tapimo 0.4.3 → 0.5.0

package/src/apps/management/routes/api-keys.test.ts

@@ -111,7 +111,20 @@ describe('keys', () => {
     expect(write.status).toBe(200)
   })
 
-  test('lets management keys manage org credentials without delegating issuance', async () => {
+  test('zone scopes are never self-serve', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+
+    // Even the org owner cannot self-mint zone access: membership is
+    // controlled zone-side, so zone scopes are super-admin-issued.
+    const denied = await app.request(base, json('POST', owner, { scopes: ['zone:421700001:read'] }))
+    expect(denied.status).toBe(403)
+    expect(await denied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+  })
+
+  test('restricts project management keys without delegating issuance', async () => {
     const app = createApp()
     const cookie = await session(app)
     const { org, project } = await fixture(app, cookie)
@@ -135,10 +148,28 @@ describe('keys', () => {
       Keys.schema.createApiKey.Response,
     )
 
+    const own = await app.request(base, {
+      headers: { 'tempo-api-key': manager.token },
+    })
+    expect(own.status).toMatchInlineSnapshot(`200`)
+
     const listed = await app.request(siblingBase, {
       headers: { 'tempo-api-key': manager.token },
     })
-    expect(listed.status).toBe(200)
+    const { requestId: listedRequestId, ...listedBody } = (await listed.json()) as {
+      requestId?: string
+    }
+
+    expect(listed.status).toMatchInlineSnapshot(`404`)
+    expect(listedRequestId).toBeDefined()
+    expect(listedBody).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
 
     const delegated = await app.request(base, {
       body: JSON.stringify({ scopes: ['management:read'] }),
@@ -151,7 +182,20 @@ describe('keys', () => {
       headers: { 'tempo-api-key': manager.token },
       method: 'DELETE',
     })
-    expect(revoked.status).toBe(200)
+    const { requestId: revokedRequestId, ...revokedBody } = (await revoked.json()) as {
+      requestId?: string
+    }
+
+    expect(revoked.status).toMatchInlineSnapshot(`404`)
+    expect(revokedRequestId).toBeDefined()
+    expect(revokedBody).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
   })
 
   test('mints, lists, authenticates, and revokes a project key', async () => {

package/src/apps/management/routes/api-keys.ts

@@ -60,7 +60,7 @@ export namespace schema {
         .array(z.string().check(z.minLength(1)))
         .check(
           z.describe(
-            "Granted scopes. '*' (grant-all) appears only on keys minted by the super admin.",
+            "Granted scopes. '*' and non-self-serve scopes appear only on keys minted by the super admin.",
           ),
           z.meta({ examples: [['data:read']] }),
         ),
@@ -218,7 +218,7 @@ export namespace schema {
 }
 
 /**
- * Mounts project-attributed API key mint, list, and revoke routes plus the org-wide list. Access follows the caller's organization ownership.
+ * Mounts project-attributed API key mint, list, and revoke routes plus the org-wide list. Project routes enforce caller organization and project attribution.
  */
 export function apiKeys(options: apiKeys.Options = {}) {
   const hidden = !options.enabled

package/src/apps/management/routes/invite-links.test.ts

@@ -0,0 +1,385 @@
+import { testClient } from 'hono/testing'
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+import type * as z from 'zod/mini'
+
+import * as TestApp from '../../../../test/App.js'
+import type * as Db from '../../../db/Db.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as Users from '../../../db/tables/users.js'
+import * as InviteLinks from './invite-links.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RPC request options carrying a session cookie. */
+function as(cookie: string) {
+  return { headers: { cookie } } as const
+}
+
+function createApp(db: Db.Source = TestApp.database()) {
+  const app = TestApp.create({ db, session: { wallet: { origin } } })
+  return { app, client: testClient(app) }
+}
+
+/** Signs in a fresh scripted account and resolves its user id. */
+async function session({ app, client }: ReturnType<typeof createApp>) {
+  const { cookie } = await TestApp.signIn(app, privateKeyToAccount(generatePrivateKey()))
+  if (!cookie) throw new Error('Sign-in did not establish a session')
+  const me = await client.v1.me.$get(undefined, as(cookie))
+  expect(me.status).toBe(200)
+  if (me.status !== 200) throw new Error(`Failed to resolve session user: ${me.status}`)
+  const { id: userId } = await me.json()
+  return { cookie, userId }
+}
+
+/** Creates an owner and organization through their public write boundaries. */
+async function setup(context: ReturnType<typeof createApp>) {
+  const owner = await session(context)
+  const response = await context.client.v1.orgs.$post({ json: { name: 'Acme' } }, as(owner.cookie))
+  expect(response.status).toBe(200)
+  if (response.status !== 200) throw new Error(`Failed to create organization: ${response.status}`)
+  const org = await response.json()
+  return { org, owner }
+}
+
+/** Creates an invite link through the management route. */
+async function createLink(
+  { client }: ReturnType<typeof createApp>,
+  orgId: string,
+  cookie: string,
+  body: z.input<typeof InviteLinks.schema.CreateBody> = { name: 'Community' },
+) {
+  const response = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links'].$post(
+    { json: body, param: { orgId } },
+    as(cookie),
+  )
+  expect(response.status).toBe(200)
+  if (response.status !== 200) throw new Error(`Failed to create invite link: ${response.status}`)
+  return response.json()
+}
+
+const unavailable = {
+  error: { code: 'invite_link_not_found', message: 'Invite link not found' },
+}
+
+describe('inviteLinks', () => {
+  test('admins manage org-scoped links that outlive their creator', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+    const { org, owner } = await setup(context)
+    const admin = await session(context)
+    const member = await session(context)
+    await Memberships.create(db, { orgId: org.id, role: 'admin', userId: admin.userId })
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+
+    const forbidden = await orgLinks.$post(
+      { json: { name: 'No access' }, param: { orgId: org.id } },
+      as(member.cookie),
+    )
+    expect(forbidden.status).toBe(403)
+
+    const link = await createLink(context, org.id, admin.cookie, { role: 'member' })
+    expect(link).toMatchObject({
+      enabled: true,
+      lastUsedAt: null,
+      maxUses: null,
+      name: 'Untitled link',
+      role: 'member',
+      status: 'active',
+      useCount: 0,
+    })
+    expect(link.id).toMatch(/^iln_/)
+    expect(link.token).toMatch(/^lnk_/)
+    expect(Date.parse(link.expiresAt!) - Date.now()).toBeGreaterThan(6 * 86_400_000)
+
+    const updated = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$patch(
+      {
+        json: { enabled: false },
+        param: { inviteLinkId: link.id, orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(updated.status).toBe(200)
+    if (updated.status !== 200) throw new Error(`Failed to update invite link: ${updated.status}`)
+    expect(await updated.json()).toMatchObject({
+      enabled: false,
+      expiresAt: link.expiresAt,
+      maxUses: null,
+      name: 'Untitled link',
+      status: 'disabled',
+    })
+    const enabled = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$patch(
+      { json: { enabled: true }, param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(enabled.status).toBe(200)
+    if (enabled.status !== 200) throw new Error(`Failed to enable invite link: ${enabled.status}`)
+    expect((await enabled.json()).status).toBe('active')
+
+    expect(await Memberships.remove(db, org.id, admin.userId)).toBe('removed')
+    const resolved = await client.v1['invite-links'].resolve.$post({ json: { token: link.token } })
+    expect(resolved.status).toBe(200)
+
+    const foreign = await setup(context)
+    const crossOrg = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$patch(
+      {
+        json: { enabled: false },
+        param: { inviteLinkId: link.id, orgId: foreign.org.id },
+      },
+      as(foreign.owner.cookie),
+    )
+    expect(crossOrg.status).toBe(404)
+
+    const deleted = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$delete(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(deleted.status).toBe(200)
+    const listed = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list invite links: ${listed.status}`)
+    expect((await listed.json()).data).toEqual([])
+  })
+
+  test('resolve reveals only a summary and hides every unavailable reason', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+    const publicLinks = client.v1['invite-links']
+    const { org, owner } = await setup(context)
+    const active = await createLink(context, org.id, owner.cookie, {
+      expiresAt: '2099-01-01T05:00:00+05:00',
+      name: 'Active',
+    })
+    expect(active.expiresAt).toBe('2099-01-01T00:00:00.000Z')
+    const resolved = await publicLinks.resolve.$post({ json: { token: active.token } })
+    expect(resolved.status).toBe(200)
+    if (resolved.status !== 200)
+      throw new Error(`Failed to resolve invite link: ${resolved.status}`)
+    expect(await resolved.json()).toEqual({
+      orgName: 'Acme',
+      role: 'member',
+    })
+    expect(resolved.headers.get('set-cookie')).toBeNull()
+
+    const disabled = await createLink(context, org.id, owner.cookie, { name: 'Disabled' })
+    await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$patch(
+      { json: { enabled: false }, param: { inviteLinkId: disabled.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    const expired = await createLink(context, org.id, owner.cookie, {
+      expiresAt: new Date(Date.now() - 1_000).toISOString(),
+      name: 'Expired',
+    })
+    const exhausted = await createLink(context, org.id, owner.cookie, {
+      expiresAt: null,
+      maxUses: 1,
+      name: 'Exhausted',
+    })
+    const invitee = await session(context)
+    await Users.setEmail(db, invitee.userId, 'exhausted@example.com')
+    const accepted = await publicLinks.accept.$post(
+      { json: { token: exhausted.token } },
+      as(invitee.cookie),
+    )
+    expect(accepted.status).toBe(200)
+    const deleted = await createLink(context, org.id, owner.cookie, { name: 'Deleted' })
+    await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$delete(
+      { param: { inviteLinkId: deleted.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+
+    for (const token of [
+      'lnk_missing',
+      deleted.token,
+      disabled.token,
+      exhausted.token,
+      expired.token,
+    ]) {
+      const response = await publicLinks.resolve.$post({ json: { token } })
+      expect(response.status).toBe(404)
+      if (response.status !== 404)
+        throw new Error(`Expected unavailable invite link, received ${response.status}`)
+      const { requestId: _, ...body } = await response.json()
+      expect(body).toEqual(unavailable)
+    }
+  })
+
+  test('accept consumes only new memberships and preserves audit after deletion', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const orgRoutes = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']
+    const orgLinks = orgRoutes['invite-links']
+    const publicLinks = client.v1['invite-links']
+    const { org, owner } = await setup(context)
+    const link = await createLink(context, org.id, owner.cookie, {
+      expiresAt: null,
+      name: 'Join',
+    })
+    const invitee = await session(context)
+
+    const unverified = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(invitee.cookie),
+    )
+    expect(unverified.status).toBe(403)
+    await Users.setEmail(db, invitee.userId, 'join@example.com')
+
+    const firstJoin = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(invitee.cookie),
+    )
+    const repeat = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(invitee.cookie),
+    )
+    expect(firstJoin.status).toBe(200)
+    expect(repeat.status).toBe(200)
+
+    const audits = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(audits.status).toBe(200)
+    if (audits.status !== 200) throw new Error(`Failed to list redemptions: ${audits.status}`)
+    const firstAudit = await audits.json()
+    expect(firstAudit.data).toHaveLength(1)
+    expect(firstAudit.data[0]).not.toHaveProperty('token')
+    expect(firstAudit.data[0]).toMatchObject({
+      email: 'join@example.com',
+      inviteLinkId: link.id,
+      inviteLinkName: 'Join',
+      userId: invitee.userId,
+    })
+
+    expect(await Memberships.remove(db, org.id, invitee.userId)).toBe('removed')
+    const rejoined = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(invitee.cookie),
+    )
+    expect(rejoined.status).toBe(200)
+    const auditsAfterRejoin = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(auditsAfterRejoin.status).toBe(200)
+    if (auditsAfterRejoin.status !== 200)
+      throw new Error(`Failed to list redemptions: ${auditsAfterRejoin.status}`)
+    expect((await auditsAfterRejoin.json()).data).toHaveLength(2)
+
+    const listed = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list invite links: ${listed.status}`)
+    const managed = (await listed.json()).data[0]!
+    expect(managed.lastUsedAt).not.toBeNull()
+    expect(managed.useCount).toBe(2)
+
+    await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].$delete(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    const auditsAfterDeletion = await orgLinks[
+      ':inviteLinkId{iln_[A-Za-z0-9_-]+}'
+    ].redemptions.$get({ param: { inviteLinkId: link.id, orgId: org.id } }, as(owner.cookie))
+    expect(auditsAfterDeletion.status).toBe(200)
+    if (auditsAfterDeletion.status !== 200)
+      throw new Error(`Failed to list preserved redemptions: ${auditsAfterDeletion.status}`)
+    expect((await auditsAfterDeletion.json()).data).toHaveLength(2)
+  })
+
+  test('serializes concurrent attempts for the finite final use', async () => {
+    const factory = TestApp.databaseFactory()
+    const db = factory()
+    const context = createApp(factory)
+    const { client } = context
+    const orgRoutes = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']
+    const publicLinks = client.v1['invite-links']
+    const { org, owner } = await setup(context)
+    const link = await createLink(context, org.id, owner.cookie, {
+      expiresAt: null,
+      maxUses: 1,
+      name: 'One use',
+    })
+    const invitees = await Promise.all([session(context), session(context)])
+    await Promise.all(
+      invitees.map((invitee, index) =>
+        Users.setEmail(db, invitee.userId, `user${index}@example.com`),
+      ),
+    )
+
+    const responses = await Promise.all(
+      invitees.map((invitee) =>
+        publicLinks.accept.$post({ json: { token: link.token } }, as(invitee.cookie)),
+      ),
+    )
+    expect(responses.map(({ status }) => status).sort((a, b) => a - b)).toEqual([200, 404])
+    const winner = invitees[responses.findIndex(({ status }) => status === 200)]!
+    const retry = await publicLinks.accept.$post({ json: { token: link.token } }, as(winner.cookie))
+    expect(retry.status).toBe(200)
+
+    const audits = await orgRoutes['invite-links'][
+      ':inviteLinkId{iln_[A-Za-z0-9_-]+}'
+    ].redemptions.$get({ param: { inviteLinkId: link.id, orgId: org.id } }, as(owner.cookie))
+    expect(audits.status).toBe(200)
+    if (audits.status !== 200) throw new Error(`Failed to list redemptions: ${audits.status}`)
+    expect((await audits.json()).data).toHaveLength(1)
+    const listed = await orgRoutes['invite-links'].$get(
+      { param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list invite links: ${listed.status}`)
+    expect((await listed.json()).data[0]).toMatchObject({
+      status: 'exhausted',
+      useCount: 1,
+    })
+  })
+
+  test('keeps privileged email invitations independent from member links', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const orgRoutes = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']
+    const { org, owner } = await setup(context)
+    const link = await createLink(context, org.id, owner.cookie, {
+      expiresAt: null,
+      name: 'Join',
+    })
+    const invitee = await session(context)
+    await Users.setEmail(db, invitee.userId, 'admin@example.com')
+    const invitationResponse = await orgRoutes.invitations.$post(
+      {
+        json: { email: 'admin@example.com', role: 'admin' },
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(invitationResponse.status).toBe(200)
+    if (invitationResponse.status !== 200)
+      throw new Error(`Failed to create email invitation: ${invitationResponse.status}`)
+    const invitation = await invitationResponse.json()
+
+    const joined = await client.v1['invite-links'].accept.$post(
+      { json: { token: link.token } },
+      as(invitee.cookie),
+    )
+    expect(joined.status).toBe(200)
+    expect((await Memberships.get(db, org.id, invitee.userId))?.role).toBe('member')
+
+    const pending = await client.v1.invitations.$get(undefined, as(invitee.cookie))
+    expect(pending.status).toBe(200)
+    if (pending.status !== 200)
+      throw new Error(`Failed to list email invitations: ${pending.status}`)
+    expect((await pending.json()).data).toHaveLength(1)
+    const elevated = await client.v1.invitations[':invitationId{inv_[A-Za-z0-9_-]+}'].accept.$post(
+      { param: { invitationId: invitation.id } },
+      as(invitee.cookie),
+    )
+    expect(elevated.status).toBe(200)
+    expect((await Memberships.get(db, org.id, invitee.userId))?.role).toBe('admin')
+  })
+})