@bongos/core 1.19.417 → 1.19.419

package/docs/api/openapi.json

@@ -77,6 +77,10 @@
       "name": "closeness",
       "description": "Endpoints under `/api/bongos/closeness`."
     },
+    {
+      "name": "connections",
+      "description": "Endpoints under `/api/bongos/connections`."
+    },
     {
       "name": "copy-desk",
       "description": "Endpoints under `/api/bongos/copy-desk`."
@@ -3435,6 +3439,330 @@
         ]
       }
     },
+    "/connections": {
+      "get": {
+        "operationId": "get_connections",
+        "tags": [
+          "connections"
+        ],
+        "summary": "GET /connections",
+        "description": "MY accepted connections (own data, keyed on the session). Own scope, so the counterparty floors on profile_state alone: a private account you connected with appears here and in no public list (D4 §2).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetConnectionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_connections",
+        "tags": [
+          "connections"
+        ],
+        "summary": "POST /connections",
+        "description": "ask to connect. The REQUESTER is always the session; the body names only who is being asked, and it names them by public handle.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostConnectionsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostConnectionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/connections/degree/{handle}": {
+      "get": {
+        "operationId": "get_connections_degree_handle",
+        "tags": [
+          "connections"
+        ],
+        "summary": "GET /connections/degree/:handle",
+        "description": "the degree label between the CALLER and one handle, plus the mutuals it was computed from (own-scope read, D4 §4). Bounded by construction: degreeBetween caps every level and answers null past the caps.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "parameters": [
+          {
+            "name": "handle",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `handle`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetConnectionsDegreeHandleResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/connections/requests": {
+      "get": {
+        "operationId": "get_connections_requests",
+        "tags": [
+          "connections"
+        ],
+        "summary": "GET /connections/requests",
+        "description": "MY pending requests, both directions (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetConnectionsRequestsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/connections/{id}": {
+      "delete": {
+        "operationId": "delete_connections_id",
+        "tags": [
+          "connections"
+        ],
+        "summary": "DELETE /connections/:id",
+        "description": "remove an accepted connection (either side may end it) or cancel a pending request I sent. An ADDRESSEE ending a pending row is a decline, not a delete, and is 404'd here so the cooldown cannot be dodged.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeleteConnectionsIdResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/connections/{id}/accept": {
+      "post": {
+        "operationId": "post_connections_id_accept",
+        "tags": [
+          "connections"
+        ],
+        "summary": "POST /connections/:id/accept",
+        "description": "accept a request addressed to ME. The addressee is the session; a row belonging to anyone else simply does not match, and the 404 that follows is what stops a builder acting on someone else's connection.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostConnectionsIdAcceptResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/connections/{id}/decline": {
+      "post": {
+        "operationId": "post_connections_id_decline",
+        "tags": [
+          "connections"
+        ],
+        "summary": "POST /connections/:id/decline",
+        "description": "decline a request addressed to ME. 204: the requester is never told, so there is nothing to return that they could ever observe.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/connections.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/copy-desk/flags": {
       "post": {
         "operationId": "post_copy_desk_flags",
@@ -8688,6 +9016,143 @@
         ]
       }
     },
+    "/me/sessions": {
+      "get": {
+        "operationId": "get_me_sessions",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/sessions",
+        "description": "GET /api/bongos/me/sessions — every live session on the CALLER's account. rank: any-builder (own identity only) — a builder owns their own sessions; the account is req.builder.id, never a caller-named one, so there is nothing here for a rank gate to protect.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-sessions.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMeSessionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/sessions/revoke": {
+      "post": {
+        "operationId": "post_me_sessions_revoke",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/sessions/revoke",
+        "description": "POST /api/bongos/me/sessions/revoke — kill ONE of the caller's own sessions. Body: { session_id }. Response: { ok, revoked: 0|1 }. Revoking the session that made the request is allowed and immediate: the response is written from a request that already authenticated, and the next call with that token fails. `revoked: 0` covers \"already gone\", \"never existed\" and \"not yours\" alike — the caller must not be able to probe for other people's session ids. rank: any-builder (own identity only) — the WHERE clause is the boundary.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-sessions.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMeSessionsRevokeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMeSessionsRevokeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/sessions/revoke-all": {
+      "post": {
+        "operationId": "post_me_sessions_revoke_all",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/sessions/revoke-all",
+        "description": "POST /api/bongos/me/sessions/revoke-all — sign out everywhere. Kills EVERY live session on the caller's account, the one making the request included. That total sweep is the point: this is the button somebody presses when they believe a token has leaked, and a remedy that spared one session would leave them guessing which. They sign in again afterwards. Response: { ok, revoked }. rank: any-builder (own identity only) — the sweep is keyed on req.builder.id.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-sessions.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMeSessionsRevokeAllResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/skill-prefs": {
       "get": {
         "operationId": "get_me_skill_prefs",
@@ -14914,6 +15379,15 @@
           "deleted"
         ]
       },
+      "DeleteConnectionsIdResponse": {
+        "type": "object",
+        "properties": {
+          "outcome": {}
+        },
+        "required": [
+          "outcome"
+        ]
+      },
       "DeleteDependenciesResponse": {
         "type": "object",
         "properties": {
@@ -15348,6 +15822,49 @@
           "why"
         ]
       },
+      "GetConnectionsDegreeHandleResponse": {
+        "type": "object",
+        "properties": {
+          "handle": {},
+          "degree": {},
+          "mutuals": {},
+          "mutual_count": {},
+          "truncated": {}
+        },
+        "required": [
+          "handle",
+          "degree",
+          "mutuals",
+          "mutual_count",
+          "truncated"
+        ]
+      },
+      "GetConnectionsRequestsResponse": {
+        "type": "object",
+        "properties": {
+          "incoming": {},
+          "outgoing": {},
+          "incoming_count": {},
+          "outgoing_count": {}
+        },
+        "required": [
+          "incoming",
+          "outgoing",
+          "incoming_count",
+          "outgoing_count"
+        ]
+      },
+      "GetConnectionsResponse": {
+        "type": "object",
+        "properties": {
+          "connections": {},
+          "count": {}
+        },
+        "required": [
+          "connections",
+          "count"
+        ]
+      },
       "GetDiscordChannelsPlanResponse": {
         "type": "object",
         "properties": {
@@ -15701,6 +16218,15 @@
           "ships"
         ]
       },
+      "GetMeSessionsResponse": {
+        "type": "object",
+        "properties": {
+          "sessions": {}
+        },
+        "required": [
+          "sessions"
+        ]
+      },
       "GetMeSkillPrefsResponse": {
         "type": "object",
         "properties": {
@@ -17786,6 +18312,41 @@
           "reward"
         ]
       },
+      "PostConnectionsIdAcceptResponse": {
+        "type": "object",
+        "properties": {
+          "status": {}
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "PostConnectionsRequest": {
+        "type": "object",
+        "properties": {
+          "handle": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 39
+          },
+          "note": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "handle"
+        ],
+        "additionalProperties": false
+      },
+      "PostConnectionsResponse": {
+        "type": "object",
+        "properties": {
+          "status": {}
+        },
+        "required": [
+          "status"
+        ]
+      },
       "PostCopyDeskFlagsIdCloseRequest": {
         "type": "object",
         "properties": {
@@ -18997,6 +19558,41 @@
           "linked"
         ]
       },
+      "PostMeSessionsRevokeAllResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "revoked": {}
+        },
+        "required": [
+          "ok",
+          "revoked"
+        ]
+      },
+      "PostMeSessionsRevokeRequest": {
+        "type": "object",
+        "properties": {
+          "session_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostMeSessionsRevokeResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "revoked": {}
+        },
+        "required": [
+          "ok",
+          "revoked"
+        ]
+      },
       "PostMemoryBuildersBuilderIdBfgWriteRequest": {
         "type": "object",
         "properties": {
@@ -20666,9 +21262,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 327,
-  "x-schema-count": 361,
+  "x-endpoint-count": 337,
+  "x-schema-count": 372,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 244,
+  "x-response-schemas": 253,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }