Workspaces

use navree::prelude::*;

pub fn app(sources: ConfigSources) -> AppBuilder {
    Navree::app()
        .module(ConfigModule::for_root(sources))
        .module(CryptoModule::from_config())
        .module(HttpModule::from_config())
        .module(DatabaseModule::from_config())
        .module(EventsModule::for_root())
        .module(ViewModule::from_config())
        .module(MailModule::from_config())
        .module(AuthModule::from_config())
        .module(AccessModule::for_root(AccessOptions::default()))
        .module(WorkspaceModule::from_config())
        .module(DealsModule)
}

use navree::db::paginate;
use navree::prelude::*;
use sea_orm::ActiveValue::Set;
use serde::Deserialize;
use uuid::Uuid;

use super::entity::{Deal, deal};

#[derive(Deserialize)]
pub struct NewDeal {
    title: String,
    amount_cents: i64,
}

#[injectable]
pub struct DealsController;

#[controller("/deals", version = "1")]
#[guard(InWorkspace::guard())]
impl DealsController {
    #[get("/")]
    #[permissions("deals.read")]
    async fn index(&self, ws: CurrentWorkspace, uow: Uow, page: PageQuery) -> Result<Page<deal::Model>> {
        let select = WorkspaceRepo::<Deal>::select(ws.id());
        Ok(paginate(select, &*uow.tx().await?, page).await?)
    }

    #[post("/")]
    #[permissions("deals.create")]
    async fn store(
        &self,
        ws: CurrentWorkspace,
        uow: Uow,
        Json(input): Json<NewDeal>,
    ) -> Result<Created<deal::Model>> {
        let deal = WorkspaceRepo::<Deal>::insert(
            &uow,
            ws.id(),
            deal::ActiveModel {
                id: Set(Uuid::now_v7()),
                owner_id: Set(ws.member().user_id),
                title: Set(input.title),
                amount_cents: Set(input.amount_cents),
                ..Default::default()
            },
        )
        .await?;
        Ok(Created(format!("/api/v1/deals/{}", deal.id), deal))
    }
}

impl Subject for deal::Entity {
    const SUBJECT: &'static str = "Deal";
    const PERMISSION_PREFIX: &'static str = "deals";
}

/// Rows carry a `workspace_id` column.
impl WorkspaceScoped for deal::Entity {}

pub type Deal = deal::Entity;

[workspace.roles.member]
permissions = ["deals.*"]

POST /api/v1/deals HTTP/1.1
Authorization: Bearer eyJhbGciOi...
X-Workspace: acme
Content-Type: application/json

{"title": "Big one", "amount_cents": 500000}

{ "statusCode": 403, "message": "You are not a member of this workspace.", "error": "Forbidden", "code": "not_a_member" }

[workspace]
resolvers = ["header", "path", "subdomain", "claim"]  # tried in order
header = "X-Workspace"
# base_domain = "app.example.com"   # acme.app.example.com names `acme`
path_prefix = "/w"                  # /api/w/acme/... names `acme`
claim = "workspace"                 # a claim of the bearer JWT
isolation = "row"                   # row, schema or database
routes = true                       # /api/workspaces and /api/invitations/accept
users_table = "users"               # names and emails of members; "" for none
schema_prefix = "workspace_"        # schema isolation
# database_url = "sqlite://storage/workspaces/{id}.db?mode=rwc"  # database isolation

[workspace.invitations]
ttl_secs = 604800                   # seven days
# url = "https://app.example.com/invitations/accept"
# mail_template = "mail/workspace-invitation"
require_matching_email = true

[workspace.roles.member]
permissions = ["deals.*"]

[workspace.organizations]           # organizations above workspaces
enabled = false

[workspace.partitions]              # partitions inside workspaces
enabled = false

[workspace.demo]                    # demo workspaces
mode = "read_only"                  # read_only or reset
reset_at = "03:00"                  # the nightly reset (UTC) in reset mode
# guest_role = "viewer"             # signed-in non-members enter demos
fixtures = "fixtures/demo"

let workspace = workspaces
    .create(&uow, user_id, NewWorkspace::named("Acme Inc."))
    .await?;
assert_eq!(workspace.slug, "acme-inc");

{
  "__type": "Workspace",
  "id": "0199f3c2-8f4e-7c1a-9d2b-5a6e7f8091ab",
  "name": "Acme Inc.",
  "slug": "acme-inc",
  "owner_id": "0199f3c2-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
  "organization_id": null,
  "kind": "live",
  "role": "owner",
  "timezone": "Asia/Kolkata",
  "country": "IN",
  "created_at": "2026-10-26T09:00:00Z",
  "updated_at": "2026-10-26T09:00:00Z"
}

use navree::events::{Listener, ModuleBuilderEventsExt};
use navree::prelude::*;
use navree::workspace::events::{InvitationAccepted, WorkspaceCreated};
use navree::{BoxFuture, KernelError};

pub struct Onboarding;

impl Injectable for Onboarding {
    fn construct(_r: Resolver) -> BoxFuture<'static, Result<Self, KernelError>> {
        Box::pin(async { Ok(Onboarding) })
    }
}

impl Listener<WorkspaceCreated> for Onboarding {
    fn handle<'a>(
        &'a self,
        event: &'a WorkspaceCreated,
        _ctx: &'a AppContext,
    ) -> BoxFuture<'a, Result<(), BoxError>> {
        Box::pin(async move {
            println!("seeding {}", event.slug);
            Ok(())
        })
    }

    // Runs on a queue worker (inline when the app has no queue).
    fn queued(&self) -> bool {
        true
    }
}

#[module(register = Self::wire)]
pub struct OnboardingModule;

impl OnboardingModule {
    fn wire(&self, m: &mut ModuleBuilder) {
        m.listen::<WorkspaceCreated, Onboarding>();
    }
}

use navree::auth::AuthService;
use navree::prelude::*;
use navree::testing::{TestApp, TestAuthenticator, principal, temp_sqlite_url};
use serde_json::json;

use crate::app;

#[tokio::test]
async fn members_create_deals_in_their_workspace() {
    let (url, _db) = temp_sqlite_url();
    let sources = ConfigSources::new()
        .set("database.url", url)
        .set("database.migrate_on_boot", true)
        .set("app.key", navree::crypto::generate_key())
        .set("hashing.memory_kib", 1024)
        .set("hashing.iterations", 1)
        .set("mail.transport", "array")
        .set("workspace.roles.member.permissions", json!(["deals.*"]));
    let app = TestApp::from_builder(TestAuthenticator::install(app(sources))).await;
    let auth = app.get::<AuthService>().await;
    let ada = auth.create_user("Ada", "[email protected]", "secret-password").await.unwrap();
    let grace = auth.create_user("Grace", "[email protected]", "secret-password").await.unwrap();

    let owner = app.acting_as(principal(ada.id));
    owner
        .post("/api/workspaces")
        .json(&json!({ "name": "Acme" }))
        .send()
        .await
        .assert_status(201);
    owner
        .post("/api/workspaces/acme/members")
        .json(&json!({ "user_id": grace.id, "role": "member" }))
        .send()
        .await
        .assert_status(201);

    let member = app.acting_as(principal(grace.id));
    member
        .post("/api/v1/deals")
        .header("X-Workspace", "acme")
        .json(&json!({ "title": "Big one", "amount_cents": 500_000 }))
        .send()
        .await
        .assert_status(201);
    app.acting_as(principal(uuid::Uuid::now_v7()))
        .get("/api/v1/deals")
        .header("X-Workspace", "acme")
        .send()
        .await
        .assert_error(403, "You are not a member of this workspace.");
}