feat: add team member role for team-level permission control by elrrrrrrr · Pull Request #1021 · cnpm/cnpmcore

elrrrrrrr · 2026-04-02T07:15:45Z

Summary

Add role field (owner / member) to TeamMember, enabling team-level permission control
Team creator is auto-added as team owner; team write operations (add/remove members, manage packages, delete team) now require team owner, org owner, or admin
Add private API GET /-/team/:org/:team/member returning [{user, role}]; npm compatible GET .../user still returns string array
PUT /-/team/:org/:team/user accepts optional role field as private extension (npm CLI unaffected)
Update docs to clearly distinguish npm compatible vs private endpoints

Changes

Area	Files
Entity/Model	`TeamMember.ts` entity + model — add `role` field
Service	`TeamService` — `addMember` supports role, `createTeam` auto-adds creator as owner
Service	`OrgService` — set role on `createOrg` and `addMember`
Controller	`TeamController` — new `requireTeamWriteAccess` with team owner check, new `/member` endpoint
Controller	`OrgController` — adapt to updated `listTeamsByUserIdAndOrgId` return type
Repository	`TeamRepository` — `listTeamsByUserIdAndOrgId` returns `{team, role}`, `addMember` supports update
SQL	`3.81.0.sql` migration for MySQL + PostgreSQL
Docs	`docs/org-team.md` — protocol compatibility section, npm vs private API table
Tests	34 passing — covers role CRUD, permission checks, npm compatibility

Test plan

34 unit tests passing (egg-bin test test/port/controller/TeamController/index.test.ts)
Verify npm CLI commands (npm team ls/create/destroy, npm access grant/revoke) still work unchanged
Verify private API GET /-/team/:org/:team/member returns role info
Verify non-owner users are blocked from team write operations in allowScopes org

🤖 Generated with Claude Code

…ontrol - Add `role` field to TeamMember entity/model (owner or member, default member) - Team creator is auto-added as team owner - Team write operations (add/remove members, manage packages, delete team) now require team owner, org owner, or admin - Add private API `GET /-/team/:org/:team/member` returning [{user, role}] - Keep npm compatible `GET /-/team/:org/:team/user` returning string array unchanged - `PUT /-/team/:org/:team/user` accepts optional `role` field (private extension) - `GET /-/user/:username/team?org=` now returns role info - Update docs to distinguish npm compatible vs private endpoints Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-04-02T07:15:54Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e7cd9ebb-0c72-49c9-b87d-7613709de294

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/user-team-api

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

fengmk2 · 2026-04-02T07:16:42Z

@codex review

gemini-code-assist

Code Review

This pull request introduces a 'role' field to team members, enabling an 'owner' role for teams. It includes updates to the database schema, core services, and controllers to support this new role, including auto-assigning the creator as a team owner and allowing team owners to manage their teams. The reviewer suggests validating the role values in the service layer and centralizing the role definition to ensure consistency across the application.

… member role Private API for promoting/demoting team members (owner <-> member). Required since npm CLI cannot pass role when adding members. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…amMember - Remove GET /-/user/:username/team (duplicate of GET /-/org/:orgName/member/:username/team) - Remove role field from PUT /-/team/:org/:team/user (role changes only via PATCH) - Update docs and tests accordingly Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cover all endpoints with 401/403/404/422 cases, permission path combinations (admin, org owner, team owner, member), allowScopes org operations, and idempotency checks. 75 tests total. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- org-team.md: Chinese version (consistent with other docs) - org-team.en.md: English version Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

3.77.0 SQL files are already released, must not be modified. The role column is added only via the 3.81.0 incremental migration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codecov · 2026-04-02T07:53:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.22%. Comparing base (0fed89d) to head (498031b).
⚠️ Report is 3 commits behind head on 3.x.

Additional details and impacted files

@@            Coverage Diff             @@
##              3.x    #1021      +/-   ##
==========================================
+ Coverage   96.06%   96.22%   +0.15%     
==========================================
  Files         208      208              
  Lines       20902    21018     +116     
  Branches     2793     2852      +59     
==========================================
+ Hits        20079    20224     +145     
+ Misses        823      794      -29

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Cover the 404 path when a non-allowScopes org is not found in write operations (line 74 of TeamController.ts). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

[skip ci] ## 3.81.0 (2026-04-02) * feat: add team member role for team-level permission control (#1021) ([3445251](3445251)), closes [#1021](#1021)

github-actions · 2026-04-02T11:15:58Z

🎉 This PR is included in version 3.81.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

…ontrol Cherry-pick from PR #1021 (feat/user-team-api branch). - Add `role` field to TeamMember entity/model (owner or member, default member) - Team creator is auto-added as team owner - Team write operations now require team owner, org owner, or admin - Add private API `GET /-/team/:org/:team/member` returning [{user, role}] - Add private API `PATCH /-/team/:org/:team/member/:username` for role updates - Keep npm compatible endpoints unchanged - Update docs (Chinese + English) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary Cherry-pick from #1021 (`feat/user-team-api` branch). - Add `role` field (`owner` / `member`) to `TeamMember`, enabling team-level permission control - Team creator is auto-added as team owner; team write operations now require **team owner**, org owner, or admin - Add private API `GET /-/team/:org/:team/member` returning `[{user, role}]` - Add private API `PATCH /-/team/:org/:team/member/:username` for updating member role - Keep npm compatible endpoints unchanged - Update docs (Chinese + English) - SQL migration: `4.32.0.sql` adds `role` column to `team_members` ## Test plan - [x] Run `npm run test:local test/port/controller/TeamController/index.test.ts` - [x] Run full test suite - [x] Verify npm CLI commands still work unchanged 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **New Features** * Team members can now have assignable roles (owner or member) controlling team permissions * New API endpoints to view team member roles and update member permissions * Team creators automatically receive team owner status upon team creation * **Documentation** * Added comprehensive guide to organization, team, and package permission models with API endpoint reference  --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

[skip ci] ## 4.32.0 (2026-04-08) * feat: add team member role for team-level permission control (#1023) ([d2fd3c5](d2fd3c5)), closes [#1023](#1023) [#1021](#1021) * chore(deps): update dependency oxfmt to ^0.44.0 (#1025) ([2d5df34](2d5df34)), closes [#1025](#1025) * chore(deps): update dependency oxlint-tsgolint to ^0.20.0 (#1024) ([407d659](407d659)), closes [#1024](#1024)

gemini-code-assist Bot reviewed Apr 2, 2026

View reviewed changes

Comment thread app/core/service/TeamService.ts

Comment thread app/port/controller/TeamController.ts Outdated

elrrrrrrr and others added 7 commits April 2, 2026 15:23

feat: add PATCH /-/team/:org/:team/member/:username for updating team…

833af91

… member role Private API for promoting/demoting team members (owner <-> member). Required since npm CLI cannot pass role when adding members. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs: explain npm original model limitation and team role extension

8197674

docs: split org-team docs into Chinese and English files

1f02a5c

- org-team.md: Chinese version (consistent with other docs) - org-team.en.md: English version Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: add missing role field in ReadAccessAuth test

7ee1544

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: revert baseline DDL changes, role column only in 3.81.0 migration

3988230

3.77.0 SQL files are already released, must not be modified. The role column is added only via the 3.81.0 incremental migration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

test: add org not found test for requireTeamWriteAccess coverage

498031b

Cover the 404 path when a non-allowScopes org is not found in write operations (line 74 of TeamController.ts). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

elrrrrrrr marked this pull request as ready for review April 2, 2026 08:23

elrrrrrrr requested review from fengmk2 and killagu April 2, 2026 08:38

fengmk2 approved these changes Apr 2, 2026

View reviewed changes

fengmk2 added this pull request to the merge queue Apr 2, 2026

github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Apr 2, 2026

fengmk2 merged commit 3445251 into 3.x Apr 2, 2026
20 of 21 checks passed

fengmk2 deleted the feat/user-team-api branch April 2, 2026 11:13

fengmk2 pushed a commit that referenced this pull request Apr 2, 2026

Release 3.81.0

c217fe7

[skip ci] ## 3.81.0 (2026-04-02) * feat: add team member role for team-level permission control (#1021) ([3445251](3445251)), closes [#1021](#1021)

github-actions Bot added the released on @3.x label Apr 2, 2026

elrrrrrrr mentioned this pull request Apr 2, 2026

feat: add team member role for team-level permission control #1023

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add team member role for team-level permission control#1021

feat: add team member role for team-level permission control#1021
fengmk2 merged 9 commits into3.xfrom
feat/user-team-api

elrrrrrrr commented Apr 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading

Review skipped

Uh oh!

fengmk2 commented Apr 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

elrrrrrrr commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

coderabbitai Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

fengmk2 commented Apr 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

elrrrrrrr commented Apr 2, 2026 •

edited

Loading

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading

codecov Bot commented Apr 2, 2026 •

edited

Loading