| 79efd41 | | | 1 | import type { FastifyInstance } from "fastify"; |
| 79efd41 | | | 2 | import { z } from "zod"; |
| 79efd41 | | | 3 | import type Database from "better-sqlite3"; |
| 79efd41 | | | 4 | |
| 79efd41 | | | 5 | const nameSchema = z |
| 79efd41 | | | 6 | .string() |
| 79efd41 | | | 7 | .min(2) |
| 79efd41 | | | 8 | .max(39) |
| 79efd41 | | | 9 | .regex(/^[a-zA-Z0-9_-]+$/); |
| 79efd41 | | | 10 | |
| 79efd41 | | | 11 | const createOrgSchema = z.object({ |
| 79efd41 | | | 12 | name: nameSchema, |
| 79efd41 | | | 13 | display_name: z.string().max(100).optional(), |
| 79efd41 | | | 14 | }); |
| 79efd41 | | | 15 | |
| 79efd41 | | | 16 | const addMemberSchema = z.object({ |
| 79efd41 | | | 17 | username: z.string().min(1), |
| 79efd41 | | | 18 | }); |
| 79efd41 | | | 19 | |
| 79efd41 | | | 20 | export function isNameTaken( |
| 79efd41 | | | 21 | db: Database.Database, |
| 79efd41 | | | 22 | name: string |
| 79efd41 | | | 23 | ): boolean { |
| 79efd41 | | | 24 | const userExists = db |
| 79efd41 | | | 25 | .prepare("SELECT 1 FROM users WHERE username = ?") |
| 79efd41 | | | 26 | .get(name); |
| 79efd41 | | | 27 | const orgExists = db |
| 79efd41 | | | 28 | .prepare("SELECT 1 FROM orgs WHERE name = ?") |
| 79efd41 | | | 29 | .get(name); |
| 79efd41 | | | 30 | return !!(userExists || orgExists); |
| 79efd41 | | | 31 | } |
| 79efd41 | | | 32 | |
| 79efd41 | | | 33 | export async function orgRoutes(app: FastifyInstance) { |
| 79efd41 | | | 34 | const db = (app as any).db as Database.Database; |
| 79efd41 | | | 35 | |
| 79efd41 | | | 36 | // Create org |
| 79efd41 | | | 37 | app.post( |
| 79efd41 | | | 38 | "/", |
| 79efd41 | | | 39 | { preHandler: [(app as any).authenticate] }, |
| 79efd41 | | | 40 | async (request: any, reply: any) => { |
| 79efd41 | | | 41 | const parsed = createOrgSchema.safeParse(request.body); |
| 79efd41 | | | 42 | if (!parsed.success) { |
| 79efd41 | | | 43 | return reply.code(400).send({ error: parsed.error.flatten() }); |
| 79efd41 | | | 44 | } |
| 79efd41 | | | 45 | |
| 79efd41 | | | 46 | const { name, display_name } = parsed.data; |
| 79efd41 | | | 47 | const userId = request.user.id; |
| 79efd41 | | | 48 | |
| 79efd41 | | | 49 | if (isNameTaken(db, name)) { |
| 79efd41 | | | 50 | return reply.code(409).send({ error: "Name already taken" }); |
| 79efd41 | | | 51 | } |
| 79efd41 | | | 52 | |
| 79efd41 | | | 53 | const result = db |
| 79efd41 | | | 54 | .prepare( |
| 79efd41 | | | 55 | "INSERT INTO orgs (name, display_name, created_by) VALUES (?, ?, ?)" |
| 79efd41 | | | 56 | ) |
| 79efd41 | | | 57 | .run(name, display_name ?? name, userId); |
| 79efd41 | | | 58 | |
| 79efd41 | | | 59 | db.prepare( |
| 79efd41 | | | 60 | "INSERT INTO org_members (org_id, user_id) VALUES (?, ?)" |
| 79efd41 | | | 61 | ).run(result.lastInsertRowid, userId); |
| 79efd41 | | | 62 | |
| 79efd41 | | | 63 | const org = db |
| 79efd41 | | | 64 | .prepare("SELECT * FROM orgs WHERE id = ?") |
| 79efd41 | | | 65 | .get(result.lastInsertRowid); |
| 79efd41 | | | 66 | |
| 79efd41 | | | 67 | return reply.code(201).send({ org }); |
| 79efd41 | | | 68 | } |
| 79efd41 | | | 69 | ); |
| 79efd41 | | | 70 | |
| 79efd41 | | | 71 | // List orgs current user is a member of |
| 79efd41 | | | 72 | app.get( |
| 79efd41 | | | 73 | "/", |
| 79efd41 | | | 74 | { preHandler: [(app as any).authenticate] }, |
| 79efd41 | | | 75 | async (request: any) => { |
| 79efd41 | | | 76 | const userId = request.user.id; |
| 79efd41 | | | 77 | |
| 79efd41 | | | 78 | const orgs = db |
| 79efd41 | | | 79 | .prepare( |
| 79efd41 | | | 80 | `SELECT o.* FROM orgs o |
| 79efd41 | | | 81 | JOIN org_members m ON o.id = m.org_id |
| 79efd41 | | | 82 | WHERE m.user_id = ? |
| 79efd41 | | | 83 | ORDER BY o.name` |
| 79efd41 | | | 84 | ) |
| 79efd41 | | | 85 | .all(userId); |
| 79efd41 | | | 86 | |
| 79efd41 | | | 87 | return { orgs }; |
| 79efd41 | | | 88 | } |
| 79efd41 | | | 89 | ); |
| 79efd41 | | | 90 | |
| 79efd41 | | | 91 | // Get org details + members |
| 79efd41 | | | 92 | app.get<{ Params: { name: string } }>( |
| 79efd41 | | | 93 | "/:name", |
| 79efd41 | | | 94 | async (request, reply) => { |
| 79efd41 | | | 95 | const { name } = request.params; |
| 79efd41 | | | 96 | |
| 79efd41 | | | 97 | const org = db |
| 79efd41 | | | 98 | .prepare("SELECT * FROM orgs WHERE name = ?") |
| 79efd41 | | | 99 | .get(name) as any; |
| 79efd41 | | | 100 | |
| 79efd41 | | | 101 | if (!org) { |
| 79efd41 | | | 102 | return reply.code(404).send({ error: "Organization not found" }); |
| 79efd41 | | | 103 | } |
| 79efd41 | | | 104 | |
| 79efd41 | | | 105 | const members = db |
| 79efd41 | | | 106 | .prepare( |
| 79efd41 | | | 107 | `SELECT u.id as user_id, u.username, u.display_name, m.created_at |
| 79efd41 | | | 108 | FROM org_members m |
| 79efd41 | | | 109 | JOIN users u ON m.user_id = u.id |
| 79efd41 | | | 110 | WHERE m.org_id = ? |
| 79efd41 | | | 111 | ORDER BY m.created_at` |
| 79efd41 | | | 112 | ) |
| 79efd41 | | | 113 | .all(org.id); |
| 79efd41 | | | 114 | |
| 79efd41 | | | 115 | return { org, members }; |
| 79efd41 | | | 116 | } |
| 79efd41 | | | 117 | ); |
| 79efd41 | | | 118 | |
| 79efd41 | | | 119 | // Add member |
| 79efd41 | | | 120 | app.post<{ Params: { name: string } }>( |
| 79efd41 | | | 121 | "/:name/members", |
| 79efd41 | | | 122 | { preHandler: [(app as any).authenticate] }, |
| 79efd41 | | | 123 | async (request: any, reply: any) => { |
| 79efd41 | | | 124 | const { name } = request.params; |
| 79efd41 | | | 125 | const parsed = addMemberSchema.safeParse(request.body); |
| 79efd41 | | | 126 | if (!parsed.success) { |
| 79efd41 | | | 127 | return reply.code(400).send({ error: parsed.error.flatten() }); |
| 79efd41 | | | 128 | } |
| 79efd41 | | | 129 | |
| 79efd41 | | | 130 | const org = db |
| 79efd41 | | | 131 | .prepare("SELECT * FROM orgs WHERE name = ?") |
| 79efd41 | | | 132 | .get(name) as any; |
| 79efd41 | | | 133 | if (!org) { |
| 79efd41 | | | 134 | return reply.code(404).send({ error: "Organization not found" }); |
| 79efd41 | | | 135 | } |
| 79efd41 | | | 136 | |
| 79efd41 | | | 137 | // Check requester is a member |
| 79efd41 | | | 138 | const isMember = db |
| 79efd41 | | | 139 | .prepare( |
| 79efd41 | | | 140 | "SELECT 1 FROM org_members WHERE org_id = ? AND user_id = ?" |
| 79efd41 | | | 141 | ) |
| 79efd41 | | | 142 | .get(org.id, request.user.id); |
| 79efd41 | | | 143 | if (!isMember) { |
| 79efd41 | | | 144 | return reply.code(403).send({ error: "Not a member of this organization" }); |
| 79efd41 | | | 145 | } |
| 79efd41 | | | 146 | |
| 79efd41 | | | 147 | const targetUser = db |
| 79efd41 | | | 148 | .prepare("SELECT id, username, display_name FROM users WHERE username = ?") |
| 79efd41 | | | 149 | .get(parsed.data.username) as any; |
| 79efd41 | | | 150 | if (!targetUser) { |
| 79efd41 | | | 151 | return reply.code(404).send({ error: "User not found" }); |
| 79efd41 | | | 152 | } |
| 79efd41 | | | 153 | |
| 79efd41 | | | 154 | const alreadyMember = db |
| 79efd41 | | | 155 | .prepare( |
| 79efd41 | | | 156 | "SELECT 1 FROM org_members WHERE org_id = ? AND user_id = ?" |
| 79efd41 | | | 157 | ) |
| 79efd41 | | | 158 | .get(org.id, targetUser.id); |
| 79efd41 | | | 159 | if (alreadyMember) { |
| 79efd41 | | | 160 | return reply.code(409).send({ error: "User is already a member" }); |
| 79efd41 | | | 161 | } |
| 79efd41 | | | 162 | |
| 79efd41 | | | 163 | db.prepare( |
| 79efd41 | | | 164 | "INSERT INTO org_members (org_id, user_id) VALUES (?, ?)" |
| 79efd41 | | | 165 | ).run(org.id, targetUser.id); |
| 79efd41 | | | 166 | |
| 79efd41 | | | 167 | return reply.code(201).send({ |
| 79efd41 | | | 168 | member: { |
| 79efd41 | | | 169 | user_id: targetUser.id, |
| 79efd41 | | | 170 | username: targetUser.username, |
| 79efd41 | | | 171 | display_name: targetUser.display_name, |
| 79efd41 | | | 172 | }, |
| 79efd41 | | | 173 | }); |
| 79efd41 | | | 174 | } |
| 79efd41 | | | 175 | ); |
| 79efd41 | | | 176 | |
| 79efd41 | | | 177 | // Remove member |
| 79efd41 | | | 178 | app.delete<{ Params: { name: string; username: string } }>( |
| 79efd41 | | | 179 | "/:name/members/:username", |
| 79efd41 | | | 180 | { preHandler: [(app as any).authenticate] }, |
| 79efd41 | | | 181 | async (request: any, reply: any) => { |
| 79efd41 | | | 182 | const { name, username } = request.params; |
| 79efd41 | | | 183 | |
| 79efd41 | | | 184 | const org = db |
| 79efd41 | | | 185 | .prepare("SELECT * FROM orgs WHERE name = ?") |
| 79efd41 | | | 186 | .get(name) as any; |
| 79efd41 | | | 187 | if (!org) { |
| 79efd41 | | | 188 | return reply.code(404).send({ error: "Organization not found" }); |
| 79efd41 | | | 189 | } |
| 79efd41 | | | 190 | |
| 79efd41 | | | 191 | // Check requester is a member |
| 79efd41 | | | 192 | const isMember = db |
| 79efd41 | | | 193 | .prepare( |
| 79efd41 | | | 194 | "SELECT 1 FROM org_members WHERE org_id = ? AND user_id = ?" |
| 79efd41 | | | 195 | ) |
| 79efd41 | | | 196 | .get(org.id, request.user.id); |
| 79efd41 | | | 197 | if (!isMember) { |
| 79efd41 | | | 198 | return reply.code(403).send({ error: "Not a member of this organization" }); |
| 79efd41 | | | 199 | } |
| 79efd41 | | | 200 | |
| 79efd41 | | | 201 | const targetUser = db |
| 79efd41 | | | 202 | .prepare("SELECT id FROM users WHERE username = ?") |
| 79efd41 | | | 203 | .get(username) as any; |
| 79efd41 | | | 204 | if (!targetUser) { |
| 79efd41 | | | 205 | return reply.code(404).send({ error: "User not found" }); |
| 79efd41 | | | 206 | } |
| 79efd41 | | | 207 | |
| 79efd41 | | | 208 | // Can't remove the creator |
| 79efd41 | | | 209 | if (targetUser.id === org.created_by) { |
| 79efd41 | | | 210 | return reply |
| 79efd41 | | | 211 | .code(400) |
| 79efd41 | | | 212 | .send({ error: "Cannot remove the organization creator" }); |
| 79efd41 | | | 213 | } |
| 79efd41 | | | 214 | |
| 79efd41 | | | 215 | const result = db |
| 79efd41 | | | 216 | .prepare( |
| 79efd41 | | | 217 | "DELETE FROM org_members WHERE org_id = ? AND user_id = ?" |
| 79efd41 | | | 218 | ) |
| 79efd41 | | | 219 | .run(org.id, targetUser.id); |
| 79efd41 | | | 220 | |
| 79efd41 | | | 221 | if (result.changes === 0) { |
| 79efd41 | | | 222 | return reply.code(404).send({ error: "User is not a member" }); |
| 79efd41 | | | 223 | } |
| 79efd41 | | | 224 | |
| 79efd41 | | | 225 | return reply.code(204).send(); |
| 79efd41 | | | 226 | } |
| 79efd41 | | | 227 | ); |
| 79efd41 | | | 228 | |
| 79efd41 | | | 229 | // Delete org |
| 79efd41 | | | 230 | app.delete<{ Params: { name: string } }>( |
| 79efd41 | | | 231 | "/:name", |
| 79efd41 | | | 232 | { preHandler: [(app as any).authenticate] }, |
| 79efd41 | | | 233 | async (request: any, reply: any) => { |
| 79efd41 | | | 234 | const { name } = request.params; |
| 79efd41 | | | 235 | |
| 79efd41 | | | 236 | const org = db |
| 79efd41 | | | 237 | .prepare("SELECT * FROM orgs WHERE name = ?") |
| 79efd41 | | | 238 | .get(name) as any; |
| 79efd41 | | | 239 | if (!org) { |
| 79efd41 | | | 240 | return reply.code(404).send({ error: "Organization not found" }); |
| 79efd41 | | | 241 | } |
| 79efd41 | | | 242 | |
| 79efd41 | | | 243 | if (org.created_by !== request.user.id) { |
| 79efd41 | | | 244 | return reply |
| 79efd41 | | | 245 | .code(403) |
| 79efd41 | | | 246 | .send({ error: "Only the creator can delete an organization" }); |
| 79efd41 | | | 247 | } |
| 79efd41 | | | 248 | |
| 79efd41 | | | 249 | // Check no repos owned by this org |
| 79efd41 | | | 250 | const repoCount = db |
| 79efd41 | | | 251 | .prepare( |
| 79efd41 | | | 252 | "SELECT COUNT(*) as count FROM repos WHERE owner_id = ? AND owner_type = 'org'" |
| 79efd41 | | | 253 | ) |
| 79efd41 | | | 254 | .get(org.id) as any; |
| 79efd41 | | | 255 | if (repoCount?.count > 0) { |
| 79efd41 | | | 256 | return reply |
| 79efd41 | | | 257 | .code(400) |
| 79efd41 | | | 258 | .send({ error: "Cannot delete organization that owns repositories" }); |
| 79efd41 | | | 259 | } |
| 79efd41 | | | 260 | |
| 79efd41 | | | 261 | db.prepare("DELETE FROM orgs WHERE id = ?").run(org.id); |
| 79efd41 | | | 262 | |
| 79efd41 | | | 263 | return reply.code(204).send(); |
| 79efd41 | | | 264 | } |
| 79efd41 | | | 265 | ); |
| 79efd41 | | | 266 | } |