Team Collaboration, Security Fixes, and Quota Isolation (#311)

* feat: team collaboration, auth response fixes, and member limit enforcement

* fix: apply CodeRabbit auto-fixes

Fixed 21 file(s) based on 19 unresolved review comments.

Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

* fix: resolve failing dashboard and react sdk tests

* chore: add migration script to clean up duplicate pending invitations

* fix: restore missing transitive dependencies in lockfile

* chore: remove unnecessary migration script for invitations

* fix: restore original working package-lock.json before CodeRabbit corruption

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

Author: 3 people

apps/dashboard-api/src/__tests__/auth.controller.test.js

@@ -242,7 +242,7 @@ describe('auth.controller', () => {
 
             expect(next).toHaveBeenCalledWith(expect.any(AppError));
             expect(next.mock.calls[0][0].statusCode).toBe(400);
-            expect(next.mock.calls[0][0].message).toBe('User not found');
+            expect(next.mock.calls[0][0].message).toBe('Invalid email or password');
         });
 
         test('returns 400 on invalid password', async () => {
@@ -256,7 +256,7 @@ describe('auth.controller', () => {
 
             expect(next).toHaveBeenCalledWith(expect.any(AppError));
             expect(next.mock.calls[0][0].statusCode).toBe(400);
-            expect(next.mock.calls[0][0].message).toBe('Invalid password');
+            expect(next.mock.calls[0][0].message).toBe('Invalid email or password');
         });
 
         test('returns 400 on Zod validation error (missing password)', async () => {

apps/dashboard-api/src/__tests__/loadProjectForAdmin.test.js

@@ -11,7 +11,8 @@ jest.mock('@urbackend/common', () => ({
     AppError,
     Project: {
         findOne: jest.fn()
-    }
+    },
+    getProjectAccessQuery: jest.fn((userId) => ({ $or: [{ owner: userId }, { "members.user": userId }] }))
 }));
 
 const { Project } = require('@urbackend/common');
@@ -48,7 +49,7 @@ describe('loadProjectForAdmin Middleware', () => {
 
         await loadProjectForAdmin(req, res, next);
 
-        expect(Project.findOne).toHaveBeenCalledWith({ _id: 'proj123', owner: 'user123' });
+        expect(Project.findOne).toHaveBeenCalledWith({ _id: 'proj123', $or: [{ owner: 'user123' }, { "members.user": 'user123' }] });
         expect(next).toHaveBeenCalledTimes(1);
         expect(next).toHaveBeenCalledWith(expect.any(AppError));
         const error = next.mock.calls[0][0];
@@ -63,7 +64,7 @@ describe('loadProjectForAdmin Middleware', () => {
 
         await loadProjectForAdmin(req, res, next);
 
-        expect(Project.findOne).toHaveBeenCalledWith({ _id: 'proj123', owner: 'user123' });
+        expect(Project.findOne).toHaveBeenCalledWith({ _id: 'proj123', $or: [{ owner: 'user123' }, { "members.user": 'user123' }] });
         expect(req.project).toEqual(mockProject);
         expect(next).toHaveBeenCalledTimes(1);
         expect(next).toHaveBeenCalledWith();

apps/dashboard-api/src/__tests__/project.controller.softDelete.test.js

@@ -24,7 +24,8 @@ jest.mock('@urbackend/common', () => ({
             this.statusCode = statusCode;
             this.isOperational = true;
         }
-    }
+    },
+    getProjectAccessQuery: jest.fn((userId) => ({ $or: [{ owner: userId }, { "members.user": userId }] }))
 }));
 
 const { deleteRow, recoverRow } = require('../controllers/project.controller');
@@ -142,7 +143,13 @@ describe('Soft Delete in dashboard project.controller', () => {
 
         await recoverRow(req, res, next);
 
-        expect(mockFindOne).toHaveBeenCalledWith({ _id: 'proj_1', owner: 'user_1' });
+        expect(mockFindOne).toHaveBeenCalledWith({ 
+            _id: 'proj_1', 
+            $or: [
+                { owner: 'user_1' },
+                { 'members.user': 'user_1' }
+            ]
+        });
         expect(mockFindOneAndUpdate).toHaveBeenCalledWith(
             expect.objectContaining({ 
                 _id: '507f1f77bcf86cd799439011', 

apps/dashboard-api/src/__tests__/routes.projects.storage.test.js

@@ -15,14 +15,21 @@ jest.mock('../middlewares/planEnforcement', () => ({
   checkByodGate: jest.fn((_req, _res, next) => next()),
   checkWebhookGate: jest.fn((_req, _res, next) => next()),
   checkMailTemplatesGate: jest.fn((_req, _res, next) => next()),
+  checkMemberLimit: jest.fn((_req, _res, next) => next()),
 }));
 
 jest.mock('@urbackend/common', () => ({
   verifyEmail: jest.fn((_req, _res, next) => next()),
   checkAuthEnabled: jest.fn((_req, _res, next) => next()),
-  loadProjectForAdmin: jest.fn((_req, _res, next) => next()),
 }));
 
+const mockAuthZ = jest.fn((req, res, next) => next());
+jest.mock('../middlewares/authorizeProject', () => {
+  const m = jest.fn(() => mockAuthZ);
+  m.middleware = mockAuthZ;
+  return m;
+});
+
 jest.mock('../controllers/userAuth.controller', () => ({
   createAdminUser: jest.fn((_req, res) => res.json({ ok: true })),
   resetPassword: jest.fn((_req, res) => res.json({ ok: true })),
@@ -76,6 +83,10 @@ jest.mock('../controllers/project.controller', () => {
     manageContacts: jest.fn(ok),
     deleteContact: jest.fn(ok),
     sendMarketingBroadcast: jest.fn(ok),
+    getMembers: jest.fn(ok),
+    inviteMember: jest.fn(ok),
+    updateMemberRole: jest.fn(ok),
+    removeMember: jest.fn(ok),
   };
 });
 
@@ -84,7 +95,8 @@ const request = require('supertest');
 const projectsRouter = require('../routes/projects');
 const projectController = require('../controllers/project.controller');
 const authMiddleware = require('../middlewares/authMiddleware');
-const { verifyEmail, loadProjectForAdmin } = require('@urbackend/common');
+const { verifyEmail } = require('@urbackend/common');
+const authorizeProject = require('../middlewares/authorizeProject');
 
 let app;
 
@@ -112,7 +124,7 @@ describe('projects storage presigned routes', () => {
     expect(res.status).toBe(200);
     expect(authMiddleware).toHaveBeenCalled();
     expect(verifyEmail).toHaveBeenCalled();
-    expect(loadProjectForAdmin).toHaveBeenCalled();
+    expect(authorizeProject.middleware).toHaveBeenCalled();
     expect(projectController.requestUpload).toHaveBeenCalledTimes(1);
   });
 
@@ -124,7 +136,7 @@ describe('projects storage presigned routes', () => {
     expect(res.status).toBe(200);
     expect(authMiddleware).toHaveBeenCalled();
     expect(verifyEmail).toHaveBeenCalled();
-    expect(loadProjectForAdmin).toHaveBeenCalled();
+    expect(authorizeProject.middleware).toHaveBeenCalled();
     expect(projectController.confirmUpload).toHaveBeenCalledTimes(1);
   });
 });

apps/dashboard-api/src/__tests__/storage.presigned.controller.test.js

@@ -51,6 +51,7 @@ jest.mock('@urbackend/common', () => {
       return normalized;
     }),
     AppError,
+    getProjectAccessQuery: jest.fn((userId) => ({ owner: userId })),
     __mockStorageFrom: mockStorageFrom,
   };
 });

apps/dashboard-api/src/__tests__/webhook.controller.test.js

@@ -51,6 +51,7 @@ jest.mock('@urbackend/common', () => {
             });
         }
     },
+    getProjectAccessQuery: jest.fn((userId) => ({ owner: userId })),
   };
 });
 

apps/dashboard-api/src/app.js

@@ -106,6 +106,7 @@ const billingRoute = require('./routes/billing');
 const eventsRoute = require('./routes/events');
 const adminMetricsRoute = require('./routes/admin.metrics');
 const aiRoute = require('./routes/ai.routes');
+const invitationsRoute = require('./routes/invitations');
 
 app.use('/api/auth', authRoute); 
 app.use('/api/projects', dashboardLimiter, projectRoute);
@@ -116,6 +117,7 @@ app.use('/api/analytics', dashboardLimiter, analyticsRoute);
 app.use('/api/billing', billingRoute);
 app.use('/api/events', dashboardLimiter, eventsRoute);
 app.use('/api/admin/metrics', dashboardLimiter, adminMetricsRoute);
+app.use('/api/invitations', dashboardLimiter, invitationsRoute);
 
 
 

apps/dashboard-api/src/controllers/ai.controller.js

@@ -1,6 +1,6 @@
 const { Project } = require('@urbackend/common/src/models');
 const { forwardToPythonService } = require('../utils/internalPythonClient');
-const { AppError, ApiResponse } = require('@urbackend/common');
+const { AppError, ApiResponse, getProjectAccessQuery } = require('@urbackend/common');
 
 /**
  * Controller to handle AI Query Builder requests.
@@ -35,7 +35,7 @@ const queryBuilder = async (req, res, next) => {
 
         // 1. Fetch the project and specifically the requested collection schema
         const project = await Project.findOne(
-            { _id: projectId, owner: req.user._id, "collections.name": safeCollectionName },
+            { ...getProjectAccessQuery(req.user._id), _id: projectId, "collections.name": safeCollectionName },
             { "collections.$": 1 }
         );
 

apps/dashboard-api/src/controllers/analytics.controller.js

@@ -1,4 +1,4 @@
-const { Project, Log, Developer, Webhook, getConnection, resolveEffectivePlan, getPlanLimits, PlatformEvent, DeveloperActivity, AppError, ApiResponse } = require("@urbackend/common");
+const { Project, Log, Developer, Webhook, getConnection, resolveEffectivePlan, getPlanLimits, PlatformEvent, DeveloperActivity, AppError, ApiResponse, getProjectAccessQuery } = require("@urbackend/common");
 const mongoose = require("mongoose");
 
 /**
@@ -12,12 +12,7 @@ module.exports.getGlobalStats = async (req, res, next) => {
     const [stats, dev] = await Promise.all([
       Project.aggregate([
         { 
-          $match: { 
-            $or: [
-              { owner: user_id },
-              { owner: userId }
-            ]
-          } 
+          $match: { owner: userId },
         },
         {
           $group: {
@@ -90,7 +85,7 @@ module.exports.getGlobalStats = async (req, res, next) => {
 module.exports.getRecentActivity = async (req, res, next) => {
   try {
     const userId = req.user._id;
-    const projectIds = await Project.find({ owner: userId }).distinct("_id");
+    const projectIds = await Project.find(getProjectAccessQuery(userId)).distinct("_id");
 
     const logs = await Log.find({ projectId: { $in: projectIds } })
       .sort({ timestamp: -1 })
@@ -271,7 +266,7 @@ module.exports.getNorthStar = async (req, res, next) => {
     const sevenDaysAgo = new Date();
     sevenDaysAgo.setUTCDate(sevenDaysAgo.getUTCDate() - 7);
 
-    // Projects owned by this developer
+    // Projects owned by this developer (North Star should be owner-only)
     const allProjects = await Project.find({ owner: developerId }).select('_id name').lean();
     const projectIds = allProjects.map((p) => p._id);
     const totalProjects = projectIds.length;

apps/dashboard-api/src/controllers/auth.controller.js

@@ -320,10 +320,10 @@ module.exports.login = async (req, res, next) => {
         const { email, password } = loginSchema.parse(req.body);
 
         const dev = await Developer.findOne({ email: email.toLowerCase().trim() }).select('+password');
-        if (!dev) return next(new AppError(400, "User not found"));
+        if (!dev) return next(new AppError(400, "Invalid email or password"));
 
         const validPass = await bcrypt.compare(password, dev.password);
-        if (!validPass) return next(new AppError(400, "Invalid password"));
+        if (!validPass) return next(new AppError(400, "Invalid email or password"));
 
         await sendTokenResponse(dev, 200, res);
     } catch (err) {