test-seam.service.ts

test-seam.service.tsapps/api/src/modules/internal/test-seam.service.tsraw ← internal3,559 B← Back to the app
1import { Inject, Injectable } from "@nestjs/common";
2import { PrismaService } from "../../common/prisma.service.js";
3import { AuditService } from "../../common/audit.service.js";
4import { ApiError } from "../../common/errors.js";
5import { loadEnv } from "../../config/env.js";
6import type { InternalAddMemberInput } from "./test-seam.dto.js";
7 
8/**
9 * Test-only membership seam (TASK-0095 S9).
10 *
11 * Why this exists: the production two-user membership flow is email-gated
12 * (D3 — the invite token is hashed and only delivered by mail, the HTTP
13 * invite response carries no token, and there is no add-member-by-userId
14 * route). An automated test therefore cannot get a second user into a
15 * workspace without a mail server. This endpoint is that test seam: it adds
16 * a REGISTERED user to a workspace directly, with the same membership row
17 * the public accept route would create.
18 *
19 * Safety model (recorded in docs/tasks/phase-07-collaboration.md):
20 *  - Gated by the SAME fail-closed `InternalServiceGuard` as the rest of
21 *    `/internal/*` (shared `INTERNAL_SERVICE_TOKEN`, constant-time compare,
22 *    user JWTs rejected) — so the route is closed unless a service token is
23 *    configured.
24 *  - ADDITIONALLY closed unless `INTERNAL_TEST_SEAM=1` — a second,
25 *    independent env switch. Production sets neither; the only consumers are
26 *    the integration suite (in-process app) and the CI e2e job.
27 *  - It creates no invitation row, sends no mail, and grants no OWNER role.
28 *    The write is audited `workspace.test_member_added` so a stray call in
29 *    the wild is visible in the audit trail.
30 */
31@Injectable()
32export class TestSeamService {
33  // Plain parameter injection (matches the sibling PageService / InternalBlocksService
34  // that boot successfully; see internal.service.ts for the full regression note).
35  constructor(
36    @Inject(PrismaService) private readonly prisma: PrismaService,
37    @Inject(AuditService) private readonly audit: AuditService
38  ) {}
39 
40  /**
41   * Add a registered user to a workspace (upsert — re-adding an existing
42   * member is a no-op that returns the current row).
43   */
44  async addMember(workspaceId: string, input: InternalAddMemberInput) {
45    if (loadEnv().INTERNAL_TEST_SEAM !== "1") {
46      // Defense in depth: the route also checks the flag, but the service
47      // re-checks so a mis-wired controller cannot open the seam.
48      throw ApiError.unauthorized("Test seam is disabled.", [{ reason: "test_seam_disabled" }]);
49    }
50    const ws = await this.prisma.workspace.findUnique({
51      where: { id: workspaceId },
52      select: { id: true, deletedAt: true }
53    });
54    if (!ws || ws.deletedAt) throw ApiError.notFound("Workspace not found.");
55    const user = await this.prisma.user.findUnique({
56      where: { email: input.email.toLowerCase() },
57      select: { id: true, email: true }
58    });
59    if (!user) throw ApiError.notFound("User not found — register the user first.");
60    const member = await this.prisma.workspaceMember.upsert({
61      where: { workspaceId_userId: { workspaceId, userId: user.id } },
62      update: {},
63      create: { workspaceId, userId: user.id, role: input.role as never, joinedAt: new Date() }
64    });
65    await this.audit.write({
66      action: "workspace.test_member_added",
67      resourceType: "workspace_member",
68      resourceId: member.id,
69      workspaceId,
70      metadata: { email: user.email, role: input.role, seam: true }
71    });
72    return { id: member.id, workspaceId: member.workspaceId, userId: member.userId, role: member.role };
73  }
74}
75