tapimo 0.0.2 → 0.2.0

package/src/apps/platform/routes/invitations.test.ts

@@ -0,0 +1,361 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as App from '../App.js'
+import * as TestApp from '../../../../test/App.js'
+import * as Invitations from '../../../db/tables/invitations.js'
+import * as InvitationsApp from './invitations.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as Orgs from './orgs.js'
+import * as Users from '../../../db/tables/users.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+/** In-memory email sender capturing dispatched messages. */
+function sender() {
+  const sent: App.Email.Message[] = []
+  const email = {
+    from: 'noreply@tempo.test',
+    send: (message: App.Email.Message) => {
+      sent.push(message)
+      return Promise.resolve()
+    },
+  } satisfies App.Email
+  return { email, sent }
+}
+
+/** Super admin secret configured on the test app. */
+const secret = 'tempo:sk:d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3'
+
+function createApp(options: { db?: ReturnType<typeof TestApp.database>; email?: App.Email } = {}) {
+  return TestApp.create({
+    auth: { superAdmin: { secret } },
+    db: options.db ?? TestApp.database(),
+    ...(options.email ? { email: options.email } : {}),
+    session: { wallet: { origin } },
+  })
+}
+
+/** Signs in a fresh scripted account; returns its cookie and user id. */
+async function session(app: ReturnType<typeof createApp>) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  const me = await app.request('/v1/me', { headers: { cookie: cookie! } })
+  const { id } = (await me.json()) as { id: string }
+  return { cookie: cookie!, userId: id }
+}
+
+describe('invitations', () => {
+  test('invites, surfaces, and accepts into membership', async () => {
+    const db = TestApp.database()
+    const { email, sent } = sender()
+    const app = createApp({ db, email })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'Dev@Example.com', role: 'member' }),
+    )
+    expect(invited.status).toBe(200)
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+    expect(invitation.id).toMatch(/^inv_/)
+    expect(invitation.email).toBe('dev@example.com')
+
+    // The invitation email dispatched through the app's sender.
+    expect(sent).toHaveLength(1)
+    expect(sent[0]!.to).toBe('dev@example.com')
+    expect(sent[0]!.subject).toContain('Acme')
+    expect(sent[0]!.text).toMatchInlineSnapshot(`
+      "You've been invited to join Acme on the Tempo Developer Platform
+
+      Sign in at https://console.tempo.xyz/?email=dev%40example.com to accept. This invitation expires in 7 days."
+    `)
+    expect(sent[0]!.html).toContain('<strong>Acme</strong>')
+    expect(sent[0]!.html).toContain('https://console.tempo.xyz/?email=dev%40example.com')
+
+    // Invisible without a verified email; visible once it matches.
+    const invitee = await session(app)
+    const before = await app.request('/v1/invitations', { headers: { cookie: invitee.cookie } })
+    expect(
+      (await TestApp.json(before, InvitationsApp.schema.listMyInvitations.Response)).data,
+    ).toEqual([])
+    await Users.setEmail(db, invitee.userId, 'dev@example.com')
+    const after = await app.request('/v1/invitations', { headers: { cookie: invitee.cookie } })
+    const mine = await TestApp.json(after, InvitationsApp.schema.listMyInvitations.Response)
+    expect(mine.data.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
+      { id: invitation.id, orgName: 'Acme' },
+    ])
+
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(200)
+    const membership = await TestApp.json(accepted, InvitationsApp.schema.acceptInvitation.Response) // prettier-ignore
+    expect(membership).toEqual({ orgId: org.id, role: 'member', userId: invitee.userId })
+
+    // Membership grants access; the pending lists drain on both sides.
+    const read = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie: invitee.cookie } })
+    expect(read.status).toBe(200)
+    const orgPending = await app.request(`/v1/orgs/${org.id}/invitations`, {
+      headers: { cookie: owner.cookie },
+    })
+    expect(
+      (await TestApp.json(orgPending, InvitationsApp.schema.listInvitations.Response)).data,
+    ).toEqual([])
+
+    // Accepting again fails: the invitation is settled.
+    const again = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(again.status).toBe(404)
+  })
+
+  test('accepting elevates an existing member but never demotes', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    // A standing member accepts an admin invitation: the role is elevated.
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'dev@example.com')
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: invitee.userId })
+    const promote = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'admin' }),
+    )
+    const promoteInvite = await TestApp.json(promote, InvitationsApp.schema.Invitation)
+    const promoted = await app.request(`/v1/invitations/${promoteInvite.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect((await TestApp.json(promoted, InvitationsApp.schema.acceptInvitation.Response)).role).toBe('admin') // prettier-ignore
+    expect((await Memberships.get(db, org.id, invitee.userId))?.role).toBe('admin')
+
+    // A lower-role invitation to the same member is a no-op, never a demotion.
+    const demote = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const demoteInvite = await TestApp.json(demote, InvitationsApp.schema.Invitation)
+    const demoted = await app.request(`/v1/invitations/${demoteInvite.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect((await TestApp.json(demoted, InvitationsApp.schema.acceptInvitation.Response)).role).toBe('admin') // prettier-ignore
+    expect((await Memberships.get(db, org.id, invitee.userId))?.role).toBe('admin')
+  })
+
+  test('re-inviting a pending email refreshes the invitation, not duplicates it', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const first = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const firstInvite = await TestApp.json(first, InvitationsApp.schema.Invitation)
+    const second = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'admin' }),
+    )
+    const secondInvite = await TestApp.json(second, InvitationsApp.schema.Invitation)
+
+    // Same row, refreshed role — a single pending invitation remains.
+    expect(secondInvite.id).toBe(firstInvite.id)
+    expect(secondInvite.role).toBe('admin')
+    const listed = await app.request(`/v1/orgs/${org.id}/invitations`, {
+      headers: { cookie: owner.cookie },
+    })
+    const pending = await TestApp.json(listed, InvitationsApp.schema.listInvitations.Response)
+    expect(pending.data).toHaveLength(1)
+    expect(pending.data[0]!.role).toBe('admin')
+  })
+
+  test('enforces the inviter role ladder', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const admin = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: admin.userId })
+    const member = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+
+    // Members cannot invite at all; admins cannot grant above their role.
+    const byMember = await app.request(`/v1/orgs/${org.id}/invitations`, json('POST', member.cookie, { email: 'a@example.com', role: 'member' })) // prettier-ignore
+    expect(byMember.status).toBe(403)
+    const escalated = await app.request(`/v1/orgs/${org.id}/invitations`, json('POST', admin.cookie, { email: 'a@example.com', role: 'owner' })) // prettier-ignore
+    expect(escalated.status).toBe(403)
+    // Admins cannot grant their own role either — only strictly below it.
+    const peer = await app.request(`/v1/orgs/${org.id}/invitations`, json('POST', admin.cookie, { email: 'a@example.com', role: 'admin' })) // prettier-ignore
+    expect(peer.status).toBe(403)
+    const byAdmin = await app.request(`/v1/orgs/${org.id}/invitations`, json('POST', admin.cookie, { email: 'a@example.com', role: 'member' })) // prettier-ignore
+    expect(byAdmin.status).toBe(200)
+    const byOwner = await app.request(`/v1/orgs/${org.id}/invitations`, json('POST', owner.cookie, { email: 'b@example.com', role: 'owner' })) // prettier-ignore
+    expect(byOwner.status).toBe(200)
+  })
+
+  test('revoked and expired invitations cannot be accepted', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'dev@example.com')
+
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+    const revoked = await app.request(`/v1/orgs/${org.id}/invitations/${invitation.id}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+    const acceptRevoked = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(acceptRevoked.status).toBe(404)
+
+    // Expired: seeded directly with a past expiry through the table module.
+    const expired = await Invitations.create(db, {
+      email: 'dev@example.com',
+      expiresAt: '2020-01-01T00:00:00.000Z',
+      invitedBy: owner.userId,
+      orgId: org.id,
+      role: 'member',
+    })
+    const listed = await app.request('/v1/invitations', { headers: { cookie: invitee.cookie } })
+    expect(
+      (await TestApp.json(listed, InvitationsApp.schema.listMyInvitations.Response)).data,
+    ).toEqual([])
+    const acceptExpired = await app.request(`/v1/invitations/${expired.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(acceptExpired.status).toBe(404)
+  })
+
+  test("hides invitations addressed to someone else's email", async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+
+    const other = await session(app)
+    await Users.setEmail(db, other.userId, 'other@example.com')
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: other.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(404)
+  })
+
+  test('a failing email sender never fails the invite', async () => {
+    const app = createApp({
+      email: {
+        from: 'noreply@tempo.test',
+        send: () => Promise.reject(new Error('smtp down')),
+      },
+    })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    expect(invited.status).toBe(200)
+  })
+
+  test('super admin provisions an org and seats its first owner', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+
+    // The super admin creates a memberless org and invites the first owner.
+    const created = await app.request('/v1/orgs', {
+      body: JSON.stringify({ name: 'Provisioned' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(created.status).toBe(200)
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const invited = await app.request(`/v1/orgs/${org.id}/invitations`, {
+      body: JSON.stringify({ email: 'founder@example.com', role: 'owner' }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
+      method: 'POST',
+    })
+    expect(invited.status).toBe(200)
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+    expect(invitation.invitedBy).toBe('super_admin')
+
+    // The invitee accepts and holds owner powers.
+    const founder = await session(app)
+    await Users.setEmail(db, founder.userId, 'founder@example.com')
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: founder.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(200)
+    const renamed = await app.request(
+      `/v1/orgs/${org.id}`,
+      json('PATCH', founder.cookie, { name: 'Founded' }),
+    )
+    expect(renamed.status).toBe(200)
+  })
+
+  test('embeds the configured console origin in the email link', async () => {
+    const sent: App.Email.Message[] = []
+    const app = createApp({
+      email: {
+        consoleUrl: 'https://portal.selfhost.example',
+        from: 'noreply@selfhost.example',
+        send: (message) => {
+          sent.push(message)
+          return Promise.resolve()
+        },
+      },
+    })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    expect(invited.status).toBe(200)
+    expect(sent[0]!.text).toContain('https://portal.selfhost.example/?email=dev%40example.com')
+  })
+})