feat: add workspace access administration

packages/control-plane/src/routes/rbac.ts

@@ -1,4 +1,14 @@
-import { AuthorizationError, AuthorizationService } from "../authorization/service";
+import { isCanonicalUserId } from "@open-inspect/shared/user-id";
+import {
+  replaceMemberRoleInputSchema,
+  replaceMemberStatusInputSchema,
+} from "@open-inspect/shared/rbac";
+import { ZodError } from "zod";
+import {
+  AuthorizationError,
+  AuthorizationService,
+  RbacConflictError,
+} from "../authorization/service";
 import type { Env } from "../types";
 import type { Route } from "./shared";
 import {
@@ -7,6 +17,7 @@ import {
   defineRoutes,
   error,
   json,
+  parseJsonBody,
   requirePermission,
   type UserRouteContext,
 } from "./shared";
@@ -22,9 +33,21 @@ function rbacErrorResponse(cause: unknown): Response {
       cause.status
     );
   }
+  if (cause instanceof RbacConflictError) {
+    return json({ error: cause.message, code: "rbac_conflict" }, 409);
+  }
+  if (cause instanceof ZodError) return error("Invalid request body", 400);
   return json({ error: "Authorization unavailable", code: "authorization_unavailable" }, 503);
 }
 
+function decodePathSegment(value: string): string | null {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
 async function handleGetCurrentAuthorization(
   _request: Request,
   _env: Env,
@@ -61,10 +84,11 @@ async function handleGetRole(
 ): Promise<Response> {
   const service = new AuthorizationService(ctx.db);
   try {
-    const role = await service.getRole(decodeURIComponent(match.groups!.id));
+    const roleId = decodePathSegment(match.groups!.id);
+    if (roleId === null) return error("Invalid role ID", 400);
+    const role = await service.getRole(roleId);
     return role ? json(role) : error("Role not found", 404);
   } catch (cause) {
-    if (cause instanceof URIError) return error("Invalid role ID", 400);
     return rbacErrorResponse(cause);
   }
 }
@@ -83,6 +107,60 @@ async function handleListMembers(
   }
 }
 
+async function handleReplaceMemberRole(
+  request: Request,
+  _env: Env,
+  match: RegExpMatchArray,
+  ctx: UserRouteContext
+): Promise<Response> {
+  const targetUserId = decodePathSegment(match.groups!.id);
+  if (targetUserId === null || !isCanonicalUserId(targetUserId)) {
+    return error("Invalid user ID", 400);
+  }
+  const body = await parseJsonBody<unknown>(request);
+  if (body instanceof Response) return body;
+  const service = new AuthorizationService(ctx.db);
+  try {
+    const parsed = replaceMemberRoleInputSchema.parse(body);
+    await service.replaceMemberRole({
+      targetUserId,
+      roleId: parsed.roleId,
+      actorUserId: ctx.principal.userId,
+      requestId: ctx.request_id,
+    });
+    return new Response(null, { status: 204 });
+  } catch (cause) {
+    return rbacErrorResponse(cause);
+  }
+}
+
+async function handleReplaceMemberStatus(
+  request: Request,
+  _env: Env,
+  match: RegExpMatchArray,
+  ctx: UserRouteContext
+): Promise<Response> {
+  const targetUserId = decodePathSegment(match.groups!.id);
+  if (targetUserId === null || !isCanonicalUserId(targetUserId)) {
+    return error("Invalid user ID", 400);
+  }
+  const body = await parseJsonBody<unknown>(request);
+  if (body instanceof Response) return body;
+  const service = new AuthorizationService(ctx.db);
+  try {
+    const parsed = replaceMemberStatusInputSchema.parse(body);
+    await service.replaceMemberStatus({
+      targetUserId,
+      suspended: parsed.suspended,
+      actorUserId: ctx.principal.userId,
+      requestId: ctx.request_id,
+    });
+    return new Response(null, { status: 204 });
+  } catch (cause) {
+    return rbacErrorResponse(cause);
+  }
+}
+
 export const rbacRoutes: Route[] = defineRoutes(SCM_AGNOSTIC_HUMAN_USER_ROUTE, [
   {
     method: "GET",
@@ -112,4 +190,18 @@ export const rbacRoutes: Route[] = defineRoutes(SCM_AGNOSTIC_HUMAN_USER_ROUTE, [
     cacheControl: "private, no-store",
     handler: handleListMembers,
   },
+  {
+    method: "PUT",
+    pattern: /^\/members\/(?<id>[^/]+)\/role$/,
+    authorization: requirePermission("workspace.members.manage"),
+    cacheControl: "private, no-store",
+    handler: handleReplaceMemberRole,
+  },
+  {
+    method: "PUT",
+    pattern: /^\/members\/(?<id>[^/]+)\/status$/,
+    authorization: requirePermission("workspace.members.manage"),
+    cacheControl: "private, no-store",
+    handler: handleReplaceMemberStatus,
+  },
 ]);