tapimo 0.4.4 → 0.5.0

package/src/db/tables/inviteLinks.ts

@@ -0,0 +1,187 @@
+import type { Selectable } from 'kysely'
+
+import * as Id from '../../internal/Id.js'
+import type * as Db from '../Db.js'
+import type * as db_Schema from '../Schema.js'
+
+/** Columns of the `invite_links` table. */
+export type Table = db_Schema.InviteLink
+/** Columns of the `invite_link_redemptions` table. */
+export type RedemptionTable = db_Schema.InviteLinkRedemption
+/** A stored invite link. */
+export type Record = Selectable<Table>
+/** A stored redemption. */
+export type Redemption = Selectable<RedemptionTable>
+/** Derived link availability. */
+export type Status = 'active' | 'deleted' | 'disabled' | 'exhausted' | 'expired'
+
+/** Derives current availability from persisted controls and count. */
+export function status(record: Record, now = new Date().toISOString()): Status {
+  if (record.deletedAt) return 'deleted'
+  if (!record.enabled) return 'disabled'
+  if (record.expiresAt && record.expiresAt <= now) return 'expired'
+  if (record.maxUses !== null && record.useCount >= record.maxUses) return 'exhausted'
+  return 'active'
+}
+
+/** Creates a reusable invite link. */
+export function create(
+  db: Db.Db,
+  input: {
+    createdBy: string
+    expiresAt: string | null
+    maxUses: number | null
+    name?: string | undefined
+    orgId: string
+    role: 'member'
+  },
+): Promise<Record> {
+  const now = new Date().toISOString()
+  return db.kysely
+    .insertInto('invite_links')
+    .values({
+      createdAt: now,
+      createdBy: input.createdBy,
+      deletedAt: null,
+      enabled: true,
+      expiresAt: input.expiresAt,
+      id: Id.generate('iln'),
+      lastUsedAt: null,
+      maxUses: input.maxUses,
+      name: input.name ?? 'Untitled link',
+      orgId: input.orgId,
+      role: input.role,
+      token: Id.generate('lnk'),
+      updatedAt: now,
+      useCount: 0,
+    })
+    .returningAll()
+    .executeTakeFirstOrThrow()
+}
+
+/** Lists non-deleted links in an organization. */
+export function list(db: Db.Db, orgId: string): Promise<Record[]> {
+  return db.kysely
+    .selectFrom('invite_links')
+    .selectAll()
+    .where('orgId', '=', orgId)
+    .where('deletedAt', 'is', null)
+    .orderBy('createdAt', 'desc')
+    .execute()
+}
+
+/** Gets an invite link by its management id, including deleted links. */
+export function get(db: Db.Db, id: string): Promise<Record | undefined> {
+  return db.kysely.selectFrom('invite_links').selectAll().where('id', '=', id).executeTakeFirst()
+}
+
+/** Gets an invite link by its bearer token, including deleted links. */
+export function getByToken(db: Db.Db, token: string): Promise<Record | undefined> {
+  return db.kysely
+    .selectFrom('invite_links')
+    .selectAll()
+    .where('token', '=', token)
+    .executeTakeFirst()
+}
+
+/** Updates an org-scoped non-deleted link. */
+export function update(
+  db: Db.Db,
+  orgId: string,
+  id: string,
+  enabled: boolean,
+): Promise<Record | undefined> {
+  return db.kysely
+    .updateTable('invite_links')
+    .set({ enabled, updatedAt: new Date().toISOString() })
+    .where('id', '=', id)
+    .where('orgId', '=', orgId)
+    .where('deletedAt', 'is', null)
+    .returningAll()
+    .executeTakeFirst()
+}
+
+/** Soft deletes an org-scoped link. */
+export function remove(db: Db.Db, orgId: string, id: string): Promise<Record | undefined> {
+  const now = new Date().toISOString()
+  return db.kysely
+    .updateTable('invite_links')
+    .set({ deletedAt: now, updatedAt: now })
+    .where('id', '=', id)
+    .where('orgId', '=', orgId)
+    .where('deletedAt', 'is', null)
+    .returningAll()
+    .executeTakeFirst()
+}
+
+/** Lists redemption audit records, newest first. */
+export function listRedemptions(
+  db: Db.Db,
+  orgId: string,
+  inviteLinkId: string,
+): Promise<Redemption[]> {
+  return db.kysely
+    .selectFrom('invite_link_redemptions')
+    .selectAll()
+    .where('orgId', '=', orgId)
+    .where('inviteLinkId', '=', inviteLinkId)
+    .orderBy('createdAt', 'desc')
+    .execute()
+}
+
+/** Atomically joins through an active link, consuming only a newly inserted membership. */
+export function accept(
+  db: Db.Db,
+  token: string,
+  userId: string,
+  email: string,
+): Promise<{ link: Record; consumed: boolean } | undefined> {
+  return db.kysely.transaction().execute(async (trx) => {
+    const now = new Date().toISOString()
+    const link = await trx
+      .selectFrom('invite_links')
+      .selectAll()
+      .where('token', '=', token)
+      .forUpdate()
+      .executeTakeFirst()
+    if (!link) return undefined
+    // Existing membership is already the desired end state, so retries remain
+    // successful after the link becomes unavailable and never consume capacity.
+    const existing = await trx
+      .selectFrom('memberships')
+      .select('userId')
+      .where('orgId', '=', link.orgId)
+      .where('userId', '=', userId)
+      .executeTakeFirst()
+    if (existing) return { consumed: false, link }
+    if (status(link, now) !== 'active') return undefined
+    const inserted = await trx
+      .insertInto('memberships')
+      .values({ createdAt: now, orgId: link.orgId, role: 'member', updatedAt: now, userId })
+      .onConflict((oc) => oc.columns(['orgId', 'userId']).doNothing())
+      .returning('userId')
+      .executeTakeFirst()
+    if (!inserted) return { consumed: false, link }
+    await trx
+      .updateTable('invite_links')
+      .set({ lastUsedAt: now, updatedAt: now, useCount: link.useCount + 1 })
+      .where('id', '=', link.id)
+      .execute()
+    await trx
+      .insertInto('invite_link_redemptions')
+      .values({
+        createdAt: now,
+        email: email.toLowerCase(),
+        id: Id.generate('ilr'),
+        inviteLinkId: link.id,
+        inviteLinkName: link.name,
+        orgId: link.orgId,
+        userId,
+      })
+      .execute()
+    return {
+      consumed: true,
+      link: { ...link, lastUsedAt: now, updatedAt: now, useCount: link.useCount + 1 },
+    }
+  })
+}

package/src/db/tables/organizations.ts

@@ -112,6 +112,8 @@ export function deleteOrganization(db: Db.Db, id: string): Promise<boolean> {
       .execute()
     await trx.deleteFrom('billing_settings').where('orgId', '=', id).execute()
     await trx.deleteFrom('invitations').where('orgId', '=', id).execute()
+    await trx.deleteFrom('invite_link_redemptions').where('orgId', '=', id).execute()
+    await trx.deleteFrom('invite_links').where('orgId', '=', id).execute()
     await trx.deleteFrom('memberships').where('orgId', '=', id).execute()
     await trx.deleteFrom('projects').where('orgId', '=', id).execute()
     await trx.deleteFrom('request_usage_buckets').where('orgId', '=', id).execute()

package/src/handlers/relay.ts

@@ -116,15 +116,27 @@ export function relay(options: relay.Options = {}): Handler {
   ) {
     await onRequest?.(request)
 
-    // Resolve chainId from: 1) explicit option (URL path), 2) first param object, 3) default chain.
     const params = 'params' in request && Array.isArray(request.params) ? request.params : []
     const first =
       typeof params[0] === 'object' && params[0]
         ? (params[0] as Record<string, unknown>)
         : undefined
-    const chainId =
-      Utils.resolveChainId(first?.['chainId']) ?? options?.chainId ?? getClient().chain?.id
-    const client = getClient(chainId)
+    const chainId_body = Utils.resolveChainId(first?.['chainId'])
+    const chainId_path = options?.chainId
+    if (chainId_body !== undefined && chainId_path !== undefined && chainId_body !== chainId_path)
+      return Utils.rpcErrorJson(
+        request,
+        new RpcResponse.InvalidParamsError({ message: 'Conflicting chain ids.' }),
+      )
+
+    let chainId: number | undefined
+    let client: Client
+    try {
+      chainId = chainId_path ?? chainId_body ?? getClient().chain?.id
+      client = getClient(chainId)
+    } catch (error) {
+      return Utils.rpcErrorJson(request, error)
+    }
 
     switch (request.method) {
       case 'eth_fillTransaction': {

package/src/internal/Auth.test.ts

@@ -1010,6 +1010,38 @@ describe('require', () => {
       })
     })
 
+    test('session challenge uses the explicit request chain', async () => {
+      const mpp = createMppServer({
+        chainId: Viem.chainId.mainnet,
+        getClient: ({ chainId = Viem.chainId.mainnet }) => Viem.getClient({ chainId }),
+      })
+      const app = createApp({
+        auth: {
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+          mpp,
+          rateLimit: overQuota(),
+        },
+        policy: {
+          mpp: { session: { amount: '1' } },
+          public: { rateLimit: { perMinute: 1 } },
+        },
+      })
+
+      const defaultResponse = await app.request('/protected')
+      const testnetResponse = await app.request('/protected?chainId=testnet')
+
+      expect(Challenge.fromHeaders(defaultResponse.headers).request).toMatchObject({
+        methodDetails: {
+          chainId: Viem.chainId.mainnet,
+        },
+      })
+      expect(Challenge.fromHeaders(testnetResponse.headers).request).toMatchObject({
+        methodDetails: {
+          chainId: Viem.chainId.testnet,
+        },
+      })
+    })
+
     test('route session overrides propagate to the challenge', async () => {
       const mpp = createMppServer()
       const app = createApp({
@@ -1657,29 +1689,74 @@ describe('require', () => {
 })
 
 describe('ensureProject', () => {
-  test('authorizes a flat project route against the API key organization', async () => {
+  test('authorizes an organization-attributed API key', async () => {
     const db = TestApp.database()
     const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
     const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
-    const response = await createProjectGuardApp(db, apiKeyPrincipal(organization.id)).request(
-      `/v1/projects/${project.id}/resource`,
-    )
+    const response = await createProjectGuardApp(
+      db,
+      apiKeyPrincipal({ orgId: organization.id }),
+    ).request(`/v1/projects/${project.id}/resource`)
+    const { orgId, projectId, ...body } = await response.json()
 
     expect(response.status).toMatchInlineSnapshot(`200`)
-    expect(await response.json()).toEqual({
-      membership: null,
-      orgId: organization.id,
-      projectId: project.id,
-    })
+    expect(orgId).toBe(organization.id)
+    expect(projectId).toBe(project.id)
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "membership": null,
+      }
+    `)
+  })
+
+  test('authorizes a project-attributed API key for its project', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(
+      db,
+      apiKeyPrincipal({ orgId: organization.id, projectId: project.id }),
+    ).request(`/v1/projects/${project.id}/resource`)
+    const { orgId, projectId, ...body } = await response.json()
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(orgId).toBe(organization.id)
+    expect(projectId).toBe(project.id)
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "membership": null,
+      }
+    `)
+  })
+
+  test('hides another project from a project-attributed API key', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(
+      db,
+      apiKeyPrincipal({ orgId: organization.id, projectId: 'prj_other' }),
+    ).request(`/v1/projects/${project.id}/resource`)
+
+    expect(response.status).toMatchInlineSnapshot(`404`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
   })
 
   test('hides a flat project from an API key in another organization', async () => {
     const db = TestApp.database()
     const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
     const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
-    const response = await createProjectGuardApp(db, apiKeyPrincipal('org_foreign')).request(
-      `/v1/projects/${project.id}/resource`,
-    )
+    const response = await createProjectGuardApp(
+      db,
+      apiKeyPrincipal({ orgId: 'org_foreign' }),
+    ).request(`/v1/projects/${project.id}/resource`)
 
     expect(response.status).toMatchInlineSnapshot(`404`)
     expect(await response.json()).toMatchInlineSnapshot(`
@@ -1703,14 +1780,16 @@ describe('ensureProject', () => {
     const response = await createProjectGuardApp(db, sessionPrincipal(user.id)).request(
       `/v1/projects/${project.id}/resource`,
     )
-    const body = (await response.json()) as Record<string, unknown>
+    const { orgId, projectId, ...body } = await response.json()
 
     expect(response.status).toMatchInlineSnapshot(`200`)
-    expect(body).toEqual({
-      membership: 'member',
-      orgId: organization.id,
-      projectId: project.id,
-    })
+    expect(orgId).toBe(organization.id)
+    expect(projectId).toBe(project.id)
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "membership": "member",
+      }
+    `)
   })
 
   test('preserves nested organization role authorization', async () => {
@@ -1735,6 +1814,26 @@ describe('ensureProject', () => {
       }
     `)
   })
+
+  test('hides another nested project from a project-attributed API key', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createNestedProjectGuardApp(
+      db,
+      apiKeyPrincipal({ orgId: organization.id, projectId: 'prj_other' }),
+    ).request(`/v1/orgs/${organization.id}/projects/${project.id}/resource`)
+
+    expect(response.status).toMatchInlineSnapshot(`404`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
+  })
 })
 
 function createScopedApp(options: {
@@ -1800,13 +1899,21 @@ function projectGuardHandler(c: Context<GuardEnvironment>) {
   })
 }
 
-function apiKeyPrincipal(orgId: string): Auth.Principal {
-  const apiKey = { ...key, orgId }
+function apiKeyPrincipal(options: {
+  orgId: string
+  projectId?: string | undefined
+}): Auth.Principal {
+  const apiKey = {
+    ...key,
+    orgId: options.orgId,
+    ...(options.projectId === undefined ? {} : { projectId: options.projectId }),
+  }
   return {
     apiKey,
     environment: apiKey.environment,
     id: apiKey.id,
-    orgId,
+    orgId: options.orgId,
+    ...(options.projectId === undefined ? {} : { projectId: options.projectId }),
     type: 'api_key',
   }
 }
@@ -1869,7 +1976,10 @@ function createMppServer(options: createMppServer.Options = {}) {
 }
 
 declare namespace createMppServer {
-  type Options = Pick<NonNullable<Parameters<typeof tempo.session>[0]>, 'store'>
+  type Options = Pick<
+    NonNullable<Parameters<typeof tempo.session>[0]>,
+    'chainId' | 'getClient' | 'store'
+  >
 }
 
 function createMppHandler(