@@ -158,5 +163,6 @@ export function WorkspaceLayout() {
+
)
}
diff --git a/internal/app/wire.go b/internal/app/wire.go
index da385f32..4d9ae223 100644
--- a/internal/app/wire.go
+++ b/internal/app/wire.go
@@ -74,7 +74,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
if err := gateEngine.LoadPolicy(startCtx); err != nil {
return nil, fmt.Errorf("load RBAC policies: %w", err)
}
- authGate := authgate.NewGoGateAdapter(gateEngine, pgClient.GetDB(startCtx))
+ authGate := authgate.NewGoGateAdapter(gateEngine, pgClient, gateCfg)
// ── Encryption service ──────────────────────────────────────────────────
encKey := cfg.EncryptionKey
@@ -127,6 +127,7 @@ func Wire(cfg *Config, sysLogger *pkglogger.Logger) (*Application, error) {
JWTSecret: jwtSecret,
JWTTTL: jwtTTL,
Gate: authGate,
+ TxManager: pgClient,
})
// ── Inbox: payload-backed reads, in-memory writes for SSE ───────────────
diff --git a/internal/core/domain/permission.go b/internal/core/domain/permission.go
index 0312d12d..e8a426d7 100644
--- a/internal/core/domain/permission.go
+++ b/internal/core/domain/permission.go
@@ -1,11 +1,15 @@
package domain
-// Roles in the RBAC system.
+// Roles in the RBAC system (global catalog; scoped per workspace via wpd-gogate team_id).
const (
RoleAdmin = "admin"
RoleMember = "member"
+ RoleViewer = "viewer"
)
+// WorkspaceRoles lists assignable workspace roles seeded for every workspace.
+var WorkspaceRoles = []string{RoleAdmin, RoleMember, RoleViewer}
+
// RBACGuardName is the guard_name used for portal roles and permissions in this project.
const RBACGuardName = "msg_web"
@@ -45,3 +49,77 @@ const (
// Inbox
PermissionInboxWrite = "inbox.write"
)
+
+// ReadPermissions are granted to the viewer workspace role (full read-only member).
+var ReadPermissions = []string{
+ PermissionWorkspacesRead,
+ PermissionMembersRead,
+ PermissionAPIKeysRead,
+ PermissionLogsRead,
+ PermissionIntegrationsRead,
+ PermissionTemplatesRead,
+ PermissionSettingsRead,
+ PermissionInvitationsRead,
+}
+
+// WritePermissions require admin or member role (never viewer).
+var WritePermissions = []string{
+ PermissionWorkspacesWrite,
+ PermissionMembersWrite,
+ PermissionAPIKeysWrite,
+ PermissionIntegrationsWrite,
+ PermissionTemplatesWrite,
+ PermissionSettingsWrite,
+ PermissionInvitationsWrite,
+ PermissionInboxWrite,
+}
+
+// AllPermissions is the full portal RBAC catalog (read + write).
+var AllPermissions = append(append([]string{}, ReadPermissions...), WritePermissions...)
+
+// IsWritePermission reports whether name is a mutating portal permission.
+func IsWritePermission(name string) bool {
+ for _, permission := range WritePermissions {
+ if permission == name {
+ return true
+ }
+ }
+ return false
+}
+
+// IsReadPermission reports whether name is a read-only portal permission for workspace members.
+func IsReadPermission(name string) bool {
+ for _, permission := range ReadPermissions {
+ if permission == name {
+ return true
+ }
+ }
+ return false
+}
+
+// PublicGuestPermissions are the only permissions non-members receive on public workspaces.
+// Narrower than viewer role: guests must not read members, API keys, logs, or settings.
+var PublicGuestPermissions = []string{
+ PermissionWorkspacesRead,
+ PermissionTemplatesRead,
+}
+
+// IsPublicGuestPermission reports whether permission is allowed for public workspace guests.
+func IsPublicGuestPermission(name string) bool {
+ for _, permission := range PublicGuestPermissions {
+ if permission == name {
+ return true
+ }
+ }
+ return false
+}
+
+// IsWorkspaceRole reports whether name is one of the seeded workspace roles.
+func IsWorkspaceRole(name string) bool {
+ for _, role := range WorkspaceRoles {
+ if role == name {
+ return true
+ }
+ }
+ return false
+}
diff --git a/internal/core/domain/permission_test.go b/internal/core/domain/permission_test.go
new file mode 100644
index 00000000..23d9c60a
--- /dev/null
+++ b/internal/core/domain/permission_test.go
@@ -0,0 +1,94 @@
+package domain
+
+import (
+ "slices"
+ "testing"
+)
+
+func TestIsWorkspaceRole(t *testing.T) {
+ t.Parallel()
+
+ for _, role := range WorkspaceRoles {
+ if !IsWorkspaceRole(role) {
+ t.Fatalf("IsWorkspaceRole(%q) = false, want true", role)
+ }
+ }
+ if IsWorkspaceRole("superadmin") {
+ t.Fatal("IsWorkspaceRole(superadmin) = true, want false")
+ }
+}
+
+func TestIsPublicGuestPermission(t *testing.T) {
+ t.Parallel()
+
+ if !IsPublicGuestPermission(PermissionWorkspacesRead) {
+ t.Fatal("expected workspaces.read for public guests")
+ }
+ if !IsPublicGuestPermission(PermissionTemplatesRead) {
+ t.Fatal("expected templates.read for public guests")
+ }
+ if IsPublicGuestPermission(PermissionLogsRead) {
+ t.Fatal("logs.read must not be granted to public guests")
+ }
+}
+
+func TestReadPermissions_excludeWritePermissions(t *testing.T) {
+ t.Parallel()
+
+ for _, readPermission := range ReadPermissions {
+ if IsWritePermission(readPermission) {
+ t.Fatalf("read permission %q must not be a write permission", readPermission)
+ }
+ }
+}
+
+func TestWritePermissions_areNotReadPermissions(t *testing.T) {
+ t.Parallel()
+
+ for _, writePermission := range WritePermissions {
+ if IsReadPermission(writePermission) {
+ t.Fatalf("write permission %q must not be a read permission", writePermission)
+ }
+ }
+}
+
+func TestAllPermissions_coversPortalCatalog(t *testing.T) {
+ t.Parallel()
+
+ if len(AllPermissions) != len(ReadPermissions)+len(WritePermissions) {
+ t.Fatalf("AllPermissions length = %d, want %d", len(AllPermissions), len(ReadPermissions)+len(WritePermissions))
+ }
+
+ seen := make(map[string]struct{}, len(AllPermissions))
+ for _, permission := range AllPermissions {
+ if _, ok := seen[permission]; ok {
+ t.Fatalf("duplicate permission %q in AllPermissions", permission)
+ }
+ seen[permission] = struct{}{}
+ }
+}
+
+func TestViewerReadPermissions_matchSeedCatalog(t *testing.T) {
+ t.Parallel()
+
+ expected := []string{
+ PermissionWorkspacesRead,
+ PermissionMembersRead,
+ PermissionAPIKeysRead,
+ PermissionLogsRead,
+ PermissionIntegrationsRead,
+ PermissionTemplatesRead,
+ PermissionSettingsRead,
+ PermissionInvitationsRead,
+ }
+
+ if len(ReadPermissions) != len(expected) {
+ t.Fatalf("ReadPermissions length = %d, want %d", len(ReadPermissions), len(expected))
+ }
+
+ for _, permission := range expected {
+ if !slices.Contains(ReadPermissions, permission) {
+ t.Fatalf("ReadPermissions missing %q (viewer seed catalog)", permission)
+ }
+ }
+}
diff --git a/internal/core/port/portal.go b/internal/core/port/portal.go
index afee1645..2c58788e 100644
--- a/internal/core/port/portal.go
+++ b/internal/core/port/portal.go
@@ -13,12 +13,14 @@ type WorkspaceMemberRepository interface {
Remove(ctx context.Context, workspaceID, userID string) error
GetRole(ctx context.Context, workspaceID, userID string) (string, error)
ListMembers(ctx context.Context, workspaceID string) ([]domain.WorkspaceMember, error)
+ MemberExistsByEmail(ctx context.Context, workspaceID, email string) (bool, error)
}
// InvitationRepository stores pending invites.
type InvitationRepository interface {
Create(ctx context.Context, inv *domain.Invitation) error
ListPendingByWorkspace(ctx context.Context, workspaceID string) ([]domain.Invitation, error)
+ PendingInvitationExistsByEmail(ctx context.Context, workspaceID, email string) (bool, error)
}
// MessageLogQuery filters for listing request logs.
@@ -46,3 +48,8 @@ type AuthorizationGate interface {
GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error)
GetPermissionsForTeams(ctx context.Context, modelType, modelID string, teamIDs []string) (map[string][]string, error)
}
+
+// TransactionManager executes a function inside a database transaction.
+type TransactionManager interface {
+ RunInTransaction(ctx context.Context, fn func(ctx context.Context) error) error
+}
diff --git a/internal/core/service/portal_service.go b/internal/core/service/portal_service.go
index 1d2edbeb..2346452a 100644
--- a/internal/core/service/portal_service.go
+++ b/internal/core/service/portal_service.go
@@ -39,6 +39,7 @@ type PortalDeps struct {
JWTSecret string
JWTTTL time.Duration
Gate port.AuthorizationGate
+ TxManager port.TransactionManager
}
// PortalService handles portal authentication and workspace-scoped operations.
@@ -53,6 +54,7 @@ type PortalService struct {
invites port.InvitationRepository
settings port.WorkspaceSettingsRepository
gate port.AuthorizationGate
+ txManager port.TransactionManager
// jwtSecret and jwtTTL are unexported; accessed only within this package.
jwtSecret string
@@ -65,6 +67,10 @@ func NewPortalService(deps PortalDeps) *PortalService {
if deps.JWTTTL <= 0 {
deps.JWTTTL = 24 * time.Hour
}
+ txM := deps.TxManager
+ if txM == nil {
+ txM = &nopTxManager{}
+ }
return &PortalService{
users: deps.Users,
members: deps.Members,
@@ -76,11 +82,18 @@ func NewPortalService(deps PortalDeps) *PortalService {
invites: deps.Invitations,
settings: deps.Settings,
gate: deps.Gate,
+ txManager: txM,
jwtSecret: deps.JWTSecret,
jwtTTL: deps.JWTTTL,
}
}
+type nopTxManager struct{}
+
+func (m *nopTxManager) RunInTransaction(ctx context.Context, fn func(ctx context.Context) error) error {
+ return fn(ctx)
+}
+
func (s *PortalService) UserByID(ctx context.Context, id string) (*domain.User, error) {
u, err := s.users.GetByID(ctx, id)
if err != nil {
@@ -124,30 +137,29 @@ func (s *PortalService) CreateWorkspace(ctx context.Context, userID, name, slug,
slog.ErrorContext(ctx, "workspace creation failed: user not found", "error", err, "user_id", userID)
return nil, err
}
- w := &domain.Workspace{
- Name: name,
- Slug: slug,
- AdminEmail: u.Email,
- Status: "active",
- Visibility: "private",
- IconKey: strings.TrimSpace(iconKey),
- }
- if err := s.workspaces.Create(ctx, w, userID); err != nil {
- slog.ErrorContext(ctx, "workspace creation failed: database error", "error", err, "user_id", userID)
- return nil, err
- }
- if err := s.members.Add(ctx, w.ID, userID, domain.RoleAdmin); err != nil {
- slog.ErrorContext(ctx, "workspace creation failed: failed to add member", "error", err, "workspace_id", w.ID, "user_id", userID)
- if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
- slog.WarnContext(ctx, "failed to roll back workspace after member add error", "error", delErr, "workspace_id", w.ID)
+ var w *domain.Workspace
+ err = s.txManager.RunInTransaction(ctx, func(txCtx context.Context) error {
+ w = &domain.Workspace{
+ Name: name,
+ Slug: slug,
+ AdminEmail: u.Email,
+ Status: "active",
+ Visibility: "private",
+ IconKey: strings.TrimSpace(iconKey),
}
- return nil, err
- }
- if err := s.gate.AssignRole(ctx, "users", userID, w.ID, domain.RoleAdmin); err != nil {
- slog.ErrorContext(ctx, "workspace creation failed: failed to assign role", "error", err, "workspace_id", w.ID, "user_id", userID)
- if delErr := s.workspaces.Delete(ctx, w.ID); delErr != nil {
- slog.WarnContext(ctx, "failed to roll back workspace after role assign error", "error", delErr, "workspace_id", w.ID)
+ if err := s.workspaces.Create(txCtx, w, userID); err != nil {
+ return err
+ }
+ if err := s.members.Add(txCtx, w.ID, userID, domain.RoleAdmin); err != nil {
+ return err
+ }
+ if err := s.gate.AssignRole(txCtx, "users", userID, w.ID, domain.RoleAdmin); err != nil {
+ return err
}
+ return nil
+ })
+ if err != nil {
+ slog.ErrorContext(ctx, "workspace creation failed", "error", err, "user_id", userID)
return nil, err
}
slog.InfoContext(ctx, "workspace created successfully", "workspace_id", w.ID, "user_id", userID)
@@ -170,12 +182,17 @@ func (s *PortalService) JoinWorkspaceWithPIN(ctx context.Context, userID, slug,
slog.WarnContext(ctx, "join workspace with PIN failed: invalid PIN", "workspace_id", ws.ID, "user_id", userID)
return errors.New("invalid PIN")
}
- if err := s.members.Add(ctx, ws.ID, userID, domain.RoleMember); err != nil {
- slog.ErrorContext(ctx, "join workspace with PIN failed: failed to add member", "error", err, "workspace_id", ws.ID, "user_id", userID)
- return err
- }
- if err := s.gate.AssignRole(ctx, "users", userID, ws.ID, domain.RoleMember); err != nil {
- slog.ErrorContext(ctx, "join workspace with PIN failed: failed to assign role", "error", err, "workspace_id", ws.ID, "user_id", userID)
+ err = s.txManager.RunInTransaction(ctx, func(txCtx context.Context) error {
+ if err := s.members.Add(txCtx, ws.ID, userID, domain.RoleMember); err != nil {
+ return err
+ }
+ if err := s.gate.AssignRole(txCtx, "users", userID, ws.ID, domain.RoleMember); err != nil {
+ return err
+ }
+ return nil
+ })
+ if err != nil {
+ slog.ErrorContext(ctx, "join workspace with PIN failed: database error", "error", err, "workspace_id", ws.ID, "user_id", userID)
return err
}
slog.InfoContext(ctx, "joined workspace successfully with PIN", "workspace_id", ws.ID, "user_id", userID)
@@ -222,17 +239,8 @@ func (s *PortalService) ListWorkspaces(ctx context.Context, userID string) ([]do
continue
}
if w.Visibility == "public" {
- w.Role = "viewer"
- w.Permissions = []string{
- domain.PermissionWorkspacesRead,
- domain.PermissionMembersRead,
- domain.PermissionAPIKeysRead,
- domain.PermissionLogsRead,
- domain.PermissionIntegrationsRead,
- domain.PermissionTemplatesRead,
- domain.PermissionSettingsRead,
- domain.PermissionInvitationsRead,
- }
+ w.Role = domain.RoleViewer
+ w.Permissions = append([]string(nil), domain.PublicGuestPermissions...)
}
}
@@ -286,26 +294,26 @@ func (s *PortalService) ListMembers(ctx context.Context, workspaceID string) ([]
return s.members.ListMembers(ctx, workspaceID)
}
-// RemoveMember removes a user from a workspace and revokes their RBAC role.
-// If the member has no role record in the RBAC gate (ErrNotFound), the gate removal
-// is skipped safely. Any other gate error aborts the operation before DB removal.
func (s *PortalService) RemoveMember(ctx context.Context, workspaceID, userID string) error {
// Fetch current role to remove the exact RBAC assignment.
- // ErrNotFound means the member was never assigned a role in the gate — skip silently.
role, err := s.members.GetRole(ctx, workspaceID, userID)
- switch {
- case errors.Is(err, port.ErrNotFound):
- // No membership record; nothing to remove from RBAC gate.
- case err != nil:
- // Unexpected infrastructure error — abort before touching the gate.
- return fmt.Errorf("wpd-message-gateway: get member role: %w", err)
- default:
- if gErr := s.gate.RemoveRole(ctx, "users", userID, workspaceID, role); gErr != nil {
- return fmt.Errorf("wpd-message-gateway: remove role %s: %w", role, gErr)
+ if err != nil {
+ if errors.Is(err, port.ErrNotFound) {
+ // No membership record; nothing to remove.
+ return nil
}
+ return fmt.Errorf("wpd-message-gateway: get member role: %w", err)
}
- return s.members.Remove(ctx, workspaceID, userID)
+ return s.txManager.RunInTransaction(ctx, func(txCtx context.Context) error {
+ if err := s.gate.RemoveRole(txCtx, "users", userID, workspaceID, role); err != nil {
+ return fmt.Errorf("remove role %s: %w", role, err)
+ }
+ if err := s.members.Remove(txCtx, workspaceID, userID); err != nil {
+ return err
+ }
+ return nil
+ })
}
func (s *PortalService) ListAPIKeys(ctx context.Context, workspaceID string) ([]domain.APIKey, error) {
@@ -571,7 +579,7 @@ const invitationTTL = 7 * 24 * time.Hour
func (s *PortalService) NewPendingInvitation(workspaceID, email, role string) *domain.Invitation {
return &domain.Invitation{
WorkspaceID: workspaceID,
- Email: email,
+ Email: strings.ToLower(strings.TrimSpace(email)),
Role: role,
ExpiresAt: time.Now().Add(invitationTTL),
Status: "pending",
@@ -586,6 +594,31 @@ func (s *PortalService) ListInvitations(ctx context.Context, workspaceID string)
// CreateInvitation generates a secure invitation token, stores its hash, and persists the
// invitation. The returned plaintext token must be sent to the invitee and is never stored.
func (s *PortalService) CreateInvitation(ctx context.Context, inv *domain.Invitation) (rawToken string, err error) {
+ if !domain.IsWorkspaceRole(inv.Role) {
+ return "", fmt.Errorf("invalid role %q: %w", inv.Role, port.ErrInvalidInput)
+ }
+
+ inv.Email = strings.ToLower(strings.TrimSpace(inv.Email))
+ if inv.Email == "" {
+ return "", fmt.Errorf("email required: %w", port.ErrInvalidInput)
+ }
+
+ isMember, err := s.members.MemberExistsByEmail(ctx, inv.WorkspaceID, inv.Email)
+ if err != nil {
+ return "", err
+ }
+ if isMember {
+ return "", fmt.Errorf("user is already a member of this workspace: %w", port.ErrInvalidInput)
+ }
+
+ hasPending, err := s.invites.PendingInvitationExistsByEmail(ctx, inv.WorkspaceID, inv.Email)
+ if err != nil {
+ return "", err
+ }
+ if hasPending {
+ return "", fmt.Errorf("a pending invitation already exists for this email: %w", port.ErrInvalidInput)
+ }
+
// Generate a cryptographically random token from two UUIDs.
rawToken = uuid.NewString() + uuid.NewString()
sum := sha256.Sum256([]byte(rawToken))
diff --git a/internal/core/service/portal_service_extended_test.go b/internal/core/service/portal_service_extended_test.go
index 2ac0ae7d..59177e10 100644
--- a/internal/core/service/portal_service_extended_test.go
+++ b/internal/core/service/portal_service_extended_test.go
@@ -4,6 +4,8 @@ import (
"context"
"crypto/sha256"
"encoding/hex"
+ "errors"
+ "strings"
"testing"
"time"
@@ -30,6 +32,35 @@ func (f *fakeInvitationRepo) ListPendingByWorkspace(_ context.Context, workspace
return f.list, nil
}
+func (f *fakeInvitationRepo) PendingInvitationExistsByEmail(_ context.Context, workspaceID, email string) (bool, error) {
+ for _, inv := range f.list {
+ if inv.WorkspaceID == workspaceID && strings.EqualFold(inv.Email, email) && inv.Status == "pending" {
+ return true, nil
+ }
+ }
+ return false, nil
+}
+
+type fakeMemberRepo struct {
+ emails map[string]struct{}
+}
+
+func (f *fakeMemberRepo) Add(context.Context, string, string, string) error { return nil }
+func (f *fakeMemberRepo) Remove(context.Context, string, string) error { return nil }
+func (f *fakeMemberRepo) GetRole(context.Context, string, string) (string, error) {
+ return "", port.ErrNotFound
+}
+func (f *fakeMemberRepo) ListMembers(context.Context, string) ([]domain.WorkspaceMember, error) {
+ return nil, nil
+}
+func (f *fakeMemberRepo) MemberExistsByEmail(_ context.Context, workspaceID, email string) (bool, error) {
+ if f.emails == nil {
+ return false, nil
+ }
+ _, ok := f.emails[strings.ToLower(strings.TrimSpace(email))]
+ return ok, nil
+}
+
type fakeAPIKeyRepo struct {
keys map[string]*domain.APIKey
byWS map[string][]domain.APIKey
@@ -117,7 +148,7 @@ func TestPortalService_CreateInvitation(t *testing.T) {
t.Parallel()
repo := &fakeInvitationRepo{}
- svc := NewPortalService(PortalDeps{Invitations: repo})
+ svc := NewPortalService(PortalDeps{Invitations: repo, Members: &fakeMemberRepo{}})
inv := svc.NewPendingInvitation("ws-1", "user@example.com", domain.RoleMember)
rawToken, err := svc.CreateInvitation(context.Background(), inv)
@@ -139,6 +170,68 @@ func TestPortalService_CreateInvitation(t *testing.T) {
}
}
+func TestPortalService_CreateInvitation_rejectsInvalidRole(t *testing.T) {
+ t.Parallel()
+
+ svc := NewPortalService(PortalDeps{
+ Invitations: &fakeInvitationRepo{},
+ Members: &fakeMemberRepo{},
+ })
+ inv := svc.NewPendingInvitation("ws-1", "user@example.com", "owner")
+
+ _, err := svc.CreateInvitation(context.Background(), inv)
+ if err == nil {
+ t.Fatal("expected error for invalid role")
+ }
+ if !errors.Is(err, port.ErrInvalidInput) {
+ t.Fatalf("expected ErrInvalidInput, got %v", err)
+ }
+}
+
+func TestPortalService_CreateInvitation_rejectsExistingMember(t *testing.T) {
+ t.Parallel()
+
+ svc := NewPortalService(PortalDeps{
+ Invitations: &fakeInvitationRepo{},
+ Members: &fakeMemberRepo{
+ emails: map[string]struct{}{"member@weprodev.com": {}},
+ },
+ })
+ inv := svc.NewPendingInvitation("ws-1", "member@weprodev.com", domain.RoleViewer)
+
+ _, err := svc.CreateInvitation(context.Background(), inv)
+ if err == nil {
+ t.Fatal("expected error for existing member")
+ }
+ if !errors.Is(err, port.ErrInvalidInput) {
+ t.Fatalf("expected ErrInvalidInput, got %v", err)
+ }
+}
+
+func TestPortalService_CreateInvitation_rejectsPendingDuplicate(t *testing.T) {
+ t.Parallel()
+
+ svc := NewPortalService(PortalDeps{
+ Invitations: &fakeInvitationRepo{
+ list: []domain.Invitation{{
+ WorkspaceID: "ws-1",
+ Email: "invitee@example.com",
+ Status: "pending",
+ }},
+ },
+ Members: &fakeMemberRepo{},
+ })
+ inv := svc.NewPendingInvitation("ws-1", "invitee@example.com", domain.RoleMember)
+
+ _, err := svc.CreateInvitation(context.Background(), inv)
+ if err == nil {
+ t.Fatal("expected error for duplicate pending invitation")
+ }
+ if !errors.Is(err, port.ErrInvalidInput) {
+ t.Fatalf("expected ErrInvalidInput, got %v", err)
+ }
+}
+
func TestPortalService_APIKeys(t *testing.T) {
t.Parallel()
diff --git a/internal/infrastructure/authgate/gate_adapter.go b/internal/infrastructure/authgate/gate_adapter.go
index 7b4b98b6..532c2dab 100644
--- a/internal/infrastructure/authgate/gate_adapter.go
+++ b/internal/infrastructure/authgate/gate_adapter.go
@@ -12,29 +12,39 @@ import (
"github.com/weprodev/wpd-message-gateway/internal/core/port"
)
+// DBProvider resolves the active DB handle (pool or transaction) from context.
+type DBProvider interface {
+ GetDB(ctx context.Context) pgsql.DBTX
+}
+
type GoGateAdapter struct {
gate *gogate.Gate
- db pgsql.DBTX
+ db DBProvider
+ cfg gogate.Config
+}
+
+func NewGoGateAdapter(gate *gogate.Gate, db DBProvider, cfg gogate.Config) port.AuthorizationGate {
+ return &GoGateAdapter{gate: gate, db: db, cfg: cfg}
}
-func NewGoGateAdapter(gate *gogate.Gate, db pgsql.DBTX) port.AuthorizationGate {
- return &GoGateAdapter{gate: gate, db: db}
+func (a *GoGateAdapter) txGate(ctx context.Context) *gogate.Gate {
+ return gogate.NewGate(a.db.GetDB(ctx), &a.cfg)
}
func (a *GoGateAdapter) AssignRole(ctx context.Context, modelType, modelID, teamID, roleName string) error {
- return a.gate.Model(modelType, modelID, teamID).AssignRole(ctx, roleName, "")
+ return a.txGate(ctx).Model(modelType, modelID, teamID).AssignRole(ctx, roleName, "")
}
func (a *GoGateAdapter) RemoveRole(ctx context.Context, modelType, modelID, teamID, roleName string) error {
- return a.gate.Model(modelType, modelID, teamID).RemoveRole(ctx, roleName, "")
+ return a.txGate(ctx).Model(modelType, modelID, teamID).RemoveRole(ctx, roleName, "")
}
func (a *GoGateAdapter) GetRoleNames(ctx context.Context, modelType, modelID, teamID string) ([]string, error) {
- return a.gate.Model(modelType, modelID, teamID).GetRoleNames(ctx)
+ return a.txGate(ctx).Model(modelType, modelID, teamID).GetRoleNames(ctx)
}
func (a *GoGateAdapter) GetAllPermissions(ctx context.Context, modelType, modelID, teamID string) ([]string, error) {
- return a.gate.Model(modelType, modelID, teamID).GetAllPermissions(ctx)
+ return a.txGate(ctx).Model(modelType, modelID, teamID).GetAllPermissions(ctx)
}
func (a *GoGateAdapter) GetPermissionsForTeams(
@@ -63,7 +73,7 @@ func (a *GoGateAdapter) GetPermissionsForTeams(
ORDER BY team_id, permission
`
- rows, err := a.db.QueryContext(ctx, query, modelType, modelID, pq.Array(teamIDs))
+ rows, err := a.db.GetDB(ctx).QueryContext(ctx, query, modelType, modelID, pq.Array(teamIDs))
if err != nil {
return nil, err
}
diff --git a/internal/infrastructure/authgate/gate_adapter_test.go b/internal/infrastructure/authgate/gate_adapter_test.go
index 71bc922f..6a571610 100644
--- a/internal/infrastructure/authgate/gate_adapter_test.go
+++ b/internal/infrastructure/authgate/gate_adapter_test.go
@@ -5,8 +5,19 @@ import (
"testing"
"github.com/DATA-DOG/go-sqlmock"
+ gogate "github.com/weprodev/wpd-gogate"
+
+ "github.com/weprodev/go-pkg/pgsql"
)
+type staticDBProvider struct {
+ db pgsql.DBTX
+}
+
+func (s staticDBProvider) GetDB(context.Context) pgsql.DBTX {
+ return s.db
+}
+
func TestGoGateAdapter_GetPermissionsForTeams_emptyInput(t *testing.T) {
t.Parallel()
@@ -16,7 +27,7 @@ func TestGoGateAdapter_GetPermissionsForTeams_emptyInput(t *testing.T) {
}
t.Cleanup(func() { _ = db.Close() })
- adapter := NewGoGateAdapter(nil, db)
+ adapter := NewGoGateAdapter(nil, staticDBProvider{db: db}, gogate.DefaultConfig())
out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", nil)
if err != nil {
t.Fatalf("GetPermissionsForTeams: %v", err)
@@ -44,7 +55,7 @@ func TestGoGateAdapter_GetPermissionsForTeams_dedupesPermissions(t *testing.T) {
WithArgs("User", "user-1", sqlmock.AnyArg()).
WillReturnRows(rows)
- adapter := NewGoGateAdapter(nil, db)
+ adapter := NewGoGateAdapter(nil, staticDBProvider{db: db}, gogate.DefaultConfig())
out, err := adapter.GetPermissionsForTeams(context.Background(), "User", "user-1", []string{"team-1"})
if err != nil {
t.Fatalf("GetPermissionsForTeams: %v", err)
diff --git a/internal/infrastructure/repository/postgres/invitation_repository.go b/internal/infrastructure/repository/postgres/invitation_repository.go
index a446d9ac..dab249ad 100644
--- a/internal/infrastructure/repository/postgres/invitation_repository.go
+++ b/internal/infrastructure/repository/postgres/invitation_repository.go
@@ -67,3 +67,21 @@ func (r *InvitationRepository) ListPendingByWorkspace(ctx context.Context, works
}
return out, nil
}
+
+func (r *InvitationRepository) PendingInvitationExistsByEmail(ctx context.Context, workspaceID, email string) (bool, error) {
+ var exists bool
+ err := r.client.GetDB(ctx).QueryRowContext(ctx, `
+ SELECT EXISTS(
+ SELECT 1
+ FROM invitations
+ WHERE workspace_id = $1
+ AND lower(email) = lower($2)
+ AND status = 'pending'
+ AND expires_at > NOW()
+ )
+ `, workspaceID, email).Scan(&exists)
+ if err != nil {
+ slog.ErrorContext(ctx, "database error: failed to check pending invitation by email", "error", err, "workspace_id", workspaceID, "email", email)
+ }
+ return exists, err
+}
diff --git a/internal/infrastructure/repository/postgres/invitation_repository_test.go b/internal/infrastructure/repository/postgres/invitation_repository_test.go
index 0500a870..ce6a20aa 100644
--- a/internal/infrastructure/repository/postgres/invitation_repository_test.go
+++ b/internal/infrastructure/repository/postgres/invitation_repository_test.go
@@ -65,3 +65,22 @@ func TestInvitationRepository_ListPendingByWorkspace(t *testing.T) {
t.Fatalf("unexpected list: %+v", list)
}
}
+
+func TestInvitationRepository_PendingInvitationExistsByEmail(t *testing.T) {
+ t.Parallel()
+
+ client, mock, _ := newMockPgClient(t)
+ repo := NewInvitationRepository(client)
+
+ mock.ExpectQuery(`SELECT EXISTS`).
+ WithArgs("ws-1", "invitee@example.com").
+ WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+
+ exists, err := repo.PendingInvitationExistsByEmail(context.Background(), "ws-1", "invitee@example.com")
+ if err != nil {
+ t.Fatalf("PendingInvitationExistsByEmail: %v", err)
+ }
+ if !exists {
+ t.Fatal("expected pending invitation to exist")
+ }
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository.go b/internal/infrastructure/repository/postgres/workspace_member_repository.go
index b08b604f..749f29c3 100644
--- a/internal/infrastructure/repository/postgres/workspace_member_repository.go
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository.go
@@ -102,3 +102,19 @@ func (r *WorkspaceMemberRepository) ListMembers(ctx context.Context, workspaceID
}
return out, nil
}
+
+func (r *WorkspaceMemberRepository) MemberExistsByEmail(ctx context.Context, workspaceID, email string) (bool, error) {
+ var exists bool
+ err := r.client.GetDB(ctx).QueryRowContext(ctx, `
+ SELECT EXISTS(
+ SELECT 1
+ FROM workspace_members wm
+ INNER JOIN users u ON u.id = wm.user_id
+ WHERE wm.workspace_id = $1 AND lower(u.email) = lower($2)
+ )
+ `, workspaceID, email).Scan(&exists)
+ if err != nil {
+ slog.ErrorContext(ctx, "database error: failed to check workspace member by email", "error", err, "workspace_id", workspaceID, "email", email)
+ }
+ return exists, err
+}
diff --git a/internal/infrastructure/repository/postgres/workspace_member_repository_test.go b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
index 8d473ea5..6d399428 100644
--- a/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
+++ b/internal/infrastructure/repository/postgres/workspace_member_repository_test.go
@@ -70,3 +70,22 @@ func TestWorkspaceMemberRepository_ListMembers(t *testing.T) {
t.Fatalf("unexpected members: %+v", members)
}
}
+
+func TestWorkspaceMemberRepository_MemberExistsByEmail(t *testing.T) {
+ t.Parallel()
+
+ client, mock, _ := newMockPgClient(t)
+ repo := NewWorkspaceMemberRepository(client)
+
+ mock.ExpectQuery(`SELECT EXISTS`).
+ WithArgs("ws-1", "member@weprodev.com").
+ WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
+
+ exists, err := repo.MemberExistsByEmail(context.Background(), "ws-1", "member@weprodev.com")
+ if err != nil {
+ t.Fatalf("MemberExistsByEmail: %v", err)
+ }
+ if !exists {
+ t.Fatal("expected member to exist")
+ }
+}
diff --git a/internal/presentation/handler/portal_workspace_handler.go b/internal/presentation/handler/portal_workspace_handler.go
index 8e83f5e9..34debc3d 100644
--- a/internal/presentation/handler/portal_workspace_handler.go
+++ b/internal/presentation/handler/portal_workspace_handler.go
@@ -7,6 +7,7 @@ import (
"github.com/labstack/echo/v4"
+ "github.com/weprodev/wpd-message-gateway/internal/core/domain"
"github.com/weprodev/wpd-message-gateway/internal/core/port"
"github.com/weprodev/wpd-message-gateway/internal/core/service"
"github.com/weprodev/wpd-message-gateway/internal/presentation/dto"
@@ -99,6 +100,9 @@ func (h *PortalWorkspaceHandler) ListMembers(c echo.Context) error {
slog.ErrorContext(c.Request().Context(), "failed to list members", "error", err, "workspace_id", wid)
return safeHTTPError(err, http.StatusInternalServerError, "failed to list members")
}
+ if members == nil {
+ members = []domain.WorkspaceMember{}
+ }
return c.JSON(http.StatusOK, members)
}
@@ -119,6 +123,9 @@ func (h *PortalWorkspaceHandler) ListInvitations(c echo.Context) error {
slog.ErrorContext(c.Request().Context(), "failed to list invitations", "error", err, "workspace_id", wid)
return safeHTTPError(err, http.StatusInternalServerError, "failed to list invitations")
}
+ if list == nil {
+ list = []domain.Invitation{}
+ }
return c.JSON(http.StatusOK, list)
}
diff --git a/internal/presentation/handler/portal_workspace_handler_test.go b/internal/presentation/handler/portal_workspace_handler_test.go
index 582af488..9b64b907 100644
--- a/internal/presentation/handler/portal_workspace_handler_test.go
+++ b/internal/presentation/handler/portal_workspace_handler_test.go
@@ -30,12 +30,38 @@ func (f *fakeInvitationRepository) ListPendingByWorkspace(context.Context, strin
return nil, nil
}
+func (f *fakeInvitationRepository) PendingInvitationExistsByEmail(context.Context, string, string) (bool, error) {
+ return false, nil
+}
+
+type fakeWorkspaceMemberRepository struct {
+ existingEmails map[string]struct{}
+}
+
+func (f *fakeWorkspaceMemberRepository) Add(context.Context, string, string, string) error {
+ return nil
+}
+func (f *fakeWorkspaceMemberRepository) Remove(context.Context, string, string) error { return nil }
+func (f *fakeWorkspaceMemberRepository) GetRole(context.Context, string, string) (string, error) {
+ return "", nil
+}
+func (f *fakeWorkspaceMemberRepository) ListMembers(context.Context, string) ([]domain.WorkspaceMember, error) {
+ return nil, nil
+}
+func (f *fakeWorkspaceMemberRepository) MemberExistsByEmail(_ context.Context, _ string, email string) (bool, error) {
+ _, ok := f.existingEmails[strings.ToLower(strings.TrimSpace(email))]
+ return ok, nil
+}
+
func TestPortalWorkspaceHandler_CreateInvitation(t *testing.T) {
t.Parallel()
e := echo.New()
repo := &fakeInvitationRepository{}
- svc := service.NewPortalService(service.PortalDeps{Invitations: repo})
+ svc := service.NewPortalService(service.PortalDeps{
+ Invitations: repo,
+ Members: &fakeWorkspaceMemberRepository{},
+ })
h := NewPortalWorkspaceHandler(svc)
body := `{"email":"invitee@example.com","role":"member"}`
@@ -72,6 +98,36 @@ func TestPortalWorkspaceHandler_CreateInvitation(t *testing.T) {
}
}
+func TestPortalWorkspaceHandler_CreateInvitation_rejectsExistingMember(t *testing.T) {
+ t.Parallel()
+ e := echo.New()
+
+ svc := service.NewPortalService(service.PortalDeps{
+ Invitations: &fakeInvitationRepository{},
+ Members: &fakeWorkspaceMemberRepository{
+ existingEmails: map[string]struct{}{"member@weprodev.com": {}},
+ },
+ })
+ h := NewPortalWorkspaceHandler(svc)
+
+ body := `{"email":"member@weprodev.com","role":"viewer"}`
+ req := httptest.NewRequest(http.MethodPost, "/api/v1/workspaces/ws-1/invitations", strings.NewReader(body))
+ req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+ rec := httptest.NewRecorder()
+ c := e.NewContext(req, rec)
+ c.SetParamNames("wid")
+ c.SetParamValues("ws-1")
+
+ err := h.CreateInvitation(c)
+ if err == nil {
+ t.Fatal("expected error")
+ }
+ var httpErr *echo.HTTPError
+ if !errors.As(err, &httpErr) || httpErr.Code != http.StatusBadRequest {
+ t.Fatalf("expected 400, got %v", err)
+ }
+}
+
func TestPortalWorkspaceHandler_CreateInvitation_rejectsInvalidJSON(t *testing.T) {
t.Parallel()
e := echo.New()
diff --git a/internal/presentation/middleware/rbac.go b/internal/presentation/middleware/rbac.go
index 39e7dab1..58e7fa95 100644
--- a/internal/presentation/middleware/rbac.go
+++ b/internal/presentation/middleware/rbac.go
@@ -3,11 +3,11 @@ package middleware
import (
"log/slog"
"net/http"
- "strings"
"github.com/labstack/echo/v4"
gogate "github.com/weprodev/wpd-gogate"
+ "github.com/weprodev/wpd-message-gateway/internal/core/domain"
"github.com/weprodev/wpd-message-gateway/internal/core/port"
)
@@ -34,8 +34,8 @@ func RequirePermission(gate *gogate.Gate, workspaceRepo port.WorkspaceRepository
return echo.NewHTTPError(http.StatusNotFound, "Workspace not found")
}
- // If workspace is public and it is a read-only request, allow access
- if ws.Visibility == "public" && strings.HasSuffix(permissionName, ".read") {
+ // Public workspaces: guest-safe read permissions only (non-members).
+ if ws.Visibility == "public" && domain.IsPublicGuestPermission(permissionName) {
slog.InfoContext(c.Request().Context(), "RBAC check bypassed: public workspace read access", "user_id", uid, "workspace_id", wid, "permission", permissionName)
return next(c)
}
diff --git a/internal/presentation/middleware/rbac_test.go b/internal/presentation/middleware/rbac_test.go
index e4ea9ce8..9885ca62 100644
--- a/internal/presentation/middleware/rbac_test.go
+++ b/internal/presentation/middleware/rbac_test.go
@@ -160,4 +160,50 @@ func TestRequirePermission(t *testing.T) {
t.Errorf("expected 200 OK, got %d", rec.Code)
}
})
+
+ t.Run("Public Workspace Denies Sensitive Read", func(t *testing.T) {
+ req := httptest.NewRequest(http.MethodGet, "/workspaces/ws-1/logs", nil)
+ rec := httptest.NewRecorder()
+ c := e.NewContext(req, rec)
+ c.SetParamNames("wid")
+ c.SetParamValues("ws-1")
+
+ ctx := context.WithValue(req.Context(), PortalUserIDKey, "user-123")
+ c.SetRequest(req.WithContext(ctx))
+
+ wsRepo := &mockWorkspaceRepository{
+ GetByIDFunc: func(ctx context.Context, id string) (*domain.Workspace, error) {
+ return &domain.Workspace{
+ ID: id,
+ Visibility: "public",
+ }, nil
+ },
+ }
+
+ mock.ExpectQuery(`SELECT 'role' AS type, r.name AS value FROM model_has_roles mhr JOIN roles r ON r.id = mhr.role_id WHERE mhr.model_type = \$1 AND mhr.model_id = \$2 AND mhr.team_id = \$5 AND r.guard_name = \$3 UNION ALL SELECT 'permission' AS type, p.name AS value FROM model_has_permissions mhp JOIN permissions p ON p.id = mhp.permission_id WHERE mhp.model_type = \$1 AND mhp.model_id = \$2 AND mhp.team_id = \$5 AND p.name = \$4 AND p.guard_name = \$3`).
+ WithArgs("users", "user-123", "msg_web", domain.PermissionLogsRead, "ws-1").
+ WillReturnRows(sqlmock.NewRows([]string{"type", "value"}))
+
+ mw := RequirePermission(gate, wsRepo, domain.PermissionLogsRead)
+ handler := mw(func(c echo.Context) error {
+ return c.String(http.StatusOK, "OK")
+ })
+
+ err := handler(c)
+ if err == nil {
+ t.Fatal("expected handler to fail with forbidden error")
+ }
+
+ he, ok := err.(*echo.HTTPError)
+ if !ok {
+ t.Fatalf("expected HTTPError, got %T", err)
+ }
+ if he.Code != http.StatusForbidden {
+ t.Errorf("expected 403 Forbidden, got %d", he.Code)
+ }
+
+ if err := mock.ExpectationsWereMet(); err != nil {
+ t.Errorf("unfulfilled expectations: %v", err)
+ }
+ })
}
diff --git a/internal/presentation/portal_write_routes_test.go b/internal/presentation/portal_write_routes_test.go
new file mode 100644
index 00000000..a6b6dedf
--- /dev/null
+++ b/internal/presentation/portal_write_routes_test.go
@@ -0,0 +1,48 @@
+package presentation
+
+import (
+ "net/http"
+ "testing"
+
+ "github.com/weprodev/wpd-message-gateway/internal/core/domain"
+)
+
+// portalWriteRoutes documents mutating portal endpoints and their required write permissions.
+// Keep in sync with Router.Setup — every state-changing workspace route must appear here.
+var portalWriteRoutes = []struct {
+ method string
+ path string
+ permission string
+}{
+ {http.MethodPatch, "/api/v1/workspaces/:wid", domain.PermissionWorkspacesWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/members/:userId", domain.PermissionMembersWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/api-keys", domain.PermissionAPIKeysWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/api-keys/:keyId", domain.PermissionAPIKeysWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/api-keys/:keyId/regenerate", domain.PermissionAPIKeysWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/integrations", domain.PermissionIntegrationsWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/integrations/:iid", domain.PermissionIntegrationsWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/templates", domain.PermissionTemplatesWrite},
+ {http.MethodPatch, "/api/v1/workspaces/:wid/templates/:tid", domain.PermissionTemplatesWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/templates/:tid", domain.PermissionTemplatesWrite},
+ {http.MethodPatch, "/api/v1/workspaces/:wid/settings", domain.PermissionSettingsWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/invitations", domain.PermissionInvitationsWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/inbox/emails/:id", domain.PermissionInboxWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/inbox/sms/:id", domain.PermissionInboxWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/inbox/push/:id", domain.PermissionInboxWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/inbox/chat/:id", domain.PermissionInboxWrite},
+ {http.MethodDelete, "/api/v1/workspaces/:wid/inbox/messages", domain.PermissionInboxWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/internal/email", domain.PermissionInboxWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/internal/sms", domain.PermissionInboxWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/internal/push", domain.PermissionInboxWrite},
+ {http.MethodPost, "/api/v1/workspaces/:wid/internal/chat", domain.PermissionInboxWrite},
+}
+
+func TestPortalWriteRoutes_requireWritePermissions(t *testing.T) {
+ t.Parallel()
+
+ for _, route := range portalWriteRoutes {
+ if !domain.IsWritePermission(route.permission) {
+ t.Fatalf("%s %s must require a write permission, got %q", route.method, route.path, route.permission)
+ }
+ }
+}
diff --git a/tests/bruno/Portal/00_Auth/Login Viewer.bru b/tests/bruno/Portal/00_Auth/Login Viewer.bru
new file mode 100644
index 00000000..a3212c8a
--- /dev/null
+++ b/tests/bruno/Portal/00_Auth/Login Viewer.bru
@@ -0,0 +1,27 @@
+meta {
+ name: Login Viewer
+ type: http
+ seq: 2
+}
+
+post {
+ url: {{baseUrl}}/api/v1/auth/login
+ body: json
+ auth: none
+}
+
+body:json {
+ {
+ "email": "viewer@weprodev.com",
+ "password": "secret"
+ }
+}
+
+tests {
+ test("should login viewer successfully", function() {
+ expect(res.status).to.equal(200);
+ expect(res.body.token).to.be.a("string");
+ });
+
+ bru.setVar("viewerPortalJwt", res.body.token);
+}
diff --git a/tests/bruno/Portal/RBAC/Invite Existing Member Forbidden.bru b/tests/bruno/Portal/RBAC/Invite Existing Member Forbidden.bru
new file mode 100644
index 00000000..0d272537
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Invite Existing Member Forbidden.bru
@@ -0,0 +1,28 @@
+meta {
+ name: Viewer Invite Existing Member Forbidden
+ type: http
+ seq: 7
+}
+
+post {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/invitations
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{portalJwt}}
+}
+
+body:json {
+ {
+ "email": "member@weprodev.com",
+ "role": "viewer"
+ }
+}
+
+tests {
+ test("cannot invite an existing workspace member", function() {
+ expect(res.status).to.equal(400);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Create API Key Forbidden.bru b/tests/bruno/Portal/RBAC/Viewer Create API Key Forbidden.bru
new file mode 100644
index 00000000..b7fb6d49
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Create API Key Forbidden.bru
@@ -0,0 +1,27 @@
+meta {
+ name: Viewer Create API Key Forbidden
+ type: http
+ seq: 3
+}
+
+post {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/api-keys
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+body:json {
+ {
+ "name": "Viewer should not create"
+ }
+}
+
+tests {
+ test("viewer cannot create API keys", function() {
+ expect(res.status).to.equal(403);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Create Template Forbidden.bru b/tests/bruno/Portal/RBAC/Viewer Create Template Forbidden.bru
new file mode 100644
index 00000000..072d3483
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Create Template Forbidden.bru
@@ -0,0 +1,31 @@
+meta {
+ name: Viewer Create Template Forbidden
+ type: http
+ seq: 6
+}
+
+post {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/templates
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+body:json {
+ {
+ "name": "Viewer Template",
+ "unique_key": "viewer_template",
+ "category": "transactional",
+ "subject": "Should fail",
+ "content_html": "
no
"
+ }
+}
+
+tests {
+ test("viewer cannot create templates", function() {
+ expect(res.status).to.equal(403);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Delete Email Forbidden.bru b/tests/bruno/Portal/RBAC/Viewer Delete Email Forbidden.bru
new file mode 100644
index 00000000..127ad7a2
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Delete Email Forbidden.bru
@@ -0,0 +1,21 @@
+meta {
+ name: Viewer Delete Email Forbidden
+ type: http
+ seq: 5
+}
+
+delete {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/inbox/emails/00000000-0000-0000-0000-000000000099
+ body: none
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+tests {
+ test("viewer cannot delete inbox messages", function() {
+ expect(res.status).to.equal(403);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Get Settings.bru b/tests/bruno/Portal/RBAC/Viewer Get Settings.bru
new file mode 100644
index 00000000..eb5def42
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Get Settings.bru
@@ -0,0 +1,21 @@
+meta {
+ name: Viewer Get Settings
+ type: http
+ seq: 1
+}
+
+get {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/settings
+ body: none
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+tests {
+ test("viewer can read settings", function() {
+ expect(res.status).to.equal(200);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Patch Settings Forbidden.bru b/tests/bruno/Portal/RBAC/Viewer Patch Settings Forbidden.bru
new file mode 100644
index 00000000..a5dc8567
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Patch Settings Forbidden.bru
@@ -0,0 +1,27 @@
+meta {
+ name: Viewer Patch Settings Forbidden
+ type: http
+ seq: 2
+}
+
+patch {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/settings
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+body:json {
+ {
+ "message_dispatch_mode": "provider"
+ }
+}
+
+tests {
+ test("viewer cannot patch settings", function() {
+ expect(res.status).to.equal(403);
+ });
+}
diff --git a/tests/bruno/Portal/RBAC/Viewer Upsert Integration Forbidden.bru b/tests/bruno/Portal/RBAC/Viewer Upsert Integration Forbidden.bru
new file mode 100644
index 00000000..05c026f6
--- /dev/null
+++ b/tests/bruno/Portal/RBAC/Viewer Upsert Integration Forbidden.bru
@@ -0,0 +1,31 @@
+meta {
+ name: Viewer Upsert Integration Forbidden
+ type: http
+ seq: 4
+}
+
+post {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/integrations
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{viewerPortalJwt}}
+}
+
+body:json {
+ {
+ "channel_type": "email",
+ "provider_name": "memory",
+ "config": {},
+ "status": "connected",
+ "is_default": true
+ }
+}
+
+tests {
+ test("viewer cannot upsert integrations", function() {
+ expect(res.status).to.equal(403);
+ });
+}
diff --git a/tests/bruno/Portal/Workspaces/Create Invitation.bru b/tests/bruno/Portal/Workspaces/Create Invitation.bru
new file mode 100644
index 00000000..05991b4d
--- /dev/null
+++ b/tests/bruno/Portal/Workspaces/Create Invitation.bru
@@ -0,0 +1,33 @@
+meta {
+ name: Create Invitation
+ type: http
+ seq: 7
+}
+
+post {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/invitations
+ body: json
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{portalJwt}}
+}
+
+body:json {
+ {
+ "email": "invitee-{{$timestamp}}@e2e.test",
+ "role": "member"
+ }
+}
+
+tests {
+ test("should create invitation with role", function() {
+ expect(res.status).to.equal(201);
+ expect(res.body).to.have.property("id");
+ expect(res.body.email).to.be.a("string");
+ expect(res.body.role).to.equal("member");
+ expect(res.body.token).to.be.a("string").and.not.empty;
+ expect(res.body.expires_at).to.be.a("string");
+ });
+}
diff --git a/tests/bruno/Portal/Workspaces/List Invitations.bru b/tests/bruno/Portal/Workspaces/List Invitations.bru
new file mode 100644
index 00000000..b25b14f2
--- /dev/null
+++ b/tests/bruno/Portal/Workspaces/List Invitations.bru
@@ -0,0 +1,22 @@
+meta {
+ name: List Invitations
+ type: http
+ seq: 6
+}
+
+get {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/invitations
+ body: none
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{portalJwt}}
+}
+
+tests {
+ test("should list pending invitations", function() {
+ expect(res.status).to.equal(200);
+ expect(res.body).to.be.an("array");
+ });
+}
diff --git a/tests/bruno/Portal/Workspaces/List Members.bru b/tests/bruno/Portal/Workspaces/List Members.bru
new file mode 100644
index 00000000..136455aa
--- /dev/null
+++ b/tests/bruno/Portal/Workspaces/List Members.bru
@@ -0,0 +1,28 @@
+meta {
+ name: List Members
+ type: http
+ seq: 5
+}
+
+get {
+ url: {{baseUrl}}/api/v1/workspaces/{{workspaceId}}/members
+ body: none
+ auth: bearer
+}
+
+auth:bearer {
+ token: {{portalJwt}}
+}
+
+tests {
+ test("should list workspace members", function() {
+ expect(res.status).to.equal(200);
+ expect(res.body).to.be.an("array");
+ if (res.body.length > 0) {
+ const member = res.body[0];
+ expect(member).to.have.property("user_id");
+ expect(member).to.have.property("role");
+ expect(member).to.have.property("joined_at");
+ }
+ });
+}