Adjusting role actions

2026-06-05 21:09:31 -04:00
parent c3bec15c63
commit bb589e3489
4 changed files with 419 additions and 24 deletions
@@ -119,6 +119,7 @@ import {
  setWorkspaceSubscriptionStatusByStripeSubscriptionId,
  updateRescueVerificationStatus,
  updateWorkspace,
+  updateWorkspaceMemberRole,
  upsertWorkspaceMember,
 } from './repositories/workspaceRepository.js';
 import type {
@@ -3388,9 +3389,51 @@ app.post('/api/workspace/members', requireAuth, requireWriteAccess, requireWorks
  }
 });

+app.put('/api/workspace/members/:memberId', requireAuth, requireWriteAccess, requireWorkspaceRole(['owner', 'assistant']), async (req: Request, res: Response, next: NextFunction) => {
+  const parsed = z.object({ role: workspaceRoleSchema.exclude(['owner']) }).safeParse(req.body);
+
+  if (!parsed.success) {
+    res.status(400).json({ error: 'Invalid flock member role payload', details: parsed.error.flatten() });
+    return;
+  }
+
+  try {
+    const billingEmail = req.auth!.workspace.billing_email ? normalizeEmail(req.auth!.workspace.billing_email) : '';
+    const requesterIsBillingOwner = Boolean(billingEmail && billingEmail === normalizeEmail(req.auth!.user.email));
+    const member = await updateWorkspaceMemberRole({
+      memberId: req.params.memberId,
+      workspaceId: req.auth!.workspace.id,
+      role: parsed.data.role,
+      requesterMemberId: req.auth!.membership.id,
+      requesterIsBillingOwner,
+      requesterRole: req.auth!.membership.role,
+      billingEmail,
+    });
+
+    if (!member) {
+      res.status(404).json({ error: 'Flock member not found or cannot be changed.' });
+      return;
+    }
+
+    await writeAuditLog(req.auth!, 'workspace_member.role_updated', 'workspace_member', member.id, member.name, {
+      role: member.role,
+    });
+    res.json({ member: normalizeWorkspaceMember(member) });
+  } catch (error) {
+    next(error);
+  }
+});
+
 app.delete('/api/workspace/members/:memberId', requireAuth, requireWriteAccess, requireWorkspaceRole(['owner', 'assistant']), async (req: Request, res: Response, next: NextFunction) => {
  try {
-    const deleted = await deleteWorkspaceMember(req.params.memberId, req.auth!.workspace.id);
+    const billingEmail = req.auth!.workspace.billing_email ? normalizeEmail(req.auth!.workspace.billing_email) : '';
+    const requesterIsBillingOwner = Boolean(billingEmail && billingEmail === normalizeEmail(req.auth!.user.email));
+    const deleted = await deleteWorkspaceMember({
+      memberId: req.params.memberId,
+      workspaceId: req.auth!.workspace.id,
+      requesterMemberId: req.auth!.membership.id,
+      requesterIsBillingOwner,
+    });

    if (!deleted) {
      res.status(404).json({ error: 'Flock member not found or cannot be removed.' });
@@ -3398,7 +3441,6 @@ app.delete('/api/workspace/members/:memberId', requireAuth, requireWriteAccess,
    }

 	    await writeAuditLog(req.auth!, 'workspace_member.deleted', 'workspace_member', req.params.memberId);
-	    await writeAuditLog(req.auth!, 'integration_token.revoked', 'integration_token', req.params.tokenId);
 	    res.status(204).send();
  } catch (error) {
    next(error);
@@ -3,6 +3,7 @@ import test from 'node:test';

 import {
  createWorkspace,
+  deleteWorkspaceMember,
  deleteWorkspaceIfEmpty,
  ensureDefaultWorkspaceForUser,
  ensurePersonalWorkspaceForUser,
@@ -10,6 +11,7 @@ import {
  getPlatformAdminSummary,
  listOwnedWorkspacesByOwnerEmail,
  updateWorkspace,
+  updateWorkspaceMemberRole,
 } from './workspaceRepository.js';
 import { mockDb } from '../test/mockDb.js';
 import type { UserRow } from '../types.js';
@@ -259,6 +261,212 @@ test('listOwnedWorkspacesByOwnerEmail resolves accepted owner flocks by email',
  assert.match(calls[0].text, /workspaces\.id <> \$2/);
 });

+test('updateWorkspaceMemberRole changes a non-owner member role', async () => {
+  const { calls } = mockDb({
+    rowCount: 1,
+    rows: [
+      {
+        id: 'member-1',
+        workspace_id: 42,
+        user_id: 'user-2',
+        invite_email: 'helper@example.com',
+        name: 'Helper',
+        role: 'viewer',
+        accepted_at: '2026-04-14T00:00:00.000Z',
+        created_at: '2026-04-14T00:00:00.000Z',
+      },
+    ],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'member-1',
+    workspaceId: 42,
+    role: 'viewer',
+    requesterMemberId: 'owner-member',
+    requesterIsBillingOwner: false,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member?.role, 'viewer');
+  assert.deepEqual(calls[0].params, ['member-1', 42, 'viewer', false, 'owner-member', 'billing@example.com', 'owner']);
+  assert.match(calls[0].text, /UPDATE workspace_members/);
+  assert.match(calls[0].text, /role <> 'owner'/);
+});
+
+test('updateWorkspaceMemberRole returns null when no non-owner member matches', async () => {
+  mockDb({
+    rowCount: 0,
+    rows: [],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'owner-member',
+    workspaceId: 42,
+    role: 'viewer',
+    requesterMemberId: 'owner-member',
+    requesterIsBillingOwner: false,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member, null);
+});
+
+test('updateWorkspaceMemberRole lets the billing owner change another owner role', async () => {
+  const { calls } = mockDb({
+    rowCount: 1,
+    rows: [
+      {
+        id: 'other-owner',
+        workspace_id: 42,
+        user_id: 'user-2',
+        invite_email: 'other@example.com',
+        name: 'Other Owner',
+        role: 'assistant',
+        accepted_at: '2026-04-14T00:00:00.000Z',
+        created_at: '2026-04-14T00:00:00.000Z',
+      },
+    ],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'other-owner',
+    workspaceId: 42,
+    role: 'assistant',
+    requesterMemberId: 'billing-owner',
+    requesterIsBillingOwner: true,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member?.role, 'assistant');
+  assert.deepEqual(calls[0].params, ['other-owner', 42, 'assistant', true, 'billing-owner', 'billing@example.com', 'owner']);
+  assert.match(calls[0].text, /id <> \$5/);
+});
+
+test('updateWorkspaceMemberRole does not let the billing owner change their own owner role', async () => {
+  mockDb({
+    rowCount: 0,
+    rows: [],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'billing-owner',
+    workspaceId: 42,
+    role: 'assistant',
+    requesterMemberId: 'billing-owner',
+    requesterIsBillingOwner: true,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member, null);
+});
+
+test('updateWorkspaceMemberRole lets a non-billing owner change another non-billing owner role', async () => {
+  const { calls } = mockDb({
+    rowCount: 1,
+    rows: [
+      {
+        id: 'other-owner',
+        workspace_id: 42,
+        user_id: 'user-2',
+        invite_email: 'other@example.com',
+        name: 'Other Owner',
+        role: 'assistant',
+        accepted_at: '2026-04-14T00:00:00.000Z',
+        created_at: '2026-04-14T00:00:00.000Z',
+      },
+    ],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'other-owner',
+    workspaceId: 42,
+    role: 'assistant',
+    requesterMemberId: 'non-billing-owner',
+    requesterIsBillingOwner: false,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member?.role, 'assistant');
+  assert.deepEqual(calls[0].params, ['other-owner', 42, 'assistant', false, 'non-billing-owner', 'billing@example.com', 'owner']);
+  assert.match(calls[0].text, /LOWER\(BTRIM\(COALESCE\(invite_email, email\)\)\) <> LOWER\(BTRIM\(\$6\)\)/);
+});
+
+test('updateWorkspaceMemberRole does not let a non-billing owner change the billing owner role', async () => {
+  mockDb({
+    rowCount: 0,
+    rows: [],
+  });
+
+  const member = await updateWorkspaceMemberRole({
+    memberId: 'billing-owner',
+    workspaceId: 42,
+    role: 'assistant',
+    requesterMemberId: 'non-billing-owner',
+    requesterIsBillingOwner: false,
+    requesterRole: 'owner',
+    billingEmail: 'billing@example.com',
+  });
+
+  assert.equal(member, null);
+});
+
+test('deleteWorkspaceMember removes non-owner members without billing owner access', async () => {
+  const { calls } = mockDb({
+    rowCount: 1,
+    rows: [{ id: 'member-1' }],
+  });
+
+  const deleted = await deleteWorkspaceMember({
+    memberId: 'member-1',
+    workspaceId: 42,
+    requesterMemberId: 'owner-member',
+    requesterIsBillingOwner: false,
+  });
+
+  assert.equal(deleted, true);
+  assert.deepEqual(calls[0].params, ['member-1', 42, false, 'owner-member']);
+  assert.match(calls[0].text, /role <> 'owner'/);
+});
+
+test('deleteWorkspaceMember lets the billing owner remove another owner', async () => {
+  const { calls } = mockDb({
+    rowCount: 1,
+    rows: [{ id: 'other-owner' }],
+  });
+
+  const deleted = await deleteWorkspaceMember({
+    memberId: 'other-owner',
+    workspaceId: 42,
+    requesterMemberId: 'billing-owner',
+    requesterIsBillingOwner: true,
+  });
+
+  assert.equal(deleted, true);
+  assert.deepEqual(calls[0].params, ['other-owner', 42, true, 'billing-owner']);
+  assert.match(calls[0].text, /id <> \$4/);
+});
+
+test('deleteWorkspaceMember does not let the billing owner remove their own owner membership', async () => {
+  mockDb({
+    rowCount: 0,
+    rows: [],
+  });
+
+  const deleted = await deleteWorkspaceMember({
+    memberId: 'billing-owner',
+    workspaceId: 42,
+    requesterMemberId: 'billing-owner',
+    requesterIsBillingOwner: true,
+  });
+
+  assert.equal(deleted, false);
+});
+
 test('getPlatformAdminSummary counts memorialized birds separately', async () => {
  const { calls } = mockDb({
    rowCount: 1,
@@ -364,19 +364,77 @@ export const upsertWorkspaceMember = async ({
  return result.rows[0] ?? null;
 };

-export const deleteWorkspaceMember = async (memberId: string, workspaceId: number) => {
+export const deleteWorkspaceMember = async ({
+  memberId,
+  workspaceId,
+  requesterMemberId,
+  requesterIsBillingOwner,
+}: {
+  memberId: string;
+  workspaceId: number;
+  requesterMemberId: string;
+  requesterIsBillingOwner: boolean;
+}) => {
  const result = await db.query<{ id: string }>(
    `DELETE FROM workspace_members
     WHERE id = $1
       AND workspace_id = $2
-       AND role <> 'owner'
+       AND (
+         role <> 'owner'
+         OR (
+           $3 = TRUE
+           AND id <> $4
+         )
+       )
     RETURNING id`,
-    [memberId, workspaceId],
+    [memberId, workspaceId, requesterIsBillingOwner, requesterMemberId],
  );

  return Boolean(result.rowCount);
 };

+export const updateWorkspaceMemberRole = async ({
+  memberId,
+  workspaceId,
+  role,
+  requesterMemberId,
+  requesterIsBillingOwner,
+  requesterRole,
+  billingEmail,
+}: {
+  memberId: string;
+  workspaceId: number;
+  role: WorkspaceMemberRow['role'];
+  requesterMemberId: string;
+  requesterIsBillingOwner: boolean;
+  requesterRole: WorkspaceMemberRow['role'];
+  billingEmail: string;
+}) => {
+  const result = await db.query<WorkspaceMemberRow>(
+    `UPDATE workspace_members
+     SET role = $3
+     WHERE id = $1
+       AND workspace_id = $2
+       AND (
+         role <> 'owner'
+         OR (
+           id <> $5
+           AND (
+             $4 = TRUE
+             OR (
+               $7 = 'owner'
+               AND LOWER(BTRIM(COALESCE(invite_email, email))) <> LOWER(BTRIM($6))
+             )
+           )
+         )
+       )
+     RETURNING id, workspace_id, user_id, COALESCE(invite_email, email) AS invite_email, name, role, accepted_at::text, created_at`,
+    [memberId, workspaceId, role, requesterIsBillingOwner, requesterMemberId, billingEmail, requesterRole],
+  );
+
+  return result.rows[0] ?? null;
+};
+
 export const listRescueWorkspacesForAdmin = async () => {
  const result = await db.query<
    WorkspaceRow & {