tapimo 0.0.2 → 0.2.0

package/src/apps/platform/routes/projects.test.ts

@@ -0,0 +1,181 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Orgs from './orgs.js'
+import * as Projects from './projects.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+function createApp() {
+  return TestApp.create({ session: { wallet: { origin } } })
+}
+
+/** Signs in a fresh scripted account; returns its session cookie. */
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+describe('projects', () => {
+  test('creates, lists, reads, and renames projects', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Checkout' }),
+    )
+    expect(createdProject.status).toBe(200)
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+    expect(project.id.startsWith('prj_')).toBe(true)
+    expect(project.orgId).toBe(org.id)
+    expect(project.environments).toMatchInlineSnapshot(`
+      [
+        "production",
+        "sandbox",
+      ]
+    `)
+
+    const listed = await app.request(`/v1/orgs/${org.id}/projects`, { headers: { cookie } })
+    const list = await TestApp.json(listed, Projects.schema.listProjects.Response)
+    expect(list.data.map(({ name }) => name)).toEqual(['Checkout'])
+
+    const detail = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+    })
+    expect(detail.status).toBe(200)
+
+    const renamed = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}`,
+      json('PATCH', cookie, { name: 'Checkout v2' }),
+    )
+    expect(renamed.status).toBe(200)
+    expect((await TestApp.json(renamed, Projects.schema.Project)).name).toBe('Checkout v2')
+  })
+
+  test('deletes a project, leaving the organization and siblings intact', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+    const keeper = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Payments' }),
+    )
+    expect(keeper.status).toBe(200)
+
+    const stranger = await session(app)
+    const foreign = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(foreign.status).toBe(404)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deleted.status).toBe(200)
+    expect(await TestApp.json(deleted, Projects.schema.deleteProject.Response)).toEqual({
+      id: project.id,
+    })
+
+    const gone = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+    })
+    expect(gone.status).toBe(404)
+
+    const listed = await app.request(`/v1/orgs/${org.id}/projects`, { headers: { cookie } })
+    const list = await TestApp.json(listed, Projects.schema.listProjects.Response)
+    expect(list.data.map(({ name }) => name)).toEqual(['Payments'])
+
+    const orgStill = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie } })
+    expect(orgStill.status).toBe(200)
+  })
+
+  test('hides projects behind foreign organizations', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', owner, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+
+    const stranger = await session(app)
+    const foreignList = await app.request(`/v1/orgs/${org.id}/projects`, {
+      headers: { cookie: stranger },
+    })
+    expect(foreignList.status).toBe(404)
+
+    const foreignDetail = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie: stranger },
+    })
+    expect(foreignDetail.status).toBe(404)
+  })
+
+  test('rejects cross-org project ids on every verb', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', owner, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+
+    // The stranger owns a perfectly valid org of their own; the victim's
+    // project id still must not resolve through it (project ids are bound to
+    // their owning org, not just to any org the caller owns).
+    const stranger = await session(app)
+    const otherOrgResponse = await app.request('/v1/orgs', json('POST', stranger, { name: 'Other' })) // prettier-ignore
+    const otherOrg = await TestApp.json(otherOrgResponse, Orgs.schema.Organization)
+
+    const smuggled = `/v1/orgs/${otherOrg.id}/projects/${project.id}`
+    const smuggledRead = await app.request(smuggled, { headers: { cookie: stranger } })
+    expect(smuggledRead.status).toBe(404)
+    const smuggledRename = await app.request(smuggled, json('PATCH', stranger, { name: 'Hijack' })) // prettier-ignore
+    expect(smuggledRename.status).toBe(404)
+    const smuggledDelete = await app.request(smuggled, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(smuggledDelete.status).toBe(404)
+
+    // Mutations through the owning org's path fail at the org-ownership link.
+    const direct = `/v1/orgs/${org.id}/projects/${project.id}`
+    const foreignRename = await app.request(direct, json('PATCH', stranger, { name: 'Hijack' }))
+    expect(foreignRename.status).toBe(404)
+    const foreignDelete = await app.request(direct, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(foreignDelete.status).toBe(404)
+
+    // The project survives every attempt, unrenamed.
+    const detail = await app.request(direct, { headers: { cookie: owner } })
+    expect(detail.status).toBe(200)
+    expect((await TestApp.json(detail, Projects.schema.Project)).name).toBe('Checkout')
+  })
+})

package/src/apps/platform/routes/projects.ts

@@ -0,0 +1,367 @@
+import { type Context, Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import * as ApiKeys from '../../../ApiKeys.js'
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Db from '../../../db/Db.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Projects from '../../../db/tables/projects.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+
+/** Environments every project exposes; sandbox maps to testnet, production to mainnet. */
+const environments = ['production', 'sandbox'] as const
+
+/** Zod schemas owned by the projects resource. */
+export namespace schema {
+  const name = z
+    .string()
+    .check(
+      z.minLength(1),
+      z.maxLength(100),
+      z.describe('Human-readable name.'),
+      z.meta({ examples: ['Checkout'] }),
+    )
+
+  /** One project: an app or integration within an organization. */
+  export const Project = Schema.describe(
+    z.object({
+      createdAt: z
+        .string()
+        .check(
+          z.describe('When the project was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+      environments: z.array(z.enum(environments)).check(
+        z.describe('Environments available to this project: sandbox (testnet) and production (mainnet).'), // prettier-ignore
+        z.meta({ examples: [[...environments]] }),
+      ),
+      id: z
+        .string()
+        .check(
+          z.describe('Opaque project id (`prj_…`).'),
+          z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      name: z
+        .string()
+        .check(z.describe('Human-readable project name.'), z.meta({ examples: ['Checkout'] })),
+      orgId: z
+        .string()
+        .check(
+          z.describe('Owning organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      updatedAt: z
+        .string()
+        .check(
+          z.describe('When the project was last updated (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+    }),
+    'A project: an app or integration within an organization.',
+  )
+
+  /** Path parameters addressing an organization's project collection. */
+  export const Params = z
+    .object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe("Path parameters for an organization's projects."))
+
+  /** Path parameters addressing one project. */
+  export const ProjectParams = z
+    .object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      projectId: z
+        .string()
+        .check(
+          z.describe('The project id (`prj_…`).'),
+          z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe('Path parameters for one project.'))
+
+  /** Request body creating or renaming a project. */
+  export const ProjectBody = z
+    .object({ name })
+    .check(z.describe('Fields for creating or renaming a project.'))
+
+  /** Schemas for the deleteProject operation. */
+  export namespace deleteProject {
+    /** Confirmation that the project was deleted. */
+    export const Response = z
+      .object({
+        id: z
+          .string()
+          .check(
+            z.describe('ID of the project that was deleted.'),
+            z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Confirmation that the project was deleted.'))
+  }
+
+  /** Schemas for the listProjects operation. */
+  export namespace listProjects {
+    /** Non-paginated list of an organization's projects. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z.array(Project).check(z.describe('The projects, newest first.')),
+      }),
+      "A non-paginated list of an organization's projects.",
+    )
+  }
+}
+
+/**
+ * Mounts the `/orgs/:orgId/projects` resource: projects nested under their
+ * owning organization. Access follows the org scope (owning session or super
+ * admin); inaccessible or absent ids render `404`.
+ */
+export function projects() {
+  return new Hono<App.Environment>()
+    .get(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg(),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'listProjects',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: {
+            description: "The organization's projects, newest first.",
+            schema: schema.listProjects.Response,
+          },
+        }),
+        summary: 'List projects',
+        tags: ['Projects'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const db = Db.get(c.get('db'))
+        try {
+          const records = await Projects.listByOrg(db, Auth.org(c).id)
+          return c.json(
+            Response.validated(schema.listProjects.Response, {
+              data: records.map(serializeProject),
+            }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .post(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.validate('json', schema.ProjectBody, {
+        code: 'body_invalid',
+        message: 'Check the request body and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'createProject',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: { description: 'The created project.', schema: schema.Project },
+        }),
+        summary: 'Create project',
+        tags: ['Projects'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+          })
+
+        const body = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          const record = await Projects.create(db, { name: body.name, orgId: Auth.org(c).id })
+          return c.json(Response.validated(schema.Project, serializeProject(record)), 200)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .get(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg(),
+      Auth.ensureProject(),
+      OpenApi.validate('param', schema.ProjectParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'getProject',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible project was found for this id.' },
+          success: { description: 'One project.', schema: schema.Project },
+        }),
+        summary: 'Get project',
+        tags: ['Projects'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureProjectError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        return c.json(Response.validated(schema.Project, serializeProject(Auth.project(c))), 200)
+      },
+    )
+    .patch(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      Auth.ensureProject(),
+      OpenApi.validate('param', schema.ProjectParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.validate('json', schema.ProjectBody, {
+        code: 'body_invalid',
+        message: 'Check the request body and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'updateProject',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible project was found for this id.' },
+          success: { description: 'The updated project.', schema: schema.Project },
+        }),
+        summary: 'Update project',
+        tags: ['Projects'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+          })
+        if (Auth.narrowScope) return Auth.ensureProjectError(c)
+
+        const body = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          const updated = await Projects.update(db, Auth.project(c).id, { name: body.name })
+          if (!updated) return projectNotFound(c)
+          return c.json(Response.validated(schema.Project, serializeProject(updated)), 200)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .delete(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'admin' }),
+      Auth.ensureProject(),
+      OpenApi.validate('param', schema.ProjectParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'deleteProject',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible project was found for this id.' },
+          success: {
+            description: 'Confirmation that the project was deleted.',
+            schema: schema.deleteProject.Response,
+          },
+        }),
+        summary: 'Delete project',
+        tags: ['Projects'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureProjectError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const db = Db.get(c.get('db'))
+        try {
+          const kv = c.get('kv')
+          if (kv)
+            for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
+              projectId: Auth.project(c).id,
+            }))
+              await ApiKeys.revoke(kv.store, record.id)
+          const deleted = await Projects.deleteProject(db, Auth.project(c).id)
+          if (!deleted) return projectNotFound(c)
+          return c.json(
+            Response.validated(schema.deleteProject.Response, { id: Auth.project(c).id }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+}
+
+function serializeProject(record: Projects.Record) {
+  return {
+    createdAt: record.createdAt,
+    environments: [...environments],
+    id: record.id,
+    name: record.name,
+    orgId: record.orgId,
+    updatedAt: record.updatedAt,
+  }
+}
+
+function projectNotFound(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'project_not_found',
+    message: 'Project not found',
+    status: 404,
+  })
+}