mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
15631f5d25
Two kinds of machine were modelled as one. A host somebody brings is theirs, reached through a team, and should die with their account. A host bought to serve other people's workloads is none of those things — and there was nowhere to put it, so it had to be registered under an employee's personal team, where it was that person's property and their account going away took it with them. Ownership becomes an either/or. A machine names a team or an organisation, exactly one, enforced by a check constraint rather than by convention: both null is a host nothing can bill, and both set is two answers to "whose is this?" where whichever join a query happens to take decides who pays. Hardware an organisation owns has no team and no person at all, which is the point. The organisation is deliberately not a billing subject and has no plan columns. It says who owns the metal; a team pays for what it uses either way. Membership is derived from a verified email domain rather than stored. An address is already the root identity, so a second record of who belongs where is a second answer that can disagree with the first — and deriving it means signing in with a personal address still gets an ordinary personal account, which is what lets one person hold a company account and use the consumer product. Nothing is granted on an unverified domain or an unverified address: either one is a string somebody typed. Entitlement on fleet hardware refuses everyone for now, with a reason that says so. What grants a run on metered hardware is a plan, and there is nothing to ask yet, so it fails closed rather than giving the expensive case away. The branch is written out so the plan check has one obvious place to land. Routes are read-only, and nothing seeds an organisation. Creating one grants membership to everyone who can receive mail at a domain, so it is an operator action against the database — a migration that inserted one would insert it into every deployment, including ones we have nothing to do with. See docs/deploy.md.
90 lines
3.0 KiB
TypeScript
90 lines
3.0 KiB
TypeScript
import { Actor } from '@nestri/core/actor';
|
|
import { ErrorCodes, VisibleError } from '@nestri/core/error';
|
|
import { Examples } from '@nestri/core/examples';
|
|
import { Machine } from '@nestri/core/machine/index';
|
|
import { Organisation } from '@nestri/core/organisation/index';
|
|
import { Hono } from 'hono';
|
|
import { describeRoute } from 'hono-openapi';
|
|
import { z } from 'zod';
|
|
|
|
import { ErrorResponses, notPublic, Result } from '../utils';
|
|
|
|
/**
|
|
* The organisation a caller belongs to, and the hardware it owns.
|
|
*
|
|
* Read-only on purpose. Organisations are made by hand and their domains are
|
|
* verified by hand, because the thing a verified domain grants is membership —
|
|
* and a route that mints one would be a route that hands out membership of any
|
|
* domain somebody types. When that changes, verification is what has to be
|
|
* built first, not this file.
|
|
*
|
|
* There is no organisation to name in a path: membership is derived from the
|
|
* caller's verified address, so there is exactly one answer and asking about
|
|
* anybody else's is not a question this API takes.
|
|
*/
|
|
export namespace OrganisationApi {
|
|
/** The caller's organisation, or a 404 that says what that means. */
|
|
async function mine() {
|
|
const organisation = await Organisation.forUser(Actor.userID);
|
|
if (!organisation) {
|
|
throw new VisibleError(
|
|
'not_found',
|
|
ErrorCodes.NotFound.RESOURCE_NOT_FOUND,
|
|
'Your address does not belong to a verified organisation domain'
|
|
);
|
|
}
|
|
return organisation;
|
|
}
|
|
|
|
export const route = new Hono()
|
|
.use(notPublic)
|
|
.get(
|
|
'/',
|
|
describeRoute({
|
|
tags: ['Organisation'],
|
|
summary: 'The organisation you belong to',
|
|
description:
|
|
'Derived from the domain of your verified email address. A personal address has no organisation, which is not an error in the product — it is the ordinary consumer account — but it is a 404 here because there is nothing to return.',
|
|
responses: {
|
|
200: {
|
|
content: { 'application/json': { schema: Result(Organisation.Info) } },
|
|
description: 'Your organisation'
|
|
},
|
|
401: ErrorResponses[401],
|
|
404: ErrorResponses[404]
|
|
}
|
|
}),
|
|
async (c) => c.json({ data: await mine() })
|
|
)
|
|
.get(
|
|
'/machines',
|
|
describeRoute({
|
|
tags: ['Organisation'],
|
|
summary: 'The hardware your organisation owns',
|
|
description:
|
|
'Every host the organisation owns outright. These belong to no team and no person, which is what separates them from a host somebody brought — those appear under the team that owns them instead.',
|
|
responses: {
|
|
200: {
|
|
content: {
|
|
'application/json': {
|
|
schema: Result(
|
|
z.array(Machine.Info).meta({
|
|
description: 'The fleet',
|
|
example: [Examples.Machine]
|
|
})
|
|
)
|
|
}
|
|
},
|
|
description: 'The fleet'
|
|
},
|
|
401: ErrorResponses[401],
|
|
404: ErrorResponses[404]
|
|
}
|
|
}),
|
|
async (c) => {
|
|
const organisation = await mine();
|
|
return c.json({ data: await Machine.listByOrganisation(organisation.id) });
|
|
}
|
|
);
|
|
}
|