mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
refactor: eslint and prettier conflict will be resolved and formatted
This commit is contained in:
Enes Köksal
@@ -10,143 +10,143 @@ type RouteParams = { params: Promise<{ workspaceId: string; memberId: string }>
|
||||
|
||||
// PATCH /api/workspaces/[workspaceId]/members/[memberId] - Update member role
|
||||
export async function PATCH(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'manage-member');
|
||||
if (limited) return limited;
|
||||
try {
|
||||
const limited = await rateLimit(request, 'manage-member');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { workspaceId, memberId } = await params;
|
||||
const session = await auth();
|
||||
const { workspaceId, memberId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
// Check if user is owner or admin
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.canEdit || (!isOwner && !isAdmin)) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { role } = body;
|
||||
|
||||
const validRoles = ['ADMIN', 'COMMENTATOR'];
|
||||
if (!validRoles.includes(role)) {
|
||||
return apiErrors.badRequest('Invalid role. Must be ADMIN or COMMENTATOR.');
|
||||
}
|
||||
|
||||
const member = await db.workspaceMember.findFirst({
|
||||
where: { id: memberId, workspaceId },
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
if (!member) {
|
||||
return apiErrors.notFound('Member');
|
||||
}
|
||||
|
||||
const updatedMember = await db.workspaceMember.update({
|
||||
where: { id: member.id },
|
||||
data: { role: role as WorkspaceMemberRole },
|
||||
include: {
|
||||
user: { select: { id: true, name: true, image: true } },
|
||||
},
|
||||
});
|
||||
|
||||
const response = successResponse(updatedMember);
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error updating member role:', error);
|
||||
return apiErrors.internalError('Failed to update member role');
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
// Check if user is owner or admin
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.canEdit || (!isOwner && !isAdmin)) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { role } = body;
|
||||
|
||||
const validRoles = ['ADMIN', 'COMMENTATOR'];
|
||||
if (!validRoles.includes(role)) {
|
||||
return apiErrors.badRequest('Invalid role. Must be ADMIN or COMMENTATOR.');
|
||||
}
|
||||
|
||||
const member = await db.workspaceMember.findFirst({
|
||||
where: { id: memberId, workspaceId },
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
if (!member) {
|
||||
return apiErrors.notFound('Member');
|
||||
}
|
||||
|
||||
const updatedMember = await db.workspaceMember.update({
|
||||
where: { id: member.id },
|
||||
data: { role: role as WorkspaceMemberRole },
|
||||
include: {
|
||||
user: { select: { id: true, name: true, image: true } },
|
||||
},
|
||||
});
|
||||
|
||||
const response = successResponse(updatedMember);
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error updating member role:', error);
|
||||
return apiErrors.internalError('Failed to update member role');
|
||||
}
|
||||
}
|
||||
|
||||
// DELETE /api/workspaces/[workspaceId]/members/[memberId] - Remove member
|
||||
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'manage-member');
|
||||
if (limited) return limited;
|
||||
try {
|
||||
const limited = await rateLimit(request, 'manage-member');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { workspaceId, memberId } = await params;
|
||||
const session = await auth();
|
||||
const { workspaceId, memberId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
// Users can remove themselves, admins/owners can remove anyone
|
||||
const memberToRemove = await db.workspaceMember.findFirst({
|
||||
where: { id: memberId, workspaceId },
|
||||
select: { id: true, userId: true },
|
||||
});
|
||||
|
||||
if (!memberToRemove) {
|
||||
return apiErrors.notFound('Member');
|
||||
}
|
||||
|
||||
const isSelf = memberToRemove.userId === session.user.id;
|
||||
|
||||
if ((!access.canEdit || (!isOwner && !isAdmin)) && !isSelf) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.projectMember.deleteMany({
|
||||
where: {
|
||||
userId: memberToRemove.userId,
|
||||
project: {
|
||||
workspaceId,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
await tx.project.updateMany({
|
||||
where: {
|
||||
workspaceId,
|
||||
ownerId: memberToRemove.userId,
|
||||
},
|
||||
data: {
|
||||
ownerId: workspace.ownerId,
|
||||
},
|
||||
});
|
||||
|
||||
await tx.workspaceMember.delete({ where: { id: memberToRemove.id } });
|
||||
});
|
||||
|
||||
const response = successResponse({ message: 'Member removed' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error removing member:', error);
|
||||
return apiErrors.internalError('Failed to remove member');
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
// Users can remove themselves, admins/owners can remove anyone
|
||||
const memberToRemove = await db.workspaceMember.findFirst({
|
||||
where: { id: memberId, workspaceId },
|
||||
select: { id: true, userId: true },
|
||||
});
|
||||
|
||||
if (!memberToRemove) {
|
||||
return apiErrors.notFound('Member');
|
||||
}
|
||||
|
||||
const isSelf = memberToRemove.userId === session.user.id;
|
||||
|
||||
if ((!access.canEdit || (!isOwner && !isAdmin)) && !isSelf) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.projectMember.deleteMany({
|
||||
where: {
|
||||
userId: memberToRemove.userId,
|
||||
project: {
|
||||
workspaceId,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
await tx.project.updateMany({
|
||||
where: {
|
||||
workspaceId,
|
||||
ownerId: memberToRemove.userId,
|
||||
},
|
||||
data: {
|
||||
ownerId: workspace.ownerId,
|
||||
},
|
||||
});
|
||||
|
||||
await tx.workspaceMember.delete({ where: { id: memberToRemove.id } });
|
||||
});
|
||||
|
||||
const response = successResponse({ message: 'Member removed' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error removing member:', error);
|
||||
return apiErrors.internalError('Failed to remove member');
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,11 @@ import { db } from '@/lib/db';
|
||||
import { auth, checkWorkspaceAccess } from '@/lib/auth';
|
||||
import { InvitationRole, WorkspaceMemberRole } from '@prisma/client';
|
||||
import { rateLimit } from '@/lib/rate-limit';
|
||||
import { buildInvitationUrl, createOrRefreshInvitation, sendInvitationEmail } from '@/lib/invitations';
|
||||
import {
|
||||
buildInvitationUrl,
|
||||
createOrRefreshInvitation,
|
||||
sendInvitationEmail,
|
||||
} from '@/lib/invitations';
|
||||
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
|
||||
import { logError } from '@/lib/logger';
|
||||
|
||||
@@ -11,215 +15,211 @@ type RouteParams = { params: Promise<{ workspaceId: string }> };
|
||||
|
||||
// GET /api/workspaces/[workspaceId]/members - List members
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { workspaceId } = await params;
|
||||
const MAX_LIMIT = 100;
|
||||
const MAX_PAGE = 1000;
|
||||
const MAX_OFFSET = 10000;
|
||||
try {
|
||||
const session = await auth();
|
||||
const { workspaceId } = await params;
|
||||
const MAX_LIMIT = 100;
|
||||
const MAX_PAGE = 1000;
|
||||
const MAX_OFFSET = 10000;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
const searchParams = request.nextUrl.searchParams;
|
||||
const pageParam = searchParams.get('page');
|
||||
const limitParam = searchParams.get('limit');
|
||||
|
||||
const pageRaw = pageParam === null ? 1 : Number(pageParam);
|
||||
if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
|
||||
return apiErrors.badRequest('Invalid page. Must be a positive integer.');
|
||||
}
|
||||
|
||||
const limitRaw = limitParam === null ? 20 : Number(limitParam);
|
||||
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
|
||||
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
|
||||
}
|
||||
|
||||
const page = pageRaw;
|
||||
const limit = limitRaw;
|
||||
const skip = (page - 1) * limit;
|
||||
if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
|
||||
return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
|
||||
}
|
||||
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: {
|
||||
members: { where: { userId: session.user.id } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isMember = workspace.members.length > 0;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.hasAccess || (!isOwner && !isMember)) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const now = new Date();
|
||||
const canViewPendingInvitations = isOwner || isAdmin;
|
||||
const [members, total, pendingInvitations] = await Promise.all([
|
||||
db.workspaceMember.findMany({
|
||||
where: { workspaceId },
|
||||
include: {
|
||||
user: { select: { id: true, name: true, email: true, image: true } },
|
||||
},
|
||||
orderBy: { createdAt: 'asc' },
|
||||
skip,
|
||||
take: limit,
|
||||
}),
|
||||
db.workspaceMember.count({
|
||||
where: { workspaceId },
|
||||
}),
|
||||
canViewPendingInvitations
|
||||
? db.invitation.findMany({
|
||||
where: {
|
||||
workspaceId,
|
||||
scope: 'WORKSPACE',
|
||||
status: 'PENDING',
|
||||
expiresAt: { gt: now },
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
email: true,
|
||||
role: true,
|
||||
createdAt: true,
|
||||
expiresAt: true,
|
||||
invitedBy: {
|
||||
select: { id: true, name: true, email: true },
|
||||
},
|
||||
},
|
||||
orderBy: { createdAt: 'desc' },
|
||||
})
|
||||
: Promise.resolve([]),
|
||||
]);
|
||||
|
||||
// Include the owner as well
|
||||
const owner = await db.user.findUnique({
|
||||
where: { id: workspace.ownerId },
|
||||
select: { id: true, name: true, email: true, image: true },
|
||||
});
|
||||
|
||||
const response = successResponse(
|
||||
{ members, owner, pendingInvitations },
|
||||
200,
|
||||
{
|
||||
page,
|
||||
limit,
|
||||
total,
|
||||
totalPages: Math.ceil(total / limit),
|
||||
}
|
||||
);
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error fetching workspace members:', error);
|
||||
return apiErrors.internalError('Failed to fetch members');
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
const searchParams = request.nextUrl.searchParams;
|
||||
const pageParam = searchParams.get('page');
|
||||
const limitParam = searchParams.get('limit');
|
||||
|
||||
const pageRaw = pageParam === null ? 1 : Number(pageParam);
|
||||
if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
|
||||
return apiErrors.badRequest('Invalid page. Must be a positive integer.');
|
||||
}
|
||||
|
||||
const limitRaw = limitParam === null ? 20 : Number(limitParam);
|
||||
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
|
||||
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
|
||||
}
|
||||
|
||||
const page = pageRaw;
|
||||
const limit = limitRaw;
|
||||
const skip = (page - 1) * limit;
|
||||
if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
|
||||
return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
|
||||
}
|
||||
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: {
|
||||
members: { where: { userId: session.user.id } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isMember = workspace.members.length > 0;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.hasAccess || (!isOwner && !isMember)) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
const now = new Date();
|
||||
const canViewPendingInvitations = isOwner || isAdmin;
|
||||
const [members, total, pendingInvitations] = await Promise.all([
|
||||
db.workspaceMember.findMany({
|
||||
where: { workspaceId },
|
||||
include: {
|
||||
user: { select: { id: true, name: true, email: true, image: true } },
|
||||
},
|
||||
orderBy: { createdAt: 'asc' },
|
||||
skip,
|
||||
take: limit,
|
||||
}),
|
||||
db.workspaceMember.count({
|
||||
where: { workspaceId },
|
||||
}),
|
||||
canViewPendingInvitations
|
||||
? db.invitation.findMany({
|
||||
where: {
|
||||
workspaceId,
|
||||
scope: 'WORKSPACE',
|
||||
status: 'PENDING',
|
||||
expiresAt: { gt: now },
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
email: true,
|
||||
role: true,
|
||||
createdAt: true,
|
||||
expiresAt: true,
|
||||
invitedBy: {
|
||||
select: { id: true, name: true, email: true },
|
||||
},
|
||||
},
|
||||
orderBy: { createdAt: 'desc' },
|
||||
})
|
||||
: Promise.resolve([]),
|
||||
]);
|
||||
|
||||
// Include the owner as well
|
||||
const owner = await db.user.findUnique({
|
||||
where: { id: workspace.ownerId },
|
||||
select: { id: true, name: true, email: true, image: true },
|
||||
});
|
||||
|
||||
const response = successResponse({ members, owner, pendingInvitations }, 200, {
|
||||
page,
|
||||
limit,
|
||||
total,
|
||||
totalPages: Math.ceil(total / limit),
|
||||
});
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error fetching workspace members:', error);
|
||||
return apiErrors.internalError('Failed to fetch members');
|
||||
}
|
||||
}
|
||||
|
||||
// POST /api/workspaces/[workspaceId]/members - Invite a member
|
||||
export async function POST(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'invite-member');
|
||||
if (limited) return limited;
|
||||
try {
|
||||
const limited = await rateLimit(request, 'invite-member');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { workspaceId } = await params;
|
||||
const session = await auth();
|
||||
const { workspaceId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
// Check if user is owner or admin
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.canEdit || (!isOwner && !isAdmin)) {
|
||||
return apiErrors.forbidden('Only workspace owners and admins can invite members');
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { email, role } = body;
|
||||
|
||||
if (!email || typeof email !== 'string') {
|
||||
return apiErrors.badRequest('Email is required');
|
||||
}
|
||||
|
||||
const normalizedEmail = email.toLowerCase().trim();
|
||||
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
||||
if (!emailRegex.test(normalizedEmail)) {
|
||||
return apiErrors.validationError('Invalid email format');
|
||||
}
|
||||
|
||||
// Validate role
|
||||
const validRoles = ['ADMIN', 'COMMENTATOR'];
|
||||
const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';
|
||||
|
||||
// If this email belongs to an existing user, validate owner/member conflicts.
|
||||
const userToInvite = await db.user.findUnique({
|
||||
where: { email: normalizedEmail },
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
if (userToInvite?.id === workspace.ownerId) {
|
||||
return apiErrors.badRequest('Cannot invite the workspace owner as a member');
|
||||
}
|
||||
|
||||
if (userToInvite) {
|
||||
const existingMember = await db.workspaceMember.findUnique({
|
||||
where: { workspaceId_userId: { workspaceId, userId: userToInvite.id } },
|
||||
});
|
||||
|
||||
if (existingMember) {
|
||||
return apiErrors.conflict('User is already a member of this workspace');
|
||||
}
|
||||
}
|
||||
|
||||
const invitation = await createOrRefreshInvitation({
|
||||
email: normalizedEmail,
|
||||
scope: 'WORKSPACE',
|
||||
role: memberRole as InvitationRole,
|
||||
invitedById: session.user.id,
|
||||
workspaceId,
|
||||
});
|
||||
|
||||
const invitationUrl = buildInvitationUrl(invitation.token);
|
||||
void sendInvitationEmail({
|
||||
to: normalizedEmail,
|
||||
inviterName: session.user.name || 'A team member',
|
||||
role: invitation.role,
|
||||
scope: invitation.scope,
|
||||
targetName: workspace.name,
|
||||
invitationUrl,
|
||||
});
|
||||
|
||||
const response = successResponse({ message: 'Invitation email sent.' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error inviting workspace member:', error);
|
||||
return apiErrors.internalError('Failed to invite member');
|
||||
if (!session?.user?.id) {
|
||||
return apiErrors.unauthorized();
|
||||
}
|
||||
|
||||
// Check if user is owner or admin
|
||||
const workspace = await db.workspace.findUnique({
|
||||
where: { id: workspaceId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!workspace) {
|
||||
return apiErrors.notFound('Workspace');
|
||||
}
|
||||
|
||||
const access = await checkWorkspaceAccess(
|
||||
{ id: workspace.id, ownerId: workspace.ownerId },
|
||||
session.user.id
|
||||
);
|
||||
const isOwner = workspace.ownerId === session.user.id;
|
||||
const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;
|
||||
|
||||
if (!access.canEdit || (!isOwner && !isAdmin)) {
|
||||
return apiErrors.forbidden('Only workspace owners and admins can invite members');
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { email, role } = body;
|
||||
|
||||
if (!email || typeof email !== 'string') {
|
||||
return apiErrors.badRequest('Email is required');
|
||||
}
|
||||
|
||||
const normalizedEmail = email.toLowerCase().trim();
|
||||
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
||||
if (!emailRegex.test(normalizedEmail)) {
|
||||
return apiErrors.validationError('Invalid email format');
|
||||
}
|
||||
|
||||
// Validate role
|
||||
const validRoles = ['ADMIN', 'COMMENTATOR'];
|
||||
const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';
|
||||
|
||||
// If this email belongs to an existing user, validate owner/member conflicts.
|
||||
const userToInvite = await db.user.findUnique({
|
||||
where: { email: normalizedEmail },
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
if (userToInvite?.id === workspace.ownerId) {
|
||||
return apiErrors.badRequest('Cannot invite the workspace owner as a member');
|
||||
}
|
||||
|
||||
if (userToInvite) {
|
||||
const existingMember = await db.workspaceMember.findUnique({
|
||||
where: { workspaceId_userId: { workspaceId, userId: userToInvite.id } },
|
||||
});
|
||||
|
||||
if (existingMember) {
|
||||
return apiErrors.conflict('User is already a member of this workspace');
|
||||
}
|
||||
}
|
||||
|
||||
const invitation = await createOrRefreshInvitation({
|
||||
email: normalizedEmail,
|
||||
scope: 'WORKSPACE',
|
||||
role: memberRole as InvitationRole,
|
||||
invitedById: session.user.id,
|
||||
workspaceId,
|
||||
});
|
||||
|
||||
const invitationUrl = buildInvitationUrl(invitation.token);
|
||||
void sendInvitationEmail({
|
||||
to: normalizedEmail,
|
||||
inviterName: session.user.name || 'A team member',
|
||||
role: invitation.role,
|
||||
scope: invitation.scope,
|
||||
targetName: workspace.name,
|
||||
invitationUrl,
|
||||
});
|
||||
|
||||
const response = successResponse({ message: 'Invitation email sent.' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error inviting workspace member:', error);
|
||||
return apiErrors.internalError('Failed to invite member');
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user