tapimo 0.13.0 → 0.15.0

package/src/apps/management/routes/me.test.ts

@@ -1,5 +1,6 @@
 import { serve } from '@hono/node-server'
 import * as Accounts from 'accounts/server'
+import { Hono } from 'hono'
 import { exportJWK, generateKeyPair } from 'jose'
 import { P256 } from 'ox'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
@@ -7,7 +8,11 @@ import { Account } from 'viem/tempo'
 import { tempoTestnet } from 'viem/tempo/chains'
 
 import * as TestApp from '../../../../test/App.js'
+import type * as App from '../../../App.js'
+import * as Organizations from '../../../db/tables/organizations.js'
+import * as Users from '../../../db/tables/users.js'
 import * as Me from './me.js'
+import * as Orgs from './orgs.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
 const origin = 'http://localhost'
@@ -115,6 +120,31 @@ describe('GET /me', () => {
     expect(body.email).toBeUndefined()
   })
 
+  test('omits the wallet address for another identity provider', async () => {
+    const db = TestApp.database()
+    const user = await Users.upsertByAddress(db, {
+      address: `0x${'11'.repeat(20)}`,
+    })
+    const app = new Hono<App.Environment>()
+      .use('*', async (c, next) => {
+        c.set('db', db)
+        c.set('principal', {
+          id: user.id,
+          identity: { provider: 'https://issuer.example', subject: 'oidc|123' },
+          type: 'session',
+        })
+        await next()
+      })
+      .route('/', Me.me())
+
+    const response = await app.request('/v1/me')
+    const body = await TestApp.json(response, Me.schema.User)
+
+    expect(response.status).toBe(200)
+    expect(body.address).toBeUndefined()
+    await db.close()
+  })
+
   test('sign-in is idempotent per address', async () => {
     const app = createApp()
     const account = privateKeyToAccount(generatePrivateKey())
@@ -150,7 +180,7 @@ describe('GET /me', () => {
     const account = privateKeyToAccount(generatePrivateKey())
     const { cookie } = await TestApp.signIn(app, account)
 
-    const logout = await app.request('/v1/auth/siwe/logout', {
+    const logout = await app.request('/v1/auth/logout', {
       headers: { cookie: cookie! },
       method: 'POST',
     })
@@ -166,7 +196,7 @@ describe('GET /me', () => {
     const { verifyResponse } = await TestApp.signIn(app, account, { returnToken: true })
     const { token } = (await verifyResponse.json()) as { token: string }
 
-    const logout = await app.request('/v1/auth/siwe/logout', {
+    const logout = await app.request('/v1/auth/logout', {
       headers: { authorization: `Bearer ${token}` },
       method: 'POST',
     })
@@ -221,8 +251,8 @@ describe('GET /me', () => {
   })
 })
 
-describe('sign-in email requirement', () => {
-  test('rejects sign-ins without an identity token', async () => {
+describe('SIWE identity', () => {
+  test('rejects sign-ins without an identity token when email is required', async () => {
     const app = TestApp.create({
       auth: { keys: [TestApp.key] },
       session: { wallet: { origin, requireEmail: true } },
@@ -239,24 +269,235 @@ describe('sign-in email requirement', () => {
     `)
   })
 
+  test('allows sign-ins without an identity token when an issuer is configured', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+      expect(verifyResponse.status).toBe(200)
+      expect(cookie).toBeDefined()
+    } finally {
+      await oidc.close()
+    }
+  })
+
   test('folds the token-verified email onto the session', async () => {
     const oidc = await createIssuer({ email: 'dev@example.com' })
+    const db = TestApp.database()
     try {
       const app = TestApp.create({
         auth: { keys: [TestApp.key] },
-        session: { wallet: { issuer: oidc.url, origin, requireEmail: true } },
+        db,
+        session: { wallet: { issuer: oidc.url, origin } },
       })
       const account = privateKeyToAccount(generatePrivateKey())
       const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
         idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
       })
+      // Simulate the previous Worker writing after the auth-field backfill.
+      await db.kysely
+        .updateTable('users')
+        .set({ email: 'Dev@Example.com', emailVerified: false })
+        .where('address', '=', account.address.toLowerCase())
+        .execute()
 
       expect(verifyResponse.status).toBe(200)
       const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
       expect(response.status).toBe(200)
       const body = await TestApp.json(response, Me.schema.User)
       expect(body.email).toBe('dev@example.com')
+      await expect(Users.getByAddress(db, account.address)).resolves.toMatchObject({
+        email: 'dev@example.com',
+        emailVerified: true,
+      })
+    } finally {
+      await db.close()
+      await oidc.close()
+    }
+  })
+
+  test('reuses the email-owned user for another wallet', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    const db = TestApp.database()
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { wallet: { issuer: oidc.url, origin } },
+      })
+      const firstAccount = privateKeyToAccount(generatePrivateKey())
+      const first = await TestApp.signIn(app, firstAccount, {
+        idToken: ({ nonce }) => oidc.mint({ address: firstAccount.address, nonce }),
+      })
+      const firstResponse = await app.request('/v1/me', { headers: { cookie: first.cookie! } })
+      const firstUser = await TestApp.json(firstResponse, Me.schema.User)
+
+      const secondAccount = privateKeyToAccount(generatePrivateKey())
+      const provisional = await TestApp.signIn(app, secondAccount)
+      const provisionalResponse = await app.request('/v1/me', {
+        headers: { cookie: provisional.cookie! },
+      })
+      const provisionalUser = await TestApp.json(provisionalResponse, Me.schema.User)
+
+      const reconciled = await TestApp.signIn(app, secondAccount, {
+        idToken: ({ nonce }) => oidc.mint({ address: secondAccount.address, nonce }),
+      })
+      const reconciledResponse = await app.request('/v1/me', {
+        headers: { cookie: reconciled.cookie! },
+      })
+      const reconciledUser = await TestApp.json(reconciledResponse, Me.schema.User)
+
+      const repeated = await TestApp.signIn(app, secondAccount)
+      const repeatedResponse = await app.request('/v1/me', {
+        headers: { cookie: repeated.cookie! },
+      })
+      const repeatedUser = await TestApp.json(repeatedResponse, Me.schema.User)
+      const staleOrganization = await Organizations.createOwned(db, {
+        name: 'Stale session organization',
+        userId: provisionalUser.id,
+        walletAddress: secondAccount.address,
+      })
+      const organizationsResponse = await app.request('/v1/orgs', {
+        headers: { cookie: repeated.cookie! },
+      })
+      const organizations = await TestApp.json(
+        organizationsResponse,
+        Orgs.schema.listOrganizations.Response,
+      )
+
+      expect(firstResponse.status).toBe(200)
+      expect(provisionalResponse.status).toBe(200)
+      expect(reconciledResponse.status).toBe(200)
+      expect(repeatedResponse.status).toBe(200)
+      expect(provisionalUser.id).not.toBe(firstUser.id)
+      expect(reconciledUser.id).toBe(firstUser.id)
+      expect(repeatedUser.id).toBe(firstUser.id)
+      expect(reconciledUser.address).toBe(secondAccount.address.toLowerCase())
+      expect(repeatedUser.address).toBe(secondAccount.address.toLowerCase())
+      expect(staleOrganization.userId).toBe(firstUser.id)
+      expect(organizations.data.map(({ id }) => id)).toContain(staleOrganization.id)
+    } finally {
+      await db.close()
+      await oidc.close()
+    }
+  })
+
+  test('serializes initial ownership of a verified email', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    const db = TestApp.database()
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { wallet: { issuer: oidc.url, origin } },
+      })
+      const accounts = Array.from({ length: 4 }, () => privateKeyToAccount(generatePrivateKey()))
+      const sessions = await Promise.all(
+        accounts.map((account) =>
+          TestApp.signIn(app, account, {
+            idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+          }),
+        ),
+      )
+      const responses = await Promise.all(
+        sessions.map(({ cookie }) =>
+          Promise.resolve(app.request('/v1/me', { headers: { cookie: cookie! } })),
+        ),
+      )
+      const users = await Promise.all(
+        responses.map((response) => TestApp.json(response, Me.schema.User)),
+      )
+
+      expect(new Set(users.map(({ id }) => id)).size).toBe(1)
+    } finally {
+      await db.close()
+      await oidc.close()
+    }
+  })
+
+  test('keeps a provisional user that owns organization resources', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    const db = TestApp.database()
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { wallet: { issuer: oidc.url, origin } },
+      })
+      const emailAccount = privateKeyToAccount(generatePrivateKey())
+      const emailSession = await TestApp.signIn(app, emailAccount, {
+        idToken: ({ nonce }) => oidc.mint({ address: emailAccount.address, nonce }),
+      })
+      const emailResponse = await app.request('/v1/me', {
+        headers: { cookie: emailSession.cookie! },
+      })
+      const emailUser = await TestApp.json(emailResponse, Me.schema.User)
+
+      const provisionalAccount = privateKeyToAccount(generatePrivateKey())
+      const provisionalSession = await TestApp.signIn(app, provisionalAccount)
+      const provisionalResponse = await app.request('/v1/me', {
+        headers: { cookie: provisionalSession.cookie! },
+      })
+      const provisionalUser = await TestApp.json(provisionalResponse, Me.schema.User)
+      const organization = await Organizations.createOwned(db, {
+        name: 'Provisional organization',
+        userId: provisionalUser.id,
+      })
+
+      const reconciledSession = await TestApp.signIn(app, provisionalAccount, {
+        idToken: ({ nonce }) => oidc.mint({ address: provisionalAccount.address, nonce }),
+      })
+      const reconciledResponse = await app.request('/v1/me', {
+        headers: { cookie: reconciledSession.cookie! },
+      })
+      const reconciledUser = await TestApp.json(reconciledResponse, Me.schema.User)
+      const organizationsResponse = await app.request('/v1/orgs', {
+        headers: { cookie: reconciledSession.cookie! },
+      })
+      const organizations = await TestApp.json(
+        organizationsResponse,
+        Orgs.schema.listOrganizations.Response,
+      )
+
+      expect(emailResponse.status).toBe(200)
+      expect(provisionalResponse.status).toBe(200)
+      expect(reconciledResponse.status).toBe(200)
+      expect(organizationsResponse.status).toBe(200)
+      expect(reconciledUser.id).not.toBe(emailUser.id)
+      expect(reconciledUser.id).toBe(provisionalUser.id)
+      expect(organizations.data.map(({ id }) => id)).toContain(organization.id)
+
+      // Simulate an address-owned user from before wallet links existed.
+      await db.kysely
+        .deleteFrom('auth_accounts')
+        .where('accountId', '=', provisionalAccount.address.toLowerCase())
+        .where('issuer', '=', 'tempo:siwe')
+        .execute()
+      const legacySession = await TestApp.signIn(app, provisionalAccount, {
+        idToken: ({ nonce }) => oidc.mint({ address: provisionalAccount.address, nonce }),
+      })
+      const legacyResponse = await app.request('/v1/me', {
+        headers: { cookie: legacySession.cookie! },
+      })
+      const legacyUser = await TestApp.json(legacyResponse, Me.schema.User)
+      const legacyOrganizationsResponse = await app.request('/v1/orgs', {
+        headers: { cookie: legacySession.cookie! },
+      })
+      const legacyOrganizations = await TestApp.json(
+        legacyOrganizationsResponse,
+        Orgs.schema.listOrganizations.Response,
+      )
+      expect(legacyResponse.status).toBe(200)
+      expect(legacyOrganizationsResponse.status).toBe(200)
+      expect(legacyUser.id).toBe(provisionalUser.id)
+      expect(legacyOrganizations.data.map(({ id }) => id)).toContain(organization.id)
     } finally {
+      await db.close()
       await oidc.close()
     }
   })

package/src/apps/management/routes/me.ts

@@ -3,6 +3,7 @@ import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
+import * as AuthAccounts from '../../../db/tables/authAccounts.js'
 import * as Db from '../../../db/Db.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
@@ -30,7 +31,7 @@ export namespace schema {
         email: z
           .optional(z.email())
           .check(
-            z.describe('Verified email from the wallet identity token, when present.'),
+            z.describe('Verified email bound to this user, when present.'),
             z.meta({ examples: ['dev@example.com'] }),
           ),
         id: z
@@ -98,9 +99,13 @@ export function me() {
             message: 'User not found',
             status: 404,
           })
+        const address =
+          principal.identity.provider === 'wallet'
+            ? principal.identity.subject
+            : await AuthAccounts.getWalletAddress(db, principal.id)
         return c.json(
           Response.validated(schema.User, {
-            ...(user.address ? { address: user.address } : {}),
+            ...(address ? { address: address.toLowerCase() } : {}),
             createdAt: user.createdAt,
             ...(user.email ? { email: user.email } : {}),
             id: user.id,

package/src/apps/management/routes/members.test.ts

@@ -1,9 +1,11 @@
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as Invitations from './invitations.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as Members from './members.js'
 import * as Orgs from './orgs.js'
+import * as Users from '../../../db/tables/users.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
 const origin = 'http://localhost'
@@ -304,6 +306,112 @@ describe('members', () => {
     expect(lastOwner.status).toBe(409)
   })
 
+  test('revokes self-issued invitations when admin access is removed', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member: demoted, org, owner } = await team(app, db, 'admin')
+    await Users.setEmail(db, demoted.userId, 'demoted@example.com')
+    const removed = await session(app)
+    await Users.setEmail(db, removed.userId, 'removed@example.com')
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: removed.userId })
+    const path = `/v1/orgs/${org.id}/invitations`
+    const demotedInvitation = await TestApp.json(
+      await app.request(
+        path,
+        json('POST', demoted.cookie, { email: 'demoted@example.com', role: 'admin' }),
+      ),
+      Invitations.schema.Invitation,
+    )
+    expect(
+      (
+        await app.request(
+          path,
+          json('POST', demoted.cookie, { email: 'planted@example.com', role: 'admin' }),
+        )
+      ).status,
+    ).toBe(200)
+    const removedInvitation = await TestApp.json(
+      await app.request(
+        path,
+        json('POST', removed.cookie, { email: 'removed@example.com', role: 'admin' }),
+      ),
+      Invitations.schema.Invitation,
+    )
+
+    expect(
+      (
+        await app.request(
+          `/v1/orgs/${org.id}/members/${demoted.userId}`,
+          json('PATCH', owner.cookie, { role: 'member' }),
+        )
+      ).status,
+    ).toBe(200)
+    expect(
+      (
+        await app.request(`/v1/orgs/${org.id}/members/${removed.userId}`, {
+          headers: { cookie: owner.cookie },
+          method: 'DELETE',
+        })
+      ).status,
+    ).toBe(200)
+
+    for (const [invitation, cookie] of [
+      [demotedInvitation, demoted.cookie],
+      [removedInvitation, removed.cookie],
+    ] as const)
+      expect(
+        (
+          await app.request(`/v1/invitations/${invitation.id}/accept`, {
+            headers: { cookie },
+            method: 'POST',
+          })
+        ).status,
+      ).toBe(404)
+    expect((await Memberships.get(db, org.id, demoted.userId))?.role).toBe('member')
+    expect(await Memberships.get(db, org.id, removed.userId)).toBeUndefined()
+    const pending = await TestApp.json(
+      await app.request(path, { headers: { cookie: owner.cookie } }),
+      Invitations.schema.listInvitations.Response,
+    )
+    expect(pending.data).toEqual([])
+  })
+
+  test('preserves invitations within authority retained after demotion', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const { member: demoted, org, owner } = await team(app, db, 'owner')
+    const path = `/v1/orgs/${org.id}/invitations`
+    const memberInvitation = await TestApp.json(
+      await app.request(
+        path,
+        json('POST', demoted.cookie, { email: 'member@example.com', role: 'member' }),
+      ),
+      Invitations.schema.Invitation,
+    )
+    const ownerInvitation = await TestApp.json(
+      await app.request(
+        path,
+        json('POST', demoted.cookie, { email: 'owner@example.com', role: 'owner' }),
+      ),
+      Invitations.schema.Invitation,
+    )
+
+    expect(
+      (
+        await app.request(
+          `/v1/orgs/${org.id}/members/${demoted.userId}`,
+          json('PATCH', owner.cookie, { role: 'admin' }),
+        )
+      ).status,
+    ).toBe(200)
+    const pending = await TestApp.json(
+      await app.request(path, { headers: { cookie: owner.cookie } }),
+      Invitations.schema.listInvitations.Response,
+    )
+    expect(pending.data.map(({ id }) => id)).toEqual([memberInvitation.id])
+    expect(pending.data.some(({ id }) => id === ownerInvitation.id)).toBe(false)
+  })
+
   test('hides the team from foreign sessions', async () => {
     const db = TestApp.database()
     const app = createApp(db)