@cyberismo/backend 0.0.21 → 0.0.22

package/src/domain/cardTypes/service.ts

@@ -54,126 +54,72 @@ export async function updateFieldVisibility(
 ): Promise<void> {
   const { fieldName, group: targetGroup, index: targetIndex } = body;
 
-  // Get current card type data
-  const cardType = await commands.showCmd.showResource(
-    cardTypeName,
-    'cardTypes',
-  );
-  if (!cardType) {
-    throw new Error(`Card type '${cardTypeName}' not found`);
-  }
+  await commands.atomic(async () => {
+    // Read is now inside the write lock
+    const cardType = await commands.showCmd.showResource(
+      cardTypeName,
+      'cardTypes',
+    );
+    if (!cardType) {
+      throw new Error(`Card type '${cardTypeName}' not found`);
+    }
 
-  const customFields = cardType.customFields || [];
-  const alwaysVisibleFields = cardType.alwaysVisibleFields || [];
-  const optionallyVisibleFields = cardType.optionallyVisibleFields || [];
+    const customFields = cardType.customFields || [];
+    const alwaysVisibleFields = cardType.alwaysVisibleFields || [];
+    const optionallyVisibleFields = cardType.optionallyVisibleFields || [];
 
-  // Validate that the field exists in customFields
-  const fieldExists = customFields.some(
-    (f: { name: string }) => f.name === fieldName,
-  );
-  if (!fieldExists) {
-    throw new Error(
-      `Field '${fieldName}' does not exist in card type '${cardTypeName}'. `,
+    // Validate that the field exists in customFields
+    const fieldExists = customFields.some(
+      (f: { name: string }) => f.name === fieldName,
     );
-  }
+    if (!fieldExists) {
+      throw new Error(
+        `Field '${fieldName}' does not exist in card type '${cardTypeName}'. `,
+      );
+    }
 
-  const currentGroup = getCurrentGroup(
-    alwaysVisibleFields,
-    optionallyVisibleFields,
-    fieldName,
-  );
+    const currentGroup = getCurrentGroup(
+      alwaysVisibleFields,
+      optionallyVisibleFields,
+      fieldName,
+    );
 
-  // If same group, just handle reordering
-  if (currentGroup === targetGroup) {
-    if (targetGroup === 'hidden') {
-      // Nothing to reorder in hidden group
+    // If same group, just handle reordering
+    if (currentGroup === targetGroup) {
+      if (targetGroup !== 'hidden' && targetIndex !== undefined) {
+        await commands.updateCmd.applyResourceOperation(
+          cardTypeName,
+          { key: groupToKey[targetGroup] },
+          { name: 'rank', target: fieldName, newIndex: targetIndex },
+        );
+      }
       return;
     }
 
-    if (targetIndex !== undefined) {
-      await commands.updateCmd.applyResourceOperation(
-        cardTypeName,
-        {
-          key: groupToKey[targetGroup],
-        },
-        {
-          name: 'rank',
-          target: fieldName,
-          newIndex: targetIndex,
-        },
-      );
-    }
-    return;
-  }
-
-  // Different group - need to remove from old and add to new
-  let removedFromOld = false;
-
-  try {
     // Remove from current group (if not hidden)
     if (currentGroup !== 'hidden') {
       await commands.updateCmd.applyResourceOperation(
         cardTypeName,
-        {
-          key: groupToKey[currentGroup],
-        },
-        {
-          name: 'remove',
-          target: fieldName,
-        },
+        { key: groupToKey[currentGroup] },
+        { name: 'remove', target: fieldName },
       );
-      removedFromOld = true;
     }
 
     // Add to new group (if not hidden)
     if (targetGroup !== 'hidden') {
       await commands.updateCmd.applyResourceOperation(
         cardTypeName,
-        {
-          key: groupToKey[targetGroup],
-        },
-        {
-          name: 'add',
-          target: fieldName,
-        },
+        { key: groupToKey[targetGroup] },
+        { name: 'add', target: fieldName },
       );
 
-      // Reorder if index specified
       if (targetIndex !== undefined) {
         await commands.updateCmd.applyResourceOperation(
           cardTypeName,
-          {
-            key: groupToKey[targetGroup],
-          },
-          {
-            name: 'rank',
-            target: fieldName,
-            newIndex: targetIndex,
-          },
-        );
-      }
-    }
-  } catch (error) {
-    // Attempt rollback if we removed from old group but failed to add to new
-    if (removedFromOld && currentGroup !== 'hidden') {
-      try {
-        await commands.updateCmd.applyResourceOperation(
-          cardTypeName,
-          {
-            key: groupToKey[currentGroup],
-          },
-          {
-            name: 'add',
-            target: fieldName,
-          },
-        );
-      } catch {
-        // Rollback failed - log but throw original error
-        console.error(
-          `Rollback failed for field '${fieldName}' in card type '${cardTypeName}'`,
+          { key: groupToKey[targetGroup] },
+          { name: 'rank', target: fieldName, newIndex: targetIndex },
         );
       }
     }
-    throw error;
-  }
+  }, `Update field visibility for ${cardTypeName}`);
 }

package/src/domain/cards/index.ts

@@ -17,6 +17,8 @@ import { getCardDetails } from './lib.js';
 import * as cardService from './service.js';
 import { isSSGContext, ssgParams } from 'hono/ssg';
 import type { AppContext } from '../../types.js';
+import { UserRole } from '../../types.js';
+import { requireRole } from '../../middleware/auth.js';
 
 const router = new Hono();
 
@@ -34,7 +36,7 @@ const router = new Hono();
  *       500:
  *         description: project_path not set.
  */
-router.get('/', async (c) => {
+router.get('/', requireRole(UserRole.Reader), async (c) => {
   const commands = c.get('commands');
 
   try {
@@ -75,6 +77,7 @@ router.get('/', async (c) => {
  */
 router.get(
   '/:key',
+  requireRole(UserRole.Reader),
   ssgParams(async (c: AppContext) => {
     const commands = c.get('commands');
     const opts = c.get('tree');
@@ -144,7 +147,7 @@ router.get(
  *       500:
  *         description: project_path not set.
  */
-router.patch('/:key', async (c) => {
+router.patch('/:key', requireRole(UserRole.Editor), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
   if (!key) {
@@ -201,7 +204,7 @@ router.patch('/:key', async (c) => {
  *       500:
  *         description: project_path not set.
  */
-router.delete('/:key', async (c) => {
+router.delete('/:key', requireRole(UserRole.Editor), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
   if (!key) {
@@ -244,7 +247,7 @@ router.delete('/:key', async (c) => {
  *       500:
  *         description: project_path not set
  */
-router.post('/:key', async (c) => {
+router.post('/:key', requireRole(UserRole.Editor), async (c) => {
   const key = c.req.param('key');
   if (!key) {
     return c.text('No search key', 400);
@@ -300,7 +303,7 @@ router.post('/:key', async (c) => {
  *       500:
  *         description: Server error
  */
-router.post('/:key/attachments', async (c) => {
+router.post('/:key/attachments', requireRole(UserRole.Editor), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
 
@@ -354,25 +357,33 @@ router.post('/:key/attachments', async (c) => {
  *       500:
  *         description: Server error
  */
-router.delete('/:key/attachments/:filename', async (c) => {
-  const commands = c.get('commands');
-  const { key, filename } = c.req.param();
+router.delete(
+  '/:key/attachments/:filename',
+  requireRole(UserRole.Editor),
+  async (c) => {
+    const commands = c.get('commands');
+    const { key, filename } = c.req.param();
 
-  try {
-    const result = await cardService.removeAttachment(commands, key, filename);
-    return c.json(result);
-  } catch (error) {
-    return c.json(
-      {
-        error:
-          error instanceof Error
-            ? error.message
-            : 'Failed to remove attachment',
-      },
-      500,
-    );
-  }
-});
+    try {
+      const result = await cardService.removeAttachment(
+        commands,
+        key,
+        filename,
+      );
+      return c.json(result);
+    } catch (error) {
+      return c.json(
+        {
+          error:
+            error instanceof Error
+              ? error.message
+              : 'Failed to remove attachment',
+        },
+        500,
+      );
+    }
+  },
+);
 
 /**
  * @swagger
@@ -398,23 +409,29 @@ router.delete('/:key/attachments/:filename', async (c) => {
  *       500:
  *         description: Server error
  */
-router.post('/:key/attachments/:filename/open', async (c) => {
-  const commands = c.get('commands');
-  const { key, filename } = c.req.param();
+router.post(
+  '/:key/attachments/:filename/open',
+  requireRole(UserRole.Reader),
+  async (c) => {
+    const commands = c.get('commands');
+    const { key, filename } = c.req.param();
 
-  try {
-    const result = await cardService.openAttachment(commands, key, filename);
-    return c.json(result);
-  } catch (error) {
-    return c.json(
-      {
-        error:
-          error instanceof Error ? error.message : 'Failed to open attachment',
-      },
-      500,
-    );
-  }
-});
+    try {
+      const result = await cardService.openAttachment(commands, key, filename);
+      return c.json(result);
+    } catch (error) {
+      return c.json(
+        {
+          error:
+            error instanceof Error
+              ? error.message
+              : 'Failed to open attachment',
+        },
+        500,
+      );
+    }
+  },
+);
 
 /**
  * @swagger
@@ -443,7 +460,7 @@ router.post('/:key/attachments/:filename/open', async (c) => {
  *       500:
  *         description: Server error
  */
-router.post('/:key/parse', async (c) => {
+router.post('/:key/parse', requireRole(UserRole.Reader), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
   const { content } = await c.req.json();
@@ -497,7 +514,7 @@ router.post('/:key/parse', async (c) => {
  *       500:
  *         description: Server error
  */
-router.post('/:key/links', async (c) => {
+router.post('/:key/links', requireRole(UserRole.Editor), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
   const { toCard, linkType, description } = await c.req.json();
@@ -556,7 +573,7 @@ router.post('/:key/links', async (c) => {
  *       500:
  *         description: Server error
  */
-router.delete('/:key/links', async (c) => {
+router.delete('/:key/links', requireRole(UserRole.Editor), async (c) => {
   const commands = c.get('commands');
   const key = c.req.param('key');
   const { toCard, linkType, description } = await c.req.json();
@@ -610,11 +627,12 @@ router.delete('/:key/links', async (c) => {
  */
 router.get(
   '/:key/a/:attachment',
+  requireRole(UserRole.Reader),
   ssgParams(async (c: Context) => {
     const commands = c.get('commands');
     return await cardService.findRelevantAttachments(commands, c.get('tree'));
   }),
-  (c) => {
+  async (c) => {
     const commands = c.get('commands');
     const { key, attachment } = c.req.param();
     const filename = decodeURI(attachment);
@@ -624,7 +642,7 @@ router.get(
     }
 
     try {
-      const attachmentResponse = cardService.getAttachment(
+      const attachmentResponse = await cardService.getAttachment(
         commands,
         key,
         filename,

package/src/domain/cards/lib.ts

@@ -30,122 +30,127 @@ export async function getCardDetails(
   staticMode: boolean,
   raw: boolean,
 ): Promise<result> {
-  let cardDetailsResponse: Card;
-  try {
-    cardDetailsResponse = commands.showCmd.showCardDetails(key);
-  } catch {
-    return { status: 400, message: `Card ${key} not found from project` };
-  }
+  return commands.consistent(async () => {
+    let cardDetailsResponse: Card;
+    try {
+      cardDetailsResponse = await commands.showCmd.showCardDetails(key);
+    } catch {
+      return { status: 400, message: `Card ${key} not found from project` };
+    }
 
-  if (!cardDetailsResponse) {
-    return { status: 400, message: `Card ${key} not found from project` };
-  }
+    if (!cardDetailsResponse) {
+      return { status: 400, message: `Card ${key} not found from project` };
+    }
 
-  // always parse for now if not in export mode
-  if (!staticMode && !raw) {
-    await commands.calculateCmd.generate();
-  }
+    // always parse for now if not in export mode
+    if (!staticMode && !raw) {
+      await commands.calculateCmd.generate();
+    }
 
-  let asciidocContent = '';
-  try {
-    asciidocContent = await evaluateMacros(cardDetailsResponse.content || '', {
-      context: staticMode ? 'exportedSite' : 'localApp',
-      mode: staticMode ? 'staticSite' : 'inject',
-      project: commands.project,
-      cardKey: key,
-    });
-  } catch (error) {
-    asciidocContent = `Macro error: ${error instanceof Error ? error.message : 'Unknown error'}\n\n${asciidocContent}`;
-  }
+    let asciidocContent = '';
+    try {
+      asciidocContent = await evaluateMacros(
+        cardDetailsResponse.content || '',
+        {
+          context: staticMode ? 'exportedSite' : 'localApp',
+          mode: staticMode ? 'staticSite' : 'inject',
+          project: commands.project,
+          cardKey: key,
+        },
+      );
+    } catch (error) {
+      asciidocContent = `Macro error: ${error instanceof Error ? error.message : 'Unknown error'}\n\n${asciidocContent}`;
+    }
 
-  const htmlContent = Processor()
-    .convert(asciidocContent, {
-      safe: 'safe',
-      attributes: {
-        imagesdir: `/api/cards/${key}/a`,
-        icons: 'font',
-      },
-    })
-    .toString();
+    const htmlContent = Processor()
+      .convert(asciidocContent, {
+        safe: 'safe',
+        attributes: {
+          imagesdir: `/api/cards/${key}/a`,
+          icons: 'font',
+        },
+      })
+      .toString();
 
-  if (raw) {
-    if (!cardDetailsResponse.metadata) {
-      throw new Error('Card has no metadata');
+    if (raw) {
+      if (!cardDetailsResponse.metadata) {
+        throw new Error('Card has no metadata');
+      }
+      const cardType = await commands.showCmd.showResource(
+        cardDetailsResponse.metadata.cardType,
+        'cardTypes',
+      );
+
+      const fields = [];
+      let i = 0;
+      for (const customField of cardType.customFields) {
+        const fieldType = await commands.showCmd.showResource(
+          customField.name,
+          'fieldTypes',
+        );
+        fields.push({
+          key: customField.name,
+          visibility: 'always',
+          index: i++,
+          fieldDisplayName: fieldType.displayName,
+          fieldDescription: fieldType.description,
+          dataType: fieldType.dataType,
+          isCalculated: customField.isCalculated,
+          value: cardDetailsResponse.metadata[customField.name],
+          enumValues: fieldType.enumValues ?? [],
+        });
+      }
+      return {
+        status: 200,
+        data: {
+          key: cardDetailsResponse.key,
+          rank: cardDetailsResponse.metadata?.rank,
+          title: cardDetailsResponse.metadata?.title || '',
+          cardType: cardDetailsResponse.metadata?.cardType || '',
+          cardTypeDisplayName: cardDetailsResponse.metadata.cardType,
+          workflowState: '',
+          lastUpdated: cardDetailsResponse.metadata.lastUpdated,
+          fields,
+          labels: cardDetailsResponse.metadata?.labels || [],
+          links: [],
+          notifications: [],
+          policyChecks: {
+            successes: [],
+            failures: [],
+          },
+          deniedOperations: {
+            transition: [],
+            move: [],
+            delete: [],
+            editField: [],
+            editContent: [],
+          },
+          rawContent: cardDetailsResponse.content || '',
+          parsedContent: htmlContent,
+          attachments: cardDetailsResponse.attachments,
+        },
+      };
     }
-    const cardType = await commands.showCmd.showResource(
-      cardDetailsResponse.metadata.cardType,
-      'cardTypes',
-    );
 
-    const fields = [];
-    let i = 0;
-    for (const customField of cardType.customFields) {
-      const fieldType = await commands.showCmd.showResource(
-        customField.name,
-        'fieldTypes',
-      );
-      fields.push({
-        key: customField.name,
-        visibility: 'always',
-        index: i++,
-        fieldDisplayName: fieldType.displayName,
-        fieldDescription: fieldType.description,
-        dataType: fieldType.dataType,
-        isCalculated: customField.isCalculated,
-        value: cardDetailsResponse.metadata[customField.name],
-        enumValues: fieldType.enumValues ?? [],
-      });
+    const card = staticMode
+      ? await getCardQueryResult(commands, key)
+      : await commands.calculateCmd.runQuery('card', 'localApp', {
+          cardKey: key,
+        });
+    if (card.length !== 1) {
+      throw new Error('Query failed. Check card-query syntax');
     }
+
     return {
       status: 200,
       data: {
-        key: cardDetailsResponse.key,
-        rank: cardDetailsResponse.metadata?.rank,
-        title: cardDetailsResponse.metadata?.title || '',
-        cardType: cardDetailsResponse.metadata?.cardType || '',
-        cardTypeDisplayName: cardDetailsResponse.metadata.cardType,
-        workflowState: '',
-        lastUpdated: cardDetailsResponse.metadata.lastUpdated,
-        fields,
-        labels: cardDetailsResponse.metadata?.labels || [],
-        links: [],
-        notifications: [],
-        policyChecks: {
-          successes: [],
-          failures: [],
-        },
-        deniedOperations: {
-          transition: [],
-          move: [],
-          delete: [],
-          editField: [],
-          editContent: [],
-        },
+        ...card[0],
         rawContent: cardDetailsResponse.content || '',
         parsedContent: htmlContent,
         attachments: cardDetailsResponse.attachments,
       },
     };
-  }
-
-  const card = staticMode
-    ? await getCardQueryResult(commands.project.basePath, key)
-    : await commands.calculateCmd.runQuery('card', 'localApp', {
-        cardKey: key,
-      });
-  if (card.length !== 1) {
-    throw new Error('Query failed. Check card-query syntax');
-  }
-
-  return {
-    status: 200,
-    data: {
-      ...card[0],
-      rawContent: cardDetailsResponse.content || '',
-      parsedContent: htmlContent,
-      attachments: cardDetailsResponse.attachments,
-    },
-  };
+  });
 }
 /**
  * Returns all cards from a tree query, flattened.