u

src/api/openapi.js

@@ -59,6 +59,36 @@
  *           type: number
  *         taxfreerate:
  *           type: number
+ *         role:
+ *           type: string
+ *           enum: [admin, user]
+ *           description: The caller's role in this company
+ *     CompanyUser:
+ *       type: object
+ *       required: [id, googleAuthId, email, role]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         googleAuthId:
+ *           type: integer
+ *         email:
+ *           type: string
+ *         role:
+ *           type: string
+ *           enum: [admin, user]
+ *     AutoInvite:
+ *       type: object
+ *       required: [id, email, role, createdAt]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         email:
+ *           type: string
+ *         role:
+ *           type: string
+ *           enum: [admin, user]
+ *         createdAt:
+ *           type: string
  *     SuccessResponse:
  *       type: object
  *       required: [ok]

src/api/routes/auth/selectedCompany.js

@@ -53,6 +53,12 @@ export function register(app, basePath = '') {
      *           application/json:
      *             schema:
      *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (the user is not a member of this company)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
      *       500:
      *         description: Server error
      *         content:
@@ -79,6 +85,9 @@ export function register(app, basePath = '') {
 
             res.status(200).json({ user });
         } catch (error) {
+            if (error.message === 'Not authorized') {
+                return res.status(403).json({ error: error.message });
+            }
             console.error('Set selected company failed:', error);
             res.status(500).json({ error: 'Failed to set selected company' });
         }

src/api/routes/autoinvite.js

@@ -0,0 +1,271 @@
+import * as db from '../../db/autoinvite.js';
+import { emit } from '../sse.js';
+
+// #region Helpers
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(val, field = 'id') {
+    const id = Number(val);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function autoinviteErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Invitation not found') return 404;
+    if (error.message === 'Invalid role') return 400;
+    if (error.message === 'Invalid email') return 400;
+    if (error.message === 'User already registered') return 409;
+    if (error.message === 'Invitation already exists') return 409;
+    return 500;
+}
+
+// #endregion
+
+/**
+ * Registers auto-invitation routes. All routes require the caller to be an
+ * admin of the selected company.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /autoinvite:
+     *   get:
+     *     tags: [AutoInvite]
+     *     summary: List auto-invitations
+     *     description: Lists pending auto-invitations of the selected company. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: autoinvite/list.md
+     *     responses:
+     *       200:
+     *         description: Pending invitations
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 autoinvites:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/AutoInvite'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region GET /autoinvite
+
+    app.get(`${basePath}/autoinvite`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const autoinvites = await db.list(req.user.id);
+            res.status(200).json({ autoinvites });
+        } catch (error) {
+            const status = autoinviteErrorStatus(error);
+            if (status === 500) console.error('List auto-invitations failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+
+    /**
+     * @openapi
+     * /autoinvite:
+     *   post:
+     *     tags: [AutoInvite]
+     *     summary: Create auto-invitation
+     *     description: |
+     *       Registers an email for automatic membership. When a user with this email registers,
+     *       the invitation is removed from the list and the user is added to the company with the given role.
+     *       Emails that are already registered are rejected (409); use `POST /companyuser` for those. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [autoinvite]
+     *     x-markdown: autoinvite/create.md
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [email]
+     *             properties:
+     *               email:
+     *                 type: string
+     *               role:
+     *                 type: string
+     *                 enum: [admin, user]
+     *                 default: user
+     *             example:
+     *               email: newhire@example.com
+     *               role: user
+     *     responses:
+     *       201:
+     *         description: Created invitation
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 autoinvite:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     email:
+     *                       type: string
+     *                     role:
+     *                       type: string
+     *                       enum: [admin, user]
+     *       400:
+     *         description: No company selected, invalid email or invalid role
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       409:
+     *         description: User already registered or invitation already exists
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region POST /autoinvite
+
+    app.post(`${basePath}/autoinvite`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const autoinvite = await db.add(req.user.id, {
+                email: req.body?.email,
+                role: req.body?.role,
+            });
+            emit('autoinvite', { companyId: selected.companyId });
+            res.status(201).json({ autoinvite });
+        } catch (error) {
+            const status = autoinviteErrorStatus(error);
+            if (status === 500) console.error('Create auto-invitation failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+
+    /**
+     * @openapi
+     * /autoinvite/{id}:
+     *   delete:
+     *     tags: [AutoInvite]
+     *     summary: Delete auto-invitation
+     *     description: Deletes a pending auto-invitation of the selected company. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [autoinvite]
+     *     x-markdown: autoinvite/delete.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       204:
+     *         description: Deleted
+     *       400:
+     *         description: Invalid id or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Invitation not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region DELETE /autoinvite/:id
+
+    app.delete(`${basePath}/autoinvite/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+        const parsedId = parsePositiveInt(req.params.id);
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            await db.remove(req.user.id, parsedId.id);
+            emit('autoinvite', { companyId: selected.companyId });
+            res.sendStatus(204);
+        } catch (error) {
+            const status = autoinviteErrorStatus(error);
+            if (status === 500) console.error('Delete auto-invitation failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+}

src/api/routes/companyuser.js

@@ -0,0 +1,385 @@
+import * as db from '../../db/companyuser.js';
+import { clearCachedUser } from '../middleware/auth.js';
+import { emit } from '../sse.js';
+
+// #region Helpers
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(val, field = 'id') {
+    const id = Number(val);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function companyuserErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Company user not found') return 404;
+    if (error.message === 'User not found') return 404;
+    if (error.message === 'Invalid role') return 400;
+    if (error.message === 'Invalid email') return 400;
+    if (error.message === 'User already in company') return 409;
+    if (error.message === 'Cannot demote the last admin') return 409;
+    if (error.message === 'Cannot remove the last admin') return 409;
+    return 500;
+}
+
+// #endregion
+
+/**
+ * Registers company user (membership) routes. All routes require the caller
+ * to be an admin of the selected company.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /companyuser:
+     *   get:
+     *     tags: [CompanyUser]
+     *     summary: List company users
+     *     description: Lists the members of the selected company with their role. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: companyuser/list.md
+     *     responses:
+     *       200:
+     *         description: Company members
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 companyusers:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/CompanyUser'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region GET /companyuser
+
+    app.get(`${basePath}/companyuser`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const companyusers = await db.list(req.user.id);
+            res.status(200).json({ companyusers });
+        } catch (error) {
+            const status = companyuserErrorStatus(error);
+            if (status === 500) console.error('List company users failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+
+    /**
+     * @openapi
+     * /companyuser:
+     *   post:
+     *     tags: [CompanyUser]
+     *     summary: Add an existing user to the company
+     *     description: |
+     *       Adds an existing (registered) user, identified by email, to the selected company. Admin only.
+     *       The added user can then switch to this company via `PUT /auth/selected-company`.
+     *       For emails that are not registered yet use `POST /autoinvite`.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [companyuser]
+     *     x-markdown: companyuser/create.md
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [email]
+     *             properties:
+     *               email:
+     *                 type: string
+     *               role:
+     *                 type: string
+     *                 enum: [admin, user]
+     *                 default: user
+     *             example:
+     *               email: colleague@example.com
+     *               role: user
+     *     responses:
+     *       201:
+     *         description: Created company user
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 companyuser:
+     *                   $ref: '#/components/schemas/CompanyUser'
+     *       400:
+     *         description: No company selected, invalid email or invalid role
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: No registered user with this email
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       409:
+     *         description: User already in company
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region POST /companyuser
+
+    app.post(`${basePath}/companyuser`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const companyuser = await db.addByEmail(req.user.id, {
+                email: req.body?.email,
+                role: req.body?.role,
+            });
+            emit('companyuser', { companyId: selected.companyId });
+            res.status(201).json({ companyuser });
+        } catch (error) {
+            const status = companyuserErrorStatus(error);
+            if (status === 500) console.error('Add company user failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+
+    /**
+     * @openapi
+     * /companyuser/{id}:
+     *   patch:
+     *     tags: [CompanyUser]
+     *     summary: Change a company user's role
+     *     description: Changes the role of a member of the selected company. The last admin cannot be demoted. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [companyuser]
+     *     x-markdown: companyuser/update.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [role]
+     *             properties:
+     *               role:
+     *                 type: string
+     *                 enum: [admin, user]
+     *     responses:
+     *       200:
+     *         description: Updated company user
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 companyuser:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     googleAuthId:
+     *                       type: integer
+     *                     role:
+     *                       type: string
+     *                       enum: [admin, user]
+     *       400:
+     *         description: Invalid id, role or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company user not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       409:
+     *         description: Cannot demote the last admin
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region PATCH /companyuser/:id
+
+    app.patch(`${basePath}/companyuser/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+        const parsedId = parsePositiveInt(req.params.id);
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const companyuser = await db.setRole(req.user.id, parsedId.id, req.body?.role);
+            clearCachedUser(companyuser.googleAuthId);
+            emit('companyuser', { companyId: selected.companyId });
+            res.status(200).json({ companyuser });
+        } catch (error) {
+            const status = companyuserErrorStatus(error);
+            if (status === 500) console.error('Update company user failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+
+    /**
+     * @openapi
+     * /companyuser/{id}:
+     *   delete:
+     *     tags: [CompanyUser]
+     *     summary: Remove a user from the company
+     *     description: |
+     *       Removes a member from the selected company. History entries stay but lose their author link;
+     *       if the removed user had this company selected, their selection is cleared.
+     *       The last admin cannot be removed. Admin only.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [companyuser]
+     *     x-markdown: companyuser/delete.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       204:
+     *         description: Removed
+     *       400:
+     *         description: Invalid id or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized (admin of the selected company required)
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company user not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       409:
+     *         description: Cannot remove the last admin
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region DELETE /companyuser/:id
+
+    app.delete(`${basePath}/companyuser/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+        const parsedId = parsePositiveInt(req.params.id);
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const removed = await db.remove(req.user.id, parsedId.id);
+            clearCachedUser(removed.googleAuthId);
+            emit('companyuser', { companyId: selected.companyId });
+            res.sendStatus(204);
+        } catch (error) {
+            const status = companyuserErrorStatus(error);
+            if (status === 500) console.error('Remove company user failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
+}

src/api/routes/events.js

@@ -57,6 +57,8 @@ export function register(app, basePath = '') {
      *       | `printer` | `{}` | `POST /printer`, `PUT /printer/{id}`, `PATCH /printer/{id}`, `DELETE /printer/{id}` |
      *       | `printeragent` | `{}` | `PUT /printeragent`, `PATCH /printeragent/{id}`, `DELETE /printeragent/{id}`, printer agent connect/disconnect/state |
      *       | `agentprinter` | `{ printers }` or `{}` | `PATCH /agentprinter/{id}`, `PUT /agentprinter/order`, `DELETE /agentprinter/{id}`, agent state updates / printer discovery |
+     *       | `companyuser` | `{}` | `POST /companyuser`, `PATCH /companyuser/{id}`, `DELETE /companyuser/{id}` |
+     *       | `autoinvite` | `{}` | `POST /autoinvite`, `DELETE /autoinvite/{id}` |
      *       | `warehouse` | `{}` | `POST /warehouse`, `PUT /warehouse/{id}`, `PATCH /warehouse/{id}`, `DELETE /warehouse/{id}` |
      *       | `supplier` | `{}` | `POST /supplier`, `PATCH /supplier/{id}`, `DELETE /supplier/{id}` |
      *       | `vfs` | `{}` | VFS uploads and filesystem mutations such as `POST /vfs/upload`, `POST /vfs/mkdir`, `POST /vfs/rename`, `PUT /vfs/{*path}`, `DELETE /vfs/{*path}` |
@@ -95,6 +97,10 @@ export function register(app, basePath = '') {
      *         payload: "{}"
      *       - name: propertyname
      *         payload: "{}"
+     *       - name: companyuser
+     *         payload: "{}"
+     *       - name: autoinvite
+     *         payload: "{}"
      *       - name: labeltemplate
      *         payload: "{}"
      *       - name: printer

src/db/autoinvite.js

@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function list(googleAuthId) {
+    const store = await getStore();
+    return store.autoinvite.list(googleAuthId);
+}
+
+export async function add(googleAuthId, data) {
+    const store = await getStore();
+    return store.autoinvite.add(googleAuthId, data);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.autoinvite.remove(googleAuthId, id);
+}

src/db/companyuser.js

@@ -0,0 +1,21 @@
+import { getStore } from './store.js';
+
+export async function list(googleAuthId) {
+    const store = await getStore();
+    return store.companyuser.list(googleAuthId);
+}
+
+export async function addByEmail(googleAuthId, data) {
+    const store = await getStore();
+    return store.companyuser.addByEmail(googleAuthId, data);
+}
+
+export async function setRole(googleAuthId, id, role) {
+    const store = await getStore();
+    return store.companyuser.setRole(googleAuthId, id, role);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.companyuser.remove(googleAuthId, id);
+}

src/db/store.js

@@ -14,6 +14,7 @@ let schemaVersion;
 
 const STORE_NAMESPACES = [
     'companyuser',
+    'autoinvite',
     'company',
     'category',
     'article',