tapimo 0.1.0 → 0.3.0

package/src/apps/platform/routes/orgs.ts

@@ -0,0 +1,365 @@
+import { type Context, Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import * as ApiKeys from '../../../ApiKeys.js'
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Db from '../../../db/Db.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Organizations from '../../../db/tables/organizations.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+
+/** Zod schemas owned by the organizations resource. */
+export namespace schema {
+  const name = z
+    .string()
+    .check(
+      z.minLength(1),
+      z.maxLength(100),
+      z.describe('Human-readable name.'),
+      z.meta({ examples: ['Acme, Inc.'] }),
+    )
+
+  /** One organization: the top-level tenant that owns API keys. */
+  export const Organization = Schema.describe(
+    z.object({
+      createdAt: z
+        .string()
+        .check(
+          z.describe('When the organization was created (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+      id: z
+        .string()
+        .check(
+          z.describe('Opaque organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+      name: z
+        .string()
+        .check(
+          z.describe('Human-readable organization name.'),
+          z.meta({ examples: ['Acme, Inc.'] }),
+        ),
+      role: z
+        .optional(z.enum(Memberships.roles))
+        .check(
+          z.describe("The caller's role in this organization; absent for the super admin."),
+          z.meta({ examples: ['owner'] }),
+        ),
+      updatedAt: z
+        .string()
+        .check(
+          z.describe('When the organization was last updated (ISO 8601).'),
+          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        ),
+    }),
+    'An organization: the top-level tenant that owns API keys.',
+  )
+
+  /** Path parameters addressing one organization. */
+  export const Params = z
+    .object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    })
+    .check(z.describe('Path parameters for one organization.'))
+
+  /** Request body creating or renaming an organization. */
+  export const OrganizationBody = z
+    .object({ name })
+    .check(z.describe('Fields for creating or renaming an organization.'))
+
+  /** Schemas for the deleteOrganization operation. */
+  export namespace deleteOrganization {
+    /** Confirmation that the organization was deleted. */
+    export const Response = z
+      .object({
+        id: z
+          .string()
+          .check(
+            z.describe('ID of the organization that was deleted.'),
+            z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Confirmation that the organization was deleted.'))
+  }
+
+  /** Schemas for the listOrganizations operation. */
+  export namespace listOrganizations {
+    /** Non-paginated list of organizations. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z.array(Organization).check(z.describe('The organizations, newest first.')),
+      }),
+      'A non-paginated list of organizations.',
+    )
+  }
+}
+
+/**
+ * Mounts the `/orgs` resource: session-owned tenancy (each organization is
+ * owned by the user that created it). The super admin bypasses ownership;
+ * inaccessible or absent ids render `404` so foreign org ids are
+ * indistinguishable from missing ones. Projects nest under `/orgs/:orgId` in
+ * the projects app.
+ */
+export function orgs() {
+  return new Hono<App.Environment>()
+    .get(
+      '/v1/orgs',
+      Auth.policy({ session: true }),
+      OpenApi.describeRoute({
+        operationId: 'listOrganizations',
+        responses: OpenApi.responses({
+          success: {
+            description: 'The organizations, newest first.',
+            schema: schema.listOrganizations.Response,
+          },
+        }),
+        summary: 'List organizations',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+
+        const principal = Auth.getPrincipal(c)
+        if (principal?.type !== 'session' && principal?.type !== 'super_admin')
+          return sessionRequired(c)
+
+        const db = Db.get(c.get('db'))
+        try {
+          const records =
+            principal.type === 'super_admin'
+              ? await Organizations.list(db)
+              : await Organizations.listByMember(db, principal.id)
+          return c.json(
+            Response.validated(schema.listOrganizations.Response, {
+              data: records.map(serializeOrganization),
+            }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .post(
+      '/v1/orgs',
+      Auth.policy({ session: true }),
+      OpenApi.validate('json', schema.OrganizationBody, {
+        code: 'body_invalid',
+        message: 'Check the request body and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'createOrganization',
+        responses: OpenApi.responses({
+          success: {
+            description: 'The created organization.',
+            schema: schema.Organization,
+          },
+        }),
+        summary: 'Create organization',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+          })
+
+        const principal = Auth.getPrincipal(c)
+        if (principal?.type !== 'session' && principal?.type !== 'super_admin')
+          return sessionRequired(c)
+
+        const body = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          // Sessions own what they create; the super admin has no user row.
+          // Organizations provisioned by the super admin start memberless.
+          const record =
+            principal.type === 'super_admin'
+              ? await Organizations.create(db, { createdBy: 'super_admin', name: body.name })
+              : {
+                  ...(await Organizations.createOwned(db, {
+                    name: body.name,
+                    userId: principal.id,
+                  })),
+                  role: 'owner' as const,
+                }
+          return c.json(Response.validated(schema.Organization, serializeOrganization(record)), 200)
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .get(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg(),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'getOrganization',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: { description: 'One organization.', schema: schema.Organization },
+        }),
+        summary: 'Get organization',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        return c.json(
+          Response.validated(
+            schema.Organization,
+            serializeOrganization({ ...Auth.org(c), role: Auth.membership(c)?.role }),
+          ),
+          200,
+        )
+      },
+    )
+    .patch(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'owner' }),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.validate('json', schema.OrganizationBody, {
+        code: 'body_invalid',
+        message: 'Check the request body and try again.',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'updateOrganization',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: { description: 'The updated organization.', schema: schema.Organization },
+        }),
+        summary: 'Update organization',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+          })
+
+        const body = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          const updated = await Organizations.update(db, Auth.org(c).id, { name: body.name })
+          if (!updated) return organizationNotFound(c)
+          return c.json(
+            Response.validated(
+              schema.Organization,
+              serializeOrganization({ ...updated, role: Auth.membership(c)?.role }),
+            ),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .delete(
+      '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}',
+      Auth.policy({ session: true }),
+      Auth.ensureOrg({ role: 'owner' }),
+      OpenApi.validate('param', schema.Params, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description: 'Delete an organization and all of its projects.',
+        operationId: 'deleteOrganization',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible organization was found for this id.' },
+          success: {
+            description: 'Confirmation that the organization was deleted.',
+            schema: schema.deleteOrganization.Response,
+          },
+        }),
+        summary: 'Delete organization',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const db = Db.get(c.get('db'))
+        try {
+          const kv = c.get('kv')
+          if (kv)
+            for (const record of await ApiKeys.listByOrg(kv.store, Auth.org(c).id))
+              await ApiKeys.revoke(kv.store, record.id)
+          const deleted = await Organizations.deleteOrganization(db, Auth.org(c).id)
+          if (!deleted) return organizationNotFound(c)
+          return c.json(
+            Response.validated(schema.deleteOrganization.Response, { id: Auth.org(c).id }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+}
+
+function serializeOrganization(
+  record: Organizations.Record & { role?: Memberships.Role | undefined },
+) {
+  return {
+    createdAt: record.createdAt,
+    id: record.id,
+    name: record.name,
+    ...(record.role ? { role: record.role } : {}),
+    updatedAt: record.updatedAt,
+  }
+}
+
+function organizationNotFound(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'organization_not_found',
+    message: 'Organization not found',
+    status: 404,
+  })
+}
+
+function sessionRequired(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'forbidden',
+    message: 'Session required',
+    status: 403,
+  })
+}

package/src/apps/platform/routes/projects.test.ts

@@ -0,0 +1,181 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Orgs from './orgs.js'
+import * as Projects from './projects.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+function createApp() {
+  return TestApp.create({ session: { wallet: { origin } } })
+}
+
+/** Signs in a fresh scripted account; returns its session cookie. */
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+describe('projects', () => {
+  test('creates, lists, reads, and renames projects', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Checkout' }),
+    )
+    expect(createdProject.status).toBe(200)
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+    expect(project.id.startsWith('prj_')).toBe(true)
+    expect(project.orgId).toBe(org.id)
+    expect(project.environments).toMatchInlineSnapshot(`
+      [
+        "production",
+        "sandbox",
+      ]
+    `)
+
+    const listed = await app.request(`/v1/orgs/${org.id}/projects`, { headers: { cookie } })
+    const list = await TestApp.json(listed, Projects.schema.listProjects.Response)
+    expect(list.data.map(({ name }) => name)).toEqual(['Checkout'])
+
+    const detail = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+    })
+    expect(detail.status).toBe(200)
+
+    const renamed = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}`,
+      json('PATCH', cookie, { name: 'Checkout v2' }),
+    )
+    expect(renamed.status).toBe(200)
+    expect((await TestApp.json(renamed, Projects.schema.Project)).name).toBe('Checkout v2')
+  })
+
+  test('deletes a project, leaving the organization and siblings intact', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+    const keeper = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', cookie, { name: 'Payments' }),
+    )
+    expect(keeper.status).toBe(200)
+
+    const stranger = await session(app)
+    const foreign = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(foreign.status).toBe(404)
+
+    const deleted = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deleted.status).toBe(200)
+    expect(await TestApp.json(deleted, Projects.schema.deleteProject.Response)).toEqual({
+      id: project.id,
+    })
+
+    const gone = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie },
+    })
+    expect(gone.status).toBe(404)
+
+    const listed = await app.request(`/v1/orgs/${org.id}/projects`, { headers: { cookie } })
+    const list = await TestApp.json(listed, Projects.schema.listProjects.Response)
+    expect(list.data.map(({ name }) => name)).toEqual(['Payments'])
+
+    const orgStill = await app.request(`/v1/orgs/${org.id}`, { headers: { cookie } })
+    expect(orgStill.status).toBe(200)
+  })
+
+  test('hides projects behind foreign organizations', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', owner, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+
+    const stranger = await session(app)
+    const foreignList = await app.request(`/v1/orgs/${org.id}/projects`, {
+      headers: { cookie: stranger },
+    })
+    expect(foreignList.status).toBe(404)
+
+    const foreignDetail = await app.request(`/v1/orgs/${org.id}/projects/${project.id}`, {
+      headers: { cookie: stranger },
+    })
+    expect(foreignDetail.status).toBe(404)
+  })
+
+  test('rejects cross-org project ids on every verb', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const createdProject = await app.request(
+      `/v1/orgs/${org.id}/projects`,
+      json('POST', owner, { name: 'Checkout' }),
+    )
+    const project = await TestApp.json(createdProject, Projects.schema.Project)
+
+    // The stranger owns a perfectly valid org of their own; the victim's
+    // project id still must not resolve through it (project ids are bound to
+    // their owning org, not just to any org the caller owns).
+    const stranger = await session(app)
+    const otherOrgResponse = await app.request('/v1/orgs', json('POST', stranger, { name: 'Other' })) // prettier-ignore
+    const otherOrg = await TestApp.json(otherOrgResponse, Orgs.schema.Organization)
+
+    const smuggled = `/v1/orgs/${otherOrg.id}/projects/${project.id}`
+    const smuggledRead = await app.request(smuggled, { headers: { cookie: stranger } })
+    expect(smuggledRead.status).toBe(404)
+    const smuggledRename = await app.request(smuggled, json('PATCH', stranger, { name: 'Hijack' })) // prettier-ignore
+    expect(smuggledRename.status).toBe(404)
+    const smuggledDelete = await app.request(smuggled, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(smuggledDelete.status).toBe(404)
+
+    // Mutations through the owning org's path fail at the org-ownership link.
+    const direct = `/v1/orgs/${org.id}/projects/${project.id}`
+    const foreignRename = await app.request(direct, json('PATCH', stranger, { name: 'Hijack' }))
+    expect(foreignRename.status).toBe(404)
+    const foreignDelete = await app.request(direct, {
+      headers: { cookie: stranger },
+      method: 'DELETE',
+    })
+    expect(foreignDelete.status).toBe(404)
+
+    // The project survives every attempt, unrenamed.
+    const detail = await app.request(direct, { headers: { cookie: owner } })
+    expect(detail.status).toBe(200)
+    expect((await TestApp.json(detail, Projects.schema.Project)).name).toBe('Checkout')
+  })
+})