ta_data_mas 0.0.2

package/apps/api/src/orgs/orgs.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { OrgsService } from './orgs.service';
+import { OrgsController } from './orgs.controller';
+import { AuthModule } from '../auth/auth.module';
+
+@Module({
+  imports: [AuthModule],
+  providers: [OrgsService],
+  controllers: [OrgsController],
+  exports: [OrgsService],
+})
+export class OrgsModule {}

package/apps/api/src/orgs/orgs.service.ts

@@ -0,0 +1,86 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { and, eq, isNull, sql } from 'drizzle-orm';
+import { randomBytes } from 'crypto';
+import slugify from 'slugify';
+import { DrizzleService } from '../db/drizzle.service';
+import { organizations, orgMembers, projects } from '../db/schema';
+import { CreateOrgDto } from './dto/create-org.dto';
+
+@Injectable()
+export class OrgsService {
+  constructor(private drizzle: DrizzleService) {}
+
+  private generateOrgSlug(name: string): string {
+    const base = slugify(`${name}-org`, { lower: true, strict: true });
+    const suffix = randomBytes(3).toString('hex');
+    return `${base}-${suffix}`;
+  }
+
+  async getMyOrgs(userId: string) {
+    return this.drizzle.db
+      .select({
+        id: organizations.id,
+        name: organizations.name,
+        slug: organizations.slug,
+        createdAt: organizations.createdAt,
+        updatedAt: organizations.updatedAt,
+        role: orgMembers.role,
+        projectCount: sql<number>`cast(count(distinct ${projects.id}) as int)`,
+        memberCount: sql<number>`(
+          select cast(count(*) as int)
+          from org_members om
+          where om.org_id = ${organizations.id}
+            and om.removed_at is null
+        )`,
+      })
+      .from(orgMembers)
+      .innerJoin(organizations, eq(orgMembers.orgId, organizations.id))
+      .leftJoin(projects, eq(projects.orgId, organizations.id))
+      .where(and(eq(orgMembers.userId, userId), isNull(orgMembers.removedAt)))
+      .groupBy(organizations.id, orgMembers.role);
+  }
+
+  async getOrgBySlug(slug: string, userId: string) {
+    const [row] = await this.drizzle.db
+      .select({
+        id: organizations.id,
+        name: organizations.name,
+        slug: organizations.slug,
+        createdAt: organizations.createdAt,
+        updatedAt: organizations.updatedAt,
+        role: orgMembers.role,
+      })
+      .from(organizations)
+      .innerJoin(
+        orgMembers,
+        and(
+          eq(orgMembers.orgId, organizations.id),
+          eq(orgMembers.userId, userId),
+          isNull(orgMembers.removedAt),
+        ),
+      )
+      .where(eq(organizations.slug, slug))
+      .limit(1);
+
+    if (!row) throw new NotFoundException('Organization not found');
+    return row;
+  }
+
+  async createOrg(dto: CreateOrgDto, userId: string) {
+    const [org] = await this.drizzle.db
+      .insert(organizations)
+      .values({
+        name: dto.name,
+        slug: this.generateOrgSlug(dto.name),
+      })
+      .returning();
+
+    await this.drizzle.db.insert(orgMembers).values({
+      orgId: org.id,
+      userId,
+      role: 'admin',
+    });
+
+    return org;
+  }
+}

package/apps/api/src/project-api/project-api.controller.ts

@@ -0,0 +1,95 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from '@nestjs/common';
+import type { Request as ExpressRequest } from 'express';
+import { PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+import { ProjectApiService } from './project-api.service';
+import { ProjectKeyGuard, ProjectKeyPayload } from './project-key.guard';
+
+@Controller('projects/:projectSlug/rest')
+@UseGuards(ProjectKeyGuard)
+export class ProjectApiController {
+  constructor(private projectApiService: ProjectApiService) {}
+
+  private getProjectKey(req: ExpressRequest): ProjectKeyPayload {
+    return req['projectKey'] as ProjectKeyPayload;
+  }
+
+  private assertWriteAccess(req: ExpressRequest): void {
+    const { role } = this.getProjectKey(req);
+    if (role !== PROJECT_KEY_ROLES.SERVICE_ROLE) {
+      throw new ForbiddenException(
+        'Write operations require the service role key',
+      );
+    }
+  }
+
+  @Get(':table')
+  getRows(
+    @Req() req: ExpressRequest,
+    @Param('projectSlug') projectSlug: string,
+    @Param('table') table: string,
+    @Query() query: Record<string, string>,
+  ) {
+    const { projectId } = this.getProjectKey(req);
+    return this.projectApiService.getRows(projectId, projectSlug, table, query);
+  }
+
+  @Post(':table')
+  insertRow(
+    @Req() req: ExpressRequest,
+    @Param('projectSlug') projectSlug: string,
+    @Param('table') table: string,
+    @Body() body: Record<string, unknown>,
+  ) {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    return this.projectApiService.insertRow(
+      projectId,
+      projectSlug,
+      table,
+      body,
+    );
+  }
+
+  @Patch(':table/:id')
+  updateRow(
+    @Req() req: ExpressRequest,
+    @Param('projectSlug') projectSlug: string,
+    @Param('table') table: string,
+    @Param('id') id: string,
+    @Body() body: Record<string, unknown>,
+  ) {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    return this.projectApiService.updateRow(
+      projectId,
+      projectSlug,
+      table,
+      id,
+      body,
+    );
+  }
+
+  @Delete(':table/:id')
+  deleteRow(
+    @Req() req: ExpressRequest,
+    @Param('projectSlug') projectSlug: string,
+    @Param('table') table: string,
+    @Param('id') id: string,
+  ) {
+    this.assertWriteAccess(req);
+    const { projectId } = this.getProjectKey(req);
+    return this.projectApiService.deleteRow(projectId, projectSlug, table, id);
+  }
+}

package/apps/api/src/project-api/project-api.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { ProjectApiService } from './project-api.service';
+import { ProjectApiController } from './project-api.controller';
+import { ProjectKeyGuard } from './project-key.guard';
+
+@Module({
+  imports: [JwtModule.register({})],
+  providers: [ProjectApiService, ProjectKeyGuard],
+  controllers: [ProjectApiController],
+})
+export class ProjectApiModule {}

package/apps/api/src/project-api/project-api.service.ts

@@ -0,0 +1,196 @@
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { eq } from 'drizzle-orm';
+import { DrizzleService } from '../db/drizzle.service';
+import { projects } from '../db/schema';
+import { parseQueryParams, buildWhereClause } from './query-parser';
+
+@Injectable()
+export class ProjectApiService {
+  constructor(private drizzle: DrizzleService) {}
+
+  private assertSafeIdentifier(name: string, label: string): void {
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+      throw new BadRequestException(`Invalid ${label}: ${name}`);
+    }
+  }
+
+  private formatLiteral(value: unknown): string {
+    if (value === null || value === undefined) return 'NULL';
+    if (typeof value === 'boolean') return value ? 'TRUE' : 'FALSE';
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return String(value);
+    }
+    if (typeof value === 'string') {
+      return `'${value.replace(/'/g, "''")}'`;
+    }
+    if (typeof value === 'object') {
+      return `'${JSON.stringify(value).replace(/'/g, "''")}'::jsonb`;
+    }
+    throw new BadRequestException('Unsupported column value');
+  }
+
+  async resolveProjectSchema(
+    projectId: string,
+    projectSlug: string,
+  ): Promise<string> {
+    const [project] = await this.drizzle.db
+      .select({ dbSchema: projects.dbSchema, slug: projects.slug })
+      .from(projects)
+      .where(eq(projects.id, projectId))
+      .limit(1);
+
+    if (!project) throw new NotFoundException('Project not found');
+
+    if (project.slug !== projectSlug) {
+      throw new ForbiddenException('API key does not match this project URL');
+    }
+
+    return project.dbSchema;
+  }
+
+  private async getPrimaryKeyColumn(
+    schema: string,
+    tableName: string,
+  ): Promise<string> {
+    const result = await this.drizzle.db.execute<{ column_name: string }>(
+      `SELECT kcu.column_name
+       FROM information_schema.table_constraints tc
+       JOIN information_schema.key_column_usage kcu
+         ON tc.constraint_name = kcu.constraint_name
+         AND tc.table_schema = kcu.table_schema
+       WHERE tc.constraint_type = 'PRIMARY KEY'
+         AND tc.table_schema = '${schema}'
+         AND tc.table_name = '${tableName}'
+       ORDER BY kcu.ordinal_position ASC
+       LIMIT 1`,
+    );
+
+    const pk = result.rows[0]?.column_name;
+    if (!pk) {
+      throw new BadRequestException(`Table "${tableName}" has no primary key`);
+    }
+
+    return pk;
+  }
+
+  async getRows(
+    projectId: string,
+    projectSlug: string,
+    tableName: string,
+    rawParams: Record<string, string>,
+  ) {
+    this.assertSafeIdentifier(tableName, 'table name');
+    const schema = await this.resolveProjectSchema(projectId, projectSlug);
+    const { select, filters, orderBy, limit, offset } =
+      parseQueryParams(rawParams);
+
+    const columns =
+      select.length > 0 ? select.map((c) => `"${c}"`).join(', ') : '*';
+
+    const where = buildWhereClause(filters);
+    const order = orderBy
+      ? `ORDER BY "${orderBy.column}" ${orderBy.direction}`
+      : '';
+
+    const sql = `
+      SELECT ${columns}
+      FROM "${schema}"."${tableName}"
+      ${where}
+      ${order}
+      LIMIT ${limit}
+      OFFSET ${offset}
+    `;
+
+    const result = await this.drizzle.db.execute<Record<string, unknown>>(sql);
+    return result.rows;
+  }
+
+  async insertRow(
+    projectId: string,
+    projectSlug: string,
+    tableName: string,
+    body: Record<string, unknown>,
+  ) {
+    this.assertSafeIdentifier(tableName, 'table name');
+    const schema = await this.resolveProjectSchema(projectId, projectSlug);
+
+    const entries = Object.entries(body);
+    if (entries.length === 0) {
+      throw new BadRequestException('Request body cannot be empty');
+    }
+
+    entries.forEach(([col]) => this.assertSafeIdentifier(col, 'column name'));
+
+    const columns = entries.map(([c]) => `"${c}"`).join(', ');
+    const values = entries.map(([, v]) => this.formatLiteral(v)).join(', ');
+
+    const sql = `
+      INSERT INTO "${schema}"."${tableName}" (${columns})
+      VALUES (${values})
+      RETURNING *
+    `;
+
+    const result = await this.drizzle.db.execute<Record<string, unknown>>(sql);
+    return result.rows[0];
+  }
+
+  async updateRow(
+    projectId: string,
+    projectSlug: string,
+    tableName: string,
+    rowId: string,
+    body: Record<string, unknown>,
+  ) {
+    this.assertSafeIdentifier(tableName, 'table name');
+    const schema = await this.resolveProjectSchema(projectId, projectSlug);
+    const pkColumn = await this.getPrimaryKeyColumn(schema, tableName);
+
+    const entries = Object.entries(body);
+    if (entries.length === 0) {
+      throw new BadRequestException('Request body cannot be empty');
+    }
+
+    entries.forEach(([col]) => this.assertSafeIdentifier(col, 'column name'));
+
+    const setClauses = entries
+      .map(([col, val]) => `"${col}" = ${this.formatLiteral(val)}`)
+      .join(', ');
+
+    const sql = `
+      UPDATE "${schema}"."${tableName}"
+      SET ${setClauses}
+      WHERE "${pkColumn}" = ${this.formatLiteral(rowId)}
+      RETURNING *
+    `;
+
+    const result = await this.drizzle.db.execute<Record<string, unknown>>(sql);
+    if (!result.rows[0]) throw new NotFoundException('Row not found');
+    return result.rows[0];
+  }
+
+  async deleteRow(
+    projectId: string,
+    projectSlug: string,
+    tableName: string,
+    rowId: string,
+  ) {
+    this.assertSafeIdentifier(tableName, 'table name');
+    const schema = await this.resolveProjectSchema(projectId, projectSlug);
+    const pkColumn = await this.getPrimaryKeyColumn(schema, tableName);
+
+    const sql = `
+      DELETE FROM "${schema}"."${tableName}"
+      WHERE "${pkColumn}" = ${this.formatLiteral(rowId)}
+      RETURNING *
+    `;
+
+    const result = await this.drizzle.db.execute<Record<string, unknown>>(sql);
+    if (!result.rows[0]) throw new NotFoundException('Row not found');
+    return result.rows[0];
+  }
+}

package/apps/api/src/project-api/project-key.guard.ts

@@ -0,0 +1,45 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Request } from 'express';
+import { PROJECT_KEY_ROLES } from '@apiDatabase/constants';
+
+export interface ProjectKeyPayload {
+  projectId: string;
+  role: typeof PROJECT_KEY_ROLES.ANON | typeof PROJECT_KEY_ROLES.SERVICE_ROLE;
+}
+
+@Injectable()
+export class ProjectKeyGuard implements CanActivate {
+  constructor(
+    private jwtService: JwtService,
+    private configService: ConfigService,
+  ) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+    const authHeader = request.headers.authorization;
+
+    if (!authHeader?.startsWith('Bearer ')) {
+      throw new UnauthorizedException('Missing API key');
+    }
+
+    const token = authHeader.slice(7);
+
+    try {
+      const payload = this.jwtService.verify<ProjectKeyPayload>(token, {
+        secret: this.configService.get<string>('PROJECT_JWT_SECRET'),
+      });
+
+      request['projectKey'] = payload;
+      return true;
+    } catch {
+      throw new UnauthorizedException('Invalid API key');
+    }
+  }
+}

package/apps/api/src/project-api/query-parser.ts

@@ -0,0 +1,129 @@
+import { BadRequestException } from '@nestjs/common';
+import {
+  RESERVED_QUERY_PARAMS,
+  FILTER_OPERATORS,
+  type FilterOperator,
+} from '@apiDatabase/constants';
+
+export interface ParsedQuery {
+  select: string[];
+  filters: FilterClause[];
+  orderBy: OrderClause | null;
+  limit: number;
+  offset: number;
+}
+
+interface FilterClause {
+  column: string;
+  operator: string;
+  value: string;
+}
+
+interface OrderClause {
+  column: string;
+  direction: 'ASC' | 'DESC';
+}
+
+function assertSafeIdentifier(name: string, label: string): void {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+    throw new BadRequestException(`Invalid ${label}: ${name}`);
+  }
+}
+
+function formatSqlValue(operator: string, rawValue: string): string {
+  const value = rawValue.replace(/;/g, '');
+
+  if (operator === 'IS') {
+    return value.toUpperCase() === 'NULL' ? 'NULL' : 'NOT NULL';
+  }
+
+  if (operator === 'LIKE' || operator === 'ILIKE') {
+    return `'${value.replace(/'/g, "''")}'`;
+  }
+
+  if (value.toLowerCase() === 'true' || value.toLowerCase() === 'false') {
+    return value.toLowerCase();
+  }
+
+  if (/^-?\d+(\.\d+)?$/.test(value)) {
+    return value;
+  }
+
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+export function parseQueryParams(params: Record<string, string>): ParsedQuery {
+  const filters: FilterClause[] = [];
+  let select: string[] = [];
+  let orderBy: OrderClause | null = null;
+  let limit = 100;
+  let offset = 0;
+
+  for (const [key, value] of Object.entries(params)) {
+    if (RESERVED_QUERY_PARAMS.has(key)) {
+      switch (key) {
+        case 'select':
+          select = value
+            .split(',')
+            .map((c) => c.trim())
+            .filter(Boolean);
+          select.forEach((col) => assertSafeIdentifier(col, 'select column'));
+          break;
+        case 'order': {
+          const [col, dir] = value.split('.');
+          assertSafeIdentifier(col, 'order column');
+          orderBy = {
+            column: col,
+            direction: dir?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC',
+          };
+          break;
+        }
+        case 'limit':
+          limit = Math.min(parseInt(value, 10) || 100, 1000);
+          break;
+        case 'offset':
+          offset = Math.max(parseInt(value, 10) || 0, 0);
+          break;
+      }
+      continue;
+    }
+
+    assertSafeIdentifier(key, 'filter column');
+
+    const dotIndex = value.indexOf('.');
+    if (dotIndex === -1) continue;
+
+    const operator = value.slice(0, dotIndex) as FilterOperator;
+    const filterValue = value.slice(dotIndex + 1);
+
+    if (!(operator in FILTER_OPERATORS)) continue;
+
+    filters.push({
+      column: key,
+      operator: FILTER_OPERATORS[operator],
+      value: filterValue,
+    });
+  }
+
+  return { select, filters, orderBy, limit, offset };
+}
+
+export function buildWhereClause(filters: FilterClause[]): string {
+  if (filters.length === 0) return '';
+
+  const clauses = filters.map(({ column, operator, value }) => {
+    const sqlValue = formatSqlValue(operator, value);
+
+    if (operator === 'IS') {
+      return `"${column}" IS ${sqlValue}`;
+    }
+
+    if (operator === 'LIKE' || operator === 'ILIKE') {
+      return `"${column}" ${operator} ${sqlValue}`;
+    }
+
+    return `"${column}" ${operator} ${sqlValue}`;
+  });
+
+  return `WHERE ${clauses.join(' AND ')}`;
+}

package/apps/api/src/project-auth/dto/magic-link.dto.ts

@@ -0,0 +1,7 @@
+import { IsEmail } from 'class-validator';
+import type { MagicLinkInput } from '@apiDatabase/types';
+
+export class MagicLinkDto implements MagicLinkInput {
+  @IsEmail()
+  email!: string;
+}

package/apps/api/src/project-auth/dto/signin.dto.ts

@@ -0,0 +1,10 @@
+import { IsEmail, IsString } from 'class-validator';
+import type { SignInInput } from '@apiDatabase/types';
+
+export class SignInDto implements SignInInput {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  password!: string;
+}

package/apps/api/src/project-auth/dto/signup.dto.ts

@@ -0,0 +1,11 @@
+import { IsEmail, IsString, MinLength } from 'class-validator';
+import type { SignUpInput } from '@apiDatabase/types';
+
+export class SignUpDto implements SignUpInput {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @MinLength(8)
+  password!: string;
+}

package/apps/api/src/project-auth/project-auth-dashboard.controller.ts

@@ -0,0 +1,35 @@
+import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
+import { ProjectAuthService } from './project-auth.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth-guard';
+import { OrgRoleGuard } from '../auth/guards/org-role.guards';
+
+@Controller('orgs/:slug/projects/:projectSlug/auth')
+@UseGuards(JwtAuthGuard, OrgRoleGuard)
+export class ProjectAuthDashboardController {
+  constructor(private projectAuthService: ProjectAuthService) {}
+
+  @Get('users')
+  getUsers(@Param('projectSlug') projectSlug: string) {
+    return this.projectAuthService.getUsers(projectSlug);
+  }
+
+  @Get('settings')
+  getSettings(@Param('projectSlug') projectSlug: string) {
+    return this.projectAuthService.getOAuthSettings(projectSlug);
+  }
+
+  @Post('settings')
+  updateSettings(
+    @Param('projectSlug') projectSlug: string,
+    @Body()
+    settings: {
+      siteUrl?: string;
+      googleClientId?: string;
+      googleClientSecret?: string;
+      githubClientId?: string;
+      githubClientSecret?: string;
+    },
+  ) {
+    return this.projectAuthService.updateOAuthSettings(projectSlug, settings);
+  }
+}