@commonpub/layer 0.29.0 → 0.31.0

package/pages/contests/[slug]/index.vue

@@ -51,7 +51,7 @@ interface Tab { key: string; label: string; icon: string; count?: number }
 const tabs = computed<Tab[]>(() => {
   const t: Tab[] = [{ key: 'overview', label: 'Overview', icon: 'fa-circle-info' }];
   if (c.value?.rules) t.push({ key: 'rules', label: 'Rules', icon: 'fa-file-lines' });
-  if (c.value?.prizes?.length) t.push({ key: 'prizes', label: 'Prizes', icon: 'fa-trophy' });
+  if (c.value?.prizes?.length || c.value?.prizesDescription) t.push({ key: 'prizes', label: 'Prizes', icon: 'fa-trophy' });
   t.push({ key: 'entries', label: 'Entries', icon: 'fa-box-open', count: c.value?.entryCount ?? entries.value.length });
   if (participants.value.length) t.push({ key: 'participants', label: 'Participants', icon: 'fa-users', count: participants.value.length });
   if (judges.value.length || isOwner.value) t.push({ key: 'judges', label: 'Judges', icon: 'fa-gavel', count: judges.value.length || undefined });
@@ -259,7 +259,8 @@ async function withdrawEntry(entryId: string): Promise<void> {
             <div class="cpub-about-section">
               <div class="cpub-sec-head"><h2><i class="fa fa-circle-info" style="color: var(--accent);"></i> About This Contest</h2></div>
               <div class="cpub-about-card">
-                <p>{{ c?.description || 'No description available for this contest.' }}</p>
+                <CpubMarkdown v-if="c?.description" :source="c.description" />
+                <p v-else>No description available for this contest.</p>
               </div>
             </div>
             <ContestJudgingCriteria v-if="c?.judgingCriteria?.length" :criteria="c.judgingCriteria" />
@@ -272,7 +273,7 @@ async function withdrawEntry(entryId: string): Promise<void> {
 
           <!-- PRIZES -->
           <div v-show="activeTab === 'prizes'" id="cpub-panel-prizes" role="tabpanel" aria-labelledby="cpub-tab-prizes" tabindex="0">
-            <ContestPrizes v-if="c?.prizes?.length" :prizes="c.prizes" />
+            <ContestPrizes v-if="c?.prizes?.length || c?.prizesDescription" :prizes="c?.prizes ?? []" :description="c?.prizesDescription" />
           </div>
 
           <!-- ENTRIES -->

package/pages/contests/[slug]/results.vue

@@ -5,7 +5,14 @@ const route = useRoute();
 const slug = route.params.slug as string;
 
 const { data: contest } = useLazyFetch<Serialized<ContestDetail>>(`/api/contests/${slug}`);
-const { data: entriesData } = useLazyFetch<{ items: Serialized<ContestEntryItem>[]; total: number }>(`/api/contests/${slug}/entries`);
+// Full standings: rank-ordered (not submit-ordered) + a high cap so every
+// finalist surfaces, not just the 20 most-recent entries.
+const { data: entriesData } = useLazyFetch<{ items: Serialized<ContestEntryItem>[]; total: number }>(
+  `/api/contests/${slug}/entries`,
+  { query: { order: 'rank', limit: 100 } },
+);
+const totalEntries = computed(() => entriesData.value?.total ?? 0);
+const shownEntries = computed(() => rankedEntries.value.length);
 const { data: votesData } = useLazyFetch<ContestEntryVoteInfo[]>(`/api/contests/${slug}/votes`);
 
 useSeoMeta({
@@ -43,8 +50,8 @@ const leaderboard = computed(() => rankedEntries.value);
 
 const prizes = computed(() => contest.value?.prizes ?? []);
 
-function prizeForRank(rank: number): { title: string; value?: string } | null {
-  const prize = prizes.value.find((p: { place?: number; title: string; value?: string }) => p.place === rank);
+function prizeForRank(rank: number): { title?: string; value?: string } | null {
+  const prize = prizes.value.find((p: { place?: number; title?: string; value?: string }) => p.place === rank);
   return prize ?? null;
 }
 
@@ -120,7 +127,13 @@ function medalColor(rank: number): string {
 
       <!-- LEADERBOARD -->
       <div v-if="leaderboard.length > 0" class="cpub-leaderboard">
-        <h2 class="cpub-leaderboard-title">Full Leaderboard</h2>
+        <div class="cpub-leaderboard-head">
+          <h2 class="cpub-leaderboard-title">Full Standings</h2>
+          <span class="cpub-leaderboard-count">
+            {{ totalEntries }} {{ totalEntries === 1 ? 'entry' : 'entries' }}
+            <template v-if="shownEntries < totalEntries"> · showing top {{ shownEntries }}</template>
+          </span>
+        </div>
         <div class="cpub-leaderboard-scroll">
         <table class="cpub-leaderboard-table">
           <thead>
@@ -191,7 +204,9 @@ function medalColor(rank: number): string {
 
 /* LEADERBOARD */
 .cpub-leaderboard { margin-bottom: 32px; }
-.cpub-leaderboard-title { font-size: 16px; font-weight: 700; margin-bottom: 14px; }
+.cpub-leaderboard-head { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; margin-bottom: 14px; flex-wrap: wrap; }
+.cpub-leaderboard-title { font-size: 16px; font-weight: 700; }
+.cpub-leaderboard-count { font-size: 11px; font-family: var(--font-mono); color: var(--text-faint); }
 /* Horizontal scroll on narrow screens instead of overflowing the page. */
 .cpub-leaderboard-scroll { overflow-x: auto; -webkit-overflow-scrolling: touch; }
 .cpub-leaderboard-table { width: 100%; border-collapse: collapse; font-size: 12px; min-width: 420px; }

package/pages/contests/create.vue

@@ -8,6 +8,7 @@ const { extract: extractError } = useApiError();
 const saving = ref(false);
 
 const title = ref('');
+const subheading = ref('');
 const description = ref('');
 const rules = ref('');
 const bannerUrl = ref('');
@@ -46,6 +47,7 @@ interface Prize {
   value: string;
 }
 
+const prizesDescription = ref('');
 const prizes = ref<Prize[]>([
   { place: 1, category: '', title: '1st Place', description: '', value: '' },
   { place: 2, category: '', title: '2nd Place', description: '', value: '' },
@@ -90,6 +92,7 @@ async function handleCreate(): Promise<void> {
       method: 'POST',
       body: {
         title: title.value,
+        subheading: subheading.value || undefined,
         description: description.value || undefined,
         rules: rules.value || undefined,
         bannerUrl: bannerUrl.value || undefined,
@@ -102,14 +105,15 @@ async function handleCreate(): Promise<void> {
         visibleToRoles: visibility.value === 'private' && visibleToRoles.value.length ? visibleToRoles.value : undefined,
         eligibleContentTypes: eligibleContentTypes.value.length ? eligibleContentTypes.value : undefined,
         maxEntriesPerUser: maxEntriesPerUser.value && maxEntriesPerUser.value > 0 ? maxEntriesPerUser.value : undefined,
+        prizesDescription: prizesDescription.value || undefined,
         prizes: prizes.value
-          .filter(p => p.title.trim())
+          .filter(p => p.title.trim() || p.description.trim() || p.category.trim() || (typeof p.place === 'number' && p.place > 0))
           .map(p => ({
             place: typeof p.place === 'number' && Number.isFinite(p.place) && p.place > 0 ? p.place : undefined,
             category: p.category.trim() || undefined,
-            title: p.title,
-            description: p.description || undefined,
-            value: p.value || undefined,
+            title: p.title.trim() || undefined,
+            description: p.description.trim() || undefined,
+            value: p.value.trim() || undefined,
           })),
         judgingCriteria: criteria.value
           .filter(c => c.label.trim())
@@ -129,10 +133,13 @@ async function handleCreate(): Promise<void> {
   }
 }
 
-function prizeLabel(prize: Prize, idx: number): string {
+function prizeLabel(prize: Prize): string {
   if (prize.category.trim()) return prize.category;
-  const labels = ['1st', '2nd', '3rd', '4th', '5th', '6th'];
-  return `${labels[idx] || `${idx + 1}th`} Place`;
+  if (prize.place && prize.place > 0) {
+    const labels = ['1st', '2nd', '3rd', '4th', '5th', '6th'];
+    return `${labels[prize.place - 1] || `${prize.place}th`} Place`;
+  }
+  return 'Prize';
 }
 </script>
 
@@ -149,17 +156,23 @@ function prizeLabel(prize: Prize, idx: number): string {
           <label for="contest-title" class="cpub-form-label">Title</label>
           <input id="contest-title" v-model="title" type="text" class="cpub-form-input" required placeholder="Maker Challenge 2026" />
         </div>
+        <div class="cpub-form-field">
+          <label for="contest-subheading" class="cpub-form-label">Subheading</label>
+          <input id="contest-subheading" v-model="subheading" type="text" maxlength="300" class="cpub-form-input" placeholder="One-line tagline shown in the contest header" />
+          <p class="cpub-form-hint">Short plain-text tagline shown under the title in the hero. The Description below is the full body.</p>
+        </div>
         <div class="cpub-form-field">
           <label for="contest-desc" class="cpub-form-label">Description</label>
-          <textarea id="contest-desc" v-model="description" class="cpub-form-textarea" rows="3" placeholder="Describe your contest..." />
+          <textarea id="contest-desc" v-model="description" class="cpub-form-textarea" rows="4" placeholder="Describe your contest. Supports Markdown — # headings, - lists, **bold**, [links](url)…" />
+          <p class="cpub-form-hint">Supports Markdown (headings, lists, bold, links) and inline HTML. Shown formatted on the contest page.</p>
         </div>
         <div class="cpub-form-field">
           <label for="contest-rules" class="cpub-form-label">Rules</label>
-          <textarea id="contest-rules" v-model="rules" class="cpub-form-textarea" rows="4" placeholder="Contest rules and requirements (one per line)..." />
+          <textarea id="contest-rules" v-model="rules" class="cpub-form-textarea" rows="6" placeholder="Contest rules and requirements. Supports Markdown — one rule per line, or full Markdown." />
+          <p class="cpub-form-hint">Supports Markdown. Plain one-rule-per-line text is rendered as a numbered list.</p>
         </div>
         <div class="cpub-form-field">
-          <label for="contest-banner" class="cpub-form-label">Banner Image URL</label>
-          <input id="contest-banner" v-model="bannerUrl" type="url" class="cpub-form-input" placeholder="https://..." />
+          <ImageUpload v-model="bannerUrl" purpose="banner" label="Banner Image" hint="Wide image shown across the top of the contest page (~4:1)." />
         </div>
       </section>
 
@@ -274,11 +287,16 @@ function prizeLabel(prize: Prize, idx: number): string {
           </button>
         </div>
 
-        <p class="cpub-form-hint">Use <strong>place</strong> for ranked prizes (1st/2nd/3rd) or a <strong>category</strong> for themed awards (e.g. "Best in Show").</p>
+        <p class="cpub-form-hint">Every field is optional. Use <strong>place</strong> for ranked prizes (1st/2nd/3rd), a <strong>category</strong> for themed awards (e.g. "Best in Show"), or just a <strong>description</strong>. Cash value is optional.</p>
+        <div class="cpub-form-field">
+          <label for="prizes-desc" class="cpub-form-label">Prizes overview (optional)</label>
+          <textarea id="prizes-desc" v-model="prizesDescription" class="cpub-form-textarea" rows="3" placeholder="Intro shown above the prize cards. Supports Markdown." />
+          <p class="cpub-form-hint">Markdown intro displayed on the Prizes tab, above the individual prizes.</p>
+        </div>
         <div v-for="(prize, idx) in prizes" :key="idx" class="cpub-prize-card">
           <div class="cpub-prize-header">
             <span class="cpub-prize-place">
-              <i class="fa-solid fa-trophy"></i> {{ prizeLabel(prize, idx) }}
+              <i class="fa-solid fa-trophy"></i> {{ prizeLabel(prize) }}
             </span>
             <button v-if="prizes.length > 1" type="button" class="cpub-delete-btn" aria-label="Remove prize" @click="removePrize(idx)">
               <i class="fa-solid fa-xmark"></i>

package/pages/contests/index.vue

@@ -4,6 +4,25 @@ useSeoMeta({ title: `Contests — ${useSiteName()}` });
 const { data: contests } = await useFetch('/api/contests');
 const { isAuthenticated, isAdmin, user } = useAuth();
 
+// Card blurb: prefer the short subheading; otherwise a plain-text, markdown-
+// stripped excerpt of the (possibly long Markdown) description — so listing
+// cards never dump a raw `## ...` wall.
+function cardBlurb(c: { subheading?: string | null; description?: string | null }): string {
+  if (c.subheading?.trim()) return c.subheading.trim();
+  const d = (c.description ?? '').trim();
+  if (!d) return '';
+  return d
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/`([^`]*)`/g, '$1')
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, ' ')
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+    .replace(/^#{1,6}\s+/gm, '')
+    .replace(/^\s*[-*+>]\s+/gm, '')
+    .replace(/(\*\*|__|~~|\*|_)/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
 const config = useRuntimeConfig();
 const contestCreation = config.public.contestCreation as string || 'admin';
 const canCreateContest = computed(() => {
@@ -36,8 +55,8 @@ const canCreateContest = computed(() => {
               {{ contest.title }}
             </NuxtLink>
           </h3>
-          <p v-if="contest.description" style="font-size: 12px; color: var(--text-dim); margin-bottom: 12px">
-            {{ contest.description }}
+          <p v-if="cardBlurb(contest)" class="cpub-contest-card-blurb" style="font-size: 12px; color: var(--text-dim); margin-bottom: 12px">
+            {{ cardBlurb(contest) }}
           </p>
           <div v-if="contest.endDate" style="margin-top: 8px">
             <CountdownTimer :target-date="contest.endDate" />
@@ -63,6 +82,15 @@ const canCreateContest = computed(() => {
 .cpub-card:hover { box-shadow: var(--shadow-lg); transform: translate(-1px, -1px); }
 .cpub-card-body { padding: 16px; }
 
+.cpub-contest-card-blurb {
+  display: -webkit-box;
+  -webkit-line-clamp: 3;
+  line-clamp: 3;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+  line-height: 1.5;
+}
+
 @media (max-width: 768px) {
   .cpub-contests-page { padding: 16px; }
   .cpub-grid-3 { grid-template-columns: 1fr; gap: 14px; }

package/pages/events/[slug]/index.vue

@@ -126,7 +126,7 @@ const typeIcon = computed(() => {
         </div>
 
         <div v-if="event.description" class="cpub-event-description">
-          {{ event.description }}
+          <CpubMarkdown :source="event.description" />
         </div>
 
         <div class="cpub-event-organizer">

package/pages/notifications.vue

@@ -27,6 +27,14 @@ async function deleteNotification(id: string): Promise<void> {
   await $fetch(`/api/notifications/${id}`, { method: 'DELETE' });
   refresh();
 }
+
+// Fired when a row is clicked/navigated — mark it read so the unread highlight
+// + nav badge clear. Fire-and-forget: navigation proceeds regardless.
+function onNotificationRead(id: string): void {
+  $fetch('/api/notifications/read', { method: 'POST', body: { notificationId: id } })
+    .then(() => refresh())
+    .catch(() => {});
+}
 </script>
 
 <template>
@@ -59,6 +67,7 @@ async function deleteNotification(id: string): Promise<void> {
         v-for="n in filteredNotifications"
         :key="n.id"
         :notification="n"
+        @read="onNotificationRead"
       />
       <div v-if="!filteredNotifications.length" class="cpub-empty-state">
         <div class="cpub-empty-state-icon"><i class="fa-solid fa-bell-slash"></i></div>

package/server/api/admin/api-keys/[id]/usage.get.ts

@@ -6,7 +6,7 @@ const querySchema = z.object({
 });
 
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'apikeys.manage');
   const id = getRouterParam(event, 'id');
   if (!id) throw createError({ statusCode: 400, statusMessage: 'Missing id' });
   const parsed = querySchema.safeParse(getQuery(event));

package/server/api/admin/api-keys/[id].delete.ts

@@ -1,7 +1,7 @@
 import { revokeApiKey, createAuditEntry } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'apikeys.manage');
   const id = getRouterParam(event, 'id');
   if (!id) throw createError({ statusCode: 400, statusMessage: 'Missing id' });
   const db = useDB();

package/server/api/admin/api-keys/index.get.ts

@@ -1,7 +1,7 @@
 import { listApiKeys } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'apikeys.manage');
   const query = getQuery(event);
   const includeRevoked = query.includeRevoked === 'true' || query.includeRevoked === '1';
   const db = useDB();

package/server/api/admin/api-keys/index.post.ts

@@ -14,7 +14,7 @@ import { createApiKeySchema } from '@commonpub/schema';
  * land in the metadata column.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'apikeys.manage');
   const body = await readBody(event);
   const parsed = createApiKeySchema.safeParse(body);
   if (!parsed.success) {

package/server/api/admin/audit.get.ts

@@ -9,7 +9,7 @@ const auditQuerySchema = z.object({
 
 export default defineEventHandler(async (event): Promise<PaginatedResponse<AuditLogItem>> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'audit.read');
   const db = useDB();
   const filters = parseQueryParams(event, auditQuerySchema);
 

package/server/api/admin/categories/[id].delete.ts

@@ -5,7 +5,7 @@ import { deleteContentCategory } from '@commonpub/server';
  * Delete a content category (admin only). System categories cannot be deleted.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/categories/[id].patch.ts

@@ -6,7 +6,7 @@ import { updateContentCategorySchema } from '@commonpub/schema';
  * Update a content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, updateContentCategorySchema);

package/server/api/admin/categories/index.get.ts

@@ -5,7 +5,7 @@ import { listContentCategories } from '@commonpub/server';
  * List all content categories (admin).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   return listContentCategories(db);
 });

package/server/api/admin/categories/index.post.ts

@@ -6,7 +6,7 @@ import { createContentCategorySchema } from '@commonpub/schema';
  * Create a new content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const body = await parseBody(event, createContentCategorySchema);
   return createContentCategory(db, body);

package/server/api/admin/content/[id].delete.ts

@@ -2,7 +2,7 @@ import { removeContent, removeFederatedContent } from '@commonpub/server';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'content.moderate');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/content/[id].patch.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Update admin-managed content fields (featured, editorial, category).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const { id: contentId } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, z.object({

package/server/api/admin/content/bulk-editorial.post.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Bulk update editorial status on multiple content items (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const body = await parseBody(event, z.object({
     ids: z.array(z.string().uuid()).min(1).max(100),

package/server/api/admin/features/index.get.ts

@@ -6,7 +6,7 @@ import type { FeatureFlags } from '@commonpub/config';
  * Returns current feature flags with metadata about defaults vs overrides.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'settings.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/features/index.put.ts

@@ -15,7 +15,7 @@ const updateFeaturesSchema = z.object({
  * To remove an override, omit the key from overrides.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'settings.manage');
 
   const body = await parseBody(event, updateFeaturesSchema);
   const db = useDB();

package/server/api/admin/federation/activity.get.ts

@@ -5,7 +5,7 @@ const VALID_STATUSES = ['pending', 'delivered', 'failed', 'processed'] as const;
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const query = getQuery(event);

package/server/api/admin/federation/clients.get.ts

@@ -2,7 +2,7 @@ import { listOAuthClients } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listOAuthClients(db);

package/server/api/admin/federation/clients.post.ts

@@ -8,7 +8,7 @@ const registerSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { instanceDomain, redirectUris } = await parseBody(event, registerSchema);
 

package/server/api/admin/federation/hub-mirrors/[id]/backfill.post.ts

@@ -3,7 +3,7 @@ import { backfillHubFromOutbox, fetchRemoteHubFollowers, repairFederatedHubPostA
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/hub-mirrors/index.get.ts

@@ -3,7 +3,7 @@ import { listFederatedHubs } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   return listFederatedHubs(db);

package/server/api/admin/federation/hub-mirrors/index.post.ts

@@ -8,7 +8,7 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/mirrors/[id]/backfill.post.ts

@@ -11,7 +11,7 @@ function extractDomain(url: string): string {
  * Admin only.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/mirrors/[id].delete.ts

@@ -2,7 +2,7 @@ import { cancelMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].get.ts

@@ -2,7 +2,7 @@ import { getMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].put.ts

@@ -7,7 +7,7 @@ const updateMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const { action } = await parseBody(event, updateMirrorSchema);

package/server/api/admin/federation/mirrors/index.get.ts

@@ -2,7 +2,7 @@ import { listMirrors } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listMirrors(db);

package/server/api/admin/federation/mirrors/index.post.ts

@@ -11,7 +11,7 @@ const createMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const input = await parseBody(event, createMirrorSchema);
 

package/server/api/admin/federation/pending.get.ts

@@ -8,7 +8,7 @@ import { activities } from '@commonpub/schema';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const pending = await db

package/server/api/admin/federation/refederate.post.ts

@@ -18,7 +18,7 @@ export default defineEventHandler(async (event) => {
   if (cliSecret && cliSecret === runtimeConfig.authSecret) {
     // Authorized via shared secret
   } else {
-    requireAdmin(event);
+    requirePermission(event, 'federation.manage');
   }
 
   const config = useConfig();

package/server/api/admin/federation/repair-types.post.ts

@@ -7,7 +7,7 @@ import { repairFederatedContentTypes } from '@commonpub/server';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return repairFederatedContentTypes(db);

package/server/api/admin/federation/retry.post.ts

@@ -12,7 +12,7 @@ const retrySchema = z.object({
  * Optionally filter by activity ID.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/stats.get.ts

@@ -3,7 +3,7 @@ import { activities, followRelationships } from '@commonpub/schema';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const [inbound, outbound, pending, failed, followers, following] = await Promise.all([

package/server/api/admin/federation/trusted-instances.delete.ts

@@ -7,7 +7,7 @@ const removeSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, removeSchema);
 

package/server/api/admin/federation/trusted-instances.get.ts

@@ -2,7 +2,7 @@ import { getStoredTrustedInstances } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const config = useConfig();
 

package/server/api/admin/federation/trusted-instances.post.ts

@@ -7,7 +7,7 @@ const addSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, addSchema);