chore: import upstream snapshot with attribution

apps/sim/app/api/organizations/[id]/members/route.ts

@@ -0,0 +1,380 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import {
+  invitation,
+  member,
+  subscription as subscriptionTable,
+  user,
+  userStats,
+} from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { normalizeEmail } from '@sim/utils/string'
+import { and, eq, inArray } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  inviteOrganizationMemberContract,
+  organizationMemberQuerySchema,
+  organizationParamsSchema,
+} from '@/lib/api/contracts/organization'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
+import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import {
+  cancelPendingInvitation,
+  createPendingInvitation,
+  sendInvitationEmail,
+} from '@/lib/invitations/send'
+import { quickValidateEmail } from '@/lib/messaging/email/validation'
+import {
+  InvitationsNotAllowedError,
+  validateInvitationsAllowed,
+} from '@/ee/access-control/utils/permission-check'
+
+const logger = createLogger('OrganizationMembersAPI')
+
+/**
+ * GET /api/organizations/[id]/members
+ * Get organization members with optional usage data
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const paramsResult = organizationParamsSchema.safeParse(await params)
+      if (!paramsResult.success) {
+        return NextResponse.json(
+          { error: getValidationErrorMessage(paramsResult.error, 'Invalid route parameters') },
+          { status: 400 }
+        )
+      }
+
+      const { id: organizationId } = paramsResult.data
+      const queryResult = organizationMemberQuerySchema.safeParse(
+        Object.fromEntries(request.nextUrl.searchParams.entries())
+      )
+      if (!queryResult.success) {
+        return NextResponse.json(
+          { error: getValidationErrorMessage(queryResult.error, 'Invalid query parameters') },
+          { status: 400 }
+        )
+      }
+      const includeUsage = queryResult.data.include === 'usage'
+
+      // Verify user has access to this organization
+      const memberEntry = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (memberEntry.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      const userRole = memberEntry[0].role
+      const hasAdminAccess = isOrgAdminRole(userRole)
+
+      // Get organization members
+      const query = db
+        .select({
+          id: member.id,
+          userId: member.userId,
+          organizationId: member.organizationId,
+          role: member.role,
+          createdAt: member.createdAt,
+          userName: user.name,
+          userEmail: user.email,
+        })
+        .from(member)
+        .innerJoin(user, eq(member.userId, user.id))
+        .where(eq(member.organizationId, organizationId))
+
+      // Include usage data if requested and user has admin access
+      if (includeUsage && hasAdminAccess) {
+        const base = await db
+          .select({
+            id: member.id,
+            userId: member.userId,
+            organizationId: member.organizationId,
+            role: member.role,
+            createdAt: member.createdAt,
+            userName: user.name,
+            userEmail: user.email,
+            currentPeriodCost: userStats.currentPeriodCost,
+            currentUsageLimit: userStats.currentUsageLimit,
+            usageLimitUpdatedAt: userStats.usageLimitUpdatedAt,
+          })
+          .from(member)
+          .innerJoin(user, eq(member.userId, user.id))
+          .leftJoin(userStats, eq(user.id, userStats.userId))
+          .where(eq(member.organizationId, organizationId))
+
+        // The billing period is the same for every member — it comes from
+        // whichever subscription covers them. Fetch once and attach to
+        // every row instead of calling `getUserUsageData` per-member,
+        // which would run an O(N) pooled query for each of N rows.
+        const [orgSub] = await db
+          .select({
+            periodStart: subscriptionTable.periodStart,
+            periodEnd: subscriptionTable.periodEnd,
+          })
+          .from(subscriptionTable)
+          .where(
+            and(
+              eq(subscriptionTable.referenceId, organizationId),
+              inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
+            )
+          )
+          .limit(1)
+
+        const billingPeriodStart = orgSub?.periodStart ?? null
+        const billingPeriodEnd = orgSub?.periodEnd ?? null
+
+        // currentPeriodCost is only a baseline; add each member's attributed
+        // usage_log for the period (batched, one query) so the roster shows real
+        // usage rather than the frozen baseline.
+        const usageByUser = await getOrgMemberLedgerByUser(
+          organizationId,
+          billingPeriodStart && billingPeriodEnd
+            ? { start: billingPeriodStart, end: billingPeriodEnd }
+            : null
+        )
+
+        const membersWithUsage = base.map((row) => ({
+          ...row,
+          currentPeriodCost: (
+            Number(row.currentPeriodCost ?? 0) + (usageByUser.get(row.userId) ?? 0)
+          ).toString(),
+          billingPeriodStart,
+          billingPeriodEnd,
+        }))
+
+        return NextResponse.json({
+          success: true,
+          data: membersWithUsage,
+          total: membersWithUsage.length,
+          userRole,
+          hasAdminAccess,
+        })
+      }
+
+      const members = await query
+
+      return NextResponse.json({
+        success: true,
+        data: members,
+        total: members.length,
+        userRole,
+        hasAdminAccess,
+      })
+    } catch (error) {
+      logger.error('Failed to get organization members', {
+        organizationId: (await params).id,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+/**
+ * POST /api/organizations/[id]/members
+ * Invite new member to organization
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const parsed = await parseRequest(inviteOrganizationMemberContract, request, context)
+      if (!parsed.success) return parsed.response
+
+      const { id: organizationId } = parsed.data.params
+
+      await validateInvitationsAllowed(session.user.id, { organizationId })
+
+      const { email, role = 'member' } = parsed.data.body
+
+      // Validate and normalize email
+      const normalizedEmail = normalizeEmail(email)
+      const validation = quickValidateEmail(normalizedEmail)
+      if (!validation.isValid) {
+        return NextResponse.json(
+          { error: validation.reason || 'Invalid email format' },
+          { status: 400 }
+        )
+      }
+
+      // Verify user has admin access
+      const memberEntry = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (memberEntry.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      if (!isOrgAdminRole(memberEntry[0].role)) {
+        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+      }
+
+      // Check seat availability
+      const seatValidation = await validateSeatAvailability(organizationId, 1)
+      if (!seatValidation.canInvite) {
+        return NextResponse.json(
+          {
+            error: `Cannot invite teammate. Using ${seatValidation.currentSeats} of ${seatValidation.maxSeats} seats.`,
+            details: seatValidation,
+          },
+          { status: 400 }
+        )
+      }
+
+      // Check if user is already a member
+      const existingUser = await db
+        .select({ id: user.id })
+        .from(user)
+        .where(eq(user.email, normalizedEmail))
+        .limit(1)
+
+      if (existingUser.length > 0) {
+        const existingMember = await db
+          .select()
+          .from(member)
+          .where(
+            and(eq(member.organizationId, organizationId), eq(member.userId, existingUser[0].id))
+          )
+          .limit(1)
+
+        if (existingMember.length > 0) {
+          return NextResponse.json(
+            { error: 'User is already a member of this organization' },
+            { status: 400 }
+          )
+        }
+      }
+
+      // Check for existing pending invitation
+      const existingInvitation = await db
+        .select()
+        .from(invitation)
+        .where(
+          and(
+            eq(invitation.organizationId, organizationId),
+            eq(invitation.email, normalizedEmail),
+            eq(invitation.status, 'pending')
+          )
+        )
+        .limit(1)
+
+      if (existingInvitation.length > 0) {
+        return NextResponse.json(
+          { error: 'Pending invitation already exists for this email' },
+          { status: 400 }
+        )
+      }
+
+      const { invitationId, token } = await createPendingInvitation({
+        kind: 'organization',
+        email: normalizedEmail,
+        inviterId: session.user.id,
+        organizationId,
+        role,
+        grants: [],
+      })
+
+      const [inviterRow] = await db
+        .select({ name: user.name, email: user.email })
+        .from(user)
+        .where(eq(user.id, session.user.id))
+        .limit(1)
+      const inviterName = inviterRow?.name || inviterRow?.email || 'A user'
+
+      const emailResult = await sendInvitationEmail({
+        invitationId,
+        token,
+        kind: 'organization',
+        email: normalizedEmail,
+        inviterName,
+        organizationId,
+        organizationRole: role,
+        grants: [],
+      })
+
+      if (!emailResult.success) {
+        logger.error('Failed to send organization invitation email', {
+          email: normalizedEmail,
+          invitationId,
+          error: emailResult.error,
+        })
+        await cancelPendingInvitation(invitationId)
+        return NextResponse.json(
+          { error: emailResult.error || 'Failed to send invitation email' },
+          { status: 502 }
+        )
+      }
+
+      logger.info('Member invitation sent', {
+        email: normalizedEmail,
+        organizationId,
+        invitationId,
+        role,
+      })
+
+      recordAudit({
+        workspaceId: null,
+        actorId: session.user.id,
+        action: AuditAction.ORG_INVITATION_CREATED,
+        resourceType: AuditResourceType.ORGANIZATION,
+        resourceId: organizationId,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        description: `Invited ${normalizedEmail} to organization as ${role}`,
+        metadata: { invitationId, targetEmail: normalizedEmail, targetRole: role },
+        request,
+      })
+
+      return NextResponse.json({
+        success: true,
+        message: `Invitation sent to ${normalizedEmail}`,
+        data: {
+          invitationId,
+          email: normalizedEmail,
+          role,
+        },
+      })
+    } catch (error) {
+      if (error instanceof InvitationsNotAllowedError) {
+        return NextResponse.json({ error: error.message }, { status: 403 })
+      }
+      logger.error('Failed to invite organization member', {
+        organizationId: (await context.params).id,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)