stack-auth · fomalhautb · Aug 12, 2024 · Aug 4, 2024 · Aug 4, 2024 · Aug 4, 2024
diff --git a/apps/backend/package.json b/apps/backend/package.json
@@ -7,7 +7,7 @@
    "typecheck": "tsc --noEmit",
    "with-env": "dotenv -c development --",
    "with-env:prod": "dotenv -c --",
-    "dev": "concurrently \"next dev --port 8102\" \"pnpm run watch-docs\" \"pnpm run prisma-studio\"",
+    "dev": "concurrently -k \"next dev --port 8102\" \"pnpm run watch-docs\" \"pnpm run prisma-studio\"",
    "build": "pnpm run codegen && next build",
    "analyze-bundle": "ANALYZE_BUNDLE=1 pnpm run build",
    "start": "next start --port 8102",

diff --git a/apps/backend/prisma/migrations/20240811194548_client_team_creation/migration.sql b/apps/backend/prisma/migrations/20240811194548_client_team_creation/migration.sql
@@ -0,0 +1,8 @@
+-- AlterTable
+ALTER TABLE "ProjectConfig" ADD COLUMN "clientTeamCreationEnabled" BOOLEAN NOT NULL DEFAULT false;
+
+-- Update existing rows
+UPDATE "ProjectConfig" SET "clientTeamCreationEnabled" = false;
+
+-- Remove the default constraint
+ALTER TABLE "ProjectConfig" ALTER COLUMN "clientTeamCreationEnabled" DROP DEFAULT;
diff --git a/apps/backend/prisma/schema.prisma b/apps/backend/prisma/schema.prisma
@@ -39,12 +39,12 @@ model ProjectConfig {
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

-  allowLocalhost    Boolean
-  signUpEnabled     Boolean @default(true)
-  credentialEnabled Boolean
-  magicLinkEnabled  Boolean
-
-  createTeamOnSignUp Boolean
+  allowLocalhost            Boolean
+  signUpEnabled             Boolean @default(true)
+  credentialEnabled         Boolean
+  magicLinkEnabled          Boolean
+  createTeamOnSignUp        Boolean
+  clientTeamCreationEnabled Boolean

  projects             Project[]
  oauthProviderConfigs OAuthProviderConfig[]
@@ -219,11 +219,11 @@ model ProjectUser {
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

-  project                          Project                            @relation("ProjectUsers", fields: [projectId], references: [id], onDelete: Cascade)
-  projectUserRefreshTokens         ProjectUserRefreshToken[]
-  projectUserAuthorizationCodes    ProjectUserAuthorizationCode[]
-  projectUserOAuthAccounts         ProjectUserOAuthAccount[]
-  teamMembers                      TeamMember[]
+  project                       Project                        @relation("ProjectUsers", fields: [projectId], references: [id], onDelete: Cascade)
+  projectUserRefreshTokens      ProjectUserRefreshToken[]
+  projectUserAuthorizationCodes ProjectUserAuthorizationCode[]
+  projectUserOAuthAccounts      ProjectUserOAuthAccount[]
+  teamMembers                   TeamMember[]

  // @deprecated
  projectUserEmailVerificationCode ProjectUserEmailVerificationCode[]
@@ -239,8 +239,8 @@ model ProjectUser {
  passwordHash         String?
  authWithEmail        Boolean

-  requiresTotpMfa      Boolean @default(false)
-  totpSecret           Bytes?
+  requiresTotpMfa Boolean @default(false)
+  totpSecret      Bytes?

  serverMetadata Json?
  clientMetadata Json?
@@ -362,7 +362,7 @@ model VerificationCode {
  usedAt      DateTime?
  redirectUrl String?

-  method      Json @default("null")
+  method Json @default("null")

  data Json


diff --git a/apps/backend/prisma/seed.ts b/apps/backend/prisma/seed.ts
@@ -60,6 +60,7 @@ async function seed() {
            credentialEnabled: true,
            magicLinkEnabled: true,
            createTeamOnSignUp: false,
+            clientTeamCreationEnabled: true,
          },
        },
      },

diff --git a/apps/backend/src/app/api/v1/auth/otp/sign-in/verification-code-handler.tsx b/apps/backend/src/app/api/v1/auth/otp/sign-in/verification-code-handler.tsx
@@ -1,13 +1,10 @@
-import * as yup from "yup";
-import { yupObject, yupString, yupNumber, yupBoolean, yupArray, yupMixed } from "@stackframe/stack-shared/dist/schema-fields";
-import { prismaClient } from "@/prisma-client";
+import { sendEmailFromTemplate } from "@/lib/emails";
 import { createAuthTokens } from "@/lib/tokens";
+import { prismaClient } from "@/prisma-client";
 import { createVerificationCodeHandler } from "@/route-handlers/verification-code-handler";
-import { signInResponseSchema } from "@stackframe/stack-shared/dist/schema-fields";
 import { VerificationCodeType } from "@prisma/client";
 import { UsersCrud } from "@stackframe/stack-shared/dist/interface/crud/users";
-import { sendEmailFromTemplate } from "@/lib/emails";
-import { StackAssertionError } from "@stackframe/stack-shared/dist/utils/errors";
+import { signInResponseSchema, yupBoolean, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { createMfaRequiredError } from "../../mfa/sign-in/verification-code-handler";

 export const signInVerificationCodeHandler = createVerificationCodeHandler({

diff --git a/apps/backend/src/app/api/v1/internal/projects/crud.tsx b/apps/backend/src/app/api/v1/internal/projects/crud.tsx
@@ -39,6 +39,7 @@ export const internalProjectsCrudHandlers = createLazyProxy(() => createCrudHand
              magicLinkEnabled: data.config?.magic_link_enabled ?? false,
              allowLocalhost: data.config?.allow_localhost ?? true,
              createTeamOnSignUp: data.config?.create_team_on_sign_up ?? false,
+              clientTeamCreationEnabled: data.config?.client_team_creation_enabled ?? false,
              domains: data.config?.domains ? {
                create: data.config.domains.map(item => ({
                  domain: item.domain,

diff --git a/apps/backend/src/app/api/v1/projects/current/crud.tsx b/apps/backend/src/app/api/v1/projects/current/crud.tsx
@@ -256,6 +256,7 @@ export const projectsCrudHandlers = createLazyProxy(() => createCrudHandlers(pro
              signUpEnabled: data.config?.sign_up_enabled,
              credentialEnabled: data.config?.credential_enabled,
              magicLinkEnabled: data.config?.magic_link_enabled,
+              clientTeamCreationEnabled: data.config?.client_team_creation_enabled,
              allowLocalhost: data.config?.allow_localhost,
              createTeamOnSignUp: data.config?.create_team_on_sign_up,
              domains: data.config?.domains ? {

diff --git a/apps/backend/src/app/api/v1/team-invitations/accept/verification-code-handler.tsx b/apps/backend/src/app/api/v1/team-invitations/accept/verification-code-handler.tsx
@@ -21,7 +21,6 @@ export const teamInvitationCodeHandler = createVerificationCodeHandler({
      tags: ["Teams"],
    },
  },
-  userRequired: true,
  type: VerificationCodeType.TEAM_INVITATION,
  data: yupObject({
    team_id: yupString().required(),
@@ -60,6 +59,8 @@ export const teamInvitationCodeHandler = createVerificationCodeHandler({
    });
  },
  async handler(project, {}, data, body, user) {
+    if (!user) throw new KnownErrors.UserAuthenticationRequired();
+
    const oldMembership = await prismaClient.teamMember.findUnique({
      where: {
        projectId_projectUserId_teamId: {
@@ -86,6 +87,8 @@ export const teamInvitationCodeHandler = createVerificationCodeHandler({
    };
  },
  async details(project, {}, data, body, user) {
+    if (!user) throw new KnownErrors.UserAuthenticationRequired();
+
    const team = await teamsCrudHandlers.adminRead({
      project,
      team_id: data.team_id,

diff --git a/apps/backend/src/app/api/v1/team-member-profiles/crud.tsx b/apps/backend/src/app/api/v1/team-member-profiles/crud.tsx
@@ -8,15 +8,17 @@ import { teamMemberProfilesCrud } from "@stackframe/stack-shared/dist/interface/
 import { userIdOrMeSchema, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { StatusError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { createLazyProxy } from "@stackframe/stack-shared/dist/utils/proxies";
+import { userFullInclude, userPrismaToCrud } from "../users/crud";

-const fullInclude = { projectUser: true };
+const fullInclude = { projectUser: { include: userFullInclude } };

 function prismaToCrud(prisma: Prisma.TeamMemberGetPayload<{ include: typeof fullInclude }>) {
  return {
    team_id: prisma.teamId,
    user_id: prisma.projectUserId,
    display_name: prisma.displayName ?? prisma.projectUser.displayName,
    profile_image_url: prisma.profileImageUrl ?? prisma.projectUser.profileImageUrl,
+    user: userPrismaToCrud(prisma.projectUser),
  };
 }

@@ -37,7 +39,7 @@ export const teamMemberProfilesCrudHandlers = createLazyProxy(() => createCrudHa
        // - list users in their own team if they have the $read_members permission
        // - list their own profile

-        const currentUserId = auth.user?.id ?? throwErr("Client must be authenticated");
+        const currentUserId = auth.user?.id ?? throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());

        if (!query.team_id) {
          throw new StatusError(StatusError.BadRequest, 'team_id is required for access type client');
@@ -85,14 +87,17 @@ export const teamMemberProfilesCrudHandlers = createLazyProxy(() => createCrudHa
    return await prismaClient.$transaction(async (tx) => {
      const userId = getIdFromUserIdOrMe(params.user_id, auth.user);

-      if (auth.type === 'client' && userId !== auth.user?.id) {
-        await ensureUserTeamPermissionExists(tx, {
-          project: auth.project,
-          teamId: params.team_id,
-          userId: auth.user?.id ?? throwErr("Client must be authenticated"),
-          permissionId: '$read_members',
-          errorType: 'required',
-        });
+      if (auth.type === 'client') {
+        const currentUserId = auth.user?.id ?? throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());
+        if (userId !== currentUserId) {
+          await ensureUserTeamPermissionExists(tx, {
+            project: auth.project,
+            teamId: params.team_id,
+            userId: currentUserId,
+            permissionId: '$read_members',
+            errorType: 'required',
+          });
+        }
      }

      await ensureTeamMembershipExists(tx, { projectId: auth.project.id, teamId: params.team_id, userId: userId });
@@ -120,14 +125,17 @@ export const teamMemberProfilesCrudHandlers = createLazyProxy(() => createCrudHa
    return await prismaClient.$transaction(async (tx) => {
      const userId = getIdFromUserIdOrMe(params.user_id, auth.user);

-      if (auth.type === 'client' && userId !== auth.user?.id) {
-        throw new StatusError(StatusError.Forbidden, 'Cannot update another user\'s profile');
+      if (auth.type === 'client') {
+        const currentUserId = auth.user?.id ?? throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());
+        if (userId !== currentUserId) {
+          throw new StatusError(StatusError.Forbidden, 'Cannot update another user\'s profile');
+        }
      }

      await ensureTeamMembershipExists(tx, {
        projectId: auth.project.id,
        teamId: params.team_id,
-        userId: auth.user?.id ?? throwErr("Client must be authenticated"),
+        userId,
      });

      const db = await tx.teamMember.update({

diff --git a/apps/backend/src/app/api/v1/team-memberships/crud.tsx b/apps/backend/src/app/api/v1/team-memberships/crud.tsx
@@ -99,14 +99,18 @@ export const teamMembershipsCrudHandlers = createLazyProxy(() => createCrudHandl

      // Users are always allowed to remove themselves from a team
      // Only users with the $remove_members permission can remove other users
-      if (auth.type === 'client' && userId !== auth.user?.id) {
-        await ensureUserTeamPermissionExists(tx, {
-          project: auth.project,
-          teamId: params.team_id,
-          userId: auth.user?.id ?? throwErr('auth.user is null'),
-          permissionId: "$remove_members",
-          errorType: 'required',
-        });
+      if (auth.type === 'client') {
+        const currentUserId = auth.user?.id ?? throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());
+
+        if (userId !== currentUserId) {
+          await ensureUserTeamPermissionExists(tx, {
+            project: auth.project,
+            teamId: params.team_id,
+            userId: auth.user?.id ?? throwErr('auth.user is null'),
+            permissionId: "$remove_members",
+            errorType: 'required',
+          });
+        }
      }

      await ensureTeamMembershipExists(tx, {

diff --git a/apps/backend/src/app/api/v1/team-permissions/crud.tsx b/apps/backend/src/app/api/v1/team-permissions/crud.tsx
@@ -3,9 +3,10 @@ import { ensureTeamMembershipExists, ensureUserTeamPermissionExists } from "@/li
 import { prismaClient } from "@/prisma-client";
 import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { getIdFromUserIdOrMe } from "@/route-handlers/utils";
+import { KnownErrors } from "@stackframe/stack-shared";
 import { teamPermissionsCrud } from '@stackframe/stack-shared/dist/interface/crud/team-permissions';
 import { teamPermissionDefinitionIdSchema, userIdOrMeSchema, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
-import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+import { StatusError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { createLazyProxy } from "@stackframe/stack-shared/dist/utils/proxies";

 export const teamPermissionsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamPermissionsCrud, {
@@ -52,8 +53,12 @@ export const teamPermissionsCrudHandlers = createLazyProxy(() => createCrudHandl
  },
  async onList({ auth, query }) {
    const userId = getIdFromUserIdOrMe(query.user_id, auth.user);
-    if (auth.type === 'client' && userId !== auth.user?.id) {
-      throw new StatusError(StatusError.Forbidden, 'Client can only list permissions for their own user. user_id must be either "me" or the ID of the current user');
+    if (auth.type === 'client') {
+      const currentUserId = auth.user?.id || throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());
+
+      if (userId !== currentUserId) {
+        throw new StatusError(StatusError.Forbidden, 'Client can only list permissions for their own user. user_id must be either "me" or the ID of the current user');
+      }
    }

    return await prismaClient.$transaction(async (tx) => {

diff --git a/apps/backend/src/app/api/v1/teams/crud.tsx b/apps/backend/src/app/api/v1/teams/crud.tsx
@@ -30,6 +30,14 @@ export const teamsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamsC
    team_id: yupString().uuid().required(),
  }),
  onCreate: async ({ query, auth, data }) => {
+    if (auth.type === 'client' && !auth.user) {
+      throw new KnownErrors.UserAuthenticationRequired();
+    }
+
+    if (auth.type === 'client' && !auth.project.config.client_team_creation_enabled) {
+      throw new StatusError(StatusError.Forbidden, 'Client team creation is disabled for this project');
+    }
+
    const db = await prismaClient.$transaction(async (tx) => {
      const db = await tx.team.create({
        data: {
@@ -69,7 +77,7 @@ export const teamsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamsC
        await ensureTeamMembershipExists(tx, {
          projectId: auth.project.id,
          teamId: params.team_id,
-          userId: auth.user?.id ?? throwErr('auth.user is null'),
+          userId: auth.user?.id ?? throwErr(new KnownErrors.UserAuthenticationRequired()),
        });
      }

@@ -97,7 +105,7 @@ export const teamsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamsC
        await ensureUserTeamPermissionExists(tx, {
          project: auth.project,
          teamId: params.team_id,
-          userId: auth.user?.id ?? throwErr('auth.user is null'),
+          userId: auth.user?.id ?? throwErr(new KnownErrors.UserAuthenticationRequired()),
          permissionId: "$update_team",
          errorType: 'required',
        });
@@ -134,7 +142,7 @@ export const teamsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamsC
        await ensureUserTeamPermissionExists(tx, {
          project: auth.project,
          teamId: params.team_id,
-          userId: auth.user?.id ?? throwErr('auth.user is null'),
+          userId: auth.user?.id ?? throwErr(new KnownErrors.UserAuthenticationRequired()),
          permissionId: "$delete_team",
          errorType: 'required',
        });
@@ -160,8 +168,12 @@ export const teamsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamsC
  },
  onList: async ({ query, auth }) => {
    const userId = getIdFromUserIdOrMe(query.user_id, auth.user);
-    if (auth.type === 'client' && userId !== auth.user?.id) {
-      throw new StatusError(StatusError.Forbidden, 'Client can only list teams for their own user. user_id must be either "me" or the ID of the current user');
+    if (auth.type === 'client') {
+      const currentUserId = auth.user?.id || throwErr(new KnownErrors.CannotGetOwnUserWithoutUser());
+
+      if (userId !== currentUserId) {
+        throw new StatusError(StatusError.Forbidden, 'Client can only list teams for their own user. user_id must be either "me" or the ID of the current user');
+      }
    }

    const db = await prismaClient.team.findMany({