tapimo 0.2.0 → 0.3.0

package/src/apps/platform/routes/invitations.test.ts

@@ -76,13 +76,13 @@ describe('invitations', () => {
     expect(sent).toHaveLength(1)
     expect(sent[0]!.to).toBe('dev@example.com')
     expect(sent[0]!.subject).toContain('Acme')
-    expect(sent[0]!.text).toMatchInlineSnapshot(`
-      "You've been invited to join Acme on the Tempo Developer Platform
-
-      Sign in at https://console.tempo.xyz/?email=dev%40example.com to accept. This invitation expires in 7 days."
-    `)
+    expect(sent[0]!.text).toBe(
+      `You've been invited to join Acme on the Tempo Developer Platform\n\nSign in at https://console.tempo.xyz/?email=dev%40example.com&invitation=${invitation.id} to accept. This invitation expires in 7 days.`,
+    )
     expect(sent[0]!.html).toContain('<strong>Acme</strong>')
-    expect(sent[0]!.html).toContain('https://console.tempo.xyz/?email=dev%40example.com')
+    expect(sent[0]!.html).toContain(
+      `https://console.tempo.xyz/?email=dev%40example.com&invitation=${invitation.id}`,
+    )
 
     // Invisible without a verified email; visible once it matches.
     const invitee = await session(app)
@@ -260,6 +260,46 @@ describe('invitations', () => {
     expect(acceptExpired.status).toBe(404)
   })
 
+  test('declining settles the invitation', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const created = await app.request('/v1/orgs', json('POST', owner.cookie, { name: 'Acme' }))
+    const org = await TestApp.json(created, Orgs.schema.Organization)
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
+    )
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'dev@example.com')
+    const declined = await app.request(`/v1/invitations/${invitation.id}/decline`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(declined.status).toBe(200)
+    expect(await TestApp.json(declined, InvitationsApp.schema.declineInvitation.Response)).toEqual({
+      id: invitation.id,
+    })
+
+    // The pending list drains and the invitation can no longer be accepted or re-declined.
+    const mine = await app.request('/v1/invitations', { headers: { cookie: invitee.cookie } })
+    expect(
+      (await TestApp.json(mine, InvitationsApp.schema.listMyInvitations.Response)).data,
+    ).toEqual([])
+    const accepted = await app.request(`/v1/invitations/${invitation.id}/accept`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(accepted.status).toBe(404)
+    const again = await app.request(`/v1/invitations/${invitation.id}/decline`, {
+      headers: { cookie: invitee.cookie },
+      method: 'POST',
+    })
+    expect(again.status).toBe(404)
+  })
+
   test("hides invitations addressed to someone else's email", async () => {
     const db = TestApp.database()
     const app = createApp({ db })
@@ -279,6 +319,11 @@ describe('invitations', () => {
       method: 'POST',
     })
     expect(accepted.status).toBe(404)
+    const declined = await app.request(`/v1/invitations/${invitation.id}/decline`, {
+      headers: { cookie: other.cookie },
+      method: 'POST',
+    })
+    expect(declined.status).toBe(404)
   })
 
   test('a failing email sender never fails the invite', async () => {
@@ -356,6 +401,9 @@ describe('invitations', () => {
       json('POST', owner.cookie, { email: 'dev@example.com', role: 'member' }),
     )
     expect(invited.status).toBe(200)
-    expect(sent[0]!.text).toContain('https://portal.selfhost.example/?email=dev%40example.com')
+    const invitation = await TestApp.json(invited, InvitationsApp.schema.Invitation)
+    expect(sent[0]!.text).toContain(
+      `https://portal.selfhost.example/?email=dev%40example.com&invitation=${invitation.id}`,
+    )
   })
 })

package/src/apps/platform/routes/invitations.ts

@@ -171,6 +171,21 @@ export namespace schema {
     )
   }
 
+  /** Schemas for the declineInvitation operation. */
+  export namespace declineInvitation {
+    /** Confirmation that the invitation was declined. */
+    export const Response = z
+      .object({
+        id: z
+          .string()
+          .check(
+            z.describe('ID of the invitation that was declined.'),
+            z.meta({ examples: ['inv_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Confirmation that the invitation was declined.'))
+  }
+
   /** Schemas for the revokeInvitation operation. */
   export namespace revokeInvitation {
     /** Confirmation that the invitation was revoked. */
@@ -450,6 +465,57 @@ export function invitations() {
         }
       },
     )
+    .post(
+      '/v1/invitations/:invitationId{inv_[A-Za-z0-9_-]+}/decline',
+      Auth.policy({ session: true }),
+      OpenApi.validate('param', schema.AcceptParams, {
+        code: 'param_invalid',
+        message: 'Check the path parameters and try again.',
+      }),
+      OpenApi.describeRoute({
+        description: "Decline an invitation addressed to the session's verified email. Declining settles the invitation; it can no longer be accepted.", // prettier-ignore
+        operationId: 'declineInvitation',
+        responses: OpenApi.responses({
+          errors: { 404: 'No accessible pending invitation was found for this id.' },
+          success: {
+            description: 'Confirmation that the invitation was declined.',
+            schema: schema.declineInvitation.Response,
+          },
+        }),
+        summary: 'Decline invitation',
+        tags: ['Invitations'],
+      }),
+      async (c) => {
+        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (OpenApi.narrowValidation)
+          return OpenApi.validationError(c, {
+            code: 'param_invalid',
+            message: 'Check the path parameters and try again.',
+          })
+
+        const principal = Auth.getPrincipal(c)
+        if (principal?.type !== 'session') return sessionRequired(c)
+
+        const { invitationId } = c.req.valid('param')
+        const db = Db.get(c.get('db'))
+        try {
+          // An invitation is visible only to the verified holder of its email;
+          // everyone else sees 404.
+          const record = await Invitations.get(db, invitationId)
+          if (!record || record.email !== principal.email?.toLowerCase())
+            return invitationNotFound(c)
+          // Declining reuses the revoke settle; no surface distinguishes the two.
+          const declined = await Invitations.revoke(db, invitationId)
+          if (!declined) return invitationNotFound(c)
+          return c.json(
+            Response.validated(schema.declineInvitation.Response, { id: invitationId }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
 }
 
 /** Dispatches the invitation email through the app's sender, best-effort. */
@@ -463,6 +529,8 @@ function dispatchEmail(
   const expiry = days === 1 ? '1 day' : `${days} days`
   const link = new URL(sender.consoleUrl ?? 'https://console.tempo.xyz')
   link.searchParams.set('email', record.email)
+  // The console's index route steers `?invitation=` to the accept screen.
+  link.searchParams.set('invitation', record.id)
   const url = link.href
   const dispatch = Promise.resolve(
     sender.send({

package/src/apps/platform/routes/me.test.ts

@@ -1,3 +1,6 @@
+import { serve } from '@hono/node-server'
+import * as Accounts from 'accounts/server'
+import { exportJWK, generateKeyPair } from 'jose'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
@@ -77,6 +80,24 @@ describe('GET /me', () => {
     expect(response.status).toBe(401)
   })
 
+  test('logout revokes bearer-token sessions', async () => {
+    const app = createApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { verifyResponse } = await TestApp.signIn(app, account, { returnToken: true })
+    const { token } = (await verifyResponse.json()) as { token: string }
+
+    const logout = await app.request('/v1/auth/siwe/logout', {
+      headers: { authorization: `Bearer ${token}` },
+      method: 'POST',
+    })
+    expect(logout.status).toBe(204)
+
+    const response = await app.request('/v1/me', {
+      headers: { authorization: `Bearer ${token}` },
+    })
+    expect(response.status).toBe(401)
+  })
+
   test('rejects anonymous requests', async () => {
     const app = createApp()
     const response = await app.request('/v1/me')
@@ -119,3 +140,212 @@ describe('GET /me', () => {
     `)
   })
 })
+
+describe('sign-in email requirement', () => {
+  test('rejects sign-ins without an identity token', async () => {
+    const app = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      session: { wallet: { origin, requireEmail: true } },
+    })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+    expect(verifyResponse.status).toBe(400)
+    expect(cookie).toBeUndefined()
+    expect(await verifyResponse.json()).toMatchInlineSnapshot(`
+      {
+        "error": "identity token required",
+      }
+    `)
+  })
+
+  test('folds the token-verified email onto the session', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { wallet: { issuer: oidc.url, origin, requireEmail: true } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(200)
+      const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, Me.schema.User)
+      expect(body.email).toBe('dev@example.com')
+    } finally {
+      await oidc.close()
+    }
+  })
+})
+
+describe('sign-up email domains', () => {
+  test('allows new users on an allowlisted domain', async () => {
+    const oidc = await createIssuer({ email: 'dev@TEMPO.xyz' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { emailAllowlist: ['Tempo.XYZ'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(200)
+      const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, Me.schema.User)
+      expect(body.email).toBe('dev@TEMPO.xyz')
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('rejects new users on other domains', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
+    try {
+      const app = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+
+      expect(verifyResponse.status).toBe(403)
+      expect(cookie).toBeUndefined()
+      expect(await verifyResponse.json()).toMatchInlineSnapshot(`
+        {
+          "error": "sign-ups are restricted to approved email domains or invited emails",
+        }
+      `)
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('rejects new users without an identity token', async () => {
+    const app = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
+    })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+
+    expect(verifyResponse.status).toBe(403)
+    expect(cookie).toBeUndefined()
+  })
+
+  test('allows invited emails regardless of domain', async () => {
+    const oidc = await createIssuer({ email: 'Invited@Example.com' })
+    try {
+      const db = TestApp.database()
+
+      // Owner signs up while sign-up is open and issues the invitation.
+      const open = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { wallet: { origin } },
+      })
+      const owner = privateKeyToAccount(generatePrivateKey())
+      const { cookie } = await TestApp.signIn(open, owner)
+      const created = await open.request('/v1/orgs', {
+        body: JSON.stringify({ name: 'Acme' }),
+        headers: { 'content-type': 'application/json', cookie: cookie! },
+        method: 'POST',
+      })
+      const org = (await created.json()) as { id: string }
+      const invited = await open.request(`/v1/orgs/${org.id}/invitations`, {
+        body: JSON.stringify({ email: 'invited@example.com', role: 'member' }),
+        headers: { 'content-type': 'application/json', cookie: cookie! },
+        method: 'POST',
+      })
+      expect(invited.status).toBe(200)
+
+      const restricted = TestApp.create({
+        auth: { keys: [TestApp.key] },
+        db,
+        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
+      })
+      const account = privateKeyToAccount(generatePrivateKey())
+      const { verifyResponse } = await TestApp.signIn(restricted, account, {
+        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
+      })
+      expect(verifyResponse.status).toBe(200)
+    } finally {
+      await oidc.close()
+    }
+  })
+
+  test('allows existing users regardless of domain', async () => {
+    const db = TestApp.database()
+    const account = privateKeyToAccount(generatePrivateKey())
+
+    // Row created before the restriction (open sign-up deployment).
+    const open = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      db,
+      session: { wallet: { origin } },
+    })
+    const first = await TestApp.signIn(open, account)
+    expect(first.verifyResponse.status).toBe(200)
+
+    const restricted = TestApp.create({
+      auth: { keys: [TestApp.key] },
+      db,
+      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
+    })
+    const second = await TestApp.signIn(restricted, account)
+    expect(second.verifyResponse.status).toBe(200)
+  })
+})
+
+/** Local OIDC issuer standing in for the wallet: the SDK's own provider (discovery, JWKS, token mint). */
+async function createIssuer(options: { email: string }) {
+  // Extractable: the provider takes key material as JWK strings.
+  const { privateKey, publicKey } = await generateKeyPair('EdDSA', { extractable: true })
+  // The provider pins its `issuer` URL at construction, but the ephemeral
+  // port is only known after bind — listen through a closure, assign after.
+  let provider!: ReturnType<typeof Accounts.Handler.oidcProvider>
+  type Listener = { close: () => Promise<void>; url: string }
+  const { close, url } = await new Promise<Listener>((resolve) => {
+    const server = serve({ fetch: (request) => provider.fetch(request), port: 0 }, (info) =>
+      resolve({
+        close: () => new Promise((done) => server.close(() => done())),
+        url: `http://127.0.0.1:${info.port}`,
+      }),
+    )
+  })
+  provider = Accounts.Handler.oidcProvider({
+    // Test-only: no `authenticate`, so the request body's `subject` is trusted.
+    getClaims: () => ({ email: options.email, email_verified: true }),
+    issuer: url,
+    publicKey: JSON.stringify(await exportJWK(publicKey)),
+    signingKey: JSON.stringify(await exportJWK(privateKey)),
+  })
+  return {
+    close,
+    /** Mints a wallet-style identity token bound to the SIWE nonce and signer. */
+    async mint(mintOptions: { address: string; nonce: string }) {
+      const response = await provider.fetch(
+        new Request(`${url}/token`, {
+          body: JSON.stringify({
+            audience: origin,
+            nonce: mintOptions.nonce,
+            subject: mintOptions.address,
+          }),
+          headers: { 'content-type': 'application/json' },
+          method: 'POST',
+        }),
+      )
+      const { idToken } = (await response.json()) as { idToken: string }
+      return idToken
+    },
+    url,
+  }
+}

package/src/apps/platform/routes/orgs.ts

@@ -5,6 +5,7 @@ import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Db from '../../../db/Db.js'
+import * as Memberships from '../../../db/tables/memberships.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Response from '../../../internal/Response.js'
@@ -42,6 +43,12 @@ export namespace schema {
           z.describe('Human-readable organization name.'),
           z.meta({ examples: ['Acme, Inc.'] }),
         ),
+      role: z
+        .optional(z.enum(Memberships.roles))
+        .check(
+          z.describe("The caller's role in this organization; absent for the super admin."),
+          z.meta({ examples: ['owner'] }),
+        ),
       updatedAt: z
         .string()
         .check(
@@ -181,7 +188,13 @@ export function orgs() {
           const record =
             principal.type === 'super_admin'
               ? await Organizations.create(db, { createdBy: 'super_admin', name: body.name })
-              : await Organizations.createOwned(db, { name: body.name, userId: principal.id })
+              : {
+                  ...(await Organizations.createOwned(db, {
+                    name: body.name,
+                    userId: principal.id,
+                  })),
+                  role: 'owner' as const,
+                }
           return c.json(Response.validated(schema.Organization, serializeOrganization(record)), 200)
         } catch (cause) {
           return Response.upstream(c, cause)
@@ -215,7 +228,10 @@ export function orgs() {
           })
 
         return c.json(
-          Response.validated(schema.Organization, serializeOrganization(Auth.org(c))),
+          Response.validated(
+            schema.Organization,
+            serializeOrganization({ ...Auth.org(c), role: Auth.membership(c)?.role }),
+          ),
           200,
         )
       },
@@ -260,7 +276,10 @@ export function orgs() {
           const updated = await Organizations.update(db, Auth.org(c).id, { name: body.name })
           if (!updated) return organizationNotFound(c)
           return c.json(
-            Response.validated(schema.Organization, serializeOrganization(updated)),
+            Response.validated(
+              schema.Organization,
+              serializeOrganization({ ...updated, role: Auth.membership(c)?.role }),
+            ),
             200,
           )
         } catch (cause) {
@@ -317,11 +336,14 @@ export function orgs() {
     )
 }
 
-function serializeOrganization(record: Organizations.Record) {
+function serializeOrganization(
+  record: Organizations.Record & { role?: Memberships.Role | undefined },
+) {
   return {
     createdAt: record.createdAt,
     id: record.id,
     name: record.name,
+    ...(record.role ? { role: record.role } : {}),
     updatedAt: record.updatedAt,
   }
 }

package/src/apps/platform/routes/scopes.test.ts

@@ -0,0 +1,29 @@
+import * as Scope from '../../../Scope.js'
+import * as TestApp from '../../../../test/App.js'
+import * as Scopes from './scopes.js'
+
+describe('scopes', () => {
+  test('lists the scope catalog without authentication (public catalog)', async () => {
+    const app = TestApp.create()
+    const response = await app.request('/v1/scopes')
+    const body = await TestApp.json(response, Scopes.schema.getScopes.Response)
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    // Static public data must be cacheable (`stable`); without it every
+    // request pays the full auth/rate-limit floor.
+    expect(response.headers.get('cache-control')).toMatchInlineSnapshot(
+      `"private, max-age=300, stale-while-revalidate=3600"`,
+    )
+    expect(body.data).toEqual(Scope.catalog.map((entry) => ({ ...entry })))
+    expect(body.data.map((entry) => entry.scope)).toMatchInlineSnapshot(`
+      [
+        "data:read",
+        "indexer:query",
+        "rpc-relay:read",
+        "rpc-relay:sponsor",
+        "webhooks:read",
+        "webhooks:write",
+      ]
+    `)
+  })
+})

package/src/apps/platform/routes/scopes.ts

@@ -0,0 +1,85 @@
+import { Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Cache from '../../../internal/Cache.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Response from '../../../internal/Response.js'
+import * as Scope from '../../../Scope.js'
+
+/** Zod schemas owned by the scope-catalog resource. */
+export namespace schema {
+  /** Schemas for the getScopes operation. */
+  export namespace getScopes {
+    /** A single issuable API-key scope. */
+    export const Entry = z
+      .object({
+        description: z
+          .string()
+          .check(
+            z.describe('Human-readable explanation of what the scope grants.'),
+            z.meta({ examples: ['Read webhook subscriptions.'] }),
+          ),
+        scope: z
+          .enum(Scope.catalog.map((entry) => entry.scope))
+          .check(
+            z.describe('Scope identifier used in API-key grants and route policies.'),
+            z.meta({ examples: ['data:read'] }),
+          ),
+        selfServe: z
+          .boolean()
+          .check(
+            z.describe('Whether a session may self-mint this scope (else super-admin-only).'),
+            z.meta({ examples: [true] }),
+          ),
+      })
+      .check(z.describe('A single issuable API-key scope.'))
+
+    /** Response body for the scope catalog. */
+    export const Response = z
+      .object({
+        data: z.array(Entry).check(z.describe('Issuable API-key scopes.')),
+      })
+      .check(z.describe('Response body for the scope catalog.'))
+  }
+}
+
+/**
+ * Mounts the `/scopes` resource: the issuable API-key scope vocabulary, served
+ * from {@link Scope.catalog}. Public catalog data: anonymous callers are served
+ * within the public quota; the session lane lets signed-in consoles skip it.
+ */
+export function scopes() {
+  return new Hono<App.Environment>().get(
+    '/v1/scopes',
+    Auth.policy({ public: true, session: true }),
+    OpenApi.describeRoute({
+      description: 'See which scopes can be granted to API keys.',
+      operationId: 'getScopes',
+      responses: OpenApi.responses({
+        success: { description: 'Issuable scope catalog.', schema: schema.getScopes.Response },
+      }),
+      summary: 'List scopes',
+      tags: ['API Keys'],
+    }),
+    Cache.response<App.Environment>({
+      cacheControl: Cache.policies.stable,
+      name: 'tempo-api:scopes:v1',
+      key: (c) => {
+        const url = new URL(c.req.url)
+        url.search = ''
+        return url.toString()
+      },
+    }),
+    (c) => {
+      if (Auth.narrowAccess) return Auth.accessError(c)
+      return c.json(
+        Response.validated(schema.getScopes.Response, {
+          data: Scope.catalog.map((entry) => ({ ...entry })),
+        }),
+        200,
+      )
+    },
+  )
+}