feat(member): add household lifecycle states

apps/bot/src/miniapp-admin.ts

@@ -1,6 +1,10 @@
 import type { HouseholdOnboardingService, MiniAppAdminService } from '@household/application'
 import type { Logger } from '@household/observability'
-import type { HouseholdBillingSettingsRecord } from '@household/ports'
+import {
+  HOUSEHOLD_MEMBER_LIFECYCLE_STATUSES,
+  type HouseholdBillingSettingsRecord,
+  type HouseholdMemberLifecycleStatus
+} from '@household/ports'
 import type { MiniAppSessionResult } from './miniapp-auth'
 import type { AssistantUsageTracker } from './dm-assistant'
 
@@ -217,6 +221,42 @@ async function readRentWeightPayload(request: Request): Promise<{
   }
 }
 
+async function readMemberStatusPayload(request: Request): Promise<{
+  initData: string
+  memberId: string
+  status: HouseholdMemberLifecycleStatus
+}> {
+  const clonedRequest = request.clone()
+  const payload = await readMiniAppRequestPayload(request)
+  if (!payload.initData) {
+    throw new Error('Missing initData')
+  }
+
+  const text = await clonedRequest.text()
+  let parsed: { memberId?: string; status?: string }
+  try {
+    parsed = JSON.parse(text)
+  } catch {
+    throw new Error('Invalid JSON body')
+  }
+
+  const memberId = parsed.memberId?.trim()
+  const status = parsed.status?.trim().toLowerCase()
+  if (!memberId || !status) {
+    throw new Error('Missing member status fields')
+  }
+
+  if (!(HOUSEHOLD_MEMBER_LIFECYCLE_STATUSES as readonly string[]).includes(status)) {
+    throw new Error('Invalid member status')
+  }
+
+  return {
+    initData: payload.initData,
+    memberId,
+    status: status as HouseholdMemberLifecycleStatus
+  }
+}
+
 function serializeBillingSettings(settings: HouseholdBillingSettingsRecord) {
   return {
     householdId: settings.householdId,
@@ -253,7 +293,15 @@ async function authenticateAdminSession(
 
   if (!session.authorized || !session.member) {
     return miniAppJsonResponse(
-      { ok: false, error: 'Access limited to active household members' },
+      { ok: false, error: 'Admin access required for active household members' },
+      403,
+      origin
+    )
+  }
+
+  if (session.member.status !== 'active' || !session.member.isAdmin) {
+    return miniAppJsonResponse(
+      { ok: false, error: 'Admin access required for active household members' },
       403,
       origin
     )
@@ -305,9 +353,14 @@ export function createMiniAppPendingMembersHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )
@@ -442,9 +495,14 @@ export function createMiniAppUpdateSettingsHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )
@@ -545,9 +603,14 @@ export function createMiniAppUpsertUtilityCategoryHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )
@@ -636,9 +699,14 @@ export function createMiniAppPromoteMemberHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )
@@ -718,9 +786,14 @@ export function createMiniAppUpdateMemberRentWeightHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )
@@ -769,6 +842,87 @@ export function createMiniAppUpdateMemberRentWeightHandler(options: {
   }
 }
 
+export function createMiniAppUpdateMemberStatusHandler(options: {
+  allowedOrigins: readonly string[]
+  botToken: string
+  onboardingService: HouseholdOnboardingService
+  miniAppAdminService: MiniAppAdminService
+  logger?: Logger
+}): {
+  handler: (request: Request) => Promise<Response>
+} {
+  const sessionService = createMiniAppSessionService({
+    botToken: options.botToken,
+    onboardingService: options.onboardingService
+  })
+
+  return {
+    handler: async (request) => {
+      const origin = allowedMiniAppOrigin(request, options.allowedOrigins)
+
+      if (request.method === 'OPTIONS') {
+        return miniAppJsonResponse({ ok: true }, 204, origin)
+      }
+
+      if (request.method !== 'POST') {
+        return miniAppJsonResponse({ ok: false, error: 'Method Not Allowed' }, 405, origin)
+      }
+
+      try {
+        const payload = await readMemberStatusPayload(request)
+        const session = await sessionService.authenticate({
+          initData: payload.initData
+        })
+
+        if (
+          !session ||
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
+          return miniAppJsonResponse(
+            { ok: false, error: 'Admin access required for active household members' },
+            session ? 403 : 401,
+            origin
+          )
+        }
+
+        const result = await options.miniAppAdminService.updateMemberStatus({
+          householdId: session.member.householdId,
+          actorIsAdmin: session.member.isAdmin,
+          memberId: payload.memberId,
+          status: payload.status
+        })
+
+        if (result.status === 'rejected') {
+          return miniAppJsonResponse(
+            {
+              ok: false,
+              error:
+                result.reason === 'member_not_found' ? 'Member not found' : 'Admin access required'
+            },
+            result.reason === 'member_not_found' ? 404 : 403,
+            origin
+          )
+        }
+
+        return miniAppJsonResponse(
+          {
+            ok: true,
+            authorized: true,
+            member: result.member
+          },
+          200,
+          origin
+        )
+      } catch (error) {
+        return miniAppErrorResponse(error, origin, options.logger)
+      }
+    }
+  }
+}
+
 export function createMiniAppApproveMemberHandler(options: {
   allowedOrigins: readonly string[]
   botToken: string
@@ -809,9 +963,14 @@ export function createMiniAppApproveMemberHandler(options: {
           )
         }
 
-        if (!session.authorized || !session.member) {
+        if (
+          !session.authorized ||
+          !session.member ||
+          session.member.status !== 'active' ||
+          !session.member.isAdmin
+        ) {
           return miniAppJsonResponse(
-            { ok: false, error: 'Access limited to active household members' },
+            { ok: false, error: 'Admin access required for active household members' },
             403,
             origin
           )