|
| 1 | +/** Chat's in-process CLI inviting teammates through the public workspace invitation command. */ |
| 2 | + |
| 3 | +import { db } from '@sim/db' |
| 4 | +import { |
| 5 | + auditLog, |
| 6 | + invitation, |
| 7 | + invitationWorkspaceGrant, |
| 8 | + member, |
| 9 | + organization, |
| 10 | + permissions, |
| 11 | + user, |
| 12 | + workspace, |
| 13 | +} from '@sim/db/schema' |
| 14 | +import { generateId } from '@sim/utils/id' |
| 15 | +import { and, eq, inArray } from 'drizzle-orm' |
| 16 | +import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest' |
| 17 | +import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope' |
| 18 | +import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport' |
| 19 | +import '@/app/api/v2/workspaces/[workspaceId]/invitations/route' |
| 20 | + |
| 21 | +const ORIGIN = 'http://localhost:3000' |
| 22 | +const organizationId = generateId() |
| 23 | +const workspaceId = generateId() |
| 24 | +const adminId = generateId() |
| 25 | +const writerId = generateId() |
| 26 | +const pendingInvitationId = generateId() |
| 27 | +const fixtureDomain = `${generateId()}.invite.test` |
| 28 | +const newInvitee = `new@${fixtureDomain}` |
| 29 | +const pendingInvitee = `pending@${fixtureDomain}` |
| 30 | +const writerInvitee = `writer-target@${fixtureDomain}` |
| 31 | + |
| 32 | +function inviteFromChat(userId: string, emails: string[]) { |
| 33 | + const transport = createScopedCliTransport(ORIGIN, { userId, workspaceId, chatId: generateId() }) |
| 34 | + return withWorkspaceInvocationScope({ workspaceId, organizationId }, () => |
| 35 | + transport(`${ORIGIN}/api/v2/workspaces/${workspaceId}/invitations`, { |
| 36 | + method: 'POST', |
| 37 | + headers: { 'content-type': 'application/json' }, |
| 38 | + body: JSON.stringify({ emails, permission: 'write', membership: 'member' }), |
| 39 | + }) |
| 40 | + ) |
| 41 | +} |
| 42 | + |
| 43 | +function pendingInvitationsFor(email: string) { |
| 44 | + return db |
| 45 | + .select({ id: invitation.id, inviterId: invitation.inviterId }) |
| 46 | + .from(invitation) |
| 47 | + .where(and(eq(invitation.email, email), eq(invitation.status, 'pending'))) |
| 48 | +} |
| 49 | + |
| 50 | +function grantsOf(invitationId: string) { |
| 51 | + return db |
| 52 | + .select({ |
| 53 | + workspaceId: invitationWorkspaceGrant.workspaceId, |
| 54 | + permission: invitationWorkspaceGrant.permission, |
| 55 | + }) |
| 56 | + .from(invitationWorkspaceGrant) |
| 57 | + .where(eq(invitationWorkspaceGrant.invitationId, invitationId)) |
| 58 | +} |
| 59 | + |
| 60 | +describe('chat-delegated workspace invitations', () => { |
| 61 | + beforeAll(async () => { |
| 62 | + const now = new Date() |
| 63 | + await db.insert(user).values( |
| 64 | + [adminId, writerId].map((id) => ({ |
| 65 | + id, |
| 66 | + name: 'Invitation fixture', |
| 67 | + email: `${id}@${fixtureDomain}`, |
| 68 | + emailVerified: true, |
| 69 | + createdAt: now, |
| 70 | + updatedAt: now, |
| 71 | + })) |
| 72 | + ) |
| 73 | + await db.insert(organization).values({ |
| 74 | + id: organizationId, |
| 75 | + name: 'Invitation fixture', |
| 76 | + slug: organizationId, |
| 77 | + createdAt: now, |
| 78 | + updatedAt: now, |
| 79 | + }) |
| 80 | + await db.insert(member).values( |
| 81 | + [adminId, writerId].map((userId) => ({ |
| 82 | + id: generateId(), |
| 83 | + userId, |
| 84 | + organizationId, |
| 85 | + role: 'member', |
| 86 | + createdAt: now, |
| 87 | + })) |
| 88 | + ) |
| 89 | + await db.insert(workspace).values({ |
| 90 | + id: workspaceId, |
| 91 | + name: 'Invitation fixture', |
| 92 | + ownerId: adminId, |
| 93 | + billedAccountUserId: adminId, |
| 94 | + organizationId, |
| 95 | + workspaceMode: 'organization', |
| 96 | + }) |
| 97 | + await db.insert(permissions).values([ |
| 98 | + { |
| 99 | + id: generateId(), |
| 100 | + userId: adminId, |
| 101 | + entityType: 'workspace', |
| 102 | + entityId: workspaceId, |
| 103 | + permissionType: 'admin', |
| 104 | + }, |
| 105 | + { |
| 106 | + id: generateId(), |
| 107 | + userId: writerId, |
| 108 | + entityType: 'workspace', |
| 109 | + entityId: workspaceId, |
| 110 | + permissionType: 'write', |
| 111 | + }, |
| 112 | + ]) |
| 113 | + await db.insert(invitation).values({ |
| 114 | + id: pendingInvitationId, |
| 115 | + kind: 'organization', |
| 116 | + email: pendingInvitee, |
| 117 | + inviterId: adminId, |
| 118 | + organizationId, |
| 119 | + membershipIntent: 'internal', |
| 120 | + role: 'member', |
| 121 | + status: 'pending', |
| 122 | + token: generateId(), |
| 123 | + expiresAt: new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000), |
| 124 | + createdAt: now, |
| 125 | + updatedAt: now, |
| 126 | + }) |
| 127 | + }) |
| 128 | + |
| 129 | + afterAll(async () => { |
| 130 | + await db |
| 131 | + .delete(invitation) |
| 132 | + .where(inArray(invitation.email, [newInvitee, pendingInvitee, writerInvitee])) |
| 133 | + await db.delete(auditLog).where(eq(auditLog.workspaceId, workspaceId)) |
| 134 | + await db.delete(workspace).where(eq(workspace.id, workspaceId)) |
| 135 | + await db.delete(organization).where(eq(organization.id, organizationId)) |
| 136 | + await db.delete(user).where(inArray(user.id, [adminId, writerId])) |
| 137 | + }) |
| 138 | + |
| 139 | + it('lets a workspace admin invite a new teammate', async () => { |
| 140 | + const response = await inviteFromChat(adminId, [newInvitee]) |
| 141 | + |
| 142 | + expect(response.status).toBe(200) |
| 143 | + expect(await response.json()).toMatchObject({ |
| 144 | + data: { success: true, successful: [newInvitee], failed: [] }, |
| 145 | + }) |
| 146 | + const [created] = await pendingInvitationsFor(newInvitee) |
| 147 | + expect(created.inviterId).toBe(adminId) |
| 148 | + expect(await grantsOf(created.id)).toEqual([{ workspaceId, permission: 'write' }]) |
| 149 | + await vi.waitFor(async () => { |
| 150 | + const [audit] = await db |
| 151 | + .select({ actorId: auditLog.actorId, metadata: auditLog.metadata }) |
| 152 | + .from(auditLog) |
| 153 | + .where(and(eq(auditLog.workspaceId, workspaceId), eq(auditLog.resourceName, newInvitee))) |
| 154 | + expect(audit).toMatchObject({ |
| 155 | + actorId: adminId, |
| 156 | + metadata: { |
| 157 | + operation: 'workspace_invitations.send_batch', |
| 158 | + actor: { kind: 'delegated', serviceId: 'copilot' }, |
| 159 | + }, |
| 160 | + }) |
| 161 | + }) |
| 162 | + }) |
| 163 | + |
| 164 | + it('adds the workspace to a pending organization invitation instead of creating another', async () => { |
| 165 | + const response = await inviteFromChat(adminId, [pendingInvitee]) |
| 166 | + |
| 167 | + expect(response.status).toBe(200) |
| 168 | + expect(await response.json()).toMatchObject({ |
| 169 | + data: { success: true, successful: [pendingInvitee], failed: [] }, |
| 170 | + }) |
| 171 | + expect(await pendingInvitationsFor(pendingInvitee)).toEqual([ |
| 172 | + { id: pendingInvitationId, inviterId: adminId }, |
| 173 | + ]) |
| 174 | + expect(await grantsOf(pendingInvitationId)).toEqual([{ workspaceId, permission: 'write' }]) |
| 175 | + }) |
| 176 | + |
| 177 | + it('refuses a member without workspace admin rights', async () => { |
| 178 | + const response = await inviteFromChat(writerId, [writerInvitee]) |
| 179 | + |
| 180 | + expect(response.status).toBe(403) |
| 181 | + expect(await response.json()).toMatchObject({ |
| 182 | + error: { code: 'FORBIDDEN', details: { code: 'INSUFFICIENT_WORKSPACE_ROLE' } }, |
| 183 | + }) |
| 184 | + expect(await pendingInvitationsFor(writerInvitee)).toEqual([]) |
| 185 | + }) |
| 186 | +}) |
0 commit comments