@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.378.0

package/dist/template-resolver/handlers/patch-draft.write.js

@@ -4,6 +4,7 @@ import * as z from "zod";
 import { DOCUMENT_HTML_KINDS } from "../constants.js";
 import { applyDocumentOps, documentOpsSchema } from "../document-ops.js";
 import { parseDocumentJson, serializeDocumentJson } from "../document-sanitizer.js";
+import { refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { resolveTemplateVariables } from "../template-validation.js";
 import { loadDocumentBase } from "./document-base.js";
 import { localeSchema, templateSlugSchema } from "./shared.js";
@@ -12,94 +13,99 @@ import { validateTemplateDraft } from "./validate.query.js";
 function validationFailure(issue) {
     return writeFailure(new ValidationError({ fields: [issue] }));
 }
-export const patchDraftWrite = defineWriteHandler({
-    name: "patch-draft",
-    schema: z.object({
-        slug: templateSlugSchema,
-        kind: z.enum(DOCUMENT_HTML_KINDS),
-        locale: localeSchema,
-        base: z.object({
-            scope: z.enum(["tenant", "system"]),
-            version: z.number().int().nonnegative(),
+export function makePatchDraftWrite(policy) {
+    return defineWriteHandler({
+        name: "patch-draft",
+        schema: z.object({
+            slug: templateSlugSchema,
+            kind: z.enum(DOCUMENT_HTML_KINDS),
+            locale: localeSchema,
+            base: z.object({
+                scope: z.enum(["tenant", "system"]),
+                version: z.number().int().nonnegative(),
+            }),
+            ops: documentOpsSchema,
         }),
-        ops: documentOpsSchema,
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. Returns the written row.",
-    handler: async (event, ctx) => {
-        const { slug, kind, locale, base, ops } = event.payload;
-        const loaded = await loadDocumentBase(ctx, event.user, { slug, kind, locale });
-        if (loaded === null)
-            return writeFailure(new NotFoundError("template-resource", slug));
-        if (loaded.base.scope !== base.scope || loaded.base.version !== base.version) {
-            return writeFailure(new VersionConflictError({
-                entityId: loaded.rowId,
-                expectedVersion: base.version,
-                currentVersion: loaded.base.version,
-            }));
-        }
-        const variableOpIndex = ops.findIndex((op) => op.op === "setVariable");
-        if (variableOpIndex !== -1 &&
-            ctx.registry.getAllNotifications().get(slug)?.variables !== undefined) {
-            return validationFailure({
-                path: `ops.${variableOpIndex}`,
-                code: "variables_declared_by_feature",
-                i18nKey: "templateResolver.errors.patch.variablesDeclaredByFeature",
-                params: { slug },
-            });
-        }
-        const applied = applyDocumentOps({
-            doc: parseDocumentJson(loaded.content),
-            meta: loaded.meta,
-            variableSchema: loaded.variableSchema,
-            kind,
-            ops,
-        });
-        if (!applied.ok)
-            return writeFailure(new ValidationError({ fields: applied.issues }));
-        const content = serializeDocumentJson(applied.doc);
-        const draftOf = (draftContent, meta, variableSchema) => validateTemplateDraft(ctx, event.user, {
-            slug,
-            kind,
-            contentFormat: "html",
-            content: draftContent,
-            meta,
-            variableSchema,
-            locale,
-            scope: "tenant",
-        });
-        const before = await draftOf(loaded.content, loaded.meta, loaded.variableSchema);
-        const after = await draftOf(content, applied.meta, applied.variableSchema);
-        const alreadyMissing = new Set(before.response.missingRequired);
-        const removed = after.response.missingRequired.filter((name) => !alreadyMissing.has(name));
-        if (removed.length > 0) {
-            return validationFailure({
-                path: "ops",
-                code: "required_placeholder_removed",
-                i18nKey: "templateResolver.errors.patch.requiredPlaceholderRemoved",
-                params: { names: removed },
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
+        handler: async (event, ctx) => {
+            const { slug, kind, locale, base, ops } = event.payload;
+            const refused = refuseTemplateEdit(policy, event.user, { slug, kind });
+            if (refused !== null)
+                return refused;
+            const loaded = await loadDocumentBase(ctx, event.user, { slug, kind, locale });
+            if (loaded === null)
+                return writeFailure(new NotFoundError("template-resource", slug));
+            if (loaded.base.scope !== base.scope || loaded.base.version !== base.version) {
+                return writeFailure(new VersionConflictError({
+                    entityId: loaded.rowId,
+                    expectedVersion: base.version,
+                    currentVersion: loaded.base.version,
+                }));
+            }
+            const variableOpIndex = ops.findIndex((op) => op.op === "setVariable");
+            if (variableOpIndex !== -1 &&
+                ctx.registry.getAllNotifications().get(slug)?.variables !== undefined) {
+                return validationFailure({
+                    path: `ops.${variableOpIndex}`,
+                    code: "variables_declared_by_feature",
+                    i18nKey: "templateResolver.errors.patch.variablesDeclaredByFeature",
+                    params: { slug },
+                });
+            }
+            const applied = applyDocumentOps({
+                doc: parseDocumentJson(loaded.content),
+                meta: loaded.meta,
+                variableSchema: loaded.variableSchema,
+                kind,
+                ops,
             });
-        }
-        return writeTemplateRow({
-            ctx,
-            user: event.user,
-            tenantId: event.user.tenantId,
-            scope: "tenant",
-            status: "draft",
-            variables: resolveTemplateVariables(ctx.registry, slug, applied.variableSchema),
-            payload: {
+            if (!applied.ok)
+                return writeFailure(new ValidationError({ fields: applied.issues }));
+            const content = serializeDocumentJson(applied.doc);
+            const draftOf = (draftContent, meta, variableSchema) => validateTemplateDraft(ctx, event.user, {
                 slug,
                 kind,
-                locale,
-                content,
                 contentFormat: "html",
-                variableSchema: applied.variableSchema,
-                meta: applied.meta,
-                title: loaded.title,
-                folder: loaded.folder,
-                parentTemplateId: loaded.parentTemplateId,
-            },
-            expectedVersion: loaded.base.scope === "tenant" ? loaded.base.version : null,
-        });
-    },
-});
+                content: draftContent,
+                meta,
+                variableSchema,
+                locale,
+                scope: "tenant",
+            });
+            const before = await draftOf(loaded.content, loaded.meta, loaded.variableSchema);
+            const after = await draftOf(content, applied.meta, applied.variableSchema);
+            const alreadyMissing = new Set(before.response.missingRequired);
+            const removed = after.response.missingRequired.filter((name) => !alreadyMissing.has(name));
+            if (removed.length > 0) {
+                return validationFailure({
+                    path: "ops",
+                    code: "required_placeholder_removed",
+                    i18nKey: "templateResolver.errors.patch.requiredPlaceholderRemoved",
+                    params: { names: removed },
+                });
+            }
+            return writeTemplateRow({
+                ctx,
+                user: event.user,
+                tenantId: event.user.tenantId,
+                scope: "tenant",
+                status: "draft",
+                variables: resolveTemplateVariables(ctx.registry, slug, applied.variableSchema),
+                payload: {
+                    slug,
+                    kind,
+                    locale,
+                    content,
+                    contentFormat: "html",
+                    variableSchema: applied.variableSchema,
+                    meta: applied.meta,
+                    title: loaded.title,
+                    folder: loaded.folder,
+                    parentTemplateId: loaded.parentTemplateId,
+                },
+                expectedVersion: loaded.base.scope === "tenant" ? loaded.base.version : null,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/reset-to-system.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resetToSystemWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reset-to-system", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResetToSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reset-to-system", z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;

package/dist/template-resolver/handlers/reset-to-system.write.js

@@ -3,48 +3,55 @@ import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { templateResourcesTable } from "../table.js";
+import { refuseMissingTemplate, refuseTemplateEdit, templateEditAccess, } from "../template-edit-policy.js";
 import { executor } from "./shared.js";
-export const resetToSystemWrite = defineWriteHandler({
-    name: "reset-to-system",
-    schema: z.object({ id: z.string().min(1) }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Retires a tenant override by archiving it so the resolver serves the active system template again; the override and its content survive and can be published again. Refused when there is no active system template to fall back to.",
-    handler: async (event, ctx) => {
-        const existing = await fetchOne(ctx.db, templateResourcesTable, {
-            id: event.payload.id,
-        });
-        if (!existing || existing.tenantId !== event.user.tenantId || existing.scope !== "tenant") {
-            return writeFailure(new NotFoundError("template-resource", event.payload.id));
-        }
-        const systemRow = await fetchOne(ctx.db, templateResourcesTable, {
-            tenantId: SYSTEM_TENANT_ID,
-            slug: existing.slug,
-            kind: existing.kind,
-            locale: existing.locale,
-            status: "active",
-        });
-        if (!systemRow) {
-            return writeFailure(new ValidationError({
-                fields: [
-                    {
-                        path: "id",
-                        code: "no_system_template",
-                        i18nKey: "templateResolver.errors.noSystemTemplate",
-                    },
-                ],
-            }));
-        }
-        const response = {
-            isSuccess: true,
-            data: {
-                id: String(existing.id),
-                status: "archived",
-                systemTemplateId: String(systemRow.id),
-            },
-        };
-        if (existing.status === "archived")
-            return response;
-        const result = await executor.update({ id: existing.id, version: existing.version, changes: { status: "archived" } }, event.user, ctx.db);
-        return result.isSuccess ? response : result;
-    },
-});
+export function makeResetToSystemWrite(policy) {
+    return defineWriteHandler({
+        name: "reset-to-system",
+        schema: z.object({ id: z.string().min(1) }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Retires a tenant override by archiving it so the resolver serves the active system template again; the override and its content survive and can be published again. Refused when there is no active system template to fall back to. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const existing = await fetchOne(ctx.db, templateResourcesTable, {
+                id: event.payload.id,
+            });
+            if (!existing || existing.tenantId !== event.user.tenantId || existing.scope !== "tenant") {
+                return (refuseMissingTemplate(policy, event.user) ??
+                    writeFailure(new NotFoundError("template-resource", event.payload.id)));
+            }
+            const refused = refuseTemplateEdit(policy, event.user, existing);
+            if (refused !== null)
+                return refused;
+            const systemRow = await fetchOne(ctx.db, templateResourcesTable, {
+                tenantId: SYSTEM_TENANT_ID,
+                slug: existing.slug,
+                kind: existing.kind,
+                locale: existing.locale,
+                status: "active",
+            });
+            if (!systemRow) {
+                return writeFailure(new ValidationError({
+                    fields: [
+                        {
+                            path: "id",
+                            code: "no_system_template",
+                            i18nKey: "templateResolver.errors.noSystemTemplate",
+                        },
+                    ],
+                }));
+            }
+            const response = {
+                isSuccess: true,
+                data: {
+                    id: String(existing.id),
+                    status: "archived",
+                    systemTemplateId: String(systemRow.id),
+                },
+            };
+            if (existing.status === "archived")
+                return response;
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: { status: "archived" } }, event.user, ctx.db);
+            return result.isSuccess ? response : result;
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-link-pdf.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resourceLinkPdfWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-link-pdf", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceLinkPdfWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-link-pdf", z.ZodObject<{
     templateId: z.ZodString;
     key: z.ZodString;
     templateSlug: z.ZodString;

package/dist/template-resolver/handlers/resource-link-pdf.write.js

@@ -1,32 +1,38 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { linkTemplatePdfAttachment } from "../store-template-resource.js";
+import { refuseTemplateEditById, templateEditAccess, } from "../template-edit-policy.js";
 import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
-export const resourceLinkPdfWrite = defineWriteHandler({
-    name: "resource-link-pdf",
-    schema: z.object({
-        templateId: z.string().min(1),
-        key: resourceKeySchema,
-        /** Slug of a document-pdf template of the tenant or the system. */
-        templateSlug: z.string().min(1),
-        /** Name pattern of the attached PDF; may hold {{placeholders}}, must end with .pdf. */
-        fileName: z.string().min(1),
-        /** Cross-tenant target — SystemAdmin only. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Links a PDF rendered from a document-pdf template into a mail template under the key. Every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale; nothing is uploaded or stored. fileName is a pattern that may use the mail's {{placeholders}} and must end with .pdf. The document template must exist for the tenant or the system. Counts toward the 10 attachments per mail template together with uploaded files.",
-    handler: async (event, ctx) => {
-        const { templateId, key, templateSlug, fileName } = event.payload;
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        return linkTemplatePdfAttachment({
-            ctx,
-            user: event.user,
-            tenantId,
-            templateId,
-            key,
-            templateSlug,
-            fileName,
-        });
-    },
-});
+export function makeResourceLinkPdfWrite(policy) {
+    return defineWriteHandler({
+        name: "resource-link-pdf",
+        schema: z.object({
+            templateId: z.string().min(1),
+            key: resourceKeySchema,
+            /** Slug of a document-pdf template of the tenant or the system. */
+            templateSlug: z.string().min(1),
+            /** Name pattern of the attached PDF; may hold {{placeholders}}, must end with .pdf. */
+            fileName: z.string().min(1),
+            /** Cross-tenant target — SystemAdmin only. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Links a PDF rendered from a document-pdf template into a mail template under the key. Every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale; nothing is uploaded or stored. fileName is a pattern that may use the mail's {{placeholders}} and must end with .pdf. The document template must exist for the tenant or the system. Counts toward the 10 attachments per mail template together with uploaded files. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const { templateId, key, templateSlug, fileName } = event.payload;
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            const refused = await refuseTemplateEditById(ctx.db, policy, event.user, tenantId, templateId);
+            if (refused !== null)
+                return refused;
+            return linkTemplatePdfAttachment({
+                ctx,
+                user: event.user,
+                tenantId,
+                templateId,
+                key,
+                templateSlug,
+                fileName,
+            });
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-remove.write.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
-export declare const resourceRemoveWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-remove", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceRemoveWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-remove", z.ZodObject<{
     templateId: z.ZodString;
     key: z.ZodString;
     tenantIdOverride: z.ZodOptional<z.ZodString>;

package/dist/template-resolver/handlers/resource-remove.write.js

@@ -5,40 +5,46 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { parseLinkedResourceEntries } from "../linked-resources.js";
 import { templateResourcesTable } from "../table.js";
+import { refuseTemplateEditById, templateEditAccess, } from "../template-edit-policy.js";
 import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.js";
 import { executor } from "./shared.js";
 // The FileRef itself stays: copy-locale and tenant overrides can share ids and there is
 // no reference count to tell when the last user is gone.
-export const resourceRemoveWrite = defineWriteHandler({
-    name: "resource-remove",
-    schema: z.object({
-        templateId: z.string().min(1),
-        key: resourceKeySchema,
-        /** Cross-tenant target — SystemAdmin only. */
-        tenantIdOverride: z.string().min(1).optional(),
-    }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change.",
-    handler: async (event, ctx) => {
-        const { templateId, key } = event.payload;
-        const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-        const row = await fetchOne(db, templateResourcesTable, {
-            tenantId,
-            id: templateId,
-        });
-        if (row === undefined)
-            return writeFailure(new NotFoundError("template-resource", templateId));
-        const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
-        if (removed === undefined)
-            return { isSuccess: true, data: { key, removed: false } };
-        const updated = await executor.update({
-            id: row.id,
-            version: row.version,
-            changes: { linkedResources: JSON.stringify(remaining) },
-        }, event.user, db, { streamTenantId });
-        if (!updated.isSuccess)
-            return updated;
-        return { isSuccess: true, data: { key, removed: true } };
-    },
-});
+export function makeResourceRemoveWrite(policy) {
+    return defineWriteHandler({
+        name: "resource-remove",
+        schema: z.object({
+            templateId: z.string().min(1),
+            key: resourceKeySchema,
+            /** Cross-tenant target — SystemAdmin only. */
+            tenantIdOverride: z.string().min(1).optional(),
+        }),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+        handler: async (event, ctx) => {
+            const { templateId, key } = event.payload;
+            const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+            const refused = await refuseTemplateEditById(ctx.db, policy, event.user, tenantId, templateId);
+            if (refused !== null)
+                return refused;
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+            const row = await fetchOne(db, templateResourcesTable, {
+                tenantId,
+                id: templateId,
+            });
+            if (row === undefined)
+                return writeFailure(new NotFoundError("template-resource", templateId));
+            const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
+            if (removed === undefined)
+                return { isSuccess: true, data: { key, removed: false } };
+            const updated = await executor.update({
+                id: row.id,
+                version: row.version,
+                changes: { linkedResources: JSON.stringify(remaining) },
+            }, event.user, db, { streamTenantId });
+            if (!updated.isSuccess)
+                return updated;
+            return { isSuccess: true, data: { key, removed: true } };
+        },
+    });
+}

package/dist/template-resolver/handlers/resource-upload.write.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 import { type PreparedTemplateFile, type StoredTemplateAttachment, type StoredTemplateResource } from "../store-template-resource.ts";
-export declare const resourceUploadWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
+export declare function makeResourceUploadWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"resource-upload", z.ZodObject<{
     templateId: z.ZodOptional<z.ZodString>;
     key: z.ZodOptional<z.ZodString>;
     sourceFileRefId: z.ZodUUID;