yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add workspace management features including member invitations and role updates

Browse Source 
- Implemented API endpoints for managing workspace members (GET, POST, PATCH, DELETE).
- Added workspace creation and retrieval functionalities.
- Enhanced project model to associate with workspaces.
- Updated project member roles and access control logic.
- Created sign-out page and updated authentication flow.
- Modified header to include navigation to workspaces.
- Updated Prisma schema to include workspace and member models.
- Seed script updated to create demo workspaces and associated members.
This commit is contained in:
Yusuf İpek
2026-02-07 07:41:12 +03:00
parent d90ce4e1f6
commit 6e95f667e3
28 changed files with 2891 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/members/[memberId]/route.ts
+109
View File
@@ -0,0 +1,109 @@
import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
type RouteParams = { params: Promise<{ projectId: string; memberId: string }> };
// PATCH /api/projects/[projectId]/members/[memberId] - Update member role
export async function PATCH(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { projectId, memberId } = await params;
if (!session?.user?.id) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session.user.id } } },
});
if (!project) {
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
}
const isOwner = project.ownerId === session.user.id;
const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
if (!isOwner && !isAdmin) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
}
const body = await request.json();
const { role } = body;
const validRoles = ['ADMIN', 'COMMENTATOR'];
if (!validRoles.includes(role)) {
return NextResponse.json(
{ error: 'Invalid role. Must be ADMIN or COMMENTATOR.' },
{ status: 400 }
);
}
const member = await db.projectMember.update({
where: { id: memberId },
data: { role: role as ProjectMemberRole },
include: {
user: { select: { id: true, name: true, image: true } },
},
});
return NextResponse.json(member);
} catch (error) {
console.error('Error updating member role:', error);
return NextResponse.json(
{ error: 'Failed to update member role' },
{ status: 500 }
);
}
}
// DELETE /api/projects/[projectId]/members/[memberId] - Remove member
export async function DELETE(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { projectId, memberId } = await params;
if (!session?.user?.id) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session.user.id } } },
});
if (!project) {
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
}
const isOwner = project.ownerId === session.user.id;
const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
const memberToRemove = await db.projectMember.findUnique({
where: { id: memberId },
});
if (!memberToRemove) {
return NextResponse.json({ error: 'Member not found' }, { status: 404 });
}
const isSelf = memberToRemove.userId === session.user.id;
if (!isOwner && !isAdmin && !isSelf) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
}
await db.projectMember.delete({ where: { id: memberId } });
return NextResponse.json({ success: true, message: 'Member removed' });
} catch (error) {
console.error('Error removing member:', error);
return NextResponse.json(
{ error: 'Failed to remove member' },
{ status: 500 }
);
}
}
app/api/projects/[projectId]/members/route.ts
+153
View File
@@ -0,0 +1,153 @@
import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
type RouteParams = { params: Promise<{ projectId: string }> };
// GET /api/projects/[projectId]/members - List members
export async function GET(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { projectId } = await params;
if (!session?.user?.id) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}
const project = await db.project.findUnique({
where: { id: projectId },
include: {
members: { where: { userId: session.user.id } },
},
});
if (!project) {
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
}
const isOwner = project.ownerId === session.user.id;
const isMember = project.members.length > 0;
if (!isOwner && !isMember) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
}
const members = await db.projectMember.findMany({
where: { projectId },
include: {
user: { select: { id: true, name: true, image: true } },
},
orderBy: { createdAt: 'asc' },
});
const owner = await db.user.findUnique({
where: { id: project.ownerId },
select: { id: true, name: true, image: true },
});
return NextResponse.json({ members, owner });
} catch (error) {
console.error('Error fetching project members:', error);
return NextResponse.json(
{ error: 'Failed to fetch members' },
{ status: 500 }
);
}
}
// POST /api/projects/[projectId]/members - Invite a member
export async function POST(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { projectId } = await params;
if (!session?.user?.id) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}
// Check if user is owner or admin
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session.user.id } } },
});
if (!project) {
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
}
const isOwner = project.ownerId === session.user.id;
const isAdmin = project.members[0]?.role === ProjectMemberRole.ADMIN;
if (!isOwner && !isAdmin) {
return NextResponse.json(
{ error: 'Only project owners and admins can invite members' },
{ status: 403 }
);
}
const body = await request.json();
const { email, role } = body;
if (!email || typeof email !== 'string') {
return NextResponse.json(
{ error: 'Email is required' },
{ status: 400 }
);
}
// Validate role
const validRoles = ['ADMIN', 'COMMENTATOR'];
const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';
// Find user by email
const userToInvite = await db.user.findUnique({
where: { email: email.toLowerCase().trim() },
});
if (!userToInvite) {
return NextResponse.json(
{ message: 'If the user exists, an invitation has been sent.' },
{ status: 200 }
);
}
if (userToInvite.id === project.ownerId) {
return NextResponse.json(
{ error: 'Cannot invite the project owner as a member' },
{ status: 400 }
);
}
// Check if already a member
const existingMember = await db.projectMember.findUnique({
where: { projectId_userId: { projectId, userId: userToInvite.id } },
});
if (existingMember) {
return NextResponse.json(
{ error: 'User is already a member of this project' },
{ status: 409 }
);
}
const member = await db.projectMember.create({
data: {
projectId,
userId: userToInvite.id,
role: memberRole as ProjectMemberRole,
},
include: {
user: { select: { id: true, name: true, image: true } },
},
});
return NextResponse.json(member, { status: 201 });
} catch (error) {
console.error('Error inviting project member:', error);
return NextResponse.json(
{ error: 'Failed to invite member' },
{ status: 500 }
);
}
}
app/api/projects/[projectId]/route.ts
+38 -4
View File
@@ -18,13 +18,29 @@ async function checkProjectAccess(projectId: string, userId: string) {
const isOwner = project.ownerId === userId;
const membership = project.members[0];
const role = isOwner ? 'OWNER' : membership?.role || null;
let role: string | null = isOwner ? 'OWNER' : membership?.role || null;
// Check workspace-level access if not already authorized
if (!isOwner && !membership) {
const wsMember = await db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
if (wsOwner?.ownerId === userId) {
role = 'OWNER';
} else if (wsMember) {
role = wsMember.role; // ADMIN or COMMENTATOR from workspace
}
}
return {
project,
role,
canEdit: isOwner || role === ProjectMemberRole.ADMIN || role === ProjectMemberRole.EDITOR,
canDelete: isOwner,
canEdit: isOwner || role === 'OWNER' || role === ProjectMemberRole.ADMIN,
canDelete: isOwner || role === 'OWNER',
};
}
@@ -66,7 +82,25 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.some(m => m.userId === session?.user?.id);
if (!isPublic && !isOwner && !isMember) {
// Check workspace membership
let isWorkspaceMember = false;
if (!isPublic && !isOwner && !isMember && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
if (!isPublic && !isOwner && !isMember && !isWorkspaceMember) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
}
app/api/projects/[projectId]/videos/[videoId]/route.ts
+1 -2
View File
@@ -86,8 +86,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
membership?.role === ProjectMemberRole.EDITOR;
membership?.role === ProjectMemberRole.ADMIN;
if (!canEdit) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+1 -2
View File
@@ -76,8 +76,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
membership?.role === ProjectMemberRole.EDITOR;
membership?.role === ProjectMemberRole.ADMIN;
if (!canEdit) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
app/api/projects/[projectId]/videos/route.ts
+2 -3
View File
@@ -64,7 +64,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
}
// Check project access (must be owner, admin, or editor)
// Check project access (must be owner or admin)
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session.user.id } } },
@@ -77,8 +77,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const isOwner = project.ownerId === session.user.id;
const membership = project.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
membership?.role === ProjectMemberRole.EDITOR;
membership?.role === ProjectMemberRole.ADMIN;
if (!canEdit) {
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
app/api/projects/route.ts
+51 -13
View File
@@ -15,17 +15,32 @@ export async function GET(request: NextRequest) {
const { searchParams } = new URL(request.url);
const page = parseInt(searchParams.get('page') || '1');
const limit = parseInt(searchParams.get('limit') || '10');
const workspaceId = searchParams.get('workspaceId');
const skip = (page - 1) * limit;
// Build base filter: user is owner OR a member
const baseFilter: Record<string, unknown> = {
OR: [
{ ownerId: session.user.id },
{ members: { some: { userId: session.user.id } } },
// Also include projects in workspaces where the user is a workspace member
...(workspaceId ? [] : [{
workspace: {
members: { some: { userId: session.user.id } },
},
}]),
],
};
// Filter by workspace if provided
if (workspaceId) {
baseFilter.workspaceId = workspaceId;
}
// Get projects where user is owner OR a member
const [projects, total] = await Promise.all([
db.project.findMany({
where: {
OR: [
{ ownerId: session.user.id },
{ members: { some: { userId: session.user.id } } },
],
},
where: baseFilter,
include: {
owner: { select: { id: true, name: true, image: true } },
_count: { select: { videos: true, members: true } },
@@ -35,12 +50,7 @@ export async function GET(request: NextRequest) {
take: limit,
}),
db.project.count({
where: {
OR: [
{ ownerId: session.user.id },
{ members: { some: { userId: session.user.id } } },
],
},
where: baseFilter,
}),
]);
@@ -72,7 +82,7 @@ export async function POST(request: NextRequest) {
}
const body = await request.json();
const { name, description, visibility } = body;
const { name, description, visibility, workspaceId } = body;
if (!name || typeof name !== 'string' || name.trim().length === 0) {
return NextResponse.json(
@@ -81,6 +91,13 @@ export async function POST(request: NextRequest) {
);
}
if (!workspaceId || typeof workspaceId !== 'string') {
return NextResponse.json(
{ error: 'A workspace is required. Every project must belong to a workspace.' },
{ status: 400 }
);
}
// Generate URL-friendly slug
const baseSlug = name
.toLowerCase()
@@ -99,6 +116,26 @@ export async function POST(request: NextRequest) {
attempts++;
}
// Verify user has access to the workspace
const workspace = await db.workspace.findUnique({
where: { id: workspaceId },
include: { members: { where: { userId: session.user.id } } },
});
if (!workspace) {
return NextResponse.json({ error: 'Workspace not found' }, { status: 404 });
}
const isWsOwner = workspace.ownerId === session.user.id;
const isWsAdmin = workspace.members[0]?.role === 'ADMIN';
if (!isWsOwner && !isWsAdmin) {
return NextResponse.json(
{ error: 'Only workspace owners and admins can create projects' },
{ status: 403 }
);
}
const project = await db.project.create({
data: {
name: name.trim(),
@@ -106,6 +143,7 @@ export async function POST(request: NextRequest) {
slug,
visibility: visibility || ProjectVisibility.PRIVATE,
ownerId: session.user.id,
workspaceId,
},
include: {
owner: { select: { id: true, name: true, image: true } },