@cosmicdrift/kumiko-samples 0.377.0 → 0.378.0

package/packages/bundled-features/src/template-resolver/handlers/resource-remove.write.ts

@@ -5,46 +5,62 @@ import * as z from "zod";
 import { requireForTenant } from "../../shared/index.ts";
 import { parseLinkedResourceEntries } from "../linked-resources.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
+import {
+  refuseTemplateEditById,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { resourceKeySchema, resourceTargetTenantId } from "./resource-shared.ts";
 import { executor } from "./shared.ts";
 
 // The FileRef itself stays: copy-locale and tenant overrides can share ids and there is
 // no reference count to tell when the last user is gone.
-export const resourceRemoveWrite = defineWriteHandler({
-  name: "resource-remove",
-  schema: z.object({
-    templateId: z.string().min(1),
-    key: resourceKeySchema,
-    /** Cross-tenant target — SystemAdmin only. */
-    tenantIdOverride: z.string().min(1).optional(),
-  }),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change.",
-  handler: async (event, ctx) => {
-    const { templateId, key } = event.payload;
-    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
-    const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
-      tenantId,
-      id: templateId,
-    });
-    if (row === undefined) return writeFailure(new NotFoundError("template-resource", templateId));
+export function makeResourceRemoveWrite(policy: TemplateEditPolicy) {
+  return defineWriteHandler({
+    name: "resource-remove",
+    schema: z.object({
+      templateId: z.string().min(1),
+      key: resourceKeySchema,
+      /** Cross-tenant target — SystemAdmin only. */
+      tenantIdOverride: z.string().min(1).optional(),
+    }),
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Unlinks a resource key from a template, whether it holds an image, an attached file or a linked PDF template; removing a key the template does not have succeeds without a change. Outside the templates the app lists in tenantEditable only a SystemAdmin may use it.",
+    handler: async (event, ctx) => {
+      const { templateId, key } = event.payload;
+      const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+      const refused = await refuseTemplateEditById(
+        ctx.db,
+        policy,
+        event.user,
+        tenantId,
+        templateId,
+      );
+      if (refused !== null) return refused;
+      const { db, streamTenantId } = requireForTenant(ctx, tenantId);
+      const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+        tenantId,
+        id: templateId,
+      });
+      if (row === undefined)
+        return writeFailure(new NotFoundError("template-resource", templateId));
 
-    const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
-    if (removed === undefined) return { isSuccess: true as const, data: { key, removed: false } };
+      const { [key]: removed, ...remaining } = parseLinkedResourceEntries(row.linkedResources);
+      if (removed === undefined) return { isSuccess: true as const, data: { key, removed: false } };
 
-    const updated = await executor.update(
-      {
-        id: row.id,
-        version: row.version,
-        changes: { linkedResources: JSON.stringify(remaining) },
-      },
-      event.user,
-      db,
-      { streamTenantId },
-    );
-    if (!updated.isSuccess) return updated;
-    return { isSuccess: true as const, data: { key, removed: true } };
-  },
-});
+      const updated = await executor.update(
+        {
+          id: row.id,
+          version: row.version,
+          changes: { linkedResources: JSON.stringify(remaining) },
+        },
+        event.user,
+        db,
+        { streamTenantId },
+      );
+      if (!updated.isSuccess) return updated;
+      return { isSuccess: true as const, data: { key, removed: true } };
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/resource-upload.write.ts

@@ -26,6 +26,11 @@ import {
   storePreparedTemplateAttachment,
   storePreparedTemplateResource,
 } from "../store-template-resource.ts";
+import {
+  refuseTemplateEditById,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { RESOURCE_PURPOSES, resourceKeySchema, resourceTargetTenantId } from "./resource-shared.ts";
 
 type AttachmentTarget = {
@@ -48,127 +53,142 @@ function attachmentTargetOf(input: {
 // Purpose "image": stores a re-encoded image as a FileRef and, with templateId + key, links it into
 // the template; without templateId it only creates the FileRef (the branding logo upload path).
 // Purpose "attachment": stores the file as uploaded and links it as a mail attachment.
-export const resourceUploadWrite = defineWriteHandler({
-  name: "resource-upload",
-  schema: z
-    .object({
-      templateId: z.string().min(1).optional(),
-      key: resourceKeySchema.optional(),
-      /** An unclaimed upload of the caller (POST /api/files without entityType). */
-      sourceFileRefId: z.uuid(),
-      /** Cross-tenant target — SystemAdmin only. */
-      tenantIdOverride: z.string().min(1).optional(),
-      /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
-      purpose: z.enum(RESOURCE_PURPOSES).default("image"),
-      /** Name the recipient sees; required for purpose "attachment". */
-      fileName: z.string().optional(),
-    })
-    .refine(
-      (p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined),
-      {
-        message: "templateId and key must be given together",
-        path: ["key"],
-      },
-    ),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect.",
-  beforeTransaction: async (event, ctx): Promise<BeforeTransactionResult<PreparedTemplateFile>> => {
-    const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
-    const attachmentTarget =
-      purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
-    if (purpose === "attachment" && attachmentTarget === null) {
-      return writeFailure(
-        new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
-          i18nKey: "templateResolver.errors.attachment.invalid",
-          details: { code: "target_required" },
-        }),
-      );
-    }
-    const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
-
-    // The source is read from the session tenant only: with tenantIdOverride the upload
-    // sits in the admin's own tenant while the normalized file lands in the target tenant.
-    // Only the caller's own unclaimed upload qualifies, so a record-attached image of
-    // someone else cannot be copied into a template.
-    let source: Awaited<ReturnType<typeof readFileRefContent>>;
-    try {
-      source = await readFileRefContent({
-        db: ctx.db,
-        filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
-        fileRefId: sourceFileRefId,
-        allowedTenantIds: [event.user.tenantId],
-        unclaimedUploadOf: event.user.id,
-        maxBytes,
-      });
-    } catch (cause) {
-      if (cause instanceof FileRefTooLargeError) {
+export function makeResourceUploadWrite(policy: TemplateEditPolicy) {
+  return defineWriteHandler({
+    name: "resource-upload",
+    schema: z
+      .object({
+        templateId: z.string().min(1).optional(),
+        key: resourceKeySchema.optional(),
+        /** An unclaimed upload of the caller (POST /api/files without entityType). */
+        sourceFileRefId: z.uuid(),
+        /** Cross-tenant target — SystemAdmin only. */
+        tenantIdOverride: z.string().min(1).optional(),
+        /** "attachment" links a PDF/PNG/JPEG as a file attached to every mail of the template. */
+        purpose: z.enum(RESOURCE_PURPOSES).default("image"),
+        /** Name the recipient sees; required for purpose "attachment". */
+        fileName: z.string().optional(),
+      })
+      .refine(
+        (p) => p.purpose === "attachment" || (p.templateId === undefined) === (p.key === undefined),
+        {
+          message: "templateId and key must be given together",
+          path: ["key"],
+        },
+      ),
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Turns a file uploaded via POST /api/files (multipart, no entityType) into a template resource. With purpose image (default) the upload is checked against the resource-max-bytes cap, re-encoded to a supported image format and stored as a new file; with templateId and key it is linked into that template under the key, without them only the file is created. With purpose attachment, templateId, key and fileName are required: a PDF, PNG or JPEG is stored unchanged and linked into a mail template as a file attached to every mail sent from it, at most 10 per template. A cap above the files route's maxUploadSize has no effect. Only a SystemAdmin and the roles of the templates the app lists in tenantEditable may use it; such a role may link only into those templates.",
+    beforeTransaction: async (
+      event,
+      ctx,
+    ): Promise<BeforeTransactionResult<PreparedTemplateFile>> => {
+      const { templateId, key, sourceFileRefId, purpose, fileName } = event.payload;
+      const attachmentTarget =
+        purpose === "attachment" ? attachmentTargetOf({ templateId, key, fileName }) : null;
+      if (purpose === "attachment" && attachmentTarget === null) {
         return writeFailure(
-          new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
-            i18nKey: "templateResolver.errors.resource.tooLarge",
-            details: { maxBytes, size: cause.size },
+          new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+            i18nKey: "templateResolver.errors.attachment.invalid",
+            details: { code: "target_required" },
           }),
         );
       }
-      throw cause;
-    }
-    if (source === null) return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
+      if (templateId !== undefined) {
+        const refused = await refuseTemplateEditById(
+          ctx.db,
+          policy,
+          event.user,
+          resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId),
+          templateId,
+        );
+        if (refused !== null) return refused;
+      }
+      const maxBytes = await readTemplateResourceMaxBytes(ctx.config, ctx.registry);
 
-    // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
-    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-    if (attachmentTarget !== null) {
-      return prepareTemplateAttachmentBeforeTransaction({
+      // The source is read from the session tenant only: with tenantIdOverride the upload
+      // sits in the admin's own tenant while the normalized file lands in the target tenant.
+      // Only the caller's own unclaimed upload qualifies, so a record-attached image of
+      // someone else cannot be copied into a template.
+      let source: Awaited<ReturnType<typeof readFileRefContent>>;
+      try {
+        source = await readFileRefContent({
+          db: ctx.db,
+          filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+          fileRefId: sourceFileRefId,
+          allowedTenantIds: [event.user.tenantId],
+          unclaimedUploadOf: event.user.id,
+          maxBytes,
+        });
+      } catch (cause) {
+        if (cause instanceof FileRefTooLargeError) {
+          return writeFailure(
+            new UnprocessableError(TemplateResolverErrors.resourceTooLarge, {
+              i18nKey: "templateResolver.errors.resource.tooLarge",
+              details: { maxBytes, size: cause.size },
+            }),
+          );
+        }
+        throw cause;
+      }
+      if (source === null) return writeFailure(new NotFoundError("file-ref", sourceFileRefId));
+
+      // The source upload stays as an unclaimed file: bundled-features cannot reach the fileRef executor to delete it.
+      const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+      if (attachmentTarget !== null) {
+        return prepareTemplateAttachmentBeforeTransaction({
+          ctx,
+          user: event.user,
+          tenantId,
+          bytes: source.content,
+          maxBytes,
+          ...attachmentTarget,
+        });
+      }
+      return prepareTemplateResourceBeforeTransaction({
         ctx,
         user: event.user,
         tenantId,
         bytes: source.content,
         maxBytes,
-        ...attachmentTarget,
+        ...(templateId !== undefined && { templateId }),
+        ...(key !== undefined && { key }),
       });
-    }
-    return prepareTemplateResourceBeforeTransaction({
+    },
+    handler: async (
+      event,
       ctx,
-      user: event.user,
-      tenantId,
-      bytes: source.content,
-      maxBytes,
-      ...(templateId !== undefined && { templateId }),
-      ...(key !== undefined && { key }),
-    });
-  },
-  handler: async (
-    event,
-    ctx,
-  ): Promise<WriteResult<StoredTemplateResource | StoredTemplateAttachment>> => {
-    const { templateId, key } = event.payload;
-    const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
-    const { prepared } = event;
-    if (prepared.kind === "attachment") {
-      // The phase accepts attachments only with a complete target, so these are set.
-      if (templateId === undefined || key === undefined) {
-        return writeFailure(
-          new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
-            i18nKey: "templateResolver.errors.attachment.invalid",
-            details: { code: "target_required" },
-          }),
-        );
+    ): Promise<WriteResult<StoredTemplateResource | StoredTemplateAttachment>> => {
+      const { templateId, key } = event.payload;
+      const tenantId = resourceTargetTenantId(event.payload.tenantIdOverride, event.user.tenantId);
+      const { prepared } = event;
+      if (prepared.kind === "attachment") {
+        // The phase accepts attachments only with a complete target, so these are set.
+        if (templateId === undefined || key === undefined) {
+          return writeFailure(
+            new UnprocessableError(TemplateResolverErrors.attachmentInvalid, {
+              i18nKey: "templateResolver.errors.attachment.invalid",
+              details: { code: "target_required" },
+            }),
+          );
+        }
+        return storePreparedTemplateAttachment({
+          ctx,
+          user: event.user,
+          tenantId,
+          prepared,
+          templateId,
+          key,
+        });
       }
-      return storePreparedTemplateAttachment({
+      return storePreparedTemplateResource({
         ctx,
         user: event.user,
         tenantId,
         prepared,
-        templateId,
-        key,
+        ...(templateId !== undefined && { templateId }),
+        ...(key !== undefined && { key }),
       });
-    }
-    return storePreparedTemplateResource({
-      ctx,
-      user: event.user,
-      tenantId,
-      prepared,
-      ...(templateId !== undefined && { templateId }),
-      ...(key !== undefined && { key }),
-    });
-  },
-});
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/send-test-shared.ts

@@ -0,0 +1,38 @@
+import type { HandlerContext, Registry, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type ChannelContext,
+  collectChannels,
+  createEmailAttachmentReader,
+  EMAIL_CHANNEL_NAME,
+} from "../../delivery/index.ts";
+import { fileContextForTenant } from "../../file-foundation/index.ts";
+
+export function emailChannelOf(registry: Registry) {
+  return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+
+export function testMailChannelContext(ctx: HandlerContext, user: SessionUser): ChannelContext {
+  return {
+    db: ctx.db,
+    registry: ctx.registry,
+    sseBroker: undefined,
+    tenantId: user.tenantId,
+    secrets: ctx.secrets,
+    config: ctx.config,
+    readAttachment: createEmailAttachmentReader(
+      ctx.db,
+      ctx.registry,
+      user.tenantId,
+      ctx.config,
+      (tenantId) => fileContextForTenant(ctx, ctx.user.tenantId, tenantId),
+    ),
+  };
+}
+
+export async function resolveTestMailAddress(
+  channel: NonNullable<ReturnType<typeof emailChannelOf>>,
+  channelContext: ChannelContext,
+  user: SessionUser,
+): Promise<string | null> {
+  return (await channel.resolve?.(user.id, channelContext)) ?? null;
+}

package/packages/bundled-features/src/template-resolver/handlers/send-test-status.query.ts

@@ -0,0 +1,31 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import {
+  emailChannelOf,
+  resolveTestMailAddress,
+  testMailChannelContext,
+} from "./send-test-shared.ts";
+
+export type SendTestStatus =
+  | { readonly canSend: true; readonly reason: null }
+  | { readonly canSend: false; readonly reason: "no_channel" | "no_address" };
+
+export const sendTestStatusQuery = defineQueryHandler({
+  name: "send-test-status",
+  schema: z.object({}),
+  access: { roles: ["TenantAdmin", "SystemAdmin"] },
+  description:
+    "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
+  handler: async (query, ctx): Promise<SendTestStatus> => {
+    const channel = emailChannelOf(ctx.registry);
+    if (channel === undefined) return { canSend: false, reason: "no_channel" };
+    const address = await resolveTestMailAddress(
+      channel,
+      testMailChannelContext(ctx, query.user),
+      query.user,
+    );
+    return address === null
+      ? { canSend: false, reason: "no_address" }
+      : { canSend: true, reason: null };
+  },
+});