OpenFrame/app/api/workspaces/[workspaceId]/members/route.ts

import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth, checkWorkspaceAccess } from '@/lib/auth';
import { InvitationRole, WorkspaceMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { buildInvitationUrl, createOrRefreshInvitation, sendInvitationEmail } from '@/lib/invitations';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
import { logError } from '@/lib/logger';

type RouteParams = { params: Promise<{ workspaceId: string }> };

// GET /api/workspaces/[workspaceId]/members - List members
export async function GET(request: NextRequest, { params }: RouteParams) {
    try {
        const session = await auth();
        const { workspaceId } = await params;
        const MAX_LIMIT = 100;
        const MAX_PAGE = 1000;
        const MAX_OFFSET = 10000;

        if (!session?.user?.id) {
            return apiErrors.unauthorized();
        }

        const searchParams = request.nextUrl.searchParams;
        const pageParam = searchParams.get('page');
        const limitParam = searchParams.get('limit');

        const pageRaw = pageParam === null ? 1 : Number(pageParam);
        if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
            return apiErrors.badRequest('Invalid page. Must be a positive integer.');
        }

        const limitRaw = limitParam === null ? 20 : Number(limitParam);
        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
        }

        const page = pageRaw;
        const limit = limitRaw;
        const skip = (page - 1) * limit;
        if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
            return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
        }

        const workspace = await db.workspace.findUnique({
            where: { id: workspaceId },
            include: {
                members: { where: { userId: session.user.id } },
            },
        });

        if (!workspace) {
            return apiErrors.notFound('Workspace');
        }

        const access = await checkWorkspaceAccess(
            { id: workspace.id, ownerId: workspace.ownerId },
            session.user.id
        );
        const isOwner = workspace.ownerId === session.user.id;
        const isMember = workspace.members.length > 0;
        const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;

        if (!access.hasAccess || (!isOwner && !isMember)) {
            return apiErrors.forbidden('Access denied');
        }

        const now = new Date();
        const canViewPendingInvitations = isOwner || isAdmin;
        const [members, total, pendingInvitations] = await Promise.all([
            db.workspaceMember.findMany({
                where: { workspaceId },
                include: {
                    user: { select: { id: true, name: true, email: true, image: true } },
                },
                orderBy: { createdAt: 'asc' },
                skip,
                take: limit,
            }),
            db.workspaceMember.count({
                where: { workspaceId },
            }),
            canViewPendingInvitations
                ? db.invitation.findMany({
                    where: {
                        workspaceId,
                        scope: 'WORKSPACE',
                        status: 'PENDING',
                        expiresAt: { gt: now },
                    },
                    select: {
                        id: true,
                        email: true,
                        role: true,
                        createdAt: true,
                        expiresAt: true,
                        invitedBy: {
                            select: { id: true, name: true, email: true },
                        },
                    },
                    orderBy: { createdAt: 'desc' },
                })
                : Promise.resolve([]),
        ]);

        // Include the owner as well
        const owner = await db.user.findUnique({
            where: { id: workspace.ownerId },
            select: { id: true, name: true, email: true, image: true },
        });

        const response = successResponse(
            { members, owner, pendingInvitations },
            200,
            {
                page,
                limit,
                total,
                totalPages: Math.ceil(total / limit),
            }
        );
        return withCacheControl(response, 'private, no-store');
    } catch (error) {
        logError('Error fetching workspace members:', error);
        return apiErrors.internalError('Failed to fetch members');
    }
}

// POST /api/workspaces/[workspaceId]/members - Invite a member
export async function POST(request: NextRequest, { params }: RouteParams) {
    try {
        const limited = await rateLimit(request, 'invite-member');
        if (limited) return limited;

        const session = await auth();
        const { workspaceId } = await params;

        if (!session?.user?.id) {
            return apiErrors.unauthorized();
        }

        // Check if user is owner or admin
        const workspace = await db.workspace.findUnique({
            where: { id: workspaceId },
            include: { members: { where: { userId: session.user.id } } },
        });

        if (!workspace) {
            return apiErrors.notFound('Workspace');
        }

        const access = await checkWorkspaceAccess(
            { id: workspace.id, ownerId: workspace.ownerId },
            session.user.id
        );
        const isOwner = workspace.ownerId === session.user.id;
        const isAdmin = workspace.members[0]?.role === WorkspaceMemberRole.ADMIN;

        if (!access.canEdit || (!isOwner && !isAdmin)) {
            return apiErrors.forbidden('Only workspace owners and admins can invite members');
        }

        const body = await request.json();
        const { email, role } = body;

        if (!email || typeof email !== 'string') {
            return apiErrors.badRequest('Email is required');
        }

        const normalizedEmail = email.toLowerCase().trim();
        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
        if (!emailRegex.test(normalizedEmail)) {
            return apiErrors.validationError('Invalid email format');
        }

        // Validate role
        const validRoles = ['ADMIN', 'COMMENTATOR'];
        const memberRole = validRoles.includes(role) ? role : 'COMMENTATOR';

        // If this email belongs to an existing user, validate owner/member conflicts.
        const userToInvite = await db.user.findUnique({
            where: { email: normalizedEmail },
            select: { id: true },
        });

        if (userToInvite?.id === workspace.ownerId) {
            return apiErrors.badRequest('Cannot invite the workspace owner as a member');
        }

        if (userToInvite) {
            const existingMember = await db.workspaceMember.findUnique({
                where: { workspaceId_userId: { workspaceId, userId: userToInvite.id } },
            });

            if (existingMember) {
                return apiErrors.conflict('User is already a member of this workspace');
            }
        }

        const invitation = await createOrRefreshInvitation({
            email: normalizedEmail,
            scope: 'WORKSPACE',
            role: memberRole as InvitationRole,
            invitedById: session.user.id,
            workspaceId,
        });

        const invitationUrl = buildInvitationUrl(invitation.token);
        void sendInvitationEmail({
            to: normalizedEmail,
            inviterName: session.user.name || 'A team member',
            role: invitation.role,
            scope: invitation.scope,
            targetName: workspace.name,
            invitationUrl,
        });

        const response = successResponse({ message: 'Invitation email sent.' });
        return withCacheControl(response, 'private, no-store');
    } catch (error) {
        logError('Error inviting workspace member:', error);
        return apiErrors.internalError('Failed to invite member');
    }
}