Organization Management: Multi-Tenant Teams

// Organization - The tenant container
model Organization {
  id        String   @id @default(cuid())
  name      String
  slug      String   @unique
  logo      String?

  // Organization settings as JSON for flexibility
  settings  Json     @default("{}")

  // Metadata
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  // Relations
  members      OrganizationMember[]
  invites      OrganizationInvite[]
  subscription Subscription?
  auditLogs    AuditLog[]
  apiKeys      ApiKey[]

  // All org-scoped resources
  projects     Project[]

  @@index([slug])
}

// OrganizationMember - Junction table for user-org relationship
model OrganizationMember {
  id             String     @id @default(cuid())
  userId         String
  organizationId String
  role           MemberRole @default(MEMBER)

  // Track who invited this member
  invitedById    String?

  // Timestamps
  joinedAt       DateTime   @default(now())
  updatedAt      DateTime   @updatedAt

  // Relations
  user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)
  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  invitedBy    User?        @relation("InvitedMembers", fields: [invitedById], references: [id])

  // Ensure one membership per user per org
  @@unique([userId, organizationId])
  @@index([organizationId])
  @@index([userId])
}

// OrganizationInvite - Pending invitations
model OrganizationInvite {
  id             String     @id @default(cuid())
  organizationId String
  email          String
  role           MemberRole @default(MEMBER)

  // Secure token for invite link
  token          String     @unique @default(cuid())

  // Expiration (default 7 days)
  expiresAt      DateTime

  // Track who sent the invite
  invitedById    String

  // Timestamps
  createdAt      DateTime   @default(now())

  // Relations
  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  invitedBy    User         @relation(fields: [invitedById], references: [id])

  // Only one active invite per email per org
  @@unique([organizationId, email])
  @@index([token])
  @@index([email])
}

// MemberRole - Available roles in an organization
enum MemberRole {
  OWNER   // Full access, can delete org
  ADMIN   // Manage members, settings, billing
  MEMBER  // Access resources, no management
  VIEWER  // Read-only access
}

// AuditLog - Track all organization changes
model AuditLog {
  id             String   @id @default(cuid())
  organizationId String
  userId         String?

  // What happened
  action         String   // e.g., "member.invited", "settings.updated"
  resource       String   // e.g., "member", "project", "settings"
  resourceId     String?  // ID of affected resource

  // Change details
  metadata       Json     @default("{}")

  // IP and user agent for security
  ipAddress      String?
  userAgent      String?

  // Timestamp
  createdAt      DateTime @default(now())

  // Relations
  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  user         User?        @relation(fields: [userId], references: [id])

  @@index([organizationId])
  @@index([userId])
  @@index([action])
  @@index([createdAt])
}

// Subscription - Organization billing
model Subscription {
  id             String   @id
  organizationId String   @unique
  status         String   // active, canceled, past_due, etc.
  priceId        String

  // Stripe/Polar/Lemonsqueezy customer ID
  customerId     String

  // Current period
  currentPeriodStart DateTime
  currentPeriodEnd   DateTime

  // Cancellation
  cancelAtPeriodEnd  Boolean @default(false)
  canceledAt         DateTime?

  // Timestamps
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  // Relations
  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)

  @@index([customerId])
  @@index([status])
}

// ApiKey - Organization API keys
model ApiKey {
  id             String    @id @default(cuid())
  organizationId String

  name           String    // User-friendly name
  key            String    @unique // The actual API key (hashed)
  keyPrefix      String    // First 8 chars for identification

  // Permissions
  scopes         String[]  // e.g., ["read:projects", "write:projects"]

  // Usage tracking
  lastUsedAt     DateTime?
  usageCount     Int       @default(0)

  // Expiration (optional)
  expiresAt      DateTime?

  // Timestamps
  createdAt      DateTime  @default(now())
  revokedAt      DateTime?

  // Relations
  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)

  @@index([organizationId])
  @@index([key])
}

// types/permissions.ts

export type MemberRole = 'OWNER' | 'ADMIN' | 'MEMBER' | 'VIEWER';

export type Permission =
  // Resource permissions
  | 'resources:read'
  | 'resources:create'
  | 'resources:update'
  | 'resources:delete'
  // Member permissions
  | 'members:read'
  | 'members:invite'
  | 'members:remove'
  | 'members:update-role'
  // Organization permissions
  | 'org:read'
  | 'org:update'
  | 'org:delete'
  | 'org:transfer'
  // Billing permissions
  | 'billing:read'
  | 'billing:manage'
  // Audit permissions
  | 'audit:read'
  // API key permissions
  | 'api-keys:read'
  | 'api-keys:manage';

// Role to permissions mapping
export const ROLE_PERMISSIONS: Record<MemberRole, Permission[]> = {
  OWNER: [
    'resources:read',
    'resources:create',
    'resources:update',
    'resources:delete',
    'members:read',
    'members:invite',
    'members:remove',
    'members:update-role',
    'org:read',
    'org:update',
    'org:delete',
    'org:transfer',
    'billing:read',
    'billing:manage',
    'audit:read',
    'api-keys:read',
    'api-keys:manage',
  ],
  ADMIN: [
    'resources:read',
    'resources:create',
    'resources:update',
    'resources:delete',
    'members:read',
    'members:invite',
    'members:remove',
    'members:update-role',
    'org:read',
    'org:update',
    'billing:read',
    'billing:manage',
    'audit:read',
    'api-keys:read',
    'api-keys:manage',
  ],
  MEMBER: [
    'resources:read',
    'resources:create',
    'resources:update',
    'resources:delete',
    'members:read',
    'org:read',
  ],
  VIEWER: [
    'resources:read',
    'members:read',
    'org:read',
  ],
};

// Check if a role has a specific permission
export function hasPermission(role: MemberRole, permission: Permission): boolean {
  return ROLE_PERMISSIONS[role].includes(permission);
}

// Get role level for comparison
export function getRoleLevel(role: MemberRole): number {
  const levels: Record<MemberRole, number> = {
    OWNER: 4,
    ADMIN: 3,
    MEMBER: 2,
    VIEWER: 1,
  };
  return levels[role];
}

// Check if role1 can manage role2
export function canManageRole(managerRole: MemberRole, targetRole: MemberRole): boolean {
  return getRoleLevel(managerRole) > getRoleLevel(targetRole);
}

// lib/organizations/service.ts

import { prisma } from '@/lib/prisma';
import { generateSlug } from '@/lib/utils';
import { MemberRole } from '@prisma/client';

export interface CreateOrganizationInput {
  name: string;
  slug?: string;
  userId: string;
}

export interface OrganizationWithMembership {
  id: string;
  name: string;
  slug: string;
  logo: string | null;
  role: MemberRole;
  memberCount: number;
}

/**
 * Create a new organization with the creator as owner
 */
export async function createOrganization(input: CreateOrganizationInput) {
  const { name, userId } = input;

  // Generate slug from name if not provided
  let slug = input.slug || generateSlug(name);

  // Ensure slug is unique
  const existing = await prisma.organization.findUnique({
    where: { slug },
  });

  if (existing) {
    // Append random suffix if slug exists
    slug = `${slug}-${Math.random().toString(36).substring(2, 7)}`;
  }

  // Create organization with owner in a transaction
  const org = await prisma.$transaction(async (tx) => {
    // Create the organization
    const organization = await tx.organization.create({
      data: {
        name,
        slug,
        settings: {
          allowMemberInvites: false,
          defaultRole: 'MEMBER',
          requireEmailVerification: true,
        },
        members: {
          create: {
            userId,
            role: 'OWNER',
          },
        },
      },
      include: {
        members: {
          include: {
            user: {
              select: {
                id: true,
                name: true,
                email: true,
                image: true,
              },
            },
          },
        },
      },
    });

    // Log the creation
    await tx.auditLog.create({
      data: {
        organizationId: organization.id,
        userId,
        action: 'organization.created',
        resource: 'organization',
        resourceId: organization.id,
        metadata: {
          name: organization.name,
          slug: organization.slug,
        },
      },
    });

    return organization;
  });

  return org;
}

/**
 * Get all organizations for a user
 */
export async function getUserOrganizations(userId: string): Promise<OrganizationWithMembership[]> {
  const memberships = await prisma.organizationMember.findMany({
    where: { userId },
    include: {
      organization: {
        include: {
          _count: {
            select: { members: true },
          },
        },
      },
    },
    orderBy: {
      joinedAt: 'desc',
    },
  });

  return memberships.map((m) => ({
    id: m.organization.id,
    name: m.organization.name,
    slug: m.organization.slug,
    logo: m.organization.logo,
    role: m.role,
    memberCount: m.organization._count.members,
  }));
}

/**
 * Get organization by ID or slug
 */
export async function getOrganization(idOrSlug: string) {
  return prisma.organization.findFirst({
    where: {
      OR: [
        { id: idOrSlug },
        { slug: idOrSlug },
      ],
    },
    include: {
      members: {
        include: {
          user: {
            select: {
              id: true,
              name: true,
              email: true,
              image: true,
            },
          },
        },
      },
      _count: {
        select: { members: true },
      },
    },
  });
}

/**
 * Update organization details
 */
export async function updateOrganization(
  orgId: string,
  userId: string,
  data: {
    name?: string;
    slug?: string;
    logo?: string;
    settings?: Record<string, unknown>;
  }
) {
  // Get current org for comparison
  const currentOrg = await prisma.organization.findUnique({
    where: { id: orgId },
  });

  if (!currentOrg) {
    throw new Error('Organization not found');
  }

  // If changing slug, ensure it's unique
  if (data.slug && data.slug !== currentOrg.slug) {
    const existing = await prisma.organization.findUnique({
      where: { slug: data.slug },
    });
    if (existing) {
      throw new Error('Slug already in use');
    }
  }

  // Update organization and create audit log
  const org = await prisma.$transaction(async (tx) => {
    const updated = await tx.organization.update({
      where: { id: orgId },
      data: {
        name: data.name,
        slug: data.slug,
        logo: data.logo,
        settings: data.settings,
      },
    });

    await tx.auditLog.create({
      data: {
        organizationId: orgId,
        userId,
        action: 'organization.updated',
        resource: 'organization',
        resourceId: orgId,
        metadata: {
          changes: data,
          previous: {
            name: currentOrg.name,
            slug: currentOrg.slug,
            logo: currentOrg.logo,
          },
        },
      },
    });

    return updated;
  });

  return org;
}

/**
 * Delete an organization (owner only)
 */
export async function deleteOrganization(orgId: string, userId: string) {
  // Verify user is owner
  const membership = await prisma.organizationMember.findUnique({
    where: {
      userId_organizationId: {
        userId,
        organizationId: orgId,
      },
    },
  });

  if (!membership || membership.role !== 'OWNER') {
    throw new Error('Only the owner can delete an organization');
  }

  // Delete organization (cascades to members, invites, etc.)
  await prisma.organization.delete({
    where: { id: orgId },
  });

  return { success: true };
}

// app/api/organizations/route.ts

import { NextResponse } from 'next/server';
import { auth } from '@/lib/auth';
import { createOrganization, getUserOrganizations } from '@/lib/organizations/service';
import { z } from 'zod';

const createOrgSchema = z.object({
  name: z.string().min(2).max(50),
  slug: z.string().min(2).max(30).regex(/^[a-z0-9-]+$/).optional(),
});

// GET - List user's organizations
export async function GET() {
  const session = await auth();

  if (!session?.user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    const organizations = await getUserOrganizations(session.user.id);
    return NextResponse.json({ organizations });
  } catch (error) {
    console.error('Failed to fetch organizations:', error);
    return NextResponse.json(
      { error: 'Failed to fetch organizations' },
      { status: 500 }
    );
  }
}

// POST - Create new organization
export async function POST(request: Request) {
  const session = await auth();

  if (!session?.user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    const body = await request.json();
    const { name, slug } = createOrgSchema.parse(body);

    const organization = await createOrganization({
      name,
      slug,
      userId: session.user.id,
    });

    return NextResponse.json({ organization }, { status: 201 });
  } catch (error) {
    if (error instanceof z.ZodError) {
      return NextResponse.json(
        { error: 'Invalid input', details: error.errors },
        { status: 400 }
      );
    }
    console.error('Failed to create organization:', error);
    return NextResponse.json(
      { error: 'Failed to create organization' },
      { status: 500 }
    );
  }
}

// lib/organizations/invitations.ts

import { prisma } from '@/lib/prisma';
import { sendEmail } from '@/lib/email';
import { MemberRole } from '@prisma/client';
import { randomBytes } from 'crypto';
import { addDays } from 'date-fns';

export interface CreateInviteInput {
  organizationId: string;
  email: string;
  role: MemberRole;
  invitedById: string;
}

/**
 * Generate a secure invitation token
 */
function generateInviteToken(): string {
  return randomBytes(32).toString('hex');
}

/**
 * Create and send an invitation
 */
export async function createInvitation(input: CreateInviteInput) {
  const { organizationId, email, role, invitedById } = input;

  // Verify inviter has permission
  const inviter = await prisma.organizationMember.findUnique({
    where: {
      userId_organizationId: {
        userId: invitedById,
        organizationId,
      },
    },
    include: {
      user: true,
      organization: true,
    },
  });

  if (!inviter || !['OWNER', 'ADMIN'].includes(inviter.role)) {
    throw new Error('You do not have permission to invite members');
  }

  // Cannot invite to a higher role
  const roleHierarchy: Record<MemberRole, number> = {
    OWNER: 4,
    ADMIN: 3,
    MEMBER: 2,
    VIEWER: 1,
  };

  if (roleHierarchy[role] >= roleHierarchy[inviter.role]) {
    throw new Error('Cannot invite to a role equal or higher than your own');
  }

  // Check if user is already a member
  const existingUser = await prisma.user.findUnique({
    where: { email },
  });

  if (existingUser) {
    const existingMember = await prisma.organizationMember.findUnique({
      where: {
        userId_organizationId: {
          userId: existingUser.id,
          organizationId,
        },
      },
    });

    if (existingMember) {
      throw new Error('User is already a member of this organization');
    }
  }

  // Check for existing pending invite
  const existingInvite = await prisma.organizationInvite.findUnique({
    where: {
      organizationId_email: {
        organizationId,
        email,
      },
    },
  });

  if (existingInvite) {
    // Update existing invite instead of creating new one
    const updatedInvite = await prisma.organizationInvite.update({
      where: { id: existingInvite.id },
      data: {
        role,
        token: generateInviteToken(),
        expiresAt: addDays(new Date(), 7),
        invitedById,
      },
    });

    // Send new invite email
    await sendInviteEmail(updatedInvite, inviter);

    return updatedInvite;
  }

  // Create new invitation
  const invite = await prisma.$transaction(async (tx) => {
    const newInvite = await tx.organizationInvite.create({
      data: {
        organizationId,
        email,
        role,
        token: generateInviteToken(),
        expiresAt: addDays(new Date(), 7),
        invitedById,
      },
      include: {
        organization: true,
        invitedBy: true,
      },
    });

    // Create audit log
    await tx.auditLog.create({
      data: {
        organizationId,
        userId: invitedById,
        action: 'member.invited',
        resource: 'invite',
        resourceId: newInvite.id,
        metadata: {
          email,
          role,
        },
      },
    });

    return newInvite;
  });

  // Send invite email
  await sendInviteEmail(invite, inviter);

  return invite;
}

/**
 * Send invitation email
 */
async function sendInviteEmail(
  invite: {
    email: string;
    token: string;
    role: MemberRole;
    organization: { name: string };
  },
  inviter: {
    user: { name: string | null; email: string };
  }
) {
  const inviteUrl = `${process.env.NEXT_PUBLIC_APP_URL}/invite/${invite.token}`;

  await sendEmail.teamInvite({
    to: invite.email,
    orgName: invite.organization.name,
    inviterName: inviter.user.name || inviter.user.email,
    role: invite.role,
    inviteUrl,
  });
}

/**
 * Accept an invitation
 */
export async function acceptInvitation(token: string, userId: string) {
  const invite = await prisma.organizationInvite.findUnique({
    where: { token },
    include: {
      organization: true,
    },
  });

  if (!invite) {
    throw new Error('Invitation not found');
  }

  if (invite.expiresAt < new Date()) {
    throw new Error('This invitation has expired');
  }

  // Get the user's email
  const user = await prisma.user.findUnique({
    where: { id: userId },
  });

  if (!user) {
    throw new Error('User not found');
  }

  // Verify email matches (optional - can be relaxed for flexibility)
  if (user.email !== invite.email) {
    throw new Error('This invitation was sent to a different email address');
  }

  // Check if already a member
  const existingMember = await prisma.organizationMember.findUnique({
    where: {
      userId_organizationId: {
        userId,
        organizationId: invite.organizationId,
      },
    },
  });

  if (existingMember) {
    // Clean up the invite
    await prisma.organizationInvite.delete({
      where: { id: invite.id },
    });
    throw new Error('You are already a member of this organization');
  }

  // Create membership and delete invite in transaction
  const membership = await prisma.$transaction(async (tx) => {
    // Create membership
    const member = await tx.organizationMember.create({
      data: {
        userId,
        organizationId: invite.organizationId,
        role: invite.role,
        invitedById: invite.invitedById,
      },
      include: {
        organization: true,
        user: {
          select: {
            id: true,
            name: true,
            email: true,
            image: true,
          },
        },
      },
    });

    // Delete the used invite
    await tx.organizationInvite.delete({
      where: { id: invite.id },
    });

    // Create audit log
    await tx.auditLog.create({
      data: {
        organizationId: invite.organizationId,
        userId,
        action: 'member.joined',
        resource: 'member',
        resourceId: member.id,
        metadata: {
          role: invite.role,
          invitedBy: invite.invitedById,
        },
      },
    });

    return member;
  });

  return membership;
}

/**
 * Decline an invitation
 */
export async function declineInvitation(token: string) {
  const invite = await prisma.organizationInvite.findUnique({
    where: { token },
  });

  if (!invite) {
    throw new Error('Invitation not found');
  }

  await prisma.organizationInvite.delete({
    where: { id: invite.id },
  });

  return { success: true };
}

/**
 * Get pending invitations for an organization
 */
export async function getOrganizationInvites(organizationId: string) {
  return prisma.organizationInvite.findMany({
    where: {
      organizationId,
      expiresAt: {
        gt: new Date(),
      },
    },
    include: {
      invitedBy: {
        select: {
          id: true,
          name: true,
          email: true,
        },
      },
    },
    orderBy: {
      createdAt: 'desc',
    },
  });
}

/**
 * Cancel a pending invitation
 */
export async function cancelInvitation(
  inviteId: string,
  organizationId: string,
  userId: string
) {
  // Verify user has permission
  const member = await prisma.organizationMember.findUnique({
    where: {
      userId_organizationId: {
        userId,
        organizationId,
      },
    },
  });

  if (!member || !['OWNER', 'ADMIN'].includes(member.role)) {
    throw new Error('You do not have permission to cancel invitations');
  }

  const invite = await prisma.organizationInvite.findFirst({
    where: {
      id: inviteId,
      organizationId,
    },
  });

  if (!invite) {
    throw new Error('Invitation not found');
  }

  await prisma.$transaction(async (tx) => {
    await tx.organizationInvite.delete({
      where: { id: inviteId },
    });

    await tx.auditLog.create({
      data: {
        organizationId,
        userId,
        action: 'invite.cancelled',
        resource: 'invite',
        resourceId: inviteId,
        metadata: {
          email: invite.email,
        },
      },
    });
  });

  return { success: true };
}

/**
 * Resend an invitation
 */
export async function resendInvitation(
  inviteId: string,
  organizationId: string,
  userId: string
) {
  const member = await prisma.organizationMember.findUnique({
    where: {
      userId_organizationId: {
        userId,
        organizationId,
      },
    },
    include: {
      user: true,
      organization: true,
    },
  });

  if (!member || !['OWNER', 'ADMIN'].includes(member.role)) {
    throw new Error('You do not have permission to resend invitations');
  }

  const invite = await prisma.organizationInvite.findFirst({
    where: {
      id: inviteId,
      organizationId,
    },
  });

  if (!invite) {
    throw new Error('Invitation not found');
  }

  // Update expiration and token
  const updatedInvite = await prisma.organizationInvite.update({
    where: { id: inviteId },
    data: {
      token: generateInviteToken(),
      expiresAt: addDays(new Date(), 7),
    },
    include: {
      organization: true,
    },
  });

  // Send email
  await sendInviteEmail(updatedInvite, member);

  return updatedInvite;
}

// app/api/organizations/[orgId]/invites/route.ts

import { NextResponse } from 'next/server';
import { auth } from '@/lib/auth';
import { createInvitation, getOrganizationInvites } from '@/lib/organizations/invitations';
import { z } from 'zod';

const createInviteSchema = z.object({
  email: z.string().email(),
  role: z.enum(['ADMIN', 'MEMBER', 'VIEWER']),
});

// GET - List pending invitations
export async function GET(
  request: Request,
  { params }: { params: { orgId: string } }
) {
  const session = await auth();

  if (!session?.user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    const invites = await getOrganizationInvites(params.orgId);
    return NextResponse.json({ invites });
  } catch (error) {
    console.error('Failed to fetch invites:', error);
    return NextResponse.json(
      { error: 'Failed to fetch invitations' },
      { status: 500 }
    );
  }
}

// POST - Create new invitation
export async function POST(
  request: Request,
  { params }: { params: { orgId: string } }
) {
  const session = await auth();

  if (!session?.user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    const body = await request.json();
    const { email, role } = createInviteSchema.parse(body);

    const invite = await createInvitation({
      organizationId: params.orgId,
      email,
      role,
      invitedById: session.user.id,
    });

    return NextResponse.json({ invite }, { status: 201 });
  } catch (error) {
    if (error instanceof z.ZodError) {
      return NextResponse.json(
        { error: 'Invalid input', details: error.errors },
        { status: 400 }
      );
    }
    if (error instanceof Error) {
      return NextResponse.json(
        { error: error.message },
        { status: 400 }
      );
    }
    console.error('Failed to create invitation:', error);
    return NextResponse.json(
      { error: 'Failed to create invitation' },
      { status: 500 }
    );
  }
}