Skip to content

Commit 3cf2bff

Browse files
icecrasher321icecrasher321
committed
feat(enterprise): gate owner activation on acceptance
1 parent fbb4684 commit 3cf2bff

28 files changed

Lines changed: 2791 additions & 178 deletions

File tree

‎apps/sim/app/api/enterprise-owner-claims/[id]/accept/route.ts‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
import { createLogger } from '@sim/logger'
2+
import { type NextRequest, NextResponse } from 'next/server'
3+
import { acceptEnterpriseOwnerClaimContract } from '@/lib/api/contracts/enterprise-owner-claims'
4+
import { parseRequest } from '@/lib/api/server'
5+
import { getSession } from '@/lib/auth'
6+
import { acceptEnterpriseOwnerClaim } from '@/lib/billing/enterprise-owner-claim'
7+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
8+
9+
const logger = createLogger('EnterpriseOwnerClaimAcceptAPI')
10+
11+
export const POST = withRouteHandler(
12+
async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
13+
const session = await getSession()
14+
if (!session?.user?.id || !session.user.email) {
15+
return NextResponse.json({ error: 'unauthorized' }, { status: 401 })
16+
}
17+
if (!session.user.emailVerified) {
18+
return NextResponse.json(
19+
{
20+
error: 'email-unverified',
21+
message: 'Verify the invited email before accepting Enterprise ownership.',
22+
},
23+
{ status: 403 }
24+
)
25+
}
26+
const parsed = await parseRequest(acceptEnterpriseOwnerClaimContract, request, context)
27+
if (!parsed.success) return parsed.response
28+
const result = await acceptEnterpriseOwnerClaim({
29+
claimId: parsed.data.params.id,
30+
token: parsed.data.body.token,
31+
userId: session.user.id,
32+
userEmail: session.user.email,
33+
userName: session.user.name,
34+
disclosedWorkspaceIds: parsed.data.body.disclosedWorkspaceIds,
35+
disclosedCreatesDefaultWorkspace: parsed.data.body.disclosedCreatesDefaultWorkspace,
36+
})
37+
if (!result.success) {
38+
const statusByKind: Record<typeof result.kind, number> = {
39+
'not-found': 404,
40+
'invalid-token': 400,
41+
expired: 400,
42+
revoked: 400,
43+
'email-mismatch': 403,
44+
'already-in-organization': 409,
45+
'disclosure-outdated': 409,
46+
'workspace-limit': 400,
47+
'workspace-invitation-limit': 400,
48+
'insufficient-seats': 400,
49+
'server-error': 500,
50+
}
51+
logger.warn('Enterprise owner claim acceptance rejected', {
52+
claimId: parsed.data.params.id,
53+
reason: result.kind,
54+
})
55+
return NextResponse.json(
56+
{ error: result.kind, ...(result.message ? { message: result.message } : {}) },
57+
{ status: statusByKind[result.kind] }
58+
)
59+
}
60+
return NextResponse.json(result)
61+
}
62+
)

‎apps/sim/app/api/enterprise-owner-claims/[id]/route.ts‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
import { createLogger } from '@sim/logger'
2+
import { type NextRequest, NextResponse } from 'next/server'
3+
import { getEnterpriseOwnerClaimContract } from '@/lib/api/contracts/enterprise-owner-claims'
4+
import { parseRequest } from '@/lib/api/server'
5+
import { getSession } from '@/lib/auth'
6+
import {
7+
EnterpriseOwnerClaimEmailMismatchError,
8+
EnterpriseOwnerClaimWorkspaceLimitError,
9+
getEnterpriseOwnerClaimDetails,
10+
} from '@/lib/billing/enterprise-owner-claim'
11+
import { EnterpriseProvisioningError } from '@/lib/billing/enterprise-provisioning'
12+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
13+
14+
const logger = createLogger('EnterpriseOwnerClaimAPI')
15+
16+
export const GET = withRouteHandler(
17+
async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
18+
const session = await getSession()
19+
if (!session?.user?.id || !session.user.email) {
20+
return NextResponse.json({ error: 'unauthorized' }, { status: 401 })
21+
}
22+
if (!session.user.emailVerified) {
23+
return NextResponse.json(
24+
{
25+
error: 'email-unverified',
26+
message: 'Verify the invited email before reviewing Enterprise ownership.',
27+
},
28+
{ status: 403 }
29+
)
30+
}
31+
const parsed = await parseRequest(getEnterpriseOwnerClaimContract, request, context)
32+
if (!parsed.success) return parsed.response
33+
try {
34+
const details = await getEnterpriseOwnerClaimDetails({
35+
claimId: parsed.data.params.id,
36+
token: parsed.data.query.token,
37+
userId: session.user.id,
38+
userEmail: session.user.email,
39+
})
40+
if (!details) return NextResponse.json({ error: 'not-found' }, { status: 404 })
41+
return NextResponse.json(details)
42+
} catch (error) {
43+
if (error instanceof EnterpriseOwnerClaimEmailMismatchError) {
44+
return NextResponse.json(
45+
{ error: 'email-mismatch', message: error.message },
46+
{ status: 403 }
47+
)
48+
}
49+
if (error instanceof EnterpriseOwnerClaimWorkspaceLimitError) {
50+
return NextResponse.json(
51+
{ error: 'workspace-limit', message: error.message },
52+
{ status: 400 }
53+
)
54+
}
55+
if (error instanceof EnterpriseProvisioningError) {
56+
return NextResponse.json(
57+
{ error: 'setup-blocked', message: error.message },
58+
{ status: 400 }
59+
)
60+
}
61+
logger.error('Failed to load Enterprise owner claim', {
62+
claimId: parsed.data.params.id,
63+
error,
64+
})
65+
return NextResponse.json({ error: 'server-error' }, { status: 500 })
66+
}
67+
}
68+
)

‎apps/sim/app/api/v1/admin/dashboard/enterprise-owner-claims/[id]/retry/route.ts‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
import { createLogger } from '@sim/logger'
2+
import { getErrorMessage } from '@sim/utils/errors'
3+
import { adminDashboardRetryEnterpriseOwnerClaimContract } from '@/lib/api/contracts/v1/admin/dashboard'
4+
import { parseRequest } from '@/lib/api/server'
5+
import { retryEnterpriseOwnerClaim } from '@/lib/billing/enterprise-owner-claim'
6+
import { EnterpriseProvisioningError } from '@/lib/billing/enterprise-provisioning'
7+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
8+
import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
9+
import {
10+
adminValidationErrorResponse,
11+
badRequestResponse,
12+
internalErrorResponse,
13+
singleResponse,
14+
} from '@/app/api/v1/admin/responses'
15+
16+
const logger = createLogger('AdminEnterpriseOwnerClaimRetryAPI')
17+
18+
export const POST = withRouteHandler(
19+
withAdminAuthParams<{ id: string }>(async (request, context) => {
20+
const parsed = await parseRequest(
21+
adminDashboardRetryEnterpriseOwnerClaimContract,
22+
request,
23+
context,
24+
{ validationErrorResponse: adminValidationErrorResponse }
25+
)
26+
if (!parsed.success) return parsed.response
27+
try {
28+
return singleResponse(await retryEnterpriseOwnerClaim(parsed.data.params.id))
29+
} catch (error) {
30+
if (error instanceof EnterpriseProvisioningError) return badRequestResponse(error.message)
31+
logger.error('Failed to retry Enterprise owner invitation', { error })
32+
return internalErrorResponse(getErrorMessage(error, 'Failed to retry owner invitation'))
33+
}
34+
})
35+
)

‎apps/sim/app/api/v1/admin/dashboard/enterprise-owner-claims/[id]/revoke/route.ts‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
import { createLogger } from '@sim/logger'
2+
import { getErrorMessage } from '@sim/utils/errors'
3+
import { adminDashboardRevokeEnterpriseOwnerClaimContract } from '@/lib/api/contracts/v1/admin/dashboard'
4+
import { parseRequest } from '@/lib/api/server'
5+
import { revokeEnterpriseOwnerClaim } from '@/lib/billing/enterprise-owner-claim'
6+
import { EnterpriseProvisioningError } from '@/lib/billing/enterprise-provisioning'
7+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
8+
import { getAdminAuditActor } from '@/app/api/v1/admin/dashboard/actor'
9+
import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
10+
import {
11+
adminValidationErrorResponse,
12+
badRequestResponse,
13+
internalErrorResponse,
14+
singleResponse,
15+
} from '@/app/api/v1/admin/responses'
16+
17+
const logger = createLogger('AdminEnterpriseOwnerClaimRevokeAPI')
18+
19+
export const POST = withRouteHandler(
20+
withAdminAuthParams<{ id: string }>(async (request, context) => {
21+
const parsed = await parseRequest(
22+
adminDashboardRevokeEnterpriseOwnerClaimContract,
23+
request,
24+
context,
25+
{ validationErrorResponse: adminValidationErrorResponse }
26+
)
27+
if (!parsed.success) return parsed.response
28+
try {
29+
const actor = await getAdminAuditActor(request)
30+
return singleResponse(
31+
await revokeEnterpriseOwnerClaim(parsed.data.params.id, {
32+
id: actor.id,
33+
name: actor.name,
34+
email: actor.email,
35+
})
36+
)
37+
} catch (error) {
38+
if (error instanceof EnterpriseProvisioningError) return badRequestResponse(error.message)
39+
logger.error('Failed to revoke Enterprise owner invitation', { error })
40+
return internalErrorResponse(getErrorMessage(error, 'Failed to revoke owner invitation'))
41+
}
42+
})
43+
)

‎apps/sim/app/api/v1/admin/dashboard/enterprise-owner-claims/review/route.ts‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
import { createLogger } from '@sim/logger'
2+
import { getErrorMessage } from '@sim/utils/errors'
3+
import { adminDashboardReviewEnterpriseOwnerClaimContract } from '@/lib/api/contracts/v1/admin/dashboard'
4+
import { parseRequest } from '@/lib/api/server'
5+
import { dollarsToCredits } from '@/lib/billing/credits/conversion'
6+
import { reviewEnterpriseOwnerClaim } from '@/lib/billing/enterprise-owner-claim'
7+
import { EnterpriseProvisioningError } from '@/lib/billing/enterprise-provisioning'
8+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
9+
import { withAdminAuth } from '@/app/api/v1/admin/middleware'
10+
import {
11+
adminInvalidJsonResponse,
12+
adminValidationErrorResponse,
13+
badRequestResponse,
14+
internalErrorResponse,
15+
singleResponse,
16+
} from '@/app/api/v1/admin/responses'
17+
18+
const logger = createLogger('AdminEnterpriseOwnerClaimReviewAPI')
19+
20+
export const POST = withRouteHandler(
21+
withAdminAuth(async (request) => {
22+
const parsed = await parseRequest(
23+
adminDashboardReviewEnterpriseOwnerClaimContract,
24+
request,
25+
{},
26+
{
27+
validationErrorResponse: adminValidationErrorResponse,
28+
invalidJsonResponse: adminInvalidJsonResponse,
29+
}
30+
)
31+
if (!parsed.success) return parsed.response
32+
try {
33+
const { usageLimitDollars, ...body } = parsed.data.body
34+
return singleResponse(
35+
await reviewEnterpriseOwnerClaim({
36+
...body,
37+
usageLimitCredits:
38+
usageLimitDollars === undefined ? undefined : dollarsToCredits(usageLimitDollars),
39+
requestedByEmail: 'admin-review',
40+
requestedByUserId: null,
41+
requestedByName: 'Admin Panel',
42+
})
43+
)
44+
} catch (error) {
45+
if (error instanceof EnterpriseProvisioningError) return badRequestResponse(error.message)
46+
logger.error('Failed to review Enterprise owner claim', { error })
47+
return internalErrorResponse(
48+
getErrorMessage(error, 'Failed to review the Enterprise owner invitation')
49+
)
50+
}
51+
})
52+
)

‎apps/sim/app/api/v1/admin/dashboard/enterprise-owner-claims/route.ts‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
import { createLogger } from '@sim/logger'
2+
import { getErrorMessage } from '@sim/utils/errors'
3+
import {
4+
adminDashboardCreateEnterpriseOwnerClaimContract,
5+
adminDashboardListEnterpriseOwnerClaimsContract,
6+
} from '@/lib/api/contracts/v1/admin/dashboard'
7+
import { parseRequest } from '@/lib/api/server'
8+
import { dollarsToCredits } from '@/lib/billing/credits/conversion'
9+
import {
10+
createEnterpriseOwnerClaim,
11+
getPendingEnterpriseOwnerClaimsPage,
12+
} from '@/lib/billing/enterprise-owner-claim'
13+
import { EnterpriseProvisioningError } from '@/lib/billing/enterprise-provisioning'
14+
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
15+
import { getAdminAuditActor } from '@/app/api/v1/admin/dashboard/actor'
16+
import { withAdminAuth } from '@/app/api/v1/admin/middleware'
17+
import {
18+
adminInvalidJsonResponse,
19+
adminValidationErrorResponse,
20+
badRequestResponse,
21+
internalErrorResponse,
22+
listResponse,
23+
singleResponse,
24+
} from '@/app/api/v1/admin/responses'
25+
26+
const logger = createLogger('AdminEnterpriseOwnerClaimsAPI')
27+
28+
export const GET = withRouteHandler(
29+
withAdminAuth(async (request) => {
30+
const parsed = await parseRequest(
31+
adminDashboardListEnterpriseOwnerClaimsContract,
32+
request,
33+
{},
34+
{ validationErrorResponse: adminValidationErrorResponse }
35+
)
36+
if (!parsed.success) return parsed.response
37+
try {
38+
const { limit, offset } = parsed.data.query
39+
const result = await getPendingEnterpriseOwnerClaimsPage({ limit, offset })
40+
return listResponse(result.data, {
41+
total: result.total,
42+
limit,
43+
offset,
44+
hasMore: offset + result.data.length < result.total,
45+
})
46+
} catch (error) {
47+
logger.error('Failed to list Enterprise owner claims', { error })
48+
return internalErrorResponse(getErrorMessage(error, 'Failed to list owner invitations'))
49+
}
50+
})
51+
)
52+
53+
export const POST = withRouteHandler(
54+
withAdminAuth(async (request) => {
55+
const parsed = await parseRequest(
56+
adminDashboardCreateEnterpriseOwnerClaimContract,
57+
request,
58+
{},
59+
{
60+
validationErrorResponse: adminValidationErrorResponse,
61+
invalidJsonResponse: adminInvalidJsonResponse,
62+
}
63+
)
64+
if (!parsed.success) return parsed.response
65+
try {
66+
const actor = await getAdminAuditActor(request)
67+
const { usageLimitDollars, ...body } = parsed.data.body
68+
return singleResponse(
69+
await createEnterpriseOwnerClaim({
70+
...body,
71+
usageLimitCredits:
72+
usageLimitDollars === undefined ? undefined : dollarsToCredits(usageLimitDollars),
73+
requestedByEmail: actor.email ?? 'admin-api',
74+
requestedByUserId: actor.id,
75+
requestedByName: actor.name,
76+
})
77+
)
78+
} catch (error) {
79+
if (error instanceof EnterpriseProvisioningError) return badRequestResponse(error.message)
80+
logger.error('Failed to create Enterprise owner claim', { error })
81+
return internalErrorResponse(getErrorMessage(error, 'Failed to invite the Enterprise owner'))
82+
}
83+
})
84+
)

‎apps/sim/app/api/webhooks/outbox/process/route.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import { type NextRequest, NextResponse } from 'next/server'
55
import { adminInvitationOperationOutboxHandlers } from '@/lib/admin/invitation-operation'
66
import { adminMemberOperationOutboxHandlers } from '@/lib/admin/member-operation'
77
import { verifyCronAuth } from '@/lib/auth/internal'
8+
import { enterpriseOwnerClaimOutboxHandlers } from '@/lib/billing/enterprise-owner-claim'
89
import { enterpriseIssuanceOutboxHandlers } from '@/lib/billing/enterprise-provisioning'
910
import { membershipBillingOutboxHandlers } from '@/lib/billing/organizations/membership-reconciliation'
1011
import { billingOutboxHandlers } from '@/lib/billing/webhooks/outbox-handlers'
@@ -29,6 +30,7 @@ const handlers = {
2930
...billingOutboxHandlers,
3031
...membershipBillingOutboxHandlers,
3132
...enterpriseIssuanceOutboxHandlers,
33+
...enterpriseOwnerClaimOutboxHandlers,
3234
...invitationMigrationOutboxHandlers,
3335
...directGrantOutboxHandlers,
3436
...knowledgeDocumentProcessingOutboxHandlers,

0 commit comments

Comments
 (0)