tapimo 0.1.0 → 0.3.0

package/src/apps/platform/routes/me.test.ts

@@ -0,0 +1,351 @@
+import { serve } from '@hono/node-server'
+import * as Accounts from 'accounts/server'
+import { exportJWK, generateKeyPair } from 'jose'
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Me from './me.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+const superAdminSecret = 'tempo:sk:c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2'
+
+function createApp() {
+  return TestApp.create({
+    auth: { keys: [TestApp.key], superAdmin: { secret: superAdminSecret } },
+    session: { wallet: { origin } },
+  })
+}
+
+describe('GET /me', () => {
+  test('returns the signed-in user', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+    expect(verifyResponse.status).toBe(200)
+    expect(cookie).toBeDefined()
+
+    const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Me.schema.User)
+    expect(body.address).toBe(account.address.toLowerCase())
+    expect(body.id.startsWith('usr_')).toBe(true)
+    expect(body.email).toBeUndefined()
+  })
+
+  test('sign-in is idempotent per address', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+
+    const first = await TestApp.signIn(app, account)
+    const firstMe = await app.request('/v1/me', { headers: { cookie: first.cookie! } })
+    const firstBody = await TestApp.json(firstMe, Me.schema.User)
+
+    const second = await TestApp.signIn(app, account)
+    const secondMe = await app.request('/v1/me', { headers: { cookie: second.cookie! } })
+    const secondBody = await TestApp.json(secondMe, Me.schema.User)
+
+    expect(secondBody.id).toBe(firstBody.id)
+  })
+
+  test('supports bearer-token sessions', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { verifyResponse } = await TestApp.signIn(app, account, { returnToken: true })
+    const { token } = (await verifyResponse.json()) as { token: string }
+
+    expect(typeof token).toBe('string')
+    // The bearer session token takes the API-key header path first; the failed
+    // key lookup must fall through to the session lane.
+    const response = await app.request('/v1/me', {
+      headers: { authorization: `Bearer ${token}` },
+    })
+    expect(response.status).toBe(200)
+  })
+
+  test('logout revokes the session', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie } = await TestApp.signIn(app, account)
+
+    const logout = await app.request('/v1/auth/siwe/logout', {
+      headers: { cookie: cookie! },
+      method: 'POST',
+    })
+    expect(logout.status).toBe(204)
+
+    const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+    expect(response.status).toBe(401)
+  })
+
+  test('logout revokes bearer-token sessions', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { verifyResponse } = await TestApp.signIn(app, account, { returnToken: true })
+    const { token } = (await verifyResponse.json()) as { token: string }
+
+    const logout = await app.request('/v1/auth/siwe/logout', {
+      headers: { authorization: `Bearer ${token}` },
+      method: 'POST',
+    })
+    expect(logout.status).toBe(204)
+
+    const response = await app.request('/v1/me', {
+      headers: { authorization: `Bearer ${token}` },
+    })
+    expect(response.status).toBe(401)
+  })
+
+  test('rejects anonymous requests', async () => {
+    const app = createApp()
+    const response = await app.request('/v1/me')
+    expect(response.status).toBe(401)
+  })
+
+  test('rejects API keys', async () => {
+    const app = createApp()
+    const response = await app.request('/v1/me', {
+      headers: { 'tempo-api-key': TestApp.key.token },
+    })
+    expect(response.status).toBe(403)
+    const { requestId, ...body } = (await response.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "forbidden",
+          "message": "API key not permitted for this route",
+        },
+      }
+    `)
+  })
+
+  test('rejects the super admin (no user row)', async () => {
+    const app = createApp()
+    const response = await app.request('/v1/me', {
+      headers: { 'tempo-api-key': superAdminSecret },
+    })
+    expect(response.status).toBe(403)
+    const { requestId, ...body } = (await response.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "forbidden",
+          "message": "Session required",
+        },
+      }
+    `)
+  })
+})
+
+describe('sign-in email requirement', () => {
+  test('rejects sign-ins without an identity token', async () => {
+    const app = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      session: { wallet: { origin, requireEmail: true } },
+    })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+    expect(verifyResponse.status).toBe(400)
+    expect(cookie).toBeUndefined()
+    expect(await verifyResponse.json()).toMatchInlineSnapshot(`
+      {
+        "error": "identity token required",
+      }
+    `)
+  })
+
+  test('folds the token-verified email onto the session', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { wallet: { issuer: oidc.url, origin, requireEmail: true } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(200)
+      const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, Me.schema.User)
+      expect(body.email).toBe('dev@example.com')
+    } finally {
+      await oidc.close()
+    }
+  })
+})
+
+describe('sign-up email domains', () => {
+  test('allows new users on an allowlisted domain', async () => {
+    const oidc = await createIssuer({ email: 'dev@TEMPO.xyz' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { emailAllowlist: ['Tempo.XYZ'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(200)
+      const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, Me.schema.User)
+      expect(body.email).toBe('dev@TEMPO.xyz')
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('rejects new users on other domains', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(403)
+      expect(cookie).toBeUndefined()
+      expect(await verifyResponse.json()).toMatchInlineSnapshot(`
+        {
+          "error": "sign-ups are restricted to approved email domains or invited emails",
+        }
+      `)
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('rejects new users without an identity token', async () => {
+    const app = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
+    })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+    expect(verifyResponse.status).toBe(403)
+    expect(cookie).toBeUndefined()
+  })
+
+  test('allows invited emails regardless of domain', async () => {
+    const oidc = await createIssuer({ email: 'Invited@Example.com' })
+    try {
+      const db = TestApp.database()
+
+      // Owner signs up while sign-up is open and issues the invitation.
+      const open = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { wallet: { origin } },
+      })
+      const owner = privateKeyToAccount(generatePrivateKey())
+      const { cookie } = await TestApp.signIn(open, owner)
+      const created = await open.request('/v1/orgs', {
+        body: JSON.stringify({ name: 'Acme' }),
+        headers: { 'content-type': 'application/json', cookie: cookie! },
+        method: 'POST',
+      })
+      const org = (await created.json()) as { id: string }
+      const invited = await open.request(`/v1/orgs/${org.id}/invitations`, {
+        body: JSON.stringify({ email: 'invited@example.com', role: 'member' }),
+        headers: { 'content-type': 'application/json', cookie: cookie! },
+        method: 'POST',
+      })
+      expect(invited.status).toBe(200)
+
+      const restricted = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { verifyResponse } = await TestApp.signIn(restricted, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+      expect(verifyResponse.status).toBe(200)
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('allows existing users regardless of domain', async () => {
+    const db = TestApp.database()
+    const account = privateKeyToAccount(generatePrivateKey())
+
+    // Row created before the restriction (open sign-up deployment).
+    const open = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      db,
+      session: { wallet: { origin } },
+    })
+    const first = await TestApp.signIn(open, account)
+    expect(first.verifyResponse.status).toBe(200)
+
+    const restricted = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      db,
+      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
+    })
+    const second = await TestApp.signIn(restricted, account)
+    expect(second.verifyResponse.status).toBe(200)
+  })
+})
+
+/** Local OIDC issuer standing in for the wallet: the SDK's own provider (discovery, JWKS, token mint). */
+async function createIssuer(options: { email: string }) {
+  // Extractable: the provider takes key material as JWK strings.
+  const { privateKey, publicKey } = await generateKeyPair('EdDSA', { extractable: true })
+  // The provider pins its `issuer` URL at construction, but the ephemeral
+  // port is only known after bind — listen through a closure, assign after.
+  let provider!: ReturnType<typeof Accounts.Handler.oidcProvider>
+  type Listener = { close: () => Promise<void>; url: string }
+  const { close, url } = await new Promise<Listener>((resolve) => {
+    const server = serve({ fetch: (request) => provider.fetch(request), port: 0 }, (info) =>
+      resolve({
+        close: () => new Promise((done) => server.close(() => done())),
+        url: `http://127.0.0.1:${info.port}`,
+      }),
+    )
+  })
+  provider = Accounts.Handler.oidcProvider({
+    // Test-only: no `authenticate`, so the request body's `subject` is trusted.
+    getClaims: () => ({ email: options.email, email_verified: true }),
+    issuer: url,
+    publicKey: JSON.stringify(await exportJWK(publicKey)),
+    signingKey: JSON.stringify(await exportJWK(privateKey)),
+  })
+  return {
+    close,
+    /** Mints a wallet-style identity token bound to the SIWE nonce and signer. */
+    async mint(mintOptions: { address: string; nonce: string }) {
+      const response = await provider.fetch(
+        new Request(`${url}/token`, {
+          body: JSON.stringify({
+            audience: origin,
+            nonce: mintOptions.nonce,
+            subject: mintOptions.address,
+          }),
+          headers: { 'content-type': 'application/json' },
+          method: 'POST',
+        }),
+      )
+      const { idToken } = (await response.json()) as { idToken: string }
+      return idToken
+    },
+    url,
+  }
+}

package/src/apps/platform/routes/me.ts

@@ -0,0 +1,106 @@
+import { Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Db from '../../../db/Db.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Users from '../../../db/tables/users.js'
+
+/** Zod schemas owned by the current-user resource. */
+export namespace schema {
+  /** The signed-in developer. */
+  export const User = Schema.describe(
+    z.object({
+      address: z
+        .optional(z.string())
+        .check(
+          z.describe('Wallet address bound to this user, when wallet sign-in established it.'),
+          z.meta({ examples: ['0x0000000000000000000000000000000000000001'] }),
+        ),
+      createdAt: z
+        .string()
+        .check(
+          z.describe('When the user was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+      email: z
+        .optional(z.string())
+        .check(z.describe('Verified email from the wallet identity token, when present.')),
+      id: z
+        .string()
+        .check(
+          z.describe('Opaque user id (`usr_…`).'),
+          z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      updatedAt: z
+        .string()
+        .check(
+          z.describe('When the user was last updated (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+    }),
+    'The signed-in developer.',
+  )
+}
+
+/**
+ * Mounts the `/me` resource: the session's user. Session lane only — API keys
+ * identify workloads, not developers.
+ */
+export function me() {
+  return new Hono<App.Environment>().get(
+    '/v1/me',
+    Auth.policy({ session: true }),
+    OpenApi.describeRoute({
+      operationId: 'getMe',
+      responses: OpenApi.responses({
+        errors: {
+          403: 'The caller is not a signed-in user.',
+          404: 'No user exists for this session.',
+        },
+        success: { description: 'The authenticated user.', schema: schema.User },
+      }),
+      summary: 'Get current user',
+      tags: ['Users'],
+    }),
+    async (c) => {
+      if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+
+      // The session lane is the only lane here; `super_admin` bypasses lanes
+      // but has no user row, so it is rejected too.
+      const principal = Auth.getPrincipal(c)
+      if (principal?.type !== 'session')
+        return Response.error(c, {
+          code: 'forbidden',
+          message: 'Session required',
+          status: 403,
+        })
+
+      const db = Db.get(c.get('db'))
+      try {
+        const user = await Users.get(db, principal.id)
+        if (!user)
+          return Response.error(c, {
+            code: 'user_not_found',
+            message: 'User not found',
+            status: 404,
+          })
+        return c.json(
+          Response.validated(schema.User, {
+            ...(user.address ? { address: user.address } : {}),
+            createdAt: user.createdAt,
+            ...(user.email ? { email: user.email } : {}),
+            id: user.id,
+            updatedAt: user.updatedAt,
+          }),
+          200,
+        )
+      } catch (cause) {
+        return Response.upstream(c, cause)
+      }
+    },
+  )
+}

package/src/apps/platform/routes/members.test.ts

@@ -0,0 +1,195 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as Members from './members.js'
+import * as Orgs from './orgs.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+function createApp(db = TestApp.database()) {
+  return TestApp.create({ db, session: { wallet: { origin } } })
+}
+
+/** Signs in a fresh scripted account; returns its cookie and user id. */
+async function session(app: ReturnType<typeof createApp>) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  const me = await app.request('/v1/me', { headers: { cookie: cookie! } })
+  const { id } = (await me.json()) as { id: string }
+  return { cookie: cookie!, userId: id }
+}
+
+/** An org owned by `owner`, with `member` seeded at the given role. */
+async function team(
+  app: ReturnType<typeof createApp>,
+  db: ReturnType<typeof TestApp.database>,
+  role: Memberships.Role,
+) {
+  const owner = await session(app)
+  const member = await session(app)
+  const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+  const org = await TestApp.json(created, Orgs.schema.Organization)
+  await Memberships.create(db, { orgId: org.id, role, userId: member.userId })
+  return { member, org, owner }
+}
+
+describe('members', () => {
+  test('lists the team with roles and identity', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+
+    const response = await app.request(`/v1/orgs/${org.id}/members`, {
+      headers: { cookie: member.cookie },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Members.schema.listMembers.Response)
+    expect(body.data.map(({ role, userId }) => ({ role, userId }))).toEqual([
+      { role: 'owner', userId: owner.userId },
+      { role: 'member', userId: member.userId },
+    ])
+    expect(body.data[0]!.address).toMatch(/^0x/)
+  })
+
+  test('tiers write access by role across the surface', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org } = await team(app, db, 'member')
+
+    // Members read the org but cannot manage it or its projects.
+    const read = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie: member.cookie } })
+    expect(read.status).toBe(200)
+    const rename = await app.request(`/v1/orgs/${org.id}`, json('PATCH', member.cookie, { name: 'Steal' })) // prettier-ignore
+    expect(rename.status).toBe(403)
+    const project = await app.request(`/v1/orgs/${org.id}/projects`, json('POST', member.cookie, { name: 'Nope' })) // prettier-ignore
+    expect(project.status).toBe(403)
+
+    // Admins manage projects but not the org itself.
+    const admin = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: admin.userId })
+    const adminProject = await app.request(`/v1/orgs/${org.id}/projects`, json('POST', admin.cookie, { name: 'Checkout' })) // prettier-ignore
+    expect(adminProject.status).toBe(200)
+    const adminRename = await app.request(`/v1/orgs/${org.id}`, json('PATCH', admin.cookie, { name: 'Steal' })) // prettier-ignore
+    expect(adminRename.status).toBe(403)
+    const adminDelete = await app.request(`/v1/orgs/${org.id}`, {
+      headers: { cookie: admin.cookie },
+      method: 'DELETE',
+    })
+    expect(adminDelete.status).toBe(403)
+  })
+
+  test('owners change roles; the last owner cannot be demoted', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+
+    const promoted = await app.request(
+      `/v1/orgs/${org.id}/members/${member.userId}`,
+      json('PATCH', owner.cookie, { role: 'admin' }),
+    )
+    expect(promoted.status).toBe(200)
+    expect((await TestApp.json(promoted, Members.schema.Member)).role).toBe('admin')
+
+    // A non-owner cannot change roles.
+    const foreign = await app.request(
+      `/v1/orgs/${org.id}/members/${owner.userId}`,
+      json('PATCH', member.cookie, { role: 'member' }),
+    )
+    expect(foreign.status).toBe(403)
+
+    const demoted = await app.request(
+      `/v1/orgs/${org.id}/members/${owner.userId}`,
+      json('PATCH', owner.cookie, { role: 'member' }),
+    )
+    expect(demoted.status).toBe(409)
+    const { requestId, ...body } = (await demoted.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "last_owner",
+          "message": "The organization would be left without an owner",
+        },
+      }
+    `)
+  })
+
+  test('concurrent demotions cannot strip the last owner', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    // Two owners, each demoting the other at the same time: the guard must let
+    // exactly one through so the org is never left ownerless.
+    const second = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'owner', userId: second.userId })
+
+    const [a, b] = await Promise.all([
+      app.request(`/v1/orgs/${org.id}/members/${owner.userId}`, json('PATCH', second.cookie, { role: 'member' })), // prettier-ignore
+      app.request(`/v1/orgs/${org.id}/members/${second.userId}`, json('PATCH', owner.cookie, { role: 'member' })), // prettier-ignore
+    ])
+    expect([a.status, b.status].sort()).toEqual([200, 409])
+    const owners = (await Memberships.listByOrg(db, org.id)).filter(({ role }) => role === 'owner')
+    expect(owners).toHaveLength(1)
+  })
+
+  test('owners remove members; members remove only themselves', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member, org, owner } = await team(app, db, 'member')
+    const other = await session(app)
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: other.userId })
+
+    // A member cannot remove someone else.
+    const foreign = await app.request(`/v1/orgs/${org.id}/members/${other.userId}`, {
+      headers: { cookie: member.cookie },
+      method: 'DELETE',
+    })
+    expect(foreign.status).toBe(403)
+
+    // A member removes themself (leaves).
+    const left = await app.request(`/v1/orgs/${org.id}/members/${member.userId}`, {
+      headers: { cookie: member.cookie },
+      method: 'DELETE',
+    })
+    expect(left.status).toBe(200)
+    const gone = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie: member.cookie } })
+    expect(gone.status).toBe(404)
+
+    // The owner removes the other member; the last owner cannot leave.
+    const removed = await app.request(`/v1/orgs/${org.id}/members/${other.userId}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(removed.status).toBe(200)
+    const lastOwner = await app.request(`/v1/orgs/${org.id}/members/${owner.userId}`, {
+      headers: { cookie: owner.cookie },
+      method: 'DELETE',
+    })
+    expect(lastOwner.status).toBe(409)
+  })
+
+  test('hides the team from foreign sessions', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { org } = await team(app, db, 'member')
+
+    const stranger = await session(app)
+    const response = await app.request(`/v1/orgs/${org.id}/members`, {
+      headers: { cookie: stranger.cookie },
+    })
+    expect(response.status).toBe(404)
+  })
+})