Files
app/ts/reception/classes.organizationmanager.ts
T

589 lines
22 KiB
TypeScript

import * as plugins from '../plugins.js';
import { Reception } from './classes.reception.js';
import { Organization } from './classes.organization.js';
import { User } from './classes.user.js';
export class OrganizationManager {
public static readonly platformRoleKeys = ['owner', 'admin', 'editor', 'viewer', 'guest', 'outlaw'];
public receptionRef: Reception;
public get db() {
return this.receptionRef.db.smartdataDb;
}
public typedrouter = new plugins.typedrequest.TypedRouter();
public COrganization = plugins.smartdata.setDefaultManagerForDoc(this, Organization);
constructor(receptionRefArg: Reception) {
this.receptionRef = receptionRefArg;
this.receptionRef.typedrouter.addTypedRouter(this.typedrouter);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_CreateOrganization>(
'createOrganization',
async (requestArg) => {
const nameIsAvailable = async () => {
const existingOrg = await this.COrganization.getInstance({
data: {
slug: requestArg.organizationSlug,
},
});
const nameAvailable = !existingOrg;
return nameAvailable;
};
switch (requestArg.action) {
case 'checkAvailability':
return {
nameAvailable: await nameIsAvailable(),
};
break;
case 'manifest':
const nameCheckedOk = await nameIsAvailable();
const userData = await this.receptionRef.userManager.getUserByJwtValidation(
requestArg.jwt
);
const newOrg = await this.COrganization.createNewOrganizationForUser(
this,
userData.id,
requestArg.organizationName,
requestArg.organizationSlug
);
const role = await this.receptionRef.roleManager.modifyRoleForUserAtOrg({
action: 'create',
organizationId: newOrg.id,
userId: userData.id,
roles: ['owner'],
});
newOrg.data.roleIds.push(role.id);
await newOrg.save();
return {
nameAvailable: true,
resultingOrganization: await newOrg.createSavableObject(),
role: await role.createSavableObject(),
}
break;
}
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_GetOrganizationById>(
'getOrganizationById',
async (requestArg) => {
const verifiedJwt = await this.receptionRef.jwtManager.verifyJWTAndGetData(
requestArg.jwt
);
const user = await this.receptionRef.userManager.CUser.getInstance({
id: verifiedJwt.data.userId,
});
const organization = await this.COrganization.getInstance({
id: requestArg.id
});
const role = await this.receptionRef.roleManager.CRole.getInstance({
data: {
organizationId: organization.id,
userId: user.id,
}
});
if (!role) {
throw new plugins.typedrequest.TypedResponseError('User not authorized for the requested organization.');
}
return {
organization: await organization.createSavableObject()
};
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_UpdateOrganization>(
'updateOrganization',
async (requestArg) => {
const user = await this.receptionRef.userManager.getUserByJwtValidation(requestArg.jwt);
const organization = await this.updateOrganizationWithAudit({
user,
organizationId: requestArg.organizationId,
name: requestArg.name,
slug: requestArg.slug,
confirmationText: requestArg.confirmationText,
});
return {
success: true,
organization: await organization.createSavableObject(),
};
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_DeleteOrganization>(
'deleteOrganization',
async (requestArg) => {
const user = await this.receptionRef.userManager.getUserByJwtValidation(requestArg.jwt);
await this.deleteOrganizationWithAudit({
user,
organizationId: requestArg.organizationId,
confirmationText: requestArg.confirmationText,
});
return {
success: true,
deletedOrganizationId: requestArg.organizationId,
};
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_GetOrgRoleDefinitions>(
'getOrgRoleDefinitions',
async (requestArg) => {
const user = await this.receptionRef.userManager.getUserByJwtValidation(requestArg.jwt);
const organization = await this.getOrganizationOrThrow(requestArg.organizationId);
await this.getRoleOrThrow(user, organization);
return {
roleDefinitions: this.getCustomRoleDefinitions(organization),
};
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_UpsertOrgRoleDefinition>(
'upsertOrgRoleDefinition',
async (requestArg) => {
const user = await this.receptionRef.userManager.getUserByJwtValidation(requestArg.jwt);
const roleDefinitions = await this.upsertOrgRoleDefinition({
user,
organizationId: requestArg.organizationId,
roleDefinition: requestArg.roleDefinition,
});
return {
success: true,
roleDefinitions,
};
}
)
);
this.typedrouter.addTypedHandler(
new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_DeleteOrgRoleDefinition>(
'deleteOrgRoleDefinition',
async (requestArg) => {
const user = await this.receptionRef.userManager.getUserByJwtValidation(requestArg.jwt);
const roleDefinitions = await this.deleteOrgRoleDefinition({
user,
organizationId: requestArg.organizationId,
roleKey: requestArg.roleKey,
confirmationText: requestArg.confirmationText,
});
return {
success: true,
roleDefinitions,
};
}
)
);
}
private getCustomRoleDefinitions(organizationArg: Organization) {
return organizationArg.data.roleDefinitions || [];
}
private normalizeRoleKey(roleKeyArg: string) {
return (roleKeyArg || '').trim().toLowerCase();
}
public validateRoleKey(roleKeyArg: string) {
const roleKey = this.normalizeRoleKey(roleKeyArg);
if (!roleKey || roleKey.length < 2 || roleKey.length > 64) {
throw new plugins.typedrequest.TypedResponseError('Role key must be between 2 and 64 characters.');
}
if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(roleKey)) {
throw new plugins.typedrequest.TypedResponseError('Role key may only contain lowercase letters, numbers, and single dashes.');
}
return roleKey;
}
public async getAvailableRoleKeys(organizationIdArg: string) {
const organization = await this.getOrganizationOrThrow(organizationIdArg);
return [
...OrganizationManager.platformRoleKeys,
...this.getCustomRoleDefinitions(organization).map((roleDefinitionArg) => roleDefinitionArg.key),
];
}
public async assertRoleKeysAreValid(organizationIdArg: string, roleKeysArg: string[]) {
const normalizedRoleKeys = [...new Set((roleKeysArg || []).map((roleKeyArg) => this.validateRoleKey(roleKeyArg)))];
if (!normalizedRoleKeys.length) {
throw new plugins.typedrequest.TypedResponseError('At least one role is required.');
}
const availableRoleKeys = await this.getAvailableRoleKeys(organizationIdArg);
const invalidRoleKeys = normalizedRoleKeys.filter((roleKeyArg) => !availableRoleKeys.includes(roleKeyArg));
if (invalidRoleKeys.length) {
throw new plugins.typedrequest.TypedResponseError(`Unknown organization roles: ${invalidRoleKeys.join(', ')}.`);
}
return normalizedRoleKeys;
}
private normalizeSlug(slugArg: string) {
return (slugArg || '').trim().toLowerCase();
}
private validateSlug(slugArg: string) {
const slug = this.normalizeSlug(slugArg);
if (!slug || slug.length < 3 || slug.length > 64) {
throw new plugins.typedrequest.TypedResponseError('Organization slug must be between 3 and 64 characters.');
}
if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) {
throw new plugins.typedrequest.TypedResponseError('Organization slug may only contain lowercase letters, numbers, and single dashes.');
}
return slug;
}
private assertConfirmation(confirmationTextArg: string, expectedTextArg: string) {
if ((confirmationTextArg || '').trim() !== expectedTextArg) {
throw new plugins.typedrequest.TypedResponseError(`Confirmation text must be exactly "${expectedTextArg}".`);
}
}
private async getOrganizationOrThrow(organizationIdArg: string) {
const organization = await this.COrganization.getInstance({
id: organizationIdArg,
});
if (!organization) {
throw new plugins.typedrequest.TypedResponseError('Organization not found.');
}
return organization;
}
private async getRoleOrThrow(userArg: User, organizationArg: Organization) {
const role = await this.receptionRef.roleManager.getRoleForUserAndOrg(userArg, organizationArg);
if (!role) {
throw new plugins.typedrequest.TypedResponseError('User not authorized for this organization.');
}
return role;
}
private async verifyAdmin(userArg: User, organizationArg: Organization) {
const role = await this.getRoleOrThrow(userArg, organizationArg);
if (!role.data.roles.some((roleArg) => ['owner', 'admin'].includes(roleArg))) {
throw new plugins.typedrequest.TypedResponseError('Organization admin privileges required.');
}
return role;
}
private async verifyOwner(userArg: User, organizationArg: Organization) {
const role = await this.getRoleOrThrow(userArg, organizationArg);
if (!role.data.roles.includes('owner')) {
throw new plugins.typedrequest.TypedResponseError('Organization owner privileges required.');
}
return role;
}
private async emitOrganizationAlert(optionsArg: {
organizationId: string;
eventType: string;
severity: plugins.idpInterfaces.data.TAlertSeverity;
title: string;
body: string;
actorUserId: string;
relatedEntityId?: string;
relatedEntityType?: string;
}) {
await this.receptionRef.alertManager.createAlertsForEvent({
category: 'admin',
organizationId: optionsArg.organizationId,
eventType: optionsArg.eventType,
severity: optionsArg.severity,
title: optionsArg.title,
body: optionsArg.body,
actorUserId: optionsArg.actorUserId,
relatedEntityId: optionsArg.relatedEntityId,
relatedEntityType: optionsArg.relatedEntityType,
});
}
public async upsertOrgRoleDefinition(optionsArg: {
user: User;
organizationId: string;
roleDefinition: {
key: string;
name: string;
description?: string;
};
}) {
const organization = await this.getOrganizationOrThrow(optionsArg.organizationId);
await this.verifyAdmin(optionsArg.user, organization);
const roleKey = this.validateRoleKey(optionsArg.roleDefinition.key);
if (OrganizationManager.platformRoleKeys.includes(roleKey)) {
throw new plugins.typedrequest.TypedResponseError('Platform roles cannot be redefined by an organization.');
}
const roleName = (optionsArg.roleDefinition.name || '').trim();
if (!roleName) {
throw new plugins.typedrequest.TypedResponseError('Role name is required.');
}
const now = Date.now();
const roleDefinitions = this.getCustomRoleDefinitions(organization);
const existingRoleDefinition = roleDefinitions.find((roleDefinitionArg) => roleDefinitionArg.key === roleKey);
if (existingRoleDefinition) {
existingRoleDefinition.name = roleName;
existingRoleDefinition.description = optionsArg.roleDefinition.description?.trim() || '';
existingRoleDefinition.updatedAt = now;
} else {
roleDefinitions.push({
key: roleKey,
name: roleName,
description: optionsArg.roleDefinition.description?.trim() || '',
createdAt: now,
updatedAt: now,
});
}
organization.data.roleDefinitions = roleDefinitions.sort((leftArg, rightArg) => leftArg.name.localeCompare(rightArg.name));
await organization.save();
await this.receptionRef.activityLogManager.logActivity(
optionsArg.user.id,
'role_changed',
`${optionsArg.user.data.email} ${existingRoleDefinition ? 'updated' : 'created'} organization role ${roleKey}.`,
{
targetId: organization.id,
targetType: 'organization-role',
}
);
await this.emitOrganizationAlert({
organizationId: organization.id,
eventType: 'org_role_definition_updated',
severity: 'medium',
title: 'Organization role definition updated',
body: `${optionsArg.user.data.email} ${existingRoleDefinition ? 'updated' : 'created'} organization role ${roleKey}.`,
actorUserId: optionsArg.user.id,
relatedEntityId: roleKey,
relatedEntityType: 'organization-role',
});
return organization.data.roleDefinitions;
}
public async deleteOrgRoleDefinition(optionsArg: {
user: User;
organizationId: string;
roleKey: string;
confirmationText: string;
}) {
const organization = await this.getOrganizationOrThrow(optionsArg.organizationId);
await this.verifyAdmin(optionsArg.user, organization);
const roleKey = this.validateRoleKey(optionsArg.roleKey);
if (OrganizationManager.platformRoleKeys.includes(roleKey)) {
throw new plugins.typedrequest.TypedResponseError('Platform roles cannot be deleted.');
}
this.assertConfirmation(optionsArg.confirmationText, `delete role ${roleKey}`);
const roleDefinitions = this.getCustomRoleDefinitions(organization);
if (!roleDefinitions.some((roleDefinitionArg) => roleDefinitionArg.key === roleKey)) {
throw new plugins.typedrequest.TypedResponseError('Organization role definition not found.');
}
organization.data.roleDefinitions = roleDefinitions.filter((roleDefinitionArg) => roleDefinitionArg.key !== roleKey);
await organization.save();
const roles = await this.receptionRef.roleManager.getAllRolesForOrg(organization.id);
for (const role of roles) {
if (role.data.roles.includes(roleKey)) {
role.data.roles = role.data.roles.filter((roleKeyArg) => roleKeyArg !== roleKey);
if (!role.data.roles.length) {
role.data.roles = ['viewer'];
}
await role.save();
}
}
const appConnections = await this.receptionRef.appConnectionManager.CAppConnection.getInstances({
'data.organizationId': organization.id,
});
for (const connection of appConnections) {
if (connection.data.roleMappings?.some((mappingArg) => mappingArg.orgRoleKey === roleKey)) {
connection.data.roleMappings = connection.data.roleMappings.filter((mappingArg) => mappingArg.orgRoleKey !== roleKey);
await connection.save();
}
}
await this.receptionRef.activityLogManager.logActivity(
optionsArg.user.id,
'role_changed',
`${optionsArg.user.data.email} deleted organization role ${roleKey}.`,
{
targetId: organization.id,
targetType: 'organization-role',
}
);
await this.emitOrganizationAlert({
organizationId: organization.id,
eventType: 'org_role_definition_deleted',
severity: 'high',
title: 'Organization role definition deleted',
body: `${optionsArg.user.data.email} deleted organization role ${roleKey}. Member assignments and app mappings were cleaned up.`,
actorUserId: optionsArg.user.id,
relatedEntityId: roleKey,
relatedEntityType: 'organization-role',
});
return organization.data.roleDefinitions;
}
public async updateOrganizationWithAudit(optionsArg: {
user: User;
organizationId: string;
name?: string;
slug?: string;
confirmationText: string;
}) {
const organization = await this.getOrganizationOrThrow(optionsArg.organizationId);
await this.verifyAdmin(optionsArg.user, organization);
this.assertConfirmation(optionsArg.confirmationText, organization.data.slug);
const previousName = organization.data.name;
const previousSlug = organization.data.slug;
const nextName = typeof optionsArg.name === 'string' ? optionsArg.name.trim() : previousName;
const nextSlug = typeof optionsArg.slug === 'string' ? this.validateSlug(optionsArg.slug) : previousSlug;
if (!nextName) {
throw new plugins.typedrequest.TypedResponseError('Organization name is required.');
}
if (nextSlug !== previousSlug) {
const existingOrganization = await this.COrganization.getInstance({
data: {
slug: nextSlug,
},
});
if (existingOrganization && existingOrganization.id !== organization.id) {
throw new plugins.typedrequest.TypedResponseError('Organization slug is already in use.');
}
}
organization.data.name = nextName;
organization.data.slug = nextSlug;
await organization.save();
const changes = [
previousName !== nextName ? `name "${previousName}" -> "${nextName}"` : '',
previousSlug !== nextSlug ? `slug "${previousSlug}" -> "${nextSlug}"` : '',
].filter(Boolean).join(', ') || 'no field changes';
await this.receptionRef.activityLogManager.logActivity(
optionsArg.user.id,
'org_updated',
`Organization ${previousName} updated: ${changes}.`,
{
targetId: organization.id,
targetType: 'organization',
}
);
await this.emitOrganizationAlert({
organizationId: organization.id,
eventType: 'org_updated',
severity: 'high',
title: 'Organization settings updated',
body: `${optionsArg.user.data.email} updated ${previousName}: ${changes}.`,
actorUserId: optionsArg.user.id,
relatedEntityId: organization.id,
relatedEntityType: 'organization',
});
return organization;
}
public async deleteOrganizationWithAudit(optionsArg: {
user: User;
organizationId: string;
confirmationText: string;
}) {
const organization = await this.getOrganizationOrThrow(optionsArg.organizationId);
await this.verifyOwner(optionsArg.user, organization);
this.assertConfirmation(optionsArg.confirmationText, `delete ${organization.data.slug}`);
const organizationName = organization.data.name;
const organizationSlug = organization.data.slug;
const roles = await this.receptionRef.roleManager.getAllRolesForOrg(organization.id);
const appConnections = await this.receptionRef.appConnectionManager.CAppConnection.getInstances({
'data.organizationId': organization.id,
});
const invitations = await this.receptionRef.userInvitationManager.CUserInvitation.getInstances({});
const billingPlans = await this.receptionRef.billingPlanManager.CBillingPlan.getInstances({
'data.organizationId': organization.id,
});
await this.receptionRef.activityLogManager.logActivity(
optionsArg.user.id,
'org_deleted',
`Organization ${organizationName} (${organizationSlug}) deleted.`,
{
targetId: organization.id,
targetType: 'organization',
}
);
await this.emitOrganizationAlert({
organizationId: organization.id,
eventType: 'org_deleted',
severity: 'critical',
title: 'Organization deleted',
body: `${optionsArg.user.data.email} deleted ${organizationName}. ${roles.length} memberships and ${appConnections.length} app connections were removed.`,
actorUserId: optionsArg.user.id,
relatedEntityId: organization.id,
relatedEntityType: 'organization',
});
for (const connection of appConnections) {
await connection.delete();
}
for (const invitation of invitations) {
if (invitation.data.organizationRefs.some((refArg) => refArg.organizationId === organization.id)) {
await invitation.removeOrganization(organization.id);
}
}
for (const billingPlan of billingPlans) {
await billingPlan.delete();
}
for (const role of roles) {
const memberUser = await this.receptionRef.userManager.CUser.getInstance({
id: role.data.userId,
});
if (memberUser?.data.connectedOrgs) {
memberUser.data.connectedOrgs = memberUser.data.connectedOrgs.filter(
(organizationIdArg) => organizationIdArg !== organization.id
);
await memberUser.save();
}
await role.delete();
}
await organization.delete();
}
public async getAllOrganizationsForUser(
userArg: User,
) {
const organizations: Organization[] = [];
const userRoles = await this.receptionRef.roleManager.getAllRolesForUser(userArg);
for (const role of userRoles) {
const organization = await this.receptionRef.organizationmanager.COrganization.getInstance({
id: role.data.organizationId
});
if (!organizations.find(orgArg => orgArg.id === organization.id)) {
organizations.push(organization);
}
}
return organizations;
}
}