tapimo 0.4.1 → 0.4.4

package/src/db/Schema.ts

@@ -2,6 +2,25 @@ import * as z from 'zod/mini'
 
 import type * as Webhooks from '../internal/Webhooks.js'
 
+/** One authenticated administrator access to a protected admin API route. */
+export const AdminAuditLog = z.object({
+  actor: z.string().check(z.describe('Verified administrator email.')),
+  createdAt: z.string().check(z.describe('When the access completed (ISO 8601).')),
+  id: z.string().check(z.describe('Opaque audit event id (`aud_…`).')),
+  method: z.string().check(z.describe('HTTP method used for the access.')),
+  path: z.string().check(z.describe('Admin API path accessed, without query parameters.')),
+  query: z
+    .nullable(z.string())
+    .check(z.describe('Query string used for the lookup, or null when absent.')),
+  requestId: z.string().check(z.describe('Request id correlating the access with request logs.')),
+  status: z
+    .number()
+    .check(z.int(), z.describe('HTTP response status returned to the administrator.')),
+})
+
+/** Columns of the `admin_audit_logs` table. */
+export type AdminAuditLog = z.output<typeof AdminAuditLog>
+
 // Row schemas for database tables (`zod/mini`), the source of truth each
 // `tables/` module derives its `Table` type from. Nullable fields map to
 // nullable columns; the domain layer converts `null` back to absent fields.
@@ -49,7 +68,7 @@ export const Invitation = z.object({
       z.describe('Opaque invitation id (`inv_…`).'),
       z.meta({ examples: ['inv_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
     ),
-  invitedBy: z.string().check(z.describe('User id (`usr_…`) that created the invitation.')),
+  invitedBy: z.string().check(z.describe('User or API key id that created the invitation.')),
   orgId: z.string().check(z.describe('Organization id (`org_…`) the invitation joins.')),
   revokedAt: z
     .nullable(z.string())

package/src/db/tables/adminAuditLogs.ts

@@ -0,0 +1,47 @@
+import type { Selectable } from 'kysely'
+
+import * as Id from '../../internal/Id.js'
+import type * as Db from '../Db.js'
+import type * as db_Schema from '../Schema.js'
+
+/** Columns of the `admin_audit_logs` table. */
+export type Table = db_Schema.AdminAuditLog
+
+/** One stored administrator access event. */
+export type Record = Selectable<Table>
+
+/** Records an authenticated access to a protected admin API route. */
+export function insert(db: Db.Db, input: insert.Input): Promise<Record> {
+  return db.kysely
+    .insertInto('admin_audit_logs')
+    .values({
+      actor: input.actor,
+      createdAt: new Date().toISOString(),
+      id: Id.generate('aud'),
+      method: input.method,
+      path: input.path,
+      query: input.query ?? null,
+      requestId: input.requestId,
+      status: input.status,
+    })
+    .returningAll()
+    .executeTakeFirstOrThrow()
+}
+
+export declare namespace insert {
+  /** Fields captured for one administrator access. */
+  type Input = {
+    /** Verified administrator email. */
+    actor: string
+    /** HTTP method used for the access. */
+    method: string
+    /** Admin API path accessed, without query parameters. */
+    path: string
+    /** Query string used for the lookup. */
+    query?: string | undefined
+    /** Request id correlating the access with request logs. */
+    requestId: string
+    /** HTTP response status returned to the administrator. */
+    status: number
+  }
+}

package/src/db/tables/invitations.ts

@@ -60,7 +60,7 @@ export declare namespace create {
     email: string
     /** When the invitation expires (ISO 8601). */
     expiresAt: string
-    /** User id (`usr_…`) creating the invitation. */
+    /** User or API key id creating the invitation. */
     invitedBy: string
     /** Organization id (`org_…`) the invitation joins. */
     orgId: string

package/src/db/tables/memberships.ts

@@ -9,6 +9,9 @@ export type Table = db_Schema.Membership
 /** A stored membership row. */
 export type Record = Selectable<Table>
 
+/** A membership with the member's resolved user identity. */
+export type DetailedRecord = Record & { address: string | null; email: string | null }
+
 /** A membership role. */
 export type Role = Record['role']
 
@@ -93,20 +96,73 @@ export function listByOrg(db: Db.Db, orgId: string): Promise<Record[]> {
  * @param orgId - The organization id (`org_…`).
  * @returns The records with `address`/`email` from the member's user row.
  */
-export function listByOrgDetailed(
+export function listByOrgDetailed(db: Db.Db, orgId: string): Promise<DetailedRecord[]> {
+  return db.kysely
+    .selectFrom('memberships')
+    .innerJoin('users', 'users.id', 'memberships.userId')
+    .where('memberships.orgId', '=', orgId)
+    .selectAll('memberships')
+    .select(['users.address', 'users.email'])
+    .orderBy('memberships.createdAt', 'asc')
+    .execute()
+}
+
+/**
+ * Lists a bounded page of an organization's memberships with member identity,
+ * oldest first.
+ *
+ * @param db - The database.
+ * @param orgId - The organization id.
+ * @param options - Keyset and page-size options.
+ * @returns At most `limit + 1` rows for next-cursor derivation.
+ */
+export function listByOrgDetailedPage(
   db: Db.Db,
   orgId: string,
-): Promise<(Record & { address: string | null; email: string | null })[]> {
-  return db.kysely
+  options: listByOrgDetailedPage.Options,
+): Promise<DetailedRecord[]> {
+  const cursor = options.cursor
+  let query = db.kysely
     .selectFrom('memberships')
     .innerJoin('users', 'users.id', 'memberships.userId')
     .where('memberships.orgId', '=', orgId)
     .selectAll('memberships')
     .select(['users.address', 'users.email'])
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('memberships.createdAt', '>', cursor.createdAt),
+        eb.and([
+          eb('memberships.createdAt', '=', cursor.createdAt),
+          eb('memberships.userId', '>', cursor.userId),
+        ]),
+      ]),
+    )
+  return query
     .orderBy('memberships.createdAt', 'asc')
+    .orderBy('memberships.userId', 'asc')
+    .limit(options.limit + 1)
     .execute()
 }
 
+export declare namespace listByOrgDetailedPage {
+  /** Cursor fields for the last membership on the previous page. */
+  type Cursor = {
+    /** Membership creation time. */
+    createdAt: string
+    /** Member user id, used as a deterministic tie-breaker. */
+    userId: string
+  }
+
+  /** Options for {@link listByOrgDetailedPage}. */
+  type Options = {
+    /** Last membership returned by the previous page. */
+    cursor?: Cursor | undefined
+    /** Requested page size. */
+    limit: number
+  }
+}
+
 /**
  * Changes a member's role atomically, refusing to demote the last owner. The
  * org's owner rows are locked for the transaction, so a concurrent demotion or

package/src/db/tables/organizations.ts

@@ -1,4 +1,4 @@
-import type { Selectable } from 'kysely'
+import { sql, type Selectable } from 'kysely'
 
 import * as Id from '../../internal/Id.js'
 import type * as Db from '../Db.js'
@@ -133,6 +133,39 @@ export function get(db: Db.Db, id: string): Promise<Record | undefined> {
   return db.kysely.selectFrom('organizations').selectAll().where('id', '=', id).executeTakeFirst()
 }
 
+/**
+ * Reads an organization with current member and project counts.
+ *
+ * @param db - The database.
+ * @param id - The organization id.
+ * @returns The organization summary, or `undefined` when absent.
+ */
+export async function getSummary(db: Db.Db, id: string): Promise<search.Result | undefined> {
+  const record = await db.kysely
+    .selectFrom('organizations')
+    .selectAll('organizations')
+    .select((eb) => [
+      eb
+        .selectFrom('memberships')
+        .select((builder) => builder.fn.countAll<number>().as('count'))
+        .whereRef('memberships.orgId', '=', 'organizations.id')
+        .as('memberCount'),
+      eb
+        .selectFrom('projects')
+        .select((builder) => builder.fn.countAll<number>().as('count'))
+        .whereRef('projects.orgId', '=', 'organizations.id')
+        .as('projectCount'),
+    ])
+    .where('organizations.id', '=', id)
+    .executeTakeFirst()
+  if (!record) return undefined
+  return {
+    ...record,
+    memberCount: Number(record.memberCount),
+    projectCount: Number(record.projectCount),
+  }
+}
+
 /**
  * Lists organizations, newest first.
  *
@@ -143,6 +176,120 @@ export function list(db: Db.Db): Promise<Record[]> {
   return db.kysely.selectFrom('organizations').selectAll().orderBy('createdAt', 'desc').execute()
 }
 
+/**
+ * Searches organizations for the admin lookup surface, newest first. Results
+ * include member and project counts and use a stable `(createdAt, id)` keyset.
+ *
+ * @param db - The database.
+ * @param options - Search, keyset, and page-size options.
+ * @returns At most `limit + 1` rows so the caller can derive a next cursor.
+ */
+export async function search(db: Db.Db, options: search.Options): Promise<search.Result[]> {
+  const { cursor, limit, query: searchQuery } = options
+  let query = db.kysely
+    .selectFrom('organizations')
+    .selectAll('organizations')
+    .select((eb) => [
+      eb
+        .selectFrom('memberships')
+        .select((builder) => builder.fn.countAll<number>().as('count'))
+        .whereRef('memberships.orgId', '=', 'organizations.id')
+        .as('memberCount'),
+      eb
+        .selectFrom('projects')
+        .select((builder) => builder.fn.countAll<number>().as('count'))
+        .whereRef('projects.orgId', '=', 'organizations.id')
+        .as('projectCount'),
+    ])
+
+  if (searchQuery?.startsWith('org_')) query = query.where('organizations.id', '=', searchQuery)
+  else if (searchQuery?.startsWith('usr_'))
+    query = query.where((eb) =>
+      eb.or([
+        eb('organizations.userId', '=', searchQuery),
+        eb(
+          'organizations.id',
+          'in',
+          eb
+            .selectFrom('memberships')
+            .select('memberships.orgId')
+            .where('memberships.userId', '=', searchQuery),
+        ),
+      ]),
+    )
+  else if (searchQuery) {
+    const pattern = `${searchQuery
+      .toLowerCase()
+      .replaceAll('\\', '\\\\')
+      .replaceAll('%', '\\%')
+      .replaceAll('_', '\\_')}%`
+    query = query.where((eb) =>
+      eb.or([
+        sql<boolean>`lower(${sql.ref('organizations.name')}) LIKE ${pattern} ESCAPE '\\'`,
+        eb(
+          'organizations.id',
+          'in',
+          eb
+            .selectFrom('memberships')
+            .innerJoin('users', 'users.id', 'memberships.userId')
+            .select('memberships.orgId')
+            .where(sql<boolean>`lower(${sql.ref('users.email')}) LIKE ${pattern} ESCAPE '\\'`),
+        ),
+      ]),
+    )
+  }
+
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('organizations.createdAt', '<', cursor.createdAt),
+        eb.and([
+          eb('organizations.createdAt', '=', cursor.createdAt),
+          eb('organizations.id', '<', cursor.id),
+        ]),
+      ]),
+    )
+
+  const records = await query
+    .orderBy('organizations.createdAt', 'desc')
+    .orderBy('organizations.id', 'desc')
+    .limit(limit + 1)
+    .execute()
+  return records.map((record) => ({
+    ...record,
+    memberCount: Number(record.memberCount),
+    projectCount: Number(record.projectCount),
+  }))
+}
+
+export declare namespace search {
+  /** Cursor fields for the last organization returned by the previous page. */
+  type Cursor = {
+    /** Organization creation time. */
+    createdAt: string
+    /** Organization id, used as a deterministic tie-breaker. */
+    id: string
+  }
+
+  /** Options for {@link search}. */
+  type Options = {
+    /** Last organization returned by the previous page. */
+    cursor?: Cursor | undefined
+    /** Requested page size. */
+    limit: number
+    /** Exact resource id or case-insensitive name/email prefix search. */
+    query?: string | undefined
+  }
+
+  /** Organization summary returned by {@link search}. */
+  type Result = Record & {
+    /** Number of current organization members. */
+    memberCount: number
+    /** Number of projects owned by the organization. */
+    projectCount: number
+  }
+}
+
 /**
  * Lists organizations owned by `userId`, newest first.
  *

package/src/db/tables/projects.ts

@@ -81,6 +81,53 @@ export function listByOrg(db: Db.Db, orgId: string): Promise<Record[]> {
     .execute()
 }
 
+/**
+ * Lists a bounded page of an organization's projects, newest first.
+ *
+ * @param db - The database.
+ * @param orgId - The organization id.
+ * @param options - Keyset and page-size options.
+ * @returns At most `limit + 1` rows for next-cursor derivation.
+ */
+export function listByOrgPage(
+  db: Db.Db,
+  orgId: string,
+  options: listByOrgPage.Options,
+): Promise<Record[]> {
+  const cursor = options.cursor
+  let query = db.kysely.selectFrom('projects').selectAll().where('orgId', '=', orgId)
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('createdAt', '<', cursor.createdAt),
+        eb.and([eb('createdAt', '=', cursor.createdAt), eb('id', '<', cursor.id)]),
+      ]),
+    )
+  return query
+    .orderBy('createdAt', 'desc')
+    .orderBy('id', 'desc')
+    .limit(options.limit + 1)
+    .execute()
+}
+
+export declare namespace listByOrgPage {
+  /** Cursor fields for the last project on the previous page. */
+  type Cursor = {
+    /** Project creation time. */
+    createdAt: string
+    /** Project id, used as a deterministic tie-breaker. */
+    id: string
+  }
+
+  /** Options for {@link listByOrgPage}. */
+  type Options = {
+    /** Last project returned by the previous page. */
+    cursor?: Cursor | undefined
+    /** Requested page size. */
+    limit: number
+  }
+}
+
 /**
  * Renames a project, bumping `updatedAt`.
  *

package/src/db/tables/webhookDeliveries.ts

@@ -10,6 +10,12 @@ export type Table = db_Schema.WebhookDelivery
 /** A stored webhook-delivery row. */
 export type Record = Selectable<Table>
 
+/** A failed delivery joined to its organization-owned subscription. */
+export type OrganizationFailure = Pick<
+  Record,
+  'attempt' | 'createdAt' | 'error' | 'id' | 'responseStatus' | 'subscriptionId'
+>
+
 /** Maps a stored row to the domain delivery (null columns → absent fields). */
 export function toDelivery(row: Record): Webhooks.Delivery {
   return {
@@ -85,6 +91,83 @@ export async function list(
   return (await query.execute()).map(toDelivery)
 }
 
+/** Lists recent failed webhook deliveries across an organization. */
+export function listFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: listFailuresByOrg.Options,
+): Promise<OrganizationFailure[]> {
+  return db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select([
+      'webhook_deliveries.attempt',
+      'webhook_deliveries.createdAt',
+      'webhook_deliveries.error',
+      'webhook_deliveries.id',
+      'webhook_deliveries.responseStatus',
+      'webhook_deliveries.subscriptionId',
+    ])
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .orderBy('webhook_deliveries.createdAt', 'desc')
+    .orderBy('webhook_deliveries.id', 'desc')
+    .limit(options.limit)
+    .execute()
+}
+
+export declare namespace listFailuresByOrg {
+  /** Bounds for the organization failure scan. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** Maximum failures to return. */
+    limit: number
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
+/** Counts failed webhook deliveries across an organization in a time window. */
+export async function countFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: countFailuresByOrg.Options,
+): Promise<number> {
+  const row = await db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select((eb) => eb.fn.countAll().as('count'))
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .executeTakeFirstOrThrow()
+  return Number(row.count)
+}
+
+export declare namespace countFailuresByOrg {
+  /** Bounds for the organization failure count. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
 export declare namespace list {
   /** Options for {@link list}. */
   type Options = {