feat: Org/Team permission model with private package support

app/common/CryptoUtil.ts

@@ -7,18 +7,16 @@ export function genRSAKeys(): { publicKey: string; privateKey: string } {
   const key = generateKeyPairSync('rsa', {
     modulusLength: 512,
   });
-  const publicKey = key.publicKey
-    .export({
-      type: 'pkcs1',
-      format: 'pem',
-    })
-    .toString('base64');
-  const privateKey = key.privateKey
-    .export({
-      type: 'pkcs1',
-      format: 'pem',
-    })
-    .toString('base64');
+  // export({ format: 'pem' }) returns string; .toString('base64') is a no-op on string.
+  // Use type assertion to fix TS2554 on Node 18 type definitions.
+  const publicKey = key.publicKey.export({
+    type: 'pkcs1',
+    format: 'pem',
+  }) as string;
+  const privateKey = key.privateKey.export({
+    type: 'pkcs1',
+    format: 'pem',
+  }) as string;
   return { publicKey, privateKey };
 }
 

app/common/constants.ts

@@ -1,4 +1,5 @@
 export const BUG_VERSIONS = 'bug-versions';
+export const DEVELOPERS_TEAM = 'developers';
 export const LATEST_TAG = 'latest';
 export const GLOBAL_WORKER = 'GLOBAL_WORKER';
 export const PROXY_CACHE_DIR_NAME = 'proxy-cache-packages';

app/core/entity/Org.ts

@@ -0,0 +1,29 @@
+import { EasyData, EntityUtil } from '../util/EntityUtil.ts';
+import { Entity, EntityData } from './Entity.ts';
+
+interface OrgData extends EntityData {
+  orgId: string;
+  name: string;
+  description: string;
+}
+
+export type CreateOrgData = Omit<EasyData<OrgData, 'orgId'>, 'id' | 'description'> & { description?: string };
+
+export class Org extends Entity {
+  orgId: string;
+  name: string;
+  description: string;
+
+  constructor(data: OrgData) {
+    super(data);
+    this.orgId = data.orgId;
+    this.name = data.name;
+    this.description = data.description ?? '';
+  }
+
+  static create(data: CreateOrgData): Org {
+    const fullData = { ...data, description: data.description ?? '' };
+    const newData = EntityUtil.defaultData(fullData, 'orgId');
+    return new Org(newData);
+  }
+}

app/core/entity/OrgMember.ts

@@ -0,0 +1,31 @@
+import { EasyData, EntityUtil } from '../util/EntityUtil.ts';
+import { Entity, EntityData } from './Entity.ts';
+
+interface OrgMemberData extends EntityData {
+  orgMemberId: string;
+  orgId: string;
+  userId: string;
+  role: 'owner' | 'member';
+}
+
+export type CreateOrgMemberData = Omit<EasyData<OrgMemberData, 'orgMemberId'>, 'id'>;
+
+export class OrgMember extends Entity {
+  orgMemberId: string;
+  orgId: string;
+  userId: string;
+  role: 'owner' | 'member';
+
+  constructor(data: OrgMemberData) {
+    super(data);
+    this.orgMemberId = data.orgMemberId;
+    this.orgId = data.orgId;
+    this.userId = data.userId;
+    this.role = data.role;
+  }
+
+  static create(data: CreateOrgMemberData): OrgMember {
+    const newData = EntityUtil.defaultData(data, 'orgMemberId');
+    return new OrgMember(newData);
+  }
+}

app/core/entity/Team.ts

@@ -0,0 +1,32 @@
+import { EasyData, EntityUtil } from '../util/EntityUtil.ts';
+import { Entity, EntityData } from './Entity.ts';
+
+interface TeamData extends EntityData {
+  teamId: string;
+  orgId: string;
+  name: string;
+  description: string;
+}
+
+export type CreateTeamData = Omit<EasyData<TeamData, 'teamId'>, 'id' | 'description'> & { description?: string };
+
+export class Team extends Entity {
+  teamId: string;
+  orgId: string;
+  name: string;
+  description: string;
+
+  constructor(data: TeamData) {
+    super(data);
+    this.teamId = data.teamId;
+    this.orgId = data.orgId;
+    this.name = data.name;
+    this.description = data.description ?? '';
+  }
+
+  static create(data: CreateTeamData): Team {
+    const fullData = { ...data, description: data.description ?? '' };
+    const newData = EntityUtil.defaultData(fullData, 'teamId');
+    return new Team(newData);
+  }
+}

app/core/entity/TeamMember.ts

@@ -0,0 +1,28 @@
+import { EasyData, EntityUtil } from '../util/EntityUtil.ts';
+import { Entity, EntityData } from './Entity.ts';
+
+interface TeamMemberData extends EntityData {
+  teamMemberId: string;
+  teamId: string;
+  userId: string;
+}
+
+export type CreateTeamMemberData = Omit<EasyData<TeamMemberData, 'teamMemberId'>, 'id'>;
+
+export class TeamMember extends Entity {
+  teamMemberId: string;
+  teamId: string;
+  userId: string;
+
+  constructor(data: TeamMemberData) {
+    super(data);
+    this.teamMemberId = data.teamMemberId;
+    this.teamId = data.teamId;
+    this.userId = data.userId;
+  }
+
+  static create(data: CreateTeamMemberData): TeamMember {
+    const newData = EntityUtil.defaultData(data, 'teamMemberId');
+    return new TeamMember(newData);
+  }
+}

app/core/entity/TeamPackage.ts

@@ -0,0 +1,28 @@
+import { EasyData, EntityUtil } from '../util/EntityUtil.ts';
+import { Entity, EntityData } from './Entity.ts';
+
+interface TeamPackageData extends EntityData {
+  teamPackageId: string;
+  teamId: string;
+  packageId: string;
+}
+
+export type CreateTeamPackageData = Omit<EasyData<TeamPackageData, 'teamPackageId'>, 'id'>;
+
+export class TeamPackage extends Entity {
+  teamPackageId: string;
+  teamId: string;
+  packageId: string;
+
+  constructor(data: TeamPackageData) {
+    super(data);
+    this.teamPackageId = data.teamPackageId;
+    this.teamId = data.teamId;
+    this.packageId = data.packageId;
+  }
+
+  static create(data: CreateTeamPackageData): TeamPackage {
+    const newData = EntityUtil.defaultData(data, 'teamPackageId');
+    return new TeamPackage(newData);
+  }
+}

app/core/service/OrgService.ts

@@ -0,0 +1,141 @@
+import { AccessLevel, Inject, SingletonProto } from 'egg';
+import { ForbiddenError, NotFoundError } from 'egg/errors';
+
+import { AbstractService } from '../../common/AbstractService.ts';
+import { DEVELOPERS_TEAM } from '../../common/constants.ts';
+import type { OrgRepository } from '../../repository/OrgRepository.ts';
+import type { TeamRepository } from '../../repository/TeamRepository.ts';
+import { Org } from '../entity/Org.ts';
+import { OrgMember } from '../entity/OrgMember.ts';
+import { Team } from '../entity/Team.ts';
+import { TeamMember } from '../entity/TeamMember.ts';
+
+export interface CreateOrgCmd {
+  name: string;
+  description?: string;
+  creatorUserId: string;
+}
+
+@SingletonProto({
+  accessLevel: AccessLevel.PUBLIC,
+})
+export class OrgService extends AbstractService {
+  @Inject()
+  private readonly orgRepository: OrgRepository;
+
+  @Inject()
+  private readonly teamRepository: TeamRepository;
+
+  async createOrg(cmd: CreateOrgCmd): Promise<Org> {
+    const existing = await this.orgRepository.findOrgByName(cmd.name);
+    if (existing) {
+      throw new ForbiddenError(`Org "${cmd.name}" already exists`);
+    }
+
+    // Create org + developers team + owner + team member in one transaction
+    const org = Org.create({
+      name: cmd.name,
+      description: cmd.description,
+    });
+    const developersTeam = Team.create({
+      orgId: org.orgId,
+      name: DEVELOPERS_TEAM,
+      description: 'default team',
+    });
+    const ownerMember = OrgMember.create({
+      orgId: org.orgId,
+      userId: cmd.creatorUserId,
+      role: 'owner',
+    });
+    const teamMember = TeamMember.create({
+      teamId: developersTeam.teamId,
+      userId: cmd.creatorUserId,
+    });
+    await this.orgRepository.createOrgCascade(org, developersTeam, ownerMember, teamMember);
+
+    this.logger.info(
+      '[OrgService:createOrg] orgId: %s, name: %s, creatorUserId: %s',
+      org.orgId,
+      org.name,
+      cmd.creatorUserId,
+    );
+    return org;
+  }
+
+  async removeOrg(orgId: string): Promise<void> {
+    await this.orgRepository.removeOrgCascade(orgId);
+    this.logger.info('[OrgService:removeOrg] orgId: %s', orgId);
+  }
+
+  async findOrgByName(name: string): Promise<Org | null> {
+    return await this.orgRepository.findOrgByName(name);
+  }
+
+  // Auto-create org for allowScopes if it doesn't exist
+  async ensureOrgForScope(scope: string): Promise<Org> {
+    const orgName = scope.replace(/^@/, '');
+    const existing = await this.orgRepository.findOrgByName(orgName);
+    if (existing) return existing;
+
+    const org = Org.create({
+      name: orgName,
+      description: `Auto-created org for scope ${scope}`,
+    });
+    await this.orgRepository.saveOrg(org);
+    this.logger.info('[OrgService:ensureOrgForScope] orgId: %s, scope: %s', org.orgId, scope);
+    return org;
+  }
+
+  async addMember(orgId: string, userId: string, role: 'owner' | 'member' = 'member'): Promise<OrgMember> {
+    const org = await this.orgRepository.findOrgByOrgId(orgId);
+    if (!org) {
+      throw new NotFoundError('Org not found');
+    }
+
+    // Upsert org member
+    let member = await this.orgRepository.findMember(orgId, userId);
+    if (member) {
+      member.role = role;
+      await this.orgRepository.saveMember(member);
+    } else {
+      member = OrgMember.create({ orgId, userId, role });
+      await this.orgRepository.saveMember(member);
+    }
+
+    // Auto-add to developers team
+    const developersTeam = await this.teamRepository.findTeam(orgId, DEVELOPERS_TEAM);
+    if (developersTeam) {
+      const existingTeamMember = await this.teamRepository.findMember(developersTeam.teamId, userId);
+      if (!existingTeamMember) {
+        const teamMember = TeamMember.create({
+          teamId: developersTeam.teamId,
+          userId,
+        });
+        await this.teamRepository.addMember(teamMember);
+      }
+    }
+
+    this.logger.info('[OrgService:addMember] orgId: %s, userId: %s, role: %s', orgId, userId, role);
+    return member;
+  }
+
+  async removeMember(orgId: string, userId: string): Promise<void> {
+    // Remove from all teams in this org
+    await this.teamRepository.removeMemberFromAllTeams(orgId, userId);
+    // Remove from org
+    await this.orgRepository.removeMember(orgId, userId);
+    this.logger.info('[OrgService:removeMember] orgId: %s, userId: %s', orgId, userId);
+  }
+
+  async listMembers(orgId: string): Promise<OrgMember[]> {
+    return await this.orgRepository.listMembers(orgId);
+  }
+
+  async requiredOrgOwnerOrAdmin(orgId: string, userId: string, isAdmin: boolean): Promise<void> {
+    if (isAdmin) return;
+    const member = await this.orgRepository.findMember(orgId, userId);
+    if (!member || member.role !== 'owner') {
+      throw new ForbiddenError('Only org owner or admin can perform this action');
+    }
+  }
+}