tapimo 0.0.2 → 0.2.0

package/src/apps/platform/routes/me.ts

@@ -0,0 +1,106 @@
+import { Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Db from '../../../db/Db.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Users from '../../../db/tables/users.js'
+
+/** Zod schemas owned by the current-user resource. */
+export namespace schema {
+  /** The signed-in developer. */
+  export const User = Schema.describe(
+    z.object({
+      address: z
+        .optional(z.string())
+        .check(
+          z.describe('Wallet address bound to this user, when wallet sign-in established it.'),
+          z.meta({ examples: ['0x0000000000000000000000000000000000000001'] }),
+        ),
+      createdAt: z
+        .string()
+        .check(
+          z.describe('When the user was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+      email: z
+        .optional(z.string())
+        .check(z.describe('Verified email from the wallet identity token, when present.')),
+      id: z
+        .string()
+        .check(
+          z.describe('Opaque user id (`usr_…`).'),
+          z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      updatedAt: z
+        .string()
+        .check(
+          z.describe('When the user was last updated (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+    }),
+    'The signed-in developer.',
+  )
+}
+
+/**
+ * Mounts the `/me` resource: the session's user. Session lane only — API keys
+ * identify workloads, not developers.
+ */
+export function me() {
+  return new Hono<App.Environment>().get(
+    '/v1/me',
+    Auth.policy({ session: true }),
+    OpenApi.describeRoute({
+      operationId: 'getMe',
+      responses: OpenApi.responses({
+        errors: {
+          403: 'The caller is not a signed-in user.',
+          404: 'No user exists for this session.',
+        },
+        success: { description: 'The authenticated user.', schema: schema.User },
+      }),
+      summary: 'Get current user',
+      tags: ['Users'],
+    }),
+    async (c) => {
+      if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+
+      // The session lane is the only lane here; `super_admin` bypasses lanes
+      // but has no user row, so it is rejected too.
+      const principal = Auth.getPrincipal(c)
+      if (principal?.type !== 'session')
+        return Response.error(c, {
+          code: 'forbidden',
+          message: 'Session required',
+          status: 403,
+        })
+
+      const db = Db.get(c.get('db'))
+      try {
+        const user = await Users.get(db, principal.id)
+        if (!user)
+          return Response.error(c, {
+            code: 'user_not_found',
+            message: 'User not found',
+            status: 404,
+          })
+        return c.json(
+          Response.validated(schema.User, {
+            ...(user.address ? { address: user.address } : {}),
+            createdAt: user.createdAt,
+            ...(user.email ? { email: user.email } : {}),
+            id: user.id,
+            updatedAt: user.updatedAt,
+          }),
+          200,
+        )
+      } catch (cause) {
+        return Response.upstream(c, cause)
+      }
+    },
+  )
+}

package/src/apps/platform/routes/members.test.ts

@@ -0,0 +1,195 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as Members from './members.js'
+import * as Orgs from './orgs.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+function createApp(db = TestApp.database()) {
+  return TestApp.create({ db, session: { wallet: { origin } } })
+}
+
+/** Signs in a fresh scripted account; returns its cookie and user id. */
+async function session(app: ReturnType<typeof createApp>) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  const me = await app.request('/v1/me', { headers: { cookie: cookie! } })
+  const { id } = (await me.json()) as { id: string }
+  return { cookie: cookie!, userId: id }
+}
+
+/** An org owned by `owner`, with `member` seeded at the given role. */
+async function team(
+  app: ReturnType<typeof createApp>,
+  db: ReturnType<typeof TestApp.database>,
+  role: Memberships.Role,
+) {
+  const owner = await session(app)
+  const member = await session(app)
+  const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+  const org = await TestApp.json(created, Orgs.schema.Organization)
+  await Memberships.create(db, { orgId: org.id, role, userId: member.userId })
+  return { member, org, owner }
+}
+
+describe('members', () => {
+  test('lists the team with roles and identity', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+
+    const response = await app.request(`/v1/orgs/${org.id}/members`, {
+      headers: { cookie: member.cookie },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Members.schema.listMembers.Response)
+    expect(body.data.map(({ role, userId }) => ({ role, userId }))).toEqual([
+      { role: 'owner', userId: owner.userId },
+      { role: 'member', userId: member.userId },
+    ])
+    expect(body.data[0]!.address).toMatch(/^0x/)
+  })
+
+  test('tiers write access by role across the surface', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org } = await team(app, db, 'member')
+
+    // Members read the org but cannot manage it or its projects.
+    const read = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie: member.cookie } })
+    expect(read.status).toBe(200)
+    const rename = await app.request(`/v1/orgs/${org.id}`, json('PATCH', member.cookie, { name: 'Steal' })) // prettier-ignore
+    expect(rename.status).toBe(403)
+    const project = await app.request(`/v1/orgs/${org.id}/projects`, json('POST', member.cookie, { name: 'Nope' })) // prettier-ignore
+    expect(project.status).toBe(403)
+
+    // Admins manage projects but not the org itself.
+    const admin = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: admin.userId })
+    const adminProject = await app.request(`/v1/orgs/${org.id}/projects`, json('POST', admin.cookie, { name: 'Checkout' })) // prettier-ignore
+    expect(adminProject.status).toBe(200)
+    const adminRename = await app.request(`/v1/orgs/${org.id}`, json('PATCH', admin.cookie, { name: 'Steal' })) // prettier-ignore
+    expect(adminRename.status).toBe(403)
+    const adminDelete = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie: admin.cookie },
+      method: 'DELETE',
+    })
+    expect(adminDelete.status).toBe(403)
+  })
+
+  test('owners change roles; the last owner cannot be demoted', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+
+    const promoted = await app.request(
+      `/v1/orgs/${org.id}/members/${member.userId}`,
+      json('PATCH', owner.cookie, { role: 'admin' }),
+    )
+    expect(promoted.status).toBe(200)
+    expect((await TestApp.json(promoted, Members.schema.Member)).role).toBe('admin')
+
+    // A non-owner cannot change roles.
+    const foreign = await app.request(
+      `/v1/orgs/${org.id}/members/${owner.userId}`,
+      json('PATCH', member.cookie, { role: 'member' }),
+    )
+    expect(foreign.status).toBe(403)
+
+    const demoted = await app.request(
+      `/v1/orgs/${org.id}/members/${owner.userId}`,
+      json('PATCH', owner.cookie, { role: 'member' }),
+    )
+    expect(demoted.status).toBe(409)
+    const { requestId, ...body } = (await demoted.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "last_owner",
+          "message": "The organization would be left without an owner",
+        },
+      }
+    `)
+  })
+
+  test('concurrent demotions cannot strip the last owner', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    // Two owners, each demoting the other at the same time: the guard must let
+    // exactly one through so the org is never left ownerless.
+    const second = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'owner', userId: second.userId })
+
+    const [a, b] = await Promise.all([
+      app.request(`/v1/orgs/${org.id}/members/${owner.userId}`, json('PATCH', second.cookie, { role: 'member' })), // prettier-ignore
+      app.request(`/v1/orgs/${org.id}/members/${second.userId}`, json('PATCH', owner.cookie, { role: 'member' })), // prettier-ignore
+    ])
+    expect([a.status, b.status].sort()).toEqual([200, 409])
+    const owners = (await Memberships.listByOrg(db, org.id)).filter(({ role }) => role === 'owner')
+    expect(owners).toHaveLength(1)
+  })
+
+  test('owners remove members; members remove only themselves', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+    const other = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: other.userId })
+
+    // A member cannot remove someone else.
+    const foreign = await app.request(`/v1/orgs/${org.id}/members/${other.userId}`, {
+      headers: { cookie: member.cookie },
+      method: 'DELETE',
+    })
+    expect(foreign.status).toBe(403)
+
+    // A member removes themself (leaves).
+    const left = await app.request(`/v1/orgs/${org.id}/members/${member.userId}`, {
+      headers: { cookie: member.cookie },
+      method: 'DELETE',
+    })
+    expect(left.status).toBe(200)
+    const gone = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie: member.cookie } })
+    expect(gone.status).toBe(404)
+
+    // The owner removes the other member; the last owner cannot leave.
+    const removed = await app.request(`/v1/orgs/${org.id}/members/${other.userId}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(removed.status).toBe(200)
+    const lastOwner = await app.request(`/v1/orgs/${org.id}/members/${owner.userId}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(lastOwner.status).toBe(409)
+  })
+
+  test('hides the team from foreign sessions', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { org } = await team(app, db, 'member')
+
+    const stranger = await session(app)
+    const response = await app.request(`/v1/orgs/${org.id}/members`, {
+      headers: { cookie: stranger.cookie },
+    })
+    expect(response.status).toBe(404)
+  })
+})

package/src/apps/platform/routes/members.ts

@@ -0,0 +1,313 @@
+import { type Context, Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Db from '../../../db/Db.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Users from '../../../db/tables/users.js'
+
+/** Zod schemas owned by the members resource. */
+export namespace schema {
+  /** A membership role. */
+  export const Role = z
+    .enum(Memberships.roles)
+    .check(z.describe('Membership role.'), z.meta({ examples: ['admin'] }))
+
+  /** One organization member: the membership plus the member's identity. */
+  export const Member = Schema.describe(
+    z.object({
+      address: z
+        .optional(z.string())
+        .check(
+          z.describe("The member's wallet address, when wallet sign-in established it."),
+          z.meta({ examples: ['0x20f414b3cbcf1fd8e8f5e1c1c2e3d4a5b6c7d8e9'] }),
+        ),
+      createdAt: z
+        .string()
+        .check(
+          z.describe('When the member joined (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+      email: z
+        .optional(z.string())
+        .check(
+          z.describe("The member's verified email, when known."),
+          z.meta({ examples: ['dev@example.com'] }),
+        ),
+      role: Role,
+      userId: z
+        .string()
+        .check(
+          z.describe('Member user id (`usr_…`).'),
+          z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    }),
+    "One organization member: the membership plus the member's identity.",
+  )
+
+  /** Path parameters addressing an organization's member collection. */
+  export const Params = z
+    .object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe("Path parameters for an organization's members."))
+
+  /** Path parameters addressing one member. */
+  export const MemberParams = z
+    .object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      userId: z
+        .string()
+        .check(
+          z.describe('The member user id (`usr_…`).'),
+          z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe('Path parameters for one member.'))
+
+  /** Request body changing a member's role. */
+  export const MemberBody = z
+    .object({ role: Role })
+    .check(z.describe("Fields for changing a member's role."))
+
+  /** Schemas for the listMembers operation. */
+  export namespace listMembers {
+    /** Non-paginated list of an organization's members. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z.array(Member).check(z.describe('The members, oldest first.')),
+      }),
+      "A non-paginated list of an organization's members.",
+    )
+  }
+
+  /** Schemas for the removeMember operation. */
+  export namespace removeMember {
+    /** Confirmation that the member was removed. */
+    export const Response = z
+      .object({
+        userId: z
+          .string()
+          .check(
+            z.describe('User id (`usr_…`) of the removed member.'),
+            z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Confirmation that the member was removed.'))
+  }
+}
+
+/**
+ * Mounts the `/orgs/:orgId/members` resource: the organization's team.
+ * Members read; owners change roles and remove members (any member may remove
+ * themself). The last owner can never be demoted or removed.
+ */
+export function members() {
+  return new Hono<App.Environment>()
+    .get(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg(),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'listMembers',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: {
+            description: 'The members, oldest first.',
+            schema: schema.listMembers.Response,
+          },
+        }),
+        summary: 'List members',
+        tags: ['Members'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const db = Db.get(c.get('db'))
+        try {
+          const records = await Memberships.listByOrgDetailed(db, Auth.org(c).id)
+          return c.json(
+            Response.validated(schema.listMembers.Response, {
+              data: records.map(serializeMember),
+            }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .patch(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members/:userId{usr_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'owner' }),
+      OpenApi.validate('param', schema.MemberParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.validate('json', schema.MemberBody, {
+        code: 'body_invalid',
+        message: 'Check the request body and try again.',
+      }),
+      OpenApi.describeRoute({
+        description: "Change a member's role. The last owner cannot be demoted.",
+        operationId: 'updateMember',
+        responses: OpenApi.responses({
+          errors: {
+            404: 'No accessible member was found for this id.',
+            409: {
+              codes: ['last_owner'],
+              description: 'The organization would be left without an owner.',
+            },
+          },
+          success: { description: 'The updated member.', schema: schema.Member },
+        }),
+        summary: 'Update member',
+        tags: ['Members'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+          })
+
+        const { userId } = c.req.valid('param')
+        const body = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          const result = await Memberships.update(db, Auth.org(c).id, userId, { role: body.role })
+          if (result.error === 'last_owner') return lastOwner(c)
+          if (result.error) return memberNotFound(c)
+          const user = await Users.get(db, userId)
+          if (!user) return memberNotFound(c)
+          return c.json(
+            Response.validated(
+              schema.Member,
+              serializeMember({ ...result.record, address: user.address, email: user.email }),
+            ),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .delete(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/members/:userId{usr_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg(),
+      OpenApi.validate('param', schema.MemberParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description: 'Remove a member. Owners remove anyone; any member removes themself. The last owner cannot be removed.', // prettier-ignore
+        operationId: 'removeMember',
+        responses: OpenApi.responses({
+          errors: {
+            404: 'No accessible member was found for this id.',
+            409: {
+              codes: ['last_owner'],
+              description: 'The organization would be left without an owner.',
+            },
+          },
+          success: {
+            description: 'Confirmation that the member was removed.',
+            schema: schema.removeMember.Response,
+          },
+        }),
+        summary: 'Remove member',
+        tags: ['Members'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const { userId } = c.req.valid('param')
+        // Owners remove anyone; everyone else only themself (leaving the org).
+        const caller = Auth.membership(c)
+        if (caller && caller.role !== 'owner' && caller.userId !== userId)
+          return Response.error(c, {
+            code: 'forbidden',
+            message: 'Requires the owner role',
+            status: 403,
+          })
+
+        const db = Db.get(c.get('db'))
+        try {
+          const result = await Memberships.remove(db, Auth.org(c).id, userId)
+          if (result === 'last_owner') return lastOwner(c)
+          if (result === 'not_found') return memberNotFound(c)
+          return c.json(Response.validated(schema.removeMember.Response, { userId }), 200)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+}
+
+/** Projects a detailed membership row onto the member shape. */
+function serializeMember(
+  record: Memberships.Record & { address: string | null; email: string | null },
+) {
+  return {
+    ...(record.address === null ? {} : { address: record.address }),
+    createdAt: record.createdAt,
+    ...(record.email === null ? {} : { email: record.email }),
+    role: record.role,
+    userId: record.userId,
+  }
+}
+
+function lastOwner(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'last_owner',
+    message: 'The organization would be left without an owner',
+    status: 409,
+  })
+}
+
+function memberNotFound(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'member_not_found',
+    message: 'Member not found',
+    status: 404,
+  })
+}