Get(':slug')
+  getOrgBySlug(@Param('slug') slug: string, @CurrentUser() user: JwtPayload) {
+    return this.orgsService.getOrgBySlug(slug, user.sub);
+  }
+
+  @Post()
+  createOrg(@Body() dto: CreateOrgDto, @CurrentUser() user: JwtPayload) {
+    return this.orgsService.createOrg(dto, user.sub);
+  }
+}