@commonpub/layer 0.28.1 → 0.30.0

package/server/api/admin/audit.get.ts

@@ -9,7 +9,7 @@ const auditQuerySchema = z.object({
 
 export default defineEventHandler(async (event): Promise<PaginatedResponse<AuditLogItem>> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'audit.read');
   const db = useDB();
   const filters = parseQueryParams(event, auditQuerySchema);
 

package/server/api/admin/categories/[id].delete.ts

@@ -5,7 +5,7 @@ import { deleteContentCategory } from '@commonpub/server';
  * Delete a content category (admin only). System categories cannot be deleted.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/categories/[id].patch.ts

@@ -6,7 +6,7 @@ import { updateContentCategorySchema } from '@commonpub/schema';
  * Update a content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, updateContentCategorySchema);

package/server/api/admin/categories/index.get.ts

@@ -5,7 +5,7 @@ import { listContentCategories } from '@commonpub/server';
  * List all content categories (admin).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   return listContentCategories(db);
 });

package/server/api/admin/categories/index.post.ts

@@ -6,7 +6,7 @@ import { createContentCategorySchema } from '@commonpub/schema';
  * Create a new content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const body = await parseBody(event, createContentCategorySchema);
   return createContentCategory(db, body);

package/server/api/admin/content/[id].delete.ts

@@ -2,7 +2,7 @@ import { removeContent, removeFederatedContent } from '@commonpub/server';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'content.moderate');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/content/[id].patch.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Update admin-managed content fields (featured, editorial, category).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const { id: contentId } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, z.object({

package/server/api/admin/content/bulk-editorial.post.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Bulk update editorial status on multiple content items (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const body = await parseBody(event, z.object({
     ids: z.array(z.string().uuid()).min(1).max(100),

package/server/api/admin/features/index.get.ts

@@ -6,7 +6,7 @@ import type { FeatureFlags } from '@commonpub/config';
  * Returns current feature flags with metadata about defaults vs overrides.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'settings.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/features/index.put.ts

@@ -15,7 +15,7 @@ const updateFeaturesSchema = z.object({
  * To remove an override, omit the key from overrides.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'settings.manage');
 
   const body = await parseBody(event, updateFeaturesSchema);
   const db = useDB();

package/server/api/admin/federation/activity.get.ts

@@ -5,7 +5,7 @@ const VALID_STATUSES = ['pending', 'delivered', 'failed', 'processed'] as const;
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const query = getQuery(event);

package/server/api/admin/federation/clients.get.ts

@@ -2,7 +2,7 @@ import { listOAuthClients } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listOAuthClients(db);

package/server/api/admin/federation/clients.post.ts

@@ -8,7 +8,7 @@ const registerSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { instanceDomain, redirectUris } = await parseBody(event, registerSchema);
 

package/server/api/admin/federation/hub-mirrors/[id]/backfill.post.ts

@@ -3,7 +3,7 @@ import { backfillHubFromOutbox, fetchRemoteHubFollowers, repairFederatedHubPostA
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/hub-mirrors/index.get.ts

@@ -3,7 +3,7 @@ import { listFederatedHubs } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   return listFederatedHubs(db);

package/server/api/admin/federation/hub-mirrors/index.post.ts

@@ -8,7 +8,7 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/mirrors/[id]/backfill.post.ts

@@ -11,7 +11,7 @@ function extractDomain(url: string): string {
  * Admin only.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/mirrors/[id].delete.ts

@@ -2,7 +2,7 @@ import { cancelMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].get.ts

@@ -2,7 +2,7 @@ import { getMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].put.ts

@@ -7,7 +7,7 @@ const updateMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const { action } = await parseBody(event, updateMirrorSchema);

package/server/api/admin/federation/mirrors/index.get.ts

@@ -2,7 +2,7 @@ import { listMirrors } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listMirrors(db);

package/server/api/admin/federation/mirrors/index.post.ts

@@ -11,7 +11,7 @@ const createMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const input = await parseBody(event, createMirrorSchema);
 

package/server/api/admin/federation/pending.get.ts

@@ -8,7 +8,7 @@ import { activities } from '@commonpub/schema';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const pending = await db

package/server/api/admin/federation/refederate.post.ts

@@ -18,7 +18,7 @@ export default defineEventHandler(async (event) => {
   if (cliSecret && cliSecret === runtimeConfig.authSecret) {
     // Authorized via shared secret
   } else {
-    requireAdmin(event);
+    requirePermission(event, 'federation.manage');
   }
 
   const config = useConfig();

package/server/api/admin/federation/repair-types.post.ts

@@ -7,7 +7,7 @@ import { repairFederatedContentTypes } from '@commonpub/server';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return repairFederatedContentTypes(db);

package/server/api/admin/federation/retry.post.ts

@@ -12,7 +12,7 @@ const retrySchema = z.object({
  * Optionally filter by activity ID.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/stats.get.ts

@@ -3,7 +3,7 @@ import { activities, followRelationships } from '@commonpub/schema';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const [inbound, outbound, pending, failed, followers, following] = await Promise.all([

package/server/api/admin/federation/trusted-instances.delete.ts

@@ -7,7 +7,7 @@ const removeSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, removeSchema);
 

package/server/api/admin/federation/trusted-instances.get.ts

@@ -2,7 +2,7 @@ import { getStoredTrustedInstances } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const config = useConfig();
 

package/server/api/admin/federation/trusted-instances.post.ts

@@ -7,7 +7,7 @@ const addSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, addSchema);
 

package/server/api/admin/homepage/sections.get.ts

@@ -5,7 +5,7 @@ import { getHomepageSections } from '@commonpub/server';
  * Returns homepage sections for admin editing.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
   const db = useDB();
   return getHomepageSections(db);
 });

package/server/api/admin/homepage/sections.put.ts

@@ -34,7 +34,7 @@ const updateSectionsSchema = z.object({
  * Save homepage section configuration.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'layout.manage');
   const db = useDB();
   const body = await parseBody(event, updateSectionsSchema);
 

package/server/api/admin/layouts/[id]/publish.post.ts

@@ -14,7 +14,7 @@ import { invalidateLayoutsByRouteCache } from '../../../../utils/layoutCache';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id]/versions/[versionId]/revert.post.ts

@@ -15,7 +15,7 @@ import { invalidateLayoutsByRouteCache } from '../../../../../../utils/layoutCac
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id]/versions/index.get.ts

@@ -12,7 +12,7 @@ import { getLayoutById, listLayoutVersions } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id].delete.ts

@@ -15,7 +15,7 @@ import { invalidateLayoutsByRouteCache } from '../../../utils/layoutCache';
 export default defineEventHandler(async (event): Promise<{ ok: true; id: string }> => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id].get.ts

@@ -11,7 +11,7 @@ import { getLayoutById } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
 
   const id = getRouterParam(event, 'id');
   if (!id) {

package/server/api/admin/layouts/[id].put.ts

@@ -27,7 +27,7 @@ import { validateSectionConfigs } from '../../../utils/validateSectionConfigs';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/index.get.ts

@@ -12,7 +12,7 @@ import { listLayouts } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
 
   const db = useDB();
   const query = getQuery(event) as { scope?: string };

package/server/api/admin/layouts/index.post.ts

@@ -19,7 +19,7 @@ import { validateSectionConfigs } from '../../../utils/validateSectionConfigs';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const body = await parseBody(event, layoutCreateSchema);

package/server/api/admin/layouts/migrate-homepage.post.ts

@@ -38,7 +38,7 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
 
   const body = await readBody(event).catch(() => ({}));
   const { force } = bodySchema.parse(body ?? {});

package/server/api/admin/layouts/seed-homepage.post.ts

@@ -24,7 +24,7 @@ import { invalidateLayoutsByRouteCache } from '../../../utils/layoutCache';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const result = await seedHomepageLayout(db, { adminId: admin.id });

package/server/api/admin/navigation/items.get.ts

@@ -5,7 +5,7 @@ import { getNavItems } from '@commonpub/server';
  * Returns navigation items for admin editing.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'navigation.manage');
   const db = useDB();
   return getNavItems(db);
 });

package/server/api/admin/navigation/items.put.ts

@@ -26,7 +26,7 @@ const updateNavSchema = z.object({
  * Save navigation item configuration.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'navigation.manage');
   const db = useDB();
   const body = await parseBody(event, updateNavSchema);
 

package/server/api/admin/reports/[id]/resolve.post.ts

@@ -3,7 +3,7 @@ import { resolveReportSchema } from '@commonpub/schema';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'reports.review');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const input = await parseBody(event, resolveReportSchema);

package/server/api/admin/reports.get.ts

@@ -10,7 +10,7 @@ const reportsQuerySchema = z.object({
 
 export default defineEventHandler(async (event): Promise<PaginatedResponse<ReportListItem>> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'reports.review');
   const db = useDB();
   const filters = parseQueryParams(event, reportsQuerySchema);
 

package/server/api/admin/search/reindex.post.ts

@@ -10,7 +10,7 @@ import type { MeiliClient } from '@commonpub/server';
  */
 export default defineEventHandler(async (event) => {
   const user = requireAuth(event);
-  requireAdmin(event);
+  requirePermission(event, 'search.manage');
 
   const meiliUrl = process.env.MEILI_URL;
   const meiliKey = process.env.MEILI_MASTER_KEY;

package/server/api/admin/settings.get.ts

@@ -2,7 +2,7 @@ import { getInstanceSettings } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'settings.manage');
   const db = useDB();
   const config = useConfig();
 

package/server/api/admin/settings.put.ts

@@ -3,7 +3,7 @@ import { adminSettingSchema } from '@commonpub/schema';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'settings.manage');
   const db = useDB();
   const input = await parseBody(event, adminSettingSchema);
 

package/server/api/admin/stats.get.ts

@@ -3,7 +3,7 @@ import type { PlatformStats } from '@commonpub/server';
 
 export default defineEventHandler(async (event): Promise<PlatformStats> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'audit.read');
   const db = useDB();
   return getPlatformStats(db);
 });

package/server/api/admin/storage/backfill-cdn-urls.post.ts

@@ -34,7 +34,7 @@ function spacesHosts(): { origin: string; cdn: string } | null {
 
 export default defineEventHandler(async (event) => {
   requireAuth(event);
-  requireAdmin(event);
+  requirePermission(event, 'storage.manage');
 
   const hosts = spacesHosts();
   if (!hosts) {

package/server/api/admin/themes/[id].delete.ts

@@ -13,7 +13,7 @@ import {
 
 export default defineEventHandler(async (event): Promise<{ ok: true; resetDefault: boolean }> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'theme.manage');
   const db = useDB();
 
   const { id } = parseParams(event, { id: 'string' });

package/server/api/admin/themes/[id].get.ts

@@ -7,7 +7,7 @@ import { getCustomTheme } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'theme.manage');
   const db = useDB();
 
   const { id } = parseParams(event, { id: 'string' });

package/server/api/admin/themes/[id].put.ts

@@ -9,7 +9,7 @@ import { getCustomTheme, saveCustomTheme } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'theme.manage');
   const db = useDB();
 
   const { id } = parseParams(event, { id: 'string' });

package/server/api/admin/themes/discover.get.ts

@@ -21,7 +21,7 @@ import { TOKEN_SPECS } from '@commonpub/ui';
 
 export default defineEventHandler((event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'theme.manage');
 
   const defaults: Record<string, string> = {};
   for (const spec of TOKEN_SPECS) {

package/server/api/admin/themes/index.get.ts

@@ -17,7 +17,7 @@ import { listCustomThemes } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'theme.manage');
   const db = useDB();
   const config = useConfig();
 

package/server/api/admin/themes/index.post.ts

@@ -12,7 +12,7 @@ const BUILT_IN_IDS = new Set(BUILT_IN_THEMES.map((t) => t.id));
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'theme.manage');
   const db = useDB();
 
   const input = await parseBody(event, customThemeSchema);

package/server/api/admin/users/[id]/role.put.ts

@@ -3,7 +3,7 @@ import { adminUpdateRoleSchema } from '@commonpub/schema';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'users.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const input = await parseBody(event, adminUpdateRoleSchema);

package/server/api/admin/users/[id]/status.put.ts

@@ -3,7 +3,7 @@ import { adminUpdateStatusSchema } from '@commonpub/schema';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'users.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const input = await parseBody(event, adminUpdateStatusSchema);

package/server/api/admin/users/[id].delete.ts

@@ -2,7 +2,7 @@ import { deleteUser } from '@commonpub/server';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'users.delete');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/users.get.ts

@@ -10,7 +10,7 @@ const adminUsersQuerySchema = z.object({
 
 export default defineEventHandler(async (event): Promise<PaginatedResponse<UserListItem>> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'users.read');
   const db = useDB();
   const filters = parseQueryParams(event, adminUsersQuerySchema);