@crowi/api 2.0.0-alpha.0

package/dist/routes/ts-rest/bookmark.js

@@ -0,0 +1,189 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const api_contract_1 = require("@crowi/api-contract");
+const express_2 = require("express");
+const mongoose_1 = require("mongoose");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const page_response_1 = require("../../util/page-response");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:bookmark');
+const bookmarkToResponse = (bookmark) => {
+    const bookmarkObj = typeof bookmark.toObject === 'function' ? bookmark.toObject() : bookmark;
+    return {
+        _id: (0, ts_rest_helpers_1.toStringId)(bookmarkObj._id),
+        page: bookmarkObj.page ? (0, page_response_1.pageToResponse)(bookmarkObj.page) : null,
+        user: (0, ts_rest_helpers_1.isPopulatedUser)(bookmarkObj.user) ? (0, ts_rest_helpers_1.toPageUser)(bookmarkObj.user) : (0, ts_rest_helpers_1.toStringId)(bookmarkObj.user),
+        createdAt: (0, ts_rest_helpers_1.toISOStringOrNull)(bookmarkObj.createdAt) || new Date().toISOString(),
+    };
+};
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const Page = crowi.model('Page');
+    const Bookmark = crowi.model('Bookmark');
+    const bookmarkRouter = s.router(api_contract_1.apiContract.bookmark, {
+        /**
+         * GET /api/v2/bookmarks?page_id=xxx
+         * Returns the current user's bookmark for a given page (or null).
+         * Equivalent to legacy GET /_api/bookmarks.get.
+         */
+        getBookmark: async ({ query, req }) => {
+            const user = req.user;
+            const { page_id } = query;
+            debug('getBookmark called with:', { page_id, userId: user._id });
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+                return ts_rest_helpers_1.invalidPageIdResponse;
+            }
+            try {
+                const pageObjectId = new mongoose_1.Types.ObjectId(page_id);
+                const bookmark = (await Bookmark.findByPageIdAndUserId(pageObjectId, user._id));
+                return {
+                    status: 200,
+                    body: {
+                        bookmark: bookmark ? bookmarkToResponse(bookmark) : null,
+                    },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error fetching bookmark:', error.message);
+                return {
+                    status: 500,
+                    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+                };
+            }
+        },
+        /**
+         * GET /api/v2/bookmarks/me?limit&offset
+         * Paginated list of the current user's bookmarks.
+         * Equivalent to legacy GET /_api/bookmarks.list (paginate).
+         */
+        listMyBookmarks: async ({ query, req }) => {
+            const user = req.user;
+            const { limit = 50, offset = 0 } = query;
+            debug('listMyBookmarks called with:', { limit, offset, userId: user._id });
+            try {
+                // Bookmark.findByUserId always populates the page (and its revision/author).
+                const result = await Bookmark.findByUserId(user._id, { limit, offset });
+                const bookmarks = result.data;
+                const total = result.meta.total;
+                const prev = offset > 0 ? Math.max(0, offset - limit) : null;
+                const next = offset + limit < total ? offset + limit : null;
+                return {
+                    status: 200,
+                    body: {
+                        bookmarks: bookmarks
+                            .filter((bookmark) => bookmark.page) // populatePage may filter out inaccessible pages
+                            .map((bookmark) => bookmarkToResponse(bookmark)),
+                        pager: { prev, next, offset },
+                        total,
+                    },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error listing my bookmarks:', error.message);
+                return {
+                    status: 500,
+                    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+                };
+            }
+        },
+        /**
+         * POST /api/v2/bookmarks { page_id }
+         * Add a bookmark for the current user.
+         * If the page is not accessible / does not exist, returns { bookmark: null }
+         * to preserve legacy /_api/bookmarks.add behavior.
+         */
+        addBookmark: async ({ body: requestBody, req }) => {
+            const user = req.user;
+            const { page_id } = requestBody;
+            debug('addBookmark called with:', { page_id, userId: user._id });
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+                return ts_rest_helpers_1.invalidPageIdResponse;
+            }
+            let pageData = null;
+            try {
+                pageData = (await Page.findPageByIdAndGrantedUser(page_id, user));
+            }
+            catch (err) {
+                const error = err;
+                // findPageByIdAndGrantedUser throws on not-found / not-granted.
+                // Per the planner spec we collapse both cases into { bookmark: null }
+                // so that the new endpoint behaves like the legacy `else` branch
+                // (which the legacy controller also intended even though it was
+                // unreachable in practice).
+                if (error.message === 'Page not found' || error.message === 'Page is not granted for the user') {
+                    return { status: 200, body: { bookmark: null } };
+                }
+                debug('Error fetching page for bookmark:', error.message);
+                return {
+                    status: 500,
+                    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+                };
+            }
+            if (!pageData) {
+                return { status: 200, body: { bookmark: null } };
+            }
+            try {
+                const created = (await Bookmark.add(pageData, user));
+                // Mirror the legacy controller: depopulate before serializing so we
+                // do not leak full populated docs that the response schema may not expect.
+                // We then re-populate via pageToResponse using the page document we already fetched.
+                created.depopulate('page');
+                created.depopulate('user');
+                // Build a hybrid object: the bookmark with the page populated by pageData.
+                const bookmarkObj = created.toObject();
+                bookmarkObj.page = pageData;
+                return {
+                    status: 200,
+                    body: {
+                        bookmark: bookmarkToResponse(bookmarkObj),
+                    },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error adding bookmark:', error.message);
+                return {
+                    status: 500,
+                    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+                };
+            }
+        },
+        /**
+         * DELETE /api/v2/bookmarks { page_id }
+         * Remove a bookmark for the current user.
+         * Mirrors the legacy controller: deletes by (page, user) directly.
+         * Returns { ok: true } even when there was no bookmark to delete
+         * (the legacy controller emits ApiResponse.success() unconditionally).
+         */
+        removeBookmark: async ({ body: requestBody, req }) => {
+            const user = req.user;
+            const { page_id } = requestBody;
+            debug('removeBookmark called with:', { page_id, userId: user._id });
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+                return ts_rest_helpers_1.invalidPageIdResponse;
+            }
+            try {
+                await Bookmark.removeBookmark(new mongoose_1.Types.ObjectId(page_id), user);
+                return { status: 200, body: { ok: true } };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error removing bookmark:', error.message);
+                return {
+                    status: 500,
+                    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+                };
+            }
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.bookmark, bookmarkRouter, router);
+    return router;
+};
+//# sourceMappingURL=bookmark.js.map

package/dist/routes/ts-rest/bookmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bookmark.js","sourceRoot":"","sources":["../../../src/routes/ts-rest/bookmark.ts"],"names":[],"mappings":";;;;;AAAA,8CAAsE;AACtE,sDAAkE;AAElE,qCAA0C;AAC1C,uCAAiC;AAIjC,8DAA6J;AAC7J,0DAAuE;AACvE,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,+BAA+B,CAAC,CAAC;AAUrD,MAAM,kBAAkB,GAAG,CAAC,QAAyC,EAAY,EAAE;IACjF,MAAM,WAAW,GACf,OAAQ,QAA6B,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAE,QAA6B,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAE,QAAyB,CAAC;IAEzI,OAAO;QACL,GAAG,EAAE,IAAA,4BAAU,EAAC,WAAW,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,8BAAc,EAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAwB;QACrF,IAAI,EAAE,IAAA,iCAAe,EAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,4BAAU,EAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,4BAAU,EAAC,WAAW,CAAC,IAA+B,CAAC;QAChI,SAAS,EAAE,IAAA,mCAAiB,EAAC,WAAW,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAChF,CAAC;AACJ,CAAC,CAAC;AAEF,kBAAe,CAAC,KAAY,EAAE,IAAa,EAAE,EAAE;IAC7C,MAAM,CAAC,GAAG,IAAA,oBAAU,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,0BAAW,CAAC,QAAQ,EAAE;QACpD;;;;WAIG;QACH,WAAW,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;YAE1B,KAAK,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO,uCAAqB,CAAC;YAC/B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,qBAAqB,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAA4B,CAAC;gBAE3G,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE;wBACJ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;qBACzD;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;WAIG;QACH,eAAe,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC;YAEzC,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAE3E,IAAI,CAAC;gBACH,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxE,MAAM,SAAS,GAAG,MAAM,CAAC,IAA0B,CAAC;gBACpD,MAAM,KAAK,GAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBAExC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE5D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE;wBACJ,SAAS,EAAE,SAAS;6BACjB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,iDAAiD;6BACrF,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;wBAClD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC7B,KAAK;qBACN;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;;WAKG;QACH,WAAW,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAEhC,KAAK,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO,uCAAqB,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,GAAwB,IAAI,CAAC;YACzC,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAwB,CAAC;YAC3F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,gEAAgE;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,gEAAgE;gBAChE,4BAA4B;gBAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,kCAAkC,EAAE,CAAC;oBAC/F,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC5D,CAAC;gBACD,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAqB,CAAC;gBAEzE,oEAAoE;gBACpE,2EAA2E;gBAC3E,qFAAqF;gBACrF,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAE3B,2EAA2E;gBAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAkB,CAAC;gBACvD,WAAW,CAAC,IAAI,GAAG,QAA+B,CAAC;gBAEnD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE;wBACJ,QAAQ,EAAE,kBAAkB,CAAC,WAAW,CAAC;qBAC1C;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/C,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACH,cAAc,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;YAEhC,KAAK,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAEpE,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,OAAO,uCAAqB,CAAC;YAC/B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;gBACjE,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAa,EAAE,EAAE,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAA,gCAAsB,EAAC,0BAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAErE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/routes/ts-rest/comment.d.ts

@@ -0,0 +1,4 @@
+import Crowi from '../../crowi';
+import { Express } from 'express';
+declare const _default: (crowi: Crowi, _app: Express) => import("express-serve-static-core").Router;
+export default _default;

package/dist/routes/ts-rest/comment.js

@@ -0,0 +1,217 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const api_contract_1 = require("@crowi/api-contract");
+const express_2 = require("express");
+const mongoose_1 = require("mongoose");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:comment');
+const COMMENT_POSITION_DEFAULT = -1;
+/**
+ * Convert CommentDocument (with optionally populated creator) to API response shape.
+ * - creator is serialized to PageUserSchema-compatible object when populated
+ * - revision is returned as a string id (UI does not need full revision object)
+ */
+const commentToResponse = (comment) => {
+    const obj = comment.toObject(); // eslint-disable-line @typescript-eslint/no-explicit-any
+    let creator = null;
+    if (obj.creator && typeof obj.creator === 'object' && '_id' in obj.creator && 'username' in obj.creator) {
+        creator = (0, ts_rest_helpers_1.toPageUser)(obj.creator);
+    }
+    else if (obj.creator) {
+        creator = obj.creator.toString();
+    }
+    return {
+        _id: comment._id.toString(),
+        page: comment.page.toString(),
+        creator,
+        revision: comment.revision.toString(),
+        comment: comment.comment,
+        commentPosition: typeof comment.commentPosition === 'number' ? comment.commentPosition : COMMENT_POSITION_DEFAULT,
+        createdAt: (0, ts_rest_helpers_1.toISOStringOrNull)(comment.createdAt) ?? new Date(0).toISOString(),
+    };
+};
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const Comment = crowi.model('Comment');
+    const Page = crowi.model('Page');
+    const commentRouter = s.router(api_contract_1.apiContract.comment, {
+        /**
+         * GET /api/v2/comments
+         * List comments by page_id or revision_id (one is required).
+         * - Authentication enforced by jwtAuth at router level.
+         */
+        listComments: async ({ query, req }) => {
+            const user = req.user;
+            const { page_id, revision_id } = query;
+            debug('listComments called with:', { page_id, revision_id, userId: user._id });
+            if (!page_id && !revision_id) {
+                return {
+                    status: 400,
+                    body: {
+                        error: {
+                            code: 'INVALID_REQUEST',
+                            message: 'page_id or revision_id is required',
+                        },
+                    },
+                };
+            }
+            try {
+                let comments;
+                if (revision_id) {
+                    if (!(0, ts_rest_helpers_1.isValidObjectId)(revision_id)) {
+                        return {
+                            status: 400,
+                            body: { error: { code: 'INVALID_REQUEST', message: 'Invalid revision_id' } },
+                        };
+                    }
+                    comments = await Comment.getCommentsByRevisionId(new mongoose_1.Types.ObjectId(revision_id));
+                }
+                else {
+                    if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+                        return {
+                            status: 400,
+                            body: { error: { code: 'INVALID_REQUEST', message: 'Invalid page_id' } },
+                        };
+                    }
+                    comments = await Comment.getCommentsByPageId(new mongoose_1.Types.ObjectId(page_id));
+                }
+                return {
+                    status: 200,
+                    body: { comments: comments.map(commentToResponse) },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error listing comments:', error.message);
+                return {
+                    status: 400,
+                    body: { error: { code: 'INVALID_REQUEST', message: error.message || 'Failed to list comments' } },
+                };
+            }
+        },
+        /**
+         * POST /api/v2/comments
+         * Add a comment to a page revision.
+         * - Validates page existence and grant before creating (stricter than the legacy
+         *   /_api/comments.add which trusted the caller-provided page_id).
+         * - Comment.create triggers post-save hooks that update Page.commentCount and
+         *   Activity entries; we intentionally do not duplicate that work here.
+         */
+        addComment: async ({ body, req }) => {
+            const user = req.user;
+            const { page_id, revision_id, comment, comment_position } = body;
+            debug('addComment called with:', { page_id, revision_id, userId: user._id });
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id) || !(0, ts_rest_helpers_1.isValidObjectId)(revision_id)) {
+                return {
+                    status: 400,
+                    body: { error: { code: 'INVALID_REQUEST', message: 'Invalid page_id or revision_id' } },
+                };
+            }
+            try {
+                const page = (await Page.findPageByIdAndGrantedUser(page_id, user));
+                if (!page) {
+                    return {
+                        status: 404,
+                        body: { error: { code: 'PAGE_NOT_FOUND', message: 'Page not found' } },
+                    };
+                }
+                const created = await Comment.create({
+                    page: new mongoose_1.Types.ObjectId(page_id),
+                    creator: user._id,
+                    revision: new mongoose_1.Types.ObjectId(revision_id),
+                    comment,
+                    commentPosition: comment_position ?? COMMENT_POSITION_DEFAULT,
+                });
+                const populated = (await created.populate('creator'));
+                return {
+                    status: 200,
+                    body: { comment: commentToResponse(populated) },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error adding comment:', error.message);
+                if (error.message === 'Page not found' || error.message === 'Page is not granted for the user') {
+                    // findPageByIdAndGrantedUser hides the distinction; map both to 404.
+                    return {
+                        status: 404,
+                        body: { error: { code: 'PAGE_NOT_FOUND', message: 'Page not found' } },
+                    };
+                }
+                return {
+                    status: 400,
+                    body: { error: { code: 'INVALID_REQUEST', message: error.message || 'Failed to add comment' } },
+                };
+            }
+        },
+        /**
+         * DELETE /api/v2/comments
+         * Delete a comment by id. The legacy controller required the caller to also
+         * supply the page_id and verified page-grant via `pageData.isGrantedFor(user)`;
+         * we preserve that behavior so nothing is lost.
+         */
+        deleteComment: async ({ body, req }) => {
+            const user = req.user;
+            const { comment_id, page_id } = body;
+            debug('deleteComment called with:', { comment_id, page_id, userId: user._id });
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(comment_id) || !(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+                return {
+                    status: 400,
+                    body: { error: { code: 'INVALID_REQUEST', message: 'Invalid comment_id or page_id' } },
+                };
+            }
+            try {
+                const pageData = (await Page.findPageById(page_id));
+                if (!pageData) {
+                    return {
+                        status: 404,
+                        body: { error: { code: 'COMMENT_NOT_FOUND', message: 'Comment not found' } },
+                    };
+                }
+                if (!pageData.isGrantedFor(user)) {
+                    return {
+                        status: 403,
+                        body: {
+                            error: { code: 'PAGE_NOT_GRANTED', message: 'Page is not granted for the user' },
+                        },
+                    };
+                }
+                const existing = await Comment.findOne({ _id: new mongoose_1.Types.ObjectId(comment_id) }).exec();
+                if (!existing) {
+                    return {
+                        status: 404,
+                        body: { error: { code: 'COMMENT_NOT_FOUND', message: 'Comment not found' } },
+                    };
+                }
+                await Comment.removeCommentById(new mongoose_1.Types.ObjectId(comment_id));
+                return {
+                    status: 200,
+                    body: { ok: true },
+                };
+            }
+            catch (err) {
+                const error = err;
+                debug('Error deleting comment:', error.message);
+                if (error.message === 'Page not found') {
+                    return {
+                        status: 404,
+                        body: { error: { code: 'COMMENT_NOT_FOUND', message: 'Comment not found' } },
+                    };
+                }
+                return {
+                    status: 400,
+                    body: { error: { code: 'INVALID_REQUEST', message: error.message || 'Failed to delete comment' } },
+                };
+            }
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.comment, commentRouter, router);
+    return router;
+};
+//# sourceMappingURL=comment.js.map

package/dist/routes/ts-rest/comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment.js","sourceRoot":"","sources":["../../../src/routes/ts-rest/comment.ts"],"names":[],"mappings":";;;;;AAAA,8CAAsE;AACtE,sDAAiE;AAEjE,qCAA0C;AAC1C,uCAAiC;AAIjC,8DAA0F;AAC1F,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,8BAA8B,CAAC,CAAC;AAEpD,MAAM,wBAAwB,GAAG,CAAC,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,OAAwB,EAAE,EAAE;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAS,CAAC,CAAC,yDAAyD;IAEhG,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,IAAI,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACxG,OAAO,GAAG,IAAA,4BAAU,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC7B,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,wBAAwB;QACjH,SAAS,EAAE,IAAA,mCAAiB,EAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KAC7E,CAAC;AACJ,CAAC,CAAC;AAEF,kBAAe,CAAC,KAAY,EAAE,IAAa,EAAE,EAAE;IAC7C,MAAM,CAAC,GAAG,IAAA,oBAAU,GAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,0BAAW,CAAC,OAAO,EAAE;QAClD;;;;WAIG;QACH,YAAY,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;YAEvC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAE/E,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE;wBACJ,KAAK,EAAE;4BACL,IAAI,EAAE,iBAA0B;4BAChC,OAAO,EAAE,oCAAoC;yBAC9C;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,QAA2B,CAAC;gBAChC,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,IAAA,iCAAe,EAAC,WAAW,CAAC,EAAE,CAAC;wBAClC,OAAO;4BACL,MAAM,EAAE,GAAY;4BACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE;yBACtF,CAAC;oBACJ,CAAC;oBACD,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,IAAI,gBAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;wBAC9B,OAAO;4BACL,MAAM,EAAE,GAAY;4BACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;yBAClF,CAAC;oBACJ,CAAC;oBACD,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE;iBACpD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChD,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,yBAAyB,EAAE,EAAE;iBAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;;;;WAOG;QACH,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;YAEjE,KAAK,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAE7E,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,IAAI,CAAC,IAAA,iCAAe,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC/D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE;iBACjG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAwB,CAAC;gBAC3F,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,gBAAyB,EAAE,EAAE;qBACzF,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;oBACnC,IAAI,EAAE,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACjC,OAAO,EAAE,IAAI,CAAC,GAAG;oBACjB,QAAQ,EAAE,IAAI,gBAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACzC,OAAO;oBACP,eAAe,EAAE,gBAAgB,IAAI,wBAAwB;iBAC9D,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAoB,CAAC;gBAEzE,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAE9C,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,IAAI,KAAK,CAAC,OAAO,KAAK,kCAAkC,EAAE,CAAC;oBAC/F,qEAAqE;oBACrE,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,gBAAyB,EAAE,EAAE;qBACzF,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,uBAAuB,EAAE,EAAE;iBACzG,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;;WAKG;QACH,aAAa,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAoB,CAAC;YACtC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;YAErC,KAAK,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAE/E,IAAI,CAAC,IAAA,iCAAe,EAAC,UAAU,CAAC,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE;iBAChG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAwB,CAAC;gBAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAA4B,EAAE,OAAO,EAAE,mBAA4B,EAAE,EAAE;qBAC/F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE;4BACJ,KAAK,EAAE,EAAE,IAAI,EAAE,kBAA2B,EAAE,OAAO,EAAE,kCAA2C,EAAE;yBACnG;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,gBAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAA4B,EAAE,OAAO,EAAE,mBAA4B,EAAE,EAAE;qBAC/F,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,CAAC,iBAAiB,CAAC,IAAI,gBAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;gBAEhE,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAa,EAAE;iBAC5B,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAAY,CAAC;gBAC3B,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAEhD,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;oBACvC,OAAO;wBACL,MAAM,EAAE,GAAY;wBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAA4B,EAAE,OAAO,EAAE,mBAA4B,EAAE,EAAE;qBAC/F,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,GAAY;oBACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,0BAA0B,EAAE,EAAE;iBAC5G,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAA,gCAAsB,EAAC,0BAAW,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAEnE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/routes/ts-rest/draft.d.ts

@@ -0,0 +1,22 @@
+import Crowi from '../../crowi';
+import { Express } from 'express';
+/**
+ * RFC-0004 Phase 3 — drafts endpoints (`/api/v2/pages/drafts`).
+ *
+ * A *draft* is a `Page` with `status === 'draft'`: a brand-new page in
+ * progress, author-only, that transitions to `published` exactly once
+ * on first save (the publish transition itself is owned by the future
+ * RFC-0003 save flow — out of scope here).
+ *
+ * Mounted in the authenticated router, so `jwtAuth` is already applied
+ * and `req.user` is a `UserDocument`. CSRF is not needed for ts-rest
+ * (token-based auth).
+ *
+ * Same-path conflict (`docs/rfcs/0004-editor-ux-enhancement.md`
+ * §"Same-path conflict"): creating a draft at a path already held by
+ * another user's draft returns 409 with that user's identity so the
+ * `Creating pages` UI can show the contact-the-owner message. A path
+ * held by a *published* page returns a plain 400.
+ */
+declare const _default: (crowi: Crowi, _app: Express) => import("express-serve-static-core").Router;
+export default _default;

package/dist/routes/ts-rest/draft.js

@@ -0,0 +1,200 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("@ts-rest/express");
+const api_contract_1 = require("@crowi/api-contract");
+const express_2 = require("express");
+const page_1 = require("../../models/page");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:routes:ts-rest:draft');
+/** MongoDB duplicate-key error code, raised by the unique `Page.path` index. */
+const isDuplicateKeyError = (err) => typeof err === 'object' && err !== null && err.code === 11000;
+/**
+ * RFC-0004 Phase 3 — drafts endpoints (`/api/v2/pages/drafts`).
+ *
+ * A *draft* is a `Page` with `status === 'draft'`: a brand-new page in
+ * progress, author-only, that transitions to `published` exactly once
+ * on first save (the publish transition itself is owned by the future
+ * RFC-0003 save flow — out of scope here).
+ *
+ * Mounted in the authenticated router, so `jwtAuth` is already applied
+ * and `req.user` is a `UserDocument`. CSRF is not needed for ts-rest
+ * (token-based auth).
+ *
+ * Same-path conflict (`docs/rfcs/0004-editor-ux-enhancement.md`
+ * §"Same-path conflict"): creating a draft at a path already held by
+ * another user's draft returns 409 with that user's identity so the
+ * `Creating pages` UI can show the contact-the-owner message. A path
+ * held by a *published* page returns a plain 400.
+ */
+exports.default = (crowi, _app) => {
+    const s = (0, express_1.initServer)();
+    const router = (0, express_2.Router)();
+    const Page = crowi.model('Page');
+    const Revision = crowi.model('Revision');
+    const User = crowi.model('User');
+    const draftRouter = s.router(api_contract_1.apiContract.draft, {
+        /**
+         * POST /api/v2/pages/drafts
+         *
+         * Create a draft at `path` with the default `GRANT_PUBLIC` grant
+         * (RFC-0005 Phase 1). A draft's author-only visibility is enforced
+         * entirely by `status: 'draft'` — `findPage*` collapse a non-author
+         * by-id / by-path access into not-found, and listing / search /
+         * backlink all exclude other users' drafts by status. The grant is
+         * deliberately left public so that once publish-on-save flips the
+         * status to `published`, the page is immediately visible to other
+         * users; a `GRANT_OWNER` draft would stay invisible at the grant
+         * layer even after the status flip. (Phase 2 will let the editor
+         * pick a non-public grant explicitly.)
+         */
+        createDraft: async ({ body, req }) => {
+            const user = req.user;
+            // The seed revision's `body` is `required` in the Revision schema
+            // and Mongoose rejects an empty string. A brand-new draft is
+            // conceptually empty, so seed a single newline — it renders to
+            // nothing and gives the collab editor an effectively blank doc.
+            const initialBody = body.initialBody && body.initialBody.length > 0 ? body.initialBody : '\n';
+            const path = Page.normalizePath(body.path);
+            debug('createDraft called', { path, userId: user._id.toString() });
+            if (!Page.isCreatableName(path)) {
+                return {
+                    status: 400,
+                    body: { error: 'invalid_path', message: `Cannot create a page at this path (${path}).` },
+                };
+            }
+            // Resolve a path already occupied by a page into the right
+            // response — the caller's own draft → 201 (idempotent, so a
+            // double-click resolves to the same draft), another user's draft
+            // → 409 with owner info, anything published → 400. `null` means
+            // the path is free. The owner is loaded only on the 409 branch.
+            const resolveOccupied = async () => {
+                const existing = (await Page.findOne({ path }));
+                if (!existing)
+                    return null;
+                if (existing.status !== page_1.STATUS_DRAFT) {
+                    return {
+                        status: 400,
+                        body: { error: 'path_taken', message: `A page already exists at ${path}.` },
+                    };
+                }
+                if (existing.isCreator(user)) {
+                    return { status: 201, body: { pageId: existing._id.toString() } };
+                }
+                const owner = (await User.findById(existing.creator));
+                return {
+                    status: 409,
+                    body: {
+                        error: 'path_taken_by_draft',
+                        owner: owner
+                            ? { id: owner._id.toString(), username: owner.username, displayName: owner.name }
+                            : { id: '', username: 'unknown', displayName: 'unknown' },
+                        message: owner ? `This page is being created by @${owner.username}.` : 'This page is being created by another user.',
+                    },
+                };
+            };
+            const occupied = await resolveOccupied();
+            if (occupied)
+                return occupied;
+            try {
+                const newPage = await Page.create({
+                    path,
+                    creator: user,
+                    lastUpdateUser: user,
+                    createdAt: Date.now(),
+                    updatedAt: Date.now(),
+                    redirectTo: null,
+                    grant: page_1.GRANT_PUBLIC,
+                    status: page_1.STATUS_DRAFT,
+                    grantedUsers: [user],
+                });
+                // Seed the first revision so the page is loadable / editable
+                // immediately. `pushRevision` wires `revision` + bumps the
+                // `Page.create` event so backlinks / search run — both already
+                // exclude other users' drafts (Phase 2).
+                const newRevision = await Revision.prepareRevision(newPage, initialBody, user, { format: 'markdown' });
+                await Page.pushRevision(newPage, newRevision, user);
+                debug('createDraft created draft page', { pageId: newPage._id.toString(), path });
+                return { status: 201, body: { pageId: newPage._id.toString() } };
+            }
+            catch (err) {
+                // A concurrent POST can win the unique-`path`-index race between
+                // the pre-check and `create`. Re-resolve so the loser still gets
+                // the proper 400 / 409 instead of a misleading `invalid_path`.
+                if (isDuplicateKeyError(err)) {
+                    const raced = await resolveOccupied();
+                    if (raced)
+                        return raced;
+                }
+                debug('createDraft failed:', err.message);
+                return {
+                    status: 400,
+                    body: { error: 'invalid_path', message: err.message || 'Failed to create draft.' },
+                };
+            }
+        },
+        /**
+         * GET /api/v2/pages/drafts
+         *
+         * List the caller's own drafts, newest first. Powers the
+         * `Creating pages` view; never returns another user's drafts.
+         */
+        listDrafts: async ({ req }) => {
+            const user = req.user;
+            debug('listDrafts called', { userId: user._id.toString() });
+            const drafts = (await Page.find({ status: page_1.STATUS_DRAFT, creator: user._id })
+                .sort({ createdAt: -1 })
+                .select('_id path createdAt updatedAt')
+                .lean()
+                .exec());
+            return {
+                status: 200,
+                body: {
+                    drafts: drafts.map((d) => ({
+                        pageId: d._id.toString(),
+                        path: d.path,
+                        createdAt: (0, ts_rest_helpers_1.toISOStringOrNull)(d.createdAt) ?? new Date().toISOString(),
+                        updatedAt: (0, ts_rest_helpers_1.toISOStringOrNull)(d.updatedAt) ?? (0, ts_rest_helpers_1.toISOStringOrNull)(d.createdAt) ?? new Date().toISOString(),
+                    })),
+                },
+            };
+        },
+        /**
+         * DELETE /api/v2/pages/drafts/:id
+         *
+         * Cancel a draft, releasing its path. Only the author may cancel.
+         * "No such draft", "not a draft", and "someone else's draft" all
+         * collapse to the same 404 so draft existence is never leaked.
+         */
+        cancelDraft: async ({ params, req }) => {
+            const user = req.user;
+            const { id } = params;
+            debug('cancelDraft called', { id, userId: user._id.toString() });
+            const draftNotFound = {
+                status: 404,
+                body: { error: 'draft_not_found', message: 'Draft not found.' },
+            };
+            // A malformed id would make the `_id` query throw a CastError;
+            // collapse it into the same 404 as "no such draft".
+            if (!(0, ts_rest_helpers_1.isValidObjectId)(id)) {
+                return draftNotFound;
+            }
+            const page = (await Page.findOne({ _id: id, status: page_1.STATUS_DRAFT, creator: user._id }));
+            if (!page) {
+                return draftNotFound;
+            }
+            // `removePage` physically deletes the Page and its revisions —
+            // the right semantics for "cancel": the path is freed and no
+            // /trash redirect stub is left behind (unlike soft delete).
+            await Page.removePage(page);
+            debug('cancelDraft removed draft', { id, path: page.path });
+            return { status: 200, body: { pageId: id } };
+        },
+    });
+    (0, express_1.createExpressEndpoints)(api_contract_1.apiContract.draft, draftRouter, router);
+    return router;
+};
+//# sourceMappingURL=draft.js.map