tapimo 0.5.2 → 0.6.0

package/src/apps/management/routes/invite-links.ts

@@ -10,8 +10,34 @@ import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
 import type { Environment } from '../App.js'
 
+// A bare domain (`example.org`), normalized before validation.
+const domainPattern = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/
+
 /** OpenAPI schemas owned by reusable invite links. */
 export namespace schema {
+  const allowedEmailDomains = z
+    .nullable(
+      z.readonly(
+        z
+          .array(
+            z
+              .string()
+              .check(
+                z.trim(),
+                z.toLowerCase(),
+                z.regex(domainPattern, 'Must be a bare domain (example.org).'),
+              ),
+          )
+          .check(
+            z.minLength(1),
+            z.overwrite((domains) => [...new Set(domains)]),
+          ),
+      ),
+    )
+    .check(
+      z.describe('Email domains allowed to redeem, or null for unrestricted.'),
+      z.meta({ examples: [['example.org'], null] }),
+    )
   const nullableExpiry = z
     .nullable(z.iso.datetime({ offset: true }))
     .check(
@@ -31,6 +57,7 @@ export namespace schema {
   /** Management representation, including the recopyable bearer id. */
   export const InviteLink = Schema.describe(
     z.object({
+      allowedEmailDomains,
       createdAt: z
         .string()
         .check(
@@ -146,6 +173,7 @@ export namespace schema {
   /** Create body. */
   export const CreateBody = z
     .object({
+      allowedEmailDomains: z.optional(allowedEmailDomains),
       expiresAt: z.optional(nullableExpiry),
       maxUses: z.optional(nullableUses),
       name: z.optional(
@@ -318,6 +346,7 @@ export function inviteLinks() {
         const body = c.req.valid('json')
         try {
           const record = await InviteLinks.create(Db.get(c.get('db')), {
+            allowedEmailDomains: body.allowedEmailDomains ?? null,
             createdBy: Auth.membership(c)?.userId ?? 'super_admin',
             expiresAt:
               body.expiresAt === undefined
@@ -498,7 +527,13 @@ export function inviteLinks() {
       OpenApi.describeRoute({
         operationId: 'acceptInviteLink',
         responses: OpenApi.responses({
-          errors: { 403: 'A verified session email is required.', ...errors },
+          errors: {
+            403: {
+              codes: ['forbidden', 'invite_link_email_forbidden'],
+              description: 'A verified session email from an allowed domain is required.',
+            },
+            ...errors,
+          },
           success: { description: 'Membership.', schema: schema.AcceptResponse },
         }),
         summary: 'Accept invite link',
@@ -531,6 +566,12 @@ export function inviteLinks() {
             200,
           )
         } catch (cause) {
+          if (cause instanceof InviteLinks.EmailDomainForbiddenError)
+            return Response.error(c, {
+              code: 'invite_link_email_forbidden',
+              message: 'Sign in with an email address on an allowed domain',
+              status: 403,
+            })
           return Response.upstream(c, cause)
         }
       },
@@ -539,6 +580,7 @@ export function inviteLinks() {
 
 function serialize(record: InviteLinks.Record) {
   return {
+    allowedEmailDomains: record.allowedEmailDomains,
     createdAt: record.createdAt,
     createdBy: record.createdBy,
     enabled: record.enabled,

package/src/apps/management/routes/me.test.ts

@@ -4,6 +4,8 @@ import { exportJWK, generateKeyPair } from 'jose'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
+import * as Users from '../../../db/tables/users.js'
 import * as Me from './me.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
@@ -18,6 +20,40 @@ function createApp() {
   })
 }
 
+/** App with the early-access gate enabled; allowlist entries seed through `EarlyAccess.add`. */
+function createGatedApp(db = TestApp.database()) {
+  return TestApp.create({
+    auth: { keys: [TestApp.key] },
+    db,
+    session: { wallet: { origin } },
+    tmp_earlyAccess: true,
+  })
+}
+
+/** RequestInit for a JSON mutation carrying the session cookie. */
+function json(method: 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+/** Signs in a fresh scripted account; returns its session cookie and user id. */
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  const me = await app.request('/v1/me', { headers: { cookie: cookie! } })
+  const { id } = (await me.json()) as { id: string }
+  return { cookie: cookie!, userId: id }
+}
+
+/** Reads the session's `tmp_earlyAccess` flag from `/v1/me`. TODO: remove after GA. */
+async function tmp_earlyAccess(app: TestApp.signIn.App, cookie: string) {
+  const response = await app.request('/v1/me', { headers: { cookie } })
+  return (await TestApp.json(response, Me.schema.User)).tmp_earlyAccess
+}
+
 describe('GET /me', () => {
   test('returns the signed-in user', async () => {
     const app = createApp()
@@ -182,13 +218,14 @@ describe('sign-in email requirement', () => {
   })
 })
 
-describe('sign-up email domains', () => {
-  test('allows new users on an allowlisted domain', async () => {
-    const oidc = await createIssuer({ email: 'dev@TEMPO.xyz' })
+describe('open sign-up', () => {
+  test('allows new users on any domain with the gate on', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
     try {
       const app = TestApp.create({
         auth: { keys: [TestApp.key] },
-        session: { emailAllowlist: ['Tempo.XYZ'], wallet: { issuer: oidc.url, origin } },
+        session: { wallet: { issuer: oidc.url, origin } },
+        tmp_earlyAccess: true,
       })
       const account = privateKeyToAccount(generatePrivateKey())
       const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
@@ -199,109 +236,124 @@ describe('sign-up email domains', () => {
       const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
       expect(response.status).toBe(200)
       const body = await TestApp.json(response, Me.schema.User)
-      expect(body.email).toBe('dev@TEMPO.xyz')
+      expect(body.email).toBe('dev@example.com')
     } finally {
       await oidc.close()
     }
   })
 
-  test('rejects new users on other domains', async () => {
-    const oidc = await createIssuer({ email: 'dev@example.com' })
-    try {
-      const app = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
-      })
-      const account = privateKeyToAccount(generatePrivateKey())
-      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
-        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
-      })
+  test('allows new users without an identity token with the gate on', async () => {
+    const app = createGatedApp()
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
 
-      expect(verifyResponse.status).toBe(403)
-      expect(cookie).toBeUndefined()
-      expect(await verifyResponse.json()).toMatchInlineSnapshot(`
-        {
-          "error": "sign-ups are restricted to approved email domains or invited emails",
-        }
-      `)
-    } finally {
-      await oidc.close()
-    }
+    expect(verifyResponse.status).toBe(200)
+    expect(cookie).toBeDefined()
   })
+})
 
-  test('rejects new users without an identity token', async () => {
-    const app = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
-    })
-    const account = privateKeyToAccount(generatePrivateKey())
-    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
+describe('tmp_earlyAccess', () => {
+  test('defaults to true while the gate is dormant', async () => {
+    const app = createApp()
+    const { cookie } = await session(app)
+    expect(await tmp_earlyAccess(app, cookie)).toBe(true)
+  })
 
-    expect(verifyResponse.status).toBe(403)
-    expect(cookie).toBeUndefined()
+  test('matches domain entries case-insensitively', async () => {
+    const db = TestApp.database()
+    const app = createGatedApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'Example.ORG' })
+    const user = await session(app)
+    await Users.setEmail(db, user.userId, 'Dev@EXAMPLE.org')
+
+    expect(await tmp_earlyAccess(app, user.cookie)).toBe(true)
   })
 
-  test('allows invited emails regardless of domain', async () => {
-    const oidc = await createIssuer({ email: 'Invited@Example.com' })
-    try {
-      const db = TestApp.database()
+  test('exact-email entries grant only that address', async () => {
+    const db = TestApp.database()
+    const app = createGatedApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'dev@example.org' })
+    const granted = await session(app)
+    await Users.setEmail(db, granted.userId, 'dev@example.org')
+    const denied = await session(app)
+    await Users.setEmail(db, denied.userId, 'other@example.org')
+
+    expect(await tmp_earlyAccess(app, granted.cookie)).toBe(true)
+    expect(await tmp_earlyAccess(app, denied.cookie)).toBe(false)
+  })
 
-      // Owner signs up while sign-up is open and issues the invitation.
-      const open = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        db,
-        session: { wallet: { origin } },
-      })
-      const owner = privateKeyToAccount(generatePrivateKey())
-      const { cookie } = await TestApp.signIn(open, owner)
-      const created = await open.request('/v1/orgs', {
-        body: JSON.stringify({ name: 'Acme' }),
-        headers: { 'content-type': 'application/json', cookie: cookie! },
-        method: 'POST',
-      })
-      const org = (await created.json()) as { id: string }
-      const invited = await open.request(`/v1/orgs/${org.id}/invitations`, {
-        body: JSON.stringify({ email: 'invited@example.com', role: 'member' }),
-        headers: { 'content-type': 'application/json', cookie: cookie! },
-        method: 'POST',
-      })
-      expect(invited.status).toBe(200)
+  test('stays false without a matching entry', async () => {
+    const db = TestApp.database()
+    const app = createGatedApp(db)
+    const user = await session(app)
+    await Users.setEmail(db, user.userId, 'dev@example.net')
 
-      const restricted = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        db,
-        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
-      })
-      const account = privateKeyToAccount(generatePrivateKey())
-      const { verifyResponse } = await TestApp.signIn(restricted, account, {
-        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
-      })
-      expect(verifyResponse.status).toBe(200)
-    } finally {
-      await oidc.close()
-    }
+    expect(await tmp_earlyAccess(app, user.cookie)).toBe(false)
+  })
+
+  test('stays false without a verified email', async () => {
+    const app = createGatedApp()
+    const { cookie } = await session(app)
+
+    expect(await tmp_earlyAccess(app, cookie)).toBe(false)
   })
 
-  test('allows existing users regardless of domain', async () => {
+  test('flips false once the entry is removed', async () => {
     const db = TestApp.database()
-    const account = privateKeyToAccount(generatePrivateKey())
+    const app = createGatedApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+    const user = await session(app)
+    await Users.setEmail(db, user.userId, 'dev@example.org')
+    expect(await tmp_earlyAccess(app, user.cookie)).toBe(true)
+
+    await EarlyAccess.remove(db, 'example.org')
+    expect(await tmp_earlyAccess(app, user.cookie)).toBe(false)
+  })
 
-    // Row created before the restriction (open sign-up deployment).
-    const open = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      db,
-      session: { wallet: { origin } },
-    })
-    const first = await TestApp.signIn(open, account)
-    expect(first.verifyResponse.status).toBe(200)
+  test('invitations from early-access inviters grant access until revoked', async () => {
+    const db = TestApp.database()
+    const app = createGatedApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
+    const inviter = await session(app)
+    await Users.setEmail(db, inviter.userId, 'owner@example.org')
+    const created = await app.request('/v1/orgs', json('POST', inviter.cookie, { name: 'Acme' }))
+    const org = (await created.json()) as { id: string }
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', inviter.cookie, { email: 'invitee@example.net', role: 'member' }),
+    )
+    expect(invited.status).toBe(200)
+    const invitation = (await invited.json()) as { id: string }
 
-    const restricted = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      db,
-      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'invitee@example.net')
+    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(true)
+
+    // Revoking the invitation withdraws the grant.
+    const revoked = await app.request(`/v1/orgs/${org.id}/invitations/${invitation.id}`, {
+      headers: { cookie: inviter.cookie },
+      method: 'DELETE',
     })
-    const second = await TestApp.signIn(restricted, account)
-    expect(second.verifyResponse.status).toBe(200)
+    expect(revoked.status).toBe(200)
+    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(false)
+  })
+
+  test('invitations from non-early-access inviters do not grant access', async () => {
+    const db = TestApp.database()
+    const app = createGatedApp(db)
+    const inviter = await session(app)
+    await Users.setEmail(db, inviter.userId, 'owner@example.net')
+    const created = await app.request('/v1/orgs', json('POST', inviter.cookie, { name: 'Acme' }))
+    const org = (await created.json()) as { id: string }
+    const invited = await app.request(
+      `/v1/orgs/${org.id}/invitations`,
+      json('POST', inviter.cookie, { email: 'friend@example.net', role: 'member' }),
+    )
+    expect(invited.status).toBe(200)
+
+    const invitee = await session(app)
+    await Users.setEmail(db, invitee.userId, 'friend@example.net')
+    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(false)
   })
 })
 

package/src/apps/management/routes/me.ts

@@ -35,6 +35,11 @@ export namespace schema {
           z.describe('Opaque user id (`usr_…`).'),
           z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
+      // TODO: remove after GA.
+      tmp_earlyAccess: z.boolean().check(
+        z.describe('Whether the user has early access; gated features require it while the platform is invite-only.'), // prettier-ignore
+        z.meta({ examples: [true] }),
+      ),
       updatedAt: z
         .string()
         .check(
@@ -94,6 +99,7 @@ export function me() {
             createdAt: user.createdAt,
             ...(user.email ? { email: user.email } : {}),
             id: user.id,
+            tmp_earlyAccess: await Auth.tmp_earlyAccess(c),
             updatedAt: user.updatedAt,
           }),
           200,

package/src/apps/management/routes/usage.test.ts

@@ -247,6 +247,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
         "data": [
           {
             "count": 2,
+            "failed": 0,
             "feeTotal": {
               "amount": "0.35",
               "currency": "usd",
@@ -255,6 +256,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
           },
           {
             "count": 1,
+            "failed": 1,
             "feeTotal": {
               "amount": "0",
               "currency": "usd",
@@ -275,6 +277,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
         "data": [
           {
             "count": 3,
+            "failed": 1,
             "feeTotal": {
               "amount": "0.35",
               "currency": "usd",
@@ -302,6 +305,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
       [
         {
           "count": 1,
+          "failed": 0,
           "feeTotal": {
             "amount": "0.5",
             "currency": "usd",
@@ -333,6 +337,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
         "data": [
           {
             "count": 1,
+            "failed": 0,
             "feeTotal": {
               "amount": "0.1",
               "currency": "usd",
@@ -352,6 +357,7 @@ describe('GET /orgs/:orgId/usage/sponsorships', () => {
         "data": [
           {
             "count": 1,
+            "failed": 0,
             "feeTotal": {
               "amount": "0.3",
               "currency": "usd",

package/src/apps/management/routes/usage.ts

@@ -199,6 +199,12 @@ export namespace schema {
             z.describe('Sponsored transactions recorded in the bucket, any status.'),
             z.meta({ examples: [42] }),
           ),
+        failed: z
+          .number()
+          .check(
+            z.describe('Sponsored transactions in the bucket whose status is `failed`.'),
+            z.meta({ examples: [3] }),
+          ),
         feeTotal: z
           .object({
             amount: z.string().check(
@@ -462,6 +468,7 @@ export function usage() {
             Response.validated(schema.getSponsorshipUsage.Response, {
               data: buckets.map((bucket) => ({
                 count: bucket.count,
+                failed: bucket.failed,
                 feeTotal: { amount: core_Billing.fromBaseUnits(bucket.feeTotal), currency },
                 timestamp: bucket.timestamp,
               })),