@cosmicdrift/kumiko-bundled-features 0.374.0 → 0.378.0

package/dist/template-resolver/handlers/resource-link-pdf.write.js

@@ -1,32 +1,38 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { linkTemplatePdfAttachment } from "../store-template-resource.js";
+import { refuseTemplateEditById, templateEditAccess, } from "../template-edit-policy.js";
 import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
-export const resourceLinkPdfWrite = defineWriteHandler({
-    name: "resource-link-pdf",
-    schema: z.object({
-        templateId: z.string().min(1),
-        key: resourceKeySchema,
-        /** Slug of a document-pdf template of the tenant or the system. */
-        templateSlug: z.string().min(1),
-        /** Name pattern of the attached PDF; may hold {{placeholders}}, must end with .pdf. */
-        fileName: z.string().min(1),
-        /** Cross-tenant target — SystemAdmin only. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Links a PDF rendered from a document-pdf template into a mail template under the key. Every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale; nothing is uploaded or stored. fileName is a pattern that may use the mail's {{placeholders}} and must end with .pdf. The document template must exist for the tenant or the system. Counts toward the 10 attachments per mail template together with uploaded files.",
-    handler: async (event, ctx) => {
-        const { templateId, key, templateSlug, fileName } = event.payload;
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        return linkTemplatePdfAttachment({
-            ctx,
-            user: event.user,
-            tenantId,
-            templateId,
-            key,
-            templateSlug,
-            fileName,
-        });
-    },
-});
+export function makeResourceLinkPdfWrite(policy) {
+    return defineWriteHandler({
+        name: "resource-link-pdf",
+        schema: z.object({
+            templateId: z.string().min(1),
+            key: resourceKeySchema,
+            /** Slug of a document-pdf template of the tenant or the system. */
+            templateSlug: z.string().min(1),
+            /** Name pattern of the attached PDF; may hold {{placeholders}}, must end with .pdf. */
+            fileName: z.string().min(1),
+            /** Cross-tenant target — SystemAdmin only. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Links a PDF rendered from a document-pdf template into a mail template under the key. Every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale; nothing is uploaded or stored. fileName is a pattern that may use the mail's {{placeholders}} and must end with .pdf. The document template must exist for the tenant or the system. Counts toward the 10 attachments per mail template together with uploaded files. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const { templateId, key, templateSlug, fileName } = event.payload;
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            const refused = await refuseTemplateEditById(ctx.db, policy, event.user, tenantId, templateId);
+            if (refused !== null)
+                return refused;
+            return linkTemplatePdfAttachment({
+                ctx,
+                user: event.user,
+                tenantId,
+                templateId,
+                key,
+                templateSlug,
+                fileName,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-remove.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resourceRemoveWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-remove", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceRemoveWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-remove", z.ZodObject<{
     templateId: z.ZodString;
     key: z.ZodString;
     tenantIdOverride: z.ZodOptional<z.ZodString>;

package/dist/template-resolver/handlers/resource-remove.write.js

@@ -5,40 +5,46 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { parseLinkedResourceEntries } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
+import { refuseTemplateEditById, templateEditAccess, } from "../template-edit-policy.js";
 import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
 import { executor } from "./shared.js";
 // The FileRef itself stays: copy-locale and tenant overrides can share ids and there is
 // no reference count to tell when the last user is gone.
-export const resourceRemoveWrite = defineWriteHandler({
-    name: "resource-remove",
-    schema: z.object({
-        templateId: z.string().min(1),
-        key: resourceKeySchema,
-        /** Cross-tenant target — SystemAdmin only. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change.",
-    handler: async (event, ctx) => {
-        const { templateId, key } = event.payload;
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-        const row = await fetchOne(db, templateResourcesTable, {
-            tenantId,
-            id: templateId,
-        });
-        if (row === undefined)
-            return writeFailure(new NotFoundError("template-resource", templateId));
-        const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
-        if (removed === undefined)
-            return { isSuccess: true, data: { key, removed: false } };
-        const updated = await executor.update({
-            id: row.id,
-            version: row.version,
-            changes: { linkedResources: JSON.stringify(remaining) },
-        }, event.user, db, { streamTenantId });
-        if (!updated.isSuccess)
-            return updated;
-        return { isSuccess: true, data: { key, removed: true } };
-    },
-});
+export function makeResourceRemoveWrite(policy) {
+    return defineWriteHandler({
+        name: "resource-remove",
+        schema: z.object({
+            templateId: z.string().min(1),
+            key: resourceKeySchema,
+            /** Cross-tenant target — SystemAdmin only. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const { templateId, key } = event.payload;
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            const refused = await refuseTemplateEditById(ctx.db, policy, event.user, tenantId, templateId);
+            if (refused !== null)
+                return refused;
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+            const row = await fetchOne(db, templateResourcesTable, {
+                tenantId,
+                id: templateId,
+            });
+            if (row === undefined)
+                return writeFailure(new NotFoundError("template-resource", templateId));
+            const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
+            if (removed === undefined)
+                return { isSuccess: true, data: { key, removed: false } };
+            const updated = await executor.update({
+                id: row.id,
+                version: row.version,
+                changes: { linkedResources: JSON.stringify(remaining) },
+            }, event.user, db, { streamTenantId });
+            if (!updated.isSuccess)
+                return updated;
+            return { isSuccess: true, data: { key, removed: true } };
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-upload.write.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 import { type PreparedTemplateFile, type StoredTemplateAttachment, type StoredTemplateResource } from "../store-template-resource.ts";
-export declare const resourceUploadWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceUploadWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
     templateId: z.ZodOptional<z.ZodString>;
     key: z.ZodOptional<z.ZodString>;
     sourceFileRefId: z.ZodUUID;

package/dist/template-resolver/handlers/resource-upload.write.js

@@ -5,6 +5,7 @@ import { FileRefTooLargeError, fileContextForTenant, readFileRefContent, } from
 import { attachmentFileNameSchema } from "../../shared/index.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
 import { prepareTemplateAttachmentBeforeTransaction, prepareTemplateResourceBeforeTransaction, readTemplateResourceMaxBytes, storePreparedTemplateAttachment, storePreparedTemplateResource, } from "../store-template-resource.js";
+import { refuseTemplateEditById, templateEditAccess, } from "../template-edit-policy.js";
 import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
 function attachmentTargetOf(input) {
     const { templateId, key, fileName } = input;
@@ -16,113 +17,120 @@ function attachmentTargetOf(input) {
 // Purpose "image": stores a re-encoded image as a FileRef and, with templateId + key, links it into
 // the template; without templateId it only creates the FileRef (the branding logo upload path).
 // Purpose "attachment": stores the file as uploaded and links it as a mail attachment.
-export const resourceUploadWrite = defineWriteHandler({
-    name: "resource-upload",
-    schema: z
-        .object({
-        templateId: z.string().min(1).optional(),
-        key: resourceKeySchema.optional(),
-        /** An unclaimed upload of the caller (POST /api/files without entityType). */
-        sourceFileRefId: z.uuid(),
-        /** Cross-tenant target — SystemAdmin only. */
-        tenantIdOverride: z.string().min(1).optional(),
-        /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
-        purpose: z.enum(RESOURCE_PURPOSES).default("image"),
-        /** Name the recipient sees; required for purpose "attachment". */
-        fileName: z.string().optional(),
-    })
-        .refine((p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined), {
-        message: "templateId and key must be given together",
-        path: ["key"],
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect.",
-    beforeTransaction: async (event, ctx) => {
-        const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
-        const attachmentTarget = purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
-        if (purpose === "attachment" && attachmentTarget === null) {
-            return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
-                i18nKey: "templateResolver.errors.attachment.invalid",
-                details: { code: "target_required" },
-            }));
-        }
-        const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
-        // The source is read from the session tenant only: with tenantIdOverride the upload
-        // sits in the admin's own tenant while the normalized file lands in the target tenant.
-        // Only the caller's own unclaimed upload qualifies, so a record-attached image of
-        // someone else cannot be copied into a template.
-        let source;
-        try {
-            source = await readFileRefContent({
-                db: ctx.db,
-                filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
-                fileRefId: sourceFileRefId,
-                allowedTenantIds: [event.user.tenantId],
-                unclaimedUploadOf: event.user.id,
-                maxBytes,
-            });
-        }
-        catch (cause) {
-            if (cause instanceof FileRefTooLargeError) {
-                return writeFailure(new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
-                    i18nKey: "templateResolver.errors.resource.tooLarge",
-                    details: { maxBytes, size: cause.size },
+export function makeResourceUploadWrite(policy) {
+    return defineWriteHandler({
+        name: "resource-upload",
+        schema: z
+            .object({
+            templateId: z.string().min(1).optional(),
+            key: resourceKeySchema.optional(),
+            /** An unclaimed upload of the caller (POST /api/files without entityType). */
+            sourceFileRefId: z.uuid(),
+            /** Cross-tenant target — SystemAdmin only. */
+            tenantIdOverride: z.string().min(1).optional(),
+            /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
+            purpose: z.enum(RESOURCE_PURPOSES).default("image"),
+            /** Name the recipient sees; required for purpose "attachment". */
+            fileName: z.string().optional(),
+        })
+            .refine((p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined), {
+            message: "templateId and key must be given together",
+            path: ["key"],
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect. Only a SystemAdmin and the roles of the templates the app lists in tenantEditable may use it; such a role may link only into those templates.",
+        beforeTransaction: async (event, ctx) => {
+            const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
+            const attachmentTarget = purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
+            if (purpose === "attachment" && attachmentTarget === null) {
+                return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+                    i18nKey: "templateResolver.errors.attachment.invalid",
+                    details: { code: "target_required" },
                 }));
             }
-            throw cause;
-        }
-        if (source === null)
-            return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
-        // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        if (attachmentTarget !== null) {
-            return prepareTemplateAttachmentBeforeTransaction({
+            if (templateId !== undefined) {
+                const refused = await refuseTemplateEditById(ctx.db, policy, event.user, resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId), templateId);
+                if (refused !== null)
+                    return refused;
+            }
+            const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
+            // The source is read from the session tenant only: with tenantIdOverride the upload
+            // sits in the admin's own tenant while the normalized file lands in the target tenant.
+            // Only the caller's own unclaimed upload qualifies, so a record-attached image of
+            // someone else cannot be copied into a template.
+            let source;
+            try {
+                source = await readFileRefContent({
+                    db: ctx.db,
+                    filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+                    fileRefId: sourceFileRefId,
+                    allowedTenantIds: [event.user.tenantId],
+                    unclaimedUploadOf: event.user.id,
+                    maxBytes,
+                });
+            }
+            catch (cause) {
+                if (cause instanceof FileRefTooLargeError) {
+                    return writeFailure(new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+                        i18nKey: "templateResolver.errors.resource.tooLarge",
+                        details: { maxBytes, size: cause.size },
+                    }));
+                }
+                throw cause;
+            }
+            if (source === null)
+                return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
+            // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            if (attachmentTarget !== null) {
+                return prepareTemplateAttachmentBeforeTransaction({
+                    ctx,
+                    user: event.user,
+                    tenantId,
+                    bytes: source.content,
+                    maxBytes,
+                    ...attachmentTarget,
+                });
+            }
+            return prepareTemplateResourceBeforeTransaction({
                 ctx,
                 user: event.user,
                 tenantId,
                 bytes: source.content,
                 maxBytes,
-                ...attachmentTarget,
+                ...(templateId !== undefined && { templateId }),
+                ...(key !== undefined && { key }),
             });
-        }
-        return prepareTemplateResourceBeforeTransaction({
-            ctx,
-            user: event.user,
-            tenantId,
-            bytes: source.content,
-            maxBytes,
-            ...(templateId !== undefined && { templateId }),
-            ...(key !== undefined && { key }),
-        });
-    },
-    handler: async (event, ctx) => {
-        const { templateId, key } = event.payload;
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        const { prepared } = event;
-        if (prepared.kind === "attachment") {
-            // The phase accepts attachments only with a complete target, so these are set.
-            if (templateId === undefined || key === undefined) {
-                return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
-                    i18nKey: "templateResolver.errors.attachment.invalid",
-                    details: { code: "target_required" },
-                }));
+        },
+        handler: async (event, ctx) => {
+            const { templateId, key } = event.payload;
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            const { prepared } = event;
+            if (prepared.kind === "attachment") {
+                // The phase accepts attachments only with a complete target, so these are set.
+                if (templateId === undefined || key === undefined) {
+                    return writeFailure(new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+                        i18nKey: "templateResolver.errors.attachment.invalid",
+                        details: { code: "target_required" },
+                    }));
+                }
+                return storePreparedTemplateAttachment({
+                    ctx,
+                    user: event.user,
+                    tenantId,
+                    prepared,
+                    templateId,
+                    key,
+                });
             }
-            return storePreparedTemplateAttachment({
+            return storePreparedTemplateResource({
                 ctx,
                 user: event.user,
                 tenantId,
                 prepared,
-                templateId,
-                key,
+                ...(templateId !== undefined && { templateId }),
+                ...(key !== undefined && { key }),
             });
-        }
-        return storePreparedTemplateResource({
-            ctx,
-            user: event.user,
-            tenantId,
-            prepared,
-            ...(templateId !== undefined && { templateId }),
-            ...(key !== undefined && { key }),
-        });
-    },
-});
+        },
+    });
+}

package/dist/template-resolver/handlers/send-test-shared.d.ts

@@ -0,0 +1,5 @@
+import type { HandlerContext, Registry, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type ChannelContext } from "../../delivery/index.ts";
+export declare function emailChannelOf(registry: Registry): import("../../delivery/types.ts").DeliveryChannel | undefined;
+export declare function testMailChannelContext(ctx: HandlerContext, user: SessionUser): ChannelContext;
+export declare function resolveTestMailAddress(channel: NonNullable<ReturnType<typeof emailChannelOf>>, channelContext: ChannelContext, user: SessionUser): Promise<string | null>;

package/dist/template-resolver/handlers/send-test-shared.js

@@ -0,0 +1,19 @@
+import { collectChannels, createEmailAttachmentReader, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
+import { fileContextForTenant } from "../../file-foundation/index.js";
+export function emailChannelOf(registry) {
+    return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+export function testMailChannelContext(ctx, user) {
+    return {
+        db: ctx.db,
+        registry: ctx.registry,
+        sseBroker: undefined,
+        tenantId: user.tenantId,
+        secrets: ctx.secrets,
+        config: ctx.config,
+        readAttachment: createEmailAttachmentReader(ctx.db, ctx.registry, user.tenantId, ctx.config, (tenantId) => fileContextForTenant(ctx, ctx.user.tenantId, tenantId)),
+    };
+}
+export async function resolveTestMailAddress(channel, channelContext, user) {
+    return (await channel.resolve?.(user.id, channelContext)) ?? null;
+}

package/dist/template-resolver/handlers/send-test-status.query.d.ts

@@ -0,0 +1,9 @@
+import * as z from "zod";
+export type SendTestStatus = {
+    readonly canSend: true;
+    readonly reason: null;
+} | {
+    readonly canSend: false;
+    readonly reason: "no_channel" | "no_address";
+};
+export declare const sendTestStatusQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"send-test-status", z.ZodObject<{}, z.core.$strip>, SendTestStatus, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/send-test-status.query.js

@@ -0,0 +1,18 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { emailChannelOf, resolveTestMailAddress, testMailChannelContext, } from "./send-test-shared.js";
+export const sendTestStatusQuery = defineQueryHandler({
+    name: "send-test-status",
+    schema: z.object({}),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description: "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
+    handler: async (query, ctx) => {
+        const channel = emailChannelOf(ctx.registry);
+        if (channel === undefined)
+            return { canSend: false, reason: "no_channel" };
+        const address = await resolveTestMailAddress(channel, testMailChannelContext(ctx, query.user), query.user);
+        return address === null
+            ? { canSend: false, reason: "no_address" }
+            : { canSend: true, reason: null };
+    },
+});

package/dist/template-resolver/handlers/send-test.write.d.ts

@@ -1,10 +1,12 @@
 import * as z from "zod";
-export declare const sendTestWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"send-test", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeSendTestWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"send-test", z.ZodObject<{
     slug: z.ZodString;
     locale: z.ZodString;
     content: z.ZodOptional<z.ZodString>;
     meta: z.ZodOptional<z.ZodUnknown>;
     variableSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    variables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     includeAttachments: z.ZodDefault<z.ZodBoolean>;
     prefixSubject: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, {