ui-syncup 0.3.13 → 0.4.0-beta.1

package/src/app/api/teams/[teamId]/invitations/[invitationId]/resend/route.ts

@@ -0,0 +1,132 @@
+/**
+ * Resend Invitation API Route
+ * 
+ * POST /api/teams/:teamId/invitations/:invitationId/resend - Resend invitation
+ * 
+ * @module api/teams/[teamId]/invitations/[invitationId]/resend
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '@/server/auth/session';
+import { resendInvitation } from '@/server/teams/invitation-service';
+import { hasRole } from '@/server/auth/rbac';
+import { logger } from '@/lib/logger';
+
+/**
+ * POST /api/teams/:teamId/invitations/:invitationId/resend
+ * 
+ * Resend an invitation. Requires TEAM_OWNER or TEAM_ADMIN role.
+ * 
+ * Success response (200):
+ * {
+ *   "message": "Invitation resent successfully"
+ * }
+ * 
+ * Error responses:
+ * - 401: Not authenticated
+ * - 403: Insufficient permissions
+ * - 404: Invitation not found
+ * - 410: Invitation already used or cancelled
+ * - 500: Internal server error
+ */
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ teamId: string; invitationId: string }> }
+) {
+  const requestId = crypto.randomUUID();
+  const { teamId, invitationId } = await params;
+  
+  try {
+    // Authenticate user
+    const user = await getSession();
+    
+    if (!user) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'UNAUTHORIZED',
+            message: 'Not authenticated',
+          },
+        },
+        { status: 401 }
+      );
+    }
+    
+    // Check permissions (TEAM_OWNER or TEAM_ADMIN)
+    const isOwner = await hasRole(user.id, 'WORKSPACE_OWNER', 'team', teamId);
+    const isAdmin = await hasRole(user.id, 'WORKSPACE_ADMIN', 'team', teamId);
+    
+    if (!isOwner && !isAdmin) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Only team owners and admins can resend invitations',
+          },
+        },
+        { status: 403 }
+      );
+    }
+    
+    // Resend invitation
+    const { invitation } = await resendInvitation(invitationId, user.id);
+    
+    logger.info('api.teams.invitations.resend.success', {
+      requestId,
+      userId: user.id,
+      teamId,
+      invitationId,
+    });
+    
+    return NextResponse.json(
+      { invitation },
+      { status: 200 }
+    );
+    
+  } catch (error) {
+    logger.error('api.teams.invitations.resend.error', {
+      requestId,
+      teamId,
+      invitationId,
+      error: error instanceof Error ? error.message : 'Unknown error',
+      stack: error instanceof Error ? error.stack : undefined,
+    });
+    
+    // Handle specific errors
+    if (error instanceof Error) {
+      if (error.message.includes('not found')) {
+        return NextResponse.json(
+          {
+            error: {
+              code: 'INVITATION_NOT_FOUND',
+              message: 'Invitation not found',
+            },
+          },
+          { status: 404 }
+        );
+      }
+      
+      if (error.message.includes('no longer active')) {
+        return NextResponse.json(
+          {
+            error: {
+              code: 'INVITATION_INACTIVE',
+              message: 'Invitation is no longer active',
+            },
+          },
+          { status: 410 }
+        );
+      }
+    }
+    
+    return NextResponse.json(
+      {
+        error: {
+          code: 'INTERNAL_SERVER_ERROR',
+          message: 'An unexpected error occurred. Please try again later.',
+        },
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/teams/[teamId]/invitations/[invitationId]/route.ts

@@ -0,0 +1,117 @@
+/**
+ * Invitation Management API Route
+ * 
+ * DELETE /api/teams/:teamId/invitations/:invitationId - Cancel invitation
+ * 
+ * @module api/teams/[teamId]/invitations/[invitationId]
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '@/server/auth/session';
+import { cancelInvitation } from '@/server/teams/invitation-service';
+import { hasRole } from '@/server/auth/rbac';
+import { logger } from '@/lib/logger';
+
+/**
+ * DELETE /api/teams/:teamId/invitations/:invitationId
+ * 
+ * Cancel an invitation. Requires TEAM_OWNER or TEAM_ADMIN role.
+ * 
+ * Success response (200):
+ * {
+ *   "message": "Invitation cancelled successfully"
+ * }
+ * 
+ * Error responses:
+ * - 401: Not authenticated
+ * - 403: Insufficient permissions
+ * - 404: Invitation not found
+ * - 500: Internal server error
+ */
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ teamId: string; invitationId: string }> }
+) {
+  const requestId = crypto.randomUUID();
+  const { teamId, invitationId } = await params;
+  
+  try {
+    // Authenticate user
+    const user = await getSession();
+    
+    if (!user) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'UNAUTHORIZED',
+            message: 'Not authenticated',
+          },
+        },
+        { status: 401 }
+      );
+    }
+    
+    // Check permissions (TEAM_OWNER or TEAM_ADMIN)
+    const isOwner = await hasRole(user.id, 'WORKSPACE_OWNER', 'team', teamId);
+    const isAdmin = await hasRole(user.id, 'WORKSPACE_ADMIN', 'team', teamId);
+    
+    if (!isOwner && !isAdmin) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Only team owners and admins can cancel invitations',
+          },
+        },
+        { status: 403 }
+      );
+    }
+    
+    // Cancel invitation
+    await cancelInvitation(invitationId, user.id);
+    
+    logger.info('api.teams.invitations.cancel.success', {
+      requestId,
+      userId: user.id,
+      teamId,
+      invitationId,
+    });
+    
+    return NextResponse.json(
+      { message: 'Invitation cancelled successfully' },
+      { status: 200 }
+    );
+    
+  } catch (error) {
+    logger.error('api.teams.invitations.cancel.error', {
+      requestId,
+      teamId,
+      invitationId,
+      error: error instanceof Error ? error.message : 'Unknown error',
+      stack: error instanceof Error ? error.stack : undefined,
+    });
+    
+    // Handle specific errors
+    if (error instanceof Error && error.message.includes('not found')) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INVITATION_NOT_FOUND',
+            message: 'Invitation not found',
+          },
+        },
+        { status: 404 }
+      );
+    }
+    
+    return NextResponse.json(
+      {
+        error: {
+          code: 'INTERNAL_SERVER_ERROR',
+          message: 'An unexpected error occurred. Please try again later.',
+        },
+      },
+      { status: 500 }
+    );
+  }
+}

package/src/app/api/teams/[teamId]/invitations/route.ts

@@ -0,0 +1,363 @@
+/**
+ * Team Invitations API Routes
+ * 
+ * POST /api/teams/:teamId/invitations - Create invitation
+ * GET /api/teams/:teamId/invitations - List invitations
+ * 
+ * @module api/teams/[teamId]/invitations
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '@/server/auth/session';
+import { getTeamIdCookie } from '@/server/auth/cookies';
+import { createInvitation } from '@/server/teams/invitation-service';
+import { hasRole } from '@/server/auth/rbac';
+import { logger } from '@/lib/logger';
+import { z } from 'zod';
+import { db } from '@/lib/db';
+import { teamInvitations } from '@/server/db/schema/team-invitations';
+import { eq, and, isNull } from 'drizzle-orm';
+import { logAdminAction } from '@/server/audit';
+
+/**
+ * Zod schema for invitation creation
+ */
+const CreateInvitationSchema = z.object({
+  email: z.string().email(),
+  managementRole: z.enum(['WORKSPACE_ADMIN']).nullable().optional(),
+  operationalRole: z.enum(['WORKSPACE_EDITOR', 'WORKSPACE_MEMBER', 'WORKSPACE_VIEWER']),
+});
+
+/**
+ * POST /api/teams/:teamId/invitations
+ * 
+ * Create a new invitation. Requires TEAM_OWNER or TEAM_ADMIN role.
+ * 
+ * Request body:
+ * {
+ *   "email": "user@example.com",
+ *   "managementRole": "WORKSPACE_ADMIN" | null,
+ *   "operationalRole": "WORKSPACE_EDITOR" | "WORKSPACE_MEMBER" | "WORKSPACE_VIEWER"
+ * }
+ * 
+ * Success response (201):
+ * {
+ *   "invitation": {
+ *     "id": "uuid",
+ *     "email": "user@example.com",
+ *     "managementRole": "WORKSPACE_ADMIN",
+ *     "operationalRole": "WORKSPACE_EDITOR",
+ *     "expiresAt": "2024-01-08T00:00:00.000Z",
+ *     ...
+ *   }
+ * }
+ * 
+ * Error responses:
+ * - 400: Invalid input
+ * - 401: Not authenticated
+ * - 403: Insufficient permissions
+ * - 409: User already a member
+ * - 429: Rate limit exceeded
+ * - 500: Internal server error
+ */
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ teamId: string }> }
+) {
+  const requestId = crypto.randomUUID();
+  const { teamId } = await params;
+  
+  try {
+    // Authenticate user
+    const user = await getSession();
+    
+    if (!user) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'UNAUTHORIZED',
+            message: 'Not authenticated',
+          },
+        },
+        { status: 401 }
+      );
+    }
+
+    // Validate team context
+    const activeTeamId = await getTeamIdCookie();
+    if (teamId !== activeTeamId) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'FORBIDDEN',
+            message: "You do not have permission to access this team's data in the current context",
+          },
+        },
+        { status: 403 }
+      );
+    }
+    
+    // Check permissions (TEAM_OWNER or TEAM_ADMIN)
+    const isOwner = await hasRole(user.id, 'WORKSPACE_OWNER', 'team', teamId);
+    const isAdmin = await hasRole(user.id, 'WORKSPACE_ADMIN', 'team', teamId);
+    
+    if (!isOwner && !isAdmin) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Only team owners and admins can send invitations',
+          },
+        },
+        { status: 403 }
+      );
+    }
+    
+    // Parse and validate request body
+    const body = await request.json();
+    const validation = CreateInvitationSchema.safeParse(body);
+    
+    if (!validation.success) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INVALID_INPUT',
+            message: 'Invalid invitation data',
+            details: validation.error.issues,
+          },
+        },
+        { status: 400 }
+      );
+    }
+    
+    const { email, managementRole, operationalRole } = validation.data;
+    
+    // Check member limit before creating invitation
+    const { checkMemberLimit, QuotaError } = await import('@/server/teams/resource-limits');
+    try {
+      await checkMemberLimit(teamId);
+    } catch (error: unknown) {
+      if (error instanceof QuotaError) {
+        return NextResponse.json(
+          {
+            error: {
+              code: error.code,
+              message: error.message,
+              limit: error.limit,
+              current: error.current,
+            },
+          },
+          { status: 422 }
+        );
+      }
+      throw error;
+    }
+    
+    // Create invitation
+    const { invitation, token } = await createInvitation({
+      teamId,
+      email,
+      managementRole: managementRole ?? null,
+      operationalRole,
+      invitedBy: user.id,
+    });
+    
+    // Build invitation URL for copy-link fallback when email not configured
+    const { env } = await import('@/lib/env');
+    const invitationUrl = `${env.NEXT_PUBLIC_APP_URL}/join-team?token=${token}`;
+    
+    logger.info('api.teams.invitations.create.success', {
+      requestId,
+      userId: user.id,
+      teamId,
+      invitationId: invitation.id,
+      email,
+    });
+    
+    // Audit log invitation
+    logAdminAction('member.invited', {
+      userId: user.id,
+      userEmail: user.email,
+      resourceType: 'team',
+      resourceId: teamId,
+      metadata: {
+        invitedEmail: email,
+        managementRole: managementRole ?? null,
+        operationalRole,
+        invitationId: invitation.id,
+      },
+    });
+
+    return NextResponse.json(
+      { invitation, invitationUrl },
+      { status: 201 }
+    );
+    
+  } catch (error) {
+    logger.error('api.teams.invitations.create.error', {
+      requestId,
+      teamId,
+      error: error instanceof Error ? error.message : 'Unknown error',
+      stack: error instanceof Error ? error.stack : undefined,
+    });
+    
+    // Handle specific errors
+    if (error instanceof Error) {
+      if (error.message.includes('rate limit')) {
+        return NextResponse.json(
+          {
+            error: {
+              code: 'RATE_LIMIT_INVITATIONS',
+              message: error.message,
+            },
+          },
+          { status: 429 }
+        );
+      }
+      
+      if (error.message.includes('already a member')) {
+        return NextResponse.json(
+          {
+            error: {
+              code: 'ALREADY_TEAM_MEMBER',
+              message: error.message,
+            },
+          },
+          { status: 409 }
+        );
+      }
+    }
+    
+    return NextResponse.json(
+      {
+        error: {
+          code: 'INTERNAL_SERVER_ERROR',
+          message: 'An unexpected error occurred. Please try again later.',
+        },
+      },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * GET /api/teams/:teamId/invitations
+ * 
+ * List pending invitations for a team. Requires TEAM_OWNER or TEAM_ADMIN role.
+ * 
+ * Success response (200):
+ * {
+ *   "invitations": [
+ *     {
+ *       "id": "uuid",
+ *       "email": "user@example.com",
+ *       "managementRole": "WORKSPACE_ADMIN",
+ *       "operationalRole": "WORKSPACE_EDITOR",
+ *       "expiresAt": "2024-01-08T00:00:00.000Z",
+ *       "createdAt": "2024-01-01T00:00:00.000Z",
+ *       ...
+ *     }
+ *   ]
+ * }
+ * 
+ * Error responses:
+ * - 401: Not authenticated
+ * - 403: Insufficient permissions
+ * - 500: Internal server error
+ */
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ teamId: string }> }
+) {
+  const requestId = crypto.randomUUID();
+  const { teamId } = await params;
+  
+  try {
+    // Authenticate user
+    const user = await getSession();
+    
+    if (!user) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'UNAUTHORIZED',
+            message: 'Not authenticated',
+          },
+        },
+        { status: 401 }
+      );
+    }
+    
+    // Validate team context
+    const activeTeamId = await getTeamIdCookie();
+    if (teamId !== activeTeamId) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'FORBIDDEN',
+            message: "You do not have permission to access this team's data in the current context",
+          },
+        },
+        { status: 403 }
+      );
+    }
+
+    // Check permissions (TEAM_OWNER or TEAM_ADMIN)
+    const isOwner = await hasRole(user.id, 'WORKSPACE_OWNER', 'team', teamId);
+    const isAdmin = await hasRole(user.id, 'WORKSPACE_ADMIN', 'team', teamId);
+    
+    if (!isOwner && !isAdmin) {
+      return NextResponse.json(
+        {
+          error: {
+            code: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Only team owners and admins can view invitations',
+          },
+        },
+        { status: 403 }
+      );
+    }
+    
+    // Get pending invitations (not used, not cancelled)
+    const invitations = await db
+      .select()
+      .from(teamInvitations)
+      .where(
+        and(
+          eq(teamInvitations.teamId, teamId),
+          isNull(teamInvitations.usedAt),
+          isNull(teamInvitations.cancelledAt)
+        )
+      );
+    
+    logger.info('api.teams.invitations.list.success', {
+      requestId,
+      userId: user.id,
+      teamId,
+      count: invitations.length,
+    });
+    
+    return NextResponse.json(
+      { invitations },
+      { status: 200 }
+    );
+    
+  } catch (error) {
+    logger.error('api.teams.invitations.list.error', {
+      requestId,
+      teamId,
+      error: error instanceof Error ? error.message : 'Unknown error',
+      stack: error instanceof Error ? error.stack : undefined,
+    });
+    
+    return NextResponse.json(
+      {
+        error: {
+          code: 'INTERNAL_SERVER_ERROR',
+          message: 'An unexpected error occurred. Please try again later.',
+        },
+      },
+      { status: 500 }
+    );
+  }
+}