651 lines
21 KiB
TypeScript
651 lines
21 KiB
TypeScript
import {
|
|
PermissionOverrides,
|
|
SystemRole,
|
|
resolvePermissions,
|
|
type ColumnPreferences,
|
|
} from "@capakraken/shared/types";
|
|
import {
|
|
dashboardLayoutSchema,
|
|
normalizeDashboardLayout,
|
|
} from "@capakraken/shared/schemas";
|
|
import { Prisma } from "@capakraken/db";
|
|
import { TRPCError } from "@trpc/server";
|
|
import { z } from "zod";
|
|
import { findUniqueOrThrow } from "../db/helpers.js";
|
|
import { adminProcedure, createTRPCRouter, managerProcedure, protectedProcedure, publicProcedure } from "../trpc.js";
|
|
import { createAuditEntry } from "../lib/audit.js";
|
|
|
|
export const userRouter = createTRPCRouter({
|
|
/** Lightweight user list for task assignment (ADMIN + MANAGER) */
|
|
listAssignable: managerProcedure.query(async ({ ctx }) => {
|
|
return ctx.db.user.findMany({
|
|
select: {
|
|
id: true,
|
|
name: true,
|
|
email: true,
|
|
},
|
|
orderBy: { name: "asc" },
|
|
});
|
|
}),
|
|
|
|
list: adminProcedure.query(async ({ ctx }) => {
|
|
return ctx.db.user.findMany({
|
|
select: {
|
|
id: true,
|
|
name: true,
|
|
email: true,
|
|
systemRole: true,
|
|
createdAt: true,
|
|
lastLoginAt: true,
|
|
lastActiveAt: true,
|
|
permissionOverrides: true,
|
|
totpEnabled: true,
|
|
},
|
|
orderBy: { name: "asc" },
|
|
});
|
|
}),
|
|
|
|
/** Count of users active in the last 5 minutes */
|
|
activeCount: adminProcedure.query(async ({ ctx }) => {
|
|
const fiveMinAgo = new Date(Date.now() - 5 * 60 * 1000);
|
|
const count = await ctx.db.user.count({
|
|
where: { lastActiveAt: { gte: fiveMinAgo } },
|
|
});
|
|
return { count };
|
|
}),
|
|
|
|
me: protectedProcedure.query(async ({ ctx }) => {
|
|
const user = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: {
|
|
id: true,
|
|
name: true,
|
|
email: true,
|
|
systemRole: true,
|
|
permissionOverrides: true,
|
|
createdAt: true,
|
|
},
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
return user;
|
|
}),
|
|
|
|
create: adminProcedure
|
|
.input(
|
|
z.object({
|
|
email: z.string().email(),
|
|
name: z.string().min(1),
|
|
systemRole: z.nativeEnum(SystemRole).default(SystemRole.USER),
|
|
password: z.string().min(8),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await ctx.db.user.findUnique({ where: { email: input.email } });
|
|
if (existing) {
|
|
throw new TRPCError({ code: "CONFLICT", message: "User with this email already exists" });
|
|
}
|
|
|
|
const { hash } = await import("@node-rs/argon2");
|
|
const passwordHash = await hash(input.password);
|
|
|
|
const user = await ctx.db.user.create({
|
|
data: {
|
|
email: input.email,
|
|
name: input.name,
|
|
systemRole: input.systemRole,
|
|
passwordHash,
|
|
},
|
|
select: { id: true, name: true, email: true, systemRole: true },
|
|
});
|
|
|
|
// Auto-link to a resource with matching email (if one exists and isn't already linked)
|
|
const matchingResource = await ctx.db.resource.findFirst({
|
|
where: { email: input.email, userId: null },
|
|
select: { id: true },
|
|
});
|
|
if (matchingResource) {
|
|
await ctx.db.resource.update({
|
|
where: { id: matchingResource.id },
|
|
data: { userId: user.id },
|
|
});
|
|
}
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: user.id,
|
|
entityName: `${user.name} (${user.email})`,
|
|
action: "CREATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
after: user as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
});
|
|
|
|
return user;
|
|
}),
|
|
|
|
setPassword: adminProcedure
|
|
.input(
|
|
z.object({
|
|
userId: z.string(),
|
|
password: z.string().min(8, "Password must be at least 8 characters"),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { id: true, name: true, email: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
const { hash } = await import("@node-rs/argon2");
|
|
const passwordHash = await hash(input.password);
|
|
|
|
await ctx.db.user.update({
|
|
where: { id: input.userId },
|
|
data: { passwordHash },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: user.id,
|
|
entityName: `${user.name} (${user.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
source: "ui",
|
|
summary: "Password reset by admin",
|
|
});
|
|
|
|
return { success: true };
|
|
}),
|
|
|
|
updateRole: adminProcedure
|
|
.input(
|
|
z.object({
|
|
id: z.string(),
|
|
systemRole: z.nativeEnum(SystemRole),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const before = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.id },
|
|
select: { id: true, name: true, email: true, systemRole: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
const updated = await ctx.db.user.update({
|
|
where: { id: input.id },
|
|
data: { systemRole: input.systemRole },
|
|
select: { id: true, name: true, email: true, systemRole: true },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: updated.id,
|
|
entityName: `${updated.name} (${updated.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
before: before as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Changed role from ${before.systemRole} to ${updated.systemRole}`,
|
|
});
|
|
|
|
return updated;
|
|
}),
|
|
|
|
updateName: adminProcedure
|
|
.input(
|
|
z.object({
|
|
id: z.string(),
|
|
name: z.string().min(1, "Name is required").max(200),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const before = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.id },
|
|
select: { id: true, name: true, email: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
const updated = await ctx.db.user.update({
|
|
where: { id: input.id },
|
|
data: { name: input.name },
|
|
select: { id: true, name: true, email: true },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: updated.id,
|
|
entityName: `${updated.name} (${updated.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
before: before as unknown as Record<string, unknown>,
|
|
after: updated as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: `Changed name from "${before.name}" to "${updated.name}"`,
|
|
});
|
|
|
|
return updated;
|
|
}),
|
|
|
|
// ─── Resource Linking ──────────────────────────────────────────────────
|
|
|
|
linkResource: adminProcedure
|
|
.input(z.object({ userId: z.string(), resourceId: z.string().nullable() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { id: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
if (input.resourceId) {
|
|
await findUniqueOrThrow(
|
|
ctx.db.resource.findUnique({
|
|
where: { id: input.resourceId },
|
|
select: { id: true },
|
|
}),
|
|
"Resource",
|
|
);
|
|
|
|
// Unlink any resource previously linked to this user
|
|
await ctx.db.resource.updateMany({
|
|
where: { userId: input.userId },
|
|
data: { userId: null },
|
|
});
|
|
// Link the new resource
|
|
await ctx.db.resource.update({
|
|
where: { id: input.resourceId },
|
|
data: { userId: input.userId },
|
|
});
|
|
} else {
|
|
// Unlink
|
|
await ctx.db.resource.updateMany({
|
|
where: { userId: input.userId },
|
|
data: { userId: null },
|
|
});
|
|
}
|
|
return { success: true };
|
|
}),
|
|
|
|
autoLinkAllByEmail: adminProcedure.mutation(async ({ ctx }) => {
|
|
// Find all users without a linked resource, then match by email
|
|
const unlinkedUsers = await ctx.db.user.findMany({
|
|
where: { resource: null },
|
|
select: { id: true, email: true },
|
|
});
|
|
|
|
let linked = 0;
|
|
for (const user of unlinkedUsers) {
|
|
const resource = await ctx.db.resource.findFirst({
|
|
where: { email: user.email, userId: null },
|
|
select: { id: true },
|
|
});
|
|
if (resource) {
|
|
await ctx.db.resource.update({
|
|
where: { id: resource.id },
|
|
data: { userId: user.id },
|
|
});
|
|
linked++;
|
|
}
|
|
}
|
|
return { linked, checked: unlinkedUsers.length };
|
|
}),
|
|
|
|
getDashboardLayout: protectedProcedure.query(async ({ ctx }) => {
|
|
const user = await ctx.db.user.findUnique({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
select: { dashboardLayout: true, updatedAt: true },
|
|
});
|
|
return {
|
|
layout: user?.dashboardLayout ? normalizeDashboardLayout(user.dashboardLayout) : null,
|
|
updatedAt: user?.updatedAt ?? null,
|
|
};
|
|
}),
|
|
|
|
saveDashboardLayout: protectedProcedure
|
|
.input(z.object({ layout: dashboardLayoutSchema }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const updated = await ctx.db.user.update({
|
|
where: { email: ctx.session.user?.email ?? "" },
|
|
data: { dashboardLayout: input.layout as unknown as import("@capakraken/db").Prisma.InputJsonValue },
|
|
select: { updatedAt: true },
|
|
});
|
|
return { updatedAt: updated.updatedAt };
|
|
}),
|
|
|
|
// ─── Favorite Projects ──────────────────────────────────────────────────
|
|
getFavoriteProjectIds: protectedProcedure.query(async ({ ctx }) => {
|
|
const user = await ctx.db.user.findUnique({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { favoriteProjectIds: true },
|
|
});
|
|
return ((user?.favoriteProjectIds as string[] | null) ?? []) as string[];
|
|
}),
|
|
|
|
toggleFavoriteProject: protectedProcedure
|
|
.input(z.object({ projectId: z.string() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await ctx.db.user.findUnique({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { favoriteProjectIds: true },
|
|
});
|
|
const current = ((user?.favoriteProjectIds as string[] | null) ?? []) as string[];
|
|
const next = current.includes(input.projectId)
|
|
? current.filter((id) => id !== input.projectId)
|
|
: [...current, input.projectId];
|
|
await ctx.db.user.update({
|
|
where: { id: ctx.dbUser!.id },
|
|
data: { favoriteProjectIds: next as unknown as Prisma.InputJsonValue },
|
|
});
|
|
return { favoriteProjectIds: next, added: !current.includes(input.projectId) };
|
|
}),
|
|
|
|
setPermissions: adminProcedure
|
|
.input(
|
|
z.object({
|
|
userId: z.string(),
|
|
overrides: z
|
|
.object({
|
|
granted: z.array(z.string()).optional(),
|
|
denied: z.array(z.string()).optional(),
|
|
chapterIds: z.array(z.string()).optional(),
|
|
})
|
|
.nullable(),
|
|
}),
|
|
)
|
|
.mutation(async ({ ctx, input }) => {
|
|
const before = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { id: true, name: true, email: true, permissionOverrides: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
const user = await ctx.db.user.update({
|
|
where: { id: input.userId },
|
|
data: { permissionOverrides: input.overrides ?? Prisma.DbNull },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: input.userId,
|
|
entityName: `${before.name} (${before.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
before: { permissionOverrides: before.permissionOverrides } as unknown as Record<string, unknown>,
|
|
after: { permissionOverrides: input.overrides } as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: input.overrides
|
|
? `Set permission overrides (granted: ${input.overrides.granted?.length ?? 0}, denied: ${input.overrides.denied?.length ?? 0})`
|
|
: "Cleared permission overrides",
|
|
});
|
|
|
|
return user;
|
|
}),
|
|
|
|
resetPermissions: adminProcedure
|
|
.input(z.object({ userId: z.string() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const before = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { id: true, name: true, email: true, permissionOverrides: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
const updated = await ctx.db.user.update({
|
|
where: { id: input.userId },
|
|
data: { permissionOverrides: Prisma.DbNull },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: input.userId,
|
|
entityName: `${before.name} (${before.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
before: { permissionOverrides: before.permissionOverrides } as unknown as Record<string, unknown>,
|
|
after: { permissionOverrides: null } as unknown as Record<string, unknown>,
|
|
source: "ui",
|
|
summary: "Reset permission overrides to role defaults",
|
|
});
|
|
|
|
return updated;
|
|
}),
|
|
|
|
getColumnPreferences: protectedProcedure.query(async ({ ctx }) => {
|
|
const user = await ctx.db.user.findUnique({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { columnPreferences: true },
|
|
});
|
|
return (user?.columnPreferences ?? {}) as ColumnPreferences;
|
|
}),
|
|
|
|
setColumnPreferences: protectedProcedure
|
|
.input(z.object({
|
|
view: z.enum(["resources", "projects", "allocations", "vacations", "roles", "users", "blueprints"]),
|
|
visible: z.array(z.string()).optional(),
|
|
sort: z.object({ field: z.string(), dir: z.enum(["asc", "desc"]) }).nullable().optional(),
|
|
rowOrder: z.array(z.string()).nullable().optional(),
|
|
}))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const existing = await ctx.db.user.findUnique({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { columnPreferences: true },
|
|
});
|
|
const prefs = (existing?.columnPreferences ?? {}) as ColumnPreferences;
|
|
const prev = (prefs[input.view] as import("@capakraken/shared").ViewPreferences | undefined) ?? { visible: [] };
|
|
|
|
// Merge: only overwrite fields that were explicitly provided
|
|
const merged: import("@capakraken/shared").ViewPreferences = {
|
|
visible: input.visible ?? prev.visible,
|
|
};
|
|
// sort: null = clear, undefined = keep existing, value = set
|
|
if (input.sort !== null && input.sort !== undefined) {
|
|
merged.sort = input.sort;
|
|
} else if (input.sort === undefined && prev.sort != null) {
|
|
merged.sort = prev.sort;
|
|
}
|
|
// rowOrder: null = clear, undefined = keep existing, value = set
|
|
if (input.rowOrder !== null && input.rowOrder !== undefined) {
|
|
merged.rowOrder = input.rowOrder;
|
|
} else if (input.rowOrder === undefined && prev.rowOrder != null) {
|
|
merged.rowOrder = prev.rowOrder;
|
|
}
|
|
|
|
prefs[input.view] = merged;
|
|
await ctx.db.user.update({
|
|
where: { id: ctx.dbUser!.id },
|
|
data: { columnPreferences: prefs as Prisma.InputJsonValue },
|
|
});
|
|
return { ok: true };
|
|
}),
|
|
|
|
getEffectivePermissions: adminProcedure
|
|
.input(z.object({ userId: z.string() }))
|
|
.query(async ({ ctx, input }) => {
|
|
const user = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { systemRole: true, permissionOverrides: true },
|
|
}),
|
|
"User",
|
|
);
|
|
const permissions = resolvePermissions(
|
|
user.systemRole as SystemRole,
|
|
user.permissionOverrides as PermissionOverrides | null,
|
|
);
|
|
return {
|
|
systemRole: user.systemRole,
|
|
effectivePermissions: Array.from(permissions),
|
|
overrides: user.permissionOverrides as PermissionOverrides | null,
|
|
};
|
|
}),
|
|
|
|
// ─── TOTP / MFA ─────────────────────────────────────────────────────────────
|
|
|
|
/** Generate a new TOTP secret for the current user (not yet enabled). */
|
|
generateTotpSecret: protectedProcedure.mutation(async ({ ctx }) => {
|
|
const { TOTP, Secret } = await import("otpauth");
|
|
const secret = new Secret({ size: 20 });
|
|
const totp = new TOTP({
|
|
issuer: "CapaKraken",
|
|
label: ctx.session.user?.email ?? ctx.dbUser!.id,
|
|
algorithm: "SHA1",
|
|
digits: 6,
|
|
period: 30,
|
|
secret,
|
|
});
|
|
|
|
// Store the secret (not yet enabled)
|
|
await ctx.db.user.update({
|
|
where: { id: ctx.dbUser!.id },
|
|
data: { totpSecret: secret.base32 },
|
|
});
|
|
|
|
const uri = totp.toString();
|
|
return { secret: secret.base32, uri };
|
|
}),
|
|
|
|
/** Verify a TOTP token and enable MFA for the current user. */
|
|
verifyAndEnableTotp: protectedProcedure
|
|
.input(z.object({ token: z.string().length(6) }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await ctx.db.user.findUniqueOrThrow({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { id: true, name: true, email: true, totpSecret: true, totpEnabled: true },
|
|
});
|
|
|
|
if (!user.totpSecret) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "No TOTP secret generated. Call generateTotpSecret first." });
|
|
}
|
|
if (user.totpEnabled) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "TOTP is already enabled." });
|
|
}
|
|
|
|
const { TOTP, Secret } = await import("otpauth");
|
|
const totp = new TOTP({
|
|
issuer: "CapaKraken",
|
|
label: user.email,
|
|
algorithm: "SHA1",
|
|
digits: 6,
|
|
period: 30,
|
|
secret: Secret.fromBase32(user.totpSecret),
|
|
});
|
|
|
|
const delta = totp.validate({ token: input.token, window: 1 });
|
|
if (delta === null) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid TOTP token." });
|
|
}
|
|
|
|
await ctx.db.user.update({
|
|
where: { id: user.id },
|
|
data: { totpEnabled: true },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: user.id,
|
|
entityName: `${user.name} (${user.email})`,
|
|
action: "UPDATE",
|
|
userId: user.id,
|
|
source: "ui",
|
|
summary: "Enabled TOTP MFA",
|
|
});
|
|
|
|
return { enabled: true };
|
|
}),
|
|
|
|
/** Admin override: disable TOTP for a specific user. */
|
|
disableTotp: adminProcedure
|
|
.input(z.object({ userId: z.string() }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await findUniqueOrThrow(
|
|
ctx.db.user.findUnique({
|
|
where: { id: input.userId },
|
|
select: { id: true, name: true, email: true, totpEnabled: true },
|
|
}),
|
|
"User",
|
|
);
|
|
|
|
await ctx.db.user.update({
|
|
where: { id: input.userId },
|
|
data: { totpEnabled: false, totpSecret: null },
|
|
});
|
|
|
|
void createAuditEntry({
|
|
db: ctx.db,
|
|
entityType: "User",
|
|
entityId: user.id,
|
|
entityName: `${user.name} (${user.email})`,
|
|
action: "UPDATE",
|
|
...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
|
|
source: "ui",
|
|
summary: "Disabled TOTP MFA (admin override)",
|
|
});
|
|
|
|
return { disabled: true };
|
|
}),
|
|
|
|
/** Verify a TOTP token (used during the login flow — public procedure). */
|
|
verifyTotp: publicProcedure
|
|
.input(z.object({ userId: z.string(), token: z.string().length(6) }))
|
|
.mutation(async ({ ctx, input }) => {
|
|
const user = await ctx.db.user.findUniqueOrThrow({
|
|
where: { id: input.userId },
|
|
select: { id: true, totpSecret: true, totpEnabled: true },
|
|
});
|
|
|
|
if (!user.totpEnabled || !user.totpSecret) {
|
|
throw new TRPCError({ code: "BAD_REQUEST", message: "TOTP is not enabled for this user." });
|
|
}
|
|
|
|
const { TOTP, Secret } = await import("otpauth");
|
|
const totp = new TOTP({
|
|
issuer: "CapaKraken",
|
|
label: user.id,
|
|
algorithm: "SHA1",
|
|
digits: 6,
|
|
period: 30,
|
|
secret: Secret.fromBase32(user.totpSecret),
|
|
});
|
|
|
|
const delta = totp.validate({ token: input.token, window: 1 });
|
|
if (delta === null) {
|
|
throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid TOTP token." });
|
|
}
|
|
|
|
return { valid: true };
|
|
}),
|
|
|
|
/** Get MFA status for the current user. */
|
|
getMfaStatus: protectedProcedure.query(async ({ ctx }) => {
|
|
const user = await ctx.db.user.findUniqueOrThrow({
|
|
where: { id: ctx.dbUser!.id },
|
|
select: { totpEnabled: true },
|
|
});
|
|
return { totpEnabled: user.totpEnabled };
|
|
}),
|
|
});
|