@cyberismo/backend 1.1.2 → 1.3.0

package/src/auth/types.ts

@@ -1,18 +1,15 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import type { UserInfo } from '../types.js';
 
+export interface AuthResult extends UserInfo {
+  /** Credential deadline (epoch seconds). Always present: a provider whose
+   * sessions do not expire says so with a deadline far enough out to be
+   * inert, rather than leaving every consumer to handle its absence. */
+  exp: number;
+}
+
 export interface AuthProvider {
-  authenticate(req: Request): Promise<UserInfo | null>;
+  authenticate(req: Request): Promise<AuthResult | null>;
 }

package/src/common/errors.ts

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { DomainError } from '@cyberismo/data-handler';
+import {
+  ERROR_HTTP_STATUS,
+  type ErrorBody,
+  type ErrorCode,
+} from '@cyberismo/model';
+import type { ContentfulStatusCode } from 'hono/utils/http-status';
+
+/**
+ * The HTTP response for an error that reached the edge. Only a DomainError's
+ * domain 'code' picks the status; anything else is a 500.
+ */
+export function errorResponse(error: Error): {
+  status: ContentfulStatusCode;
+  body: ErrorBody;
+} {
+  const message = error.message || 'Internal Server Error';
+  if (error instanceof DomainError) {
+    return {
+      status: ERROR_HTTP_STATUS[error.code] as ContentfulStatusCode,
+      body: {
+        error: message,
+        code: error.code,
+        message,
+        ...(error.details && { details: error.details }),
+      },
+    };
+  }
+  return {
+    status: 500,
+    body: { error: message, code: 'internal', message },
+  };
+}
+
+/** The body of an error the edge decides itself. */
+export function errorBody(
+  code: ErrorCode,
+  message: string,
+  details?: Record<string, unknown>,
+): ErrorBody {
+  return { error: message, code, message, ...(details && { details }) };
+}

package/src/common/validationSchemas.ts

@@ -1,15 +1,6 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+
 import { z } from 'zod';
 import { Validate } from '@cyberismo/data-handler';
 

package/src/domain/auth/index.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2026
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation. This program is distributed in the hope that it
-  will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-  of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-  See the GNU Affero General Public License for more details.
-  You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
 import { getCurrentUser } from '../../middleware/auth.js';

package/src/domain/calculations/index.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
 import * as calculationService from './service.js';
@@ -50,10 +40,10 @@ router.post(
   requireRole(UserRole.Admin, [UserRole.Connector]),
   zValidator('json', createCalculationSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { identifier } = c.req.valid('json');
 
-    await calculationService.createCalculation(commands, identifier);
+    await calculationService.createCalculation(ws, identifier);
     return c.json({ message: 'Calculation created successfully' });
   },
 );

package/src/domain/calculations/schema.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { z } from 'zod';
 

package/src/domain/calculations/service.ts

@@ -1,17 +1,7 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
-import type { CommandManager } from '@cyberismo/data-handler';
+import type { Workspace } from '@cyberismo/data-handler';
 import { updateResourceWithOperation } from '../resources/service.js';
 
 /**
@@ -22,17 +12,14 @@ function capitalize(str: string): string {
   return str.charAt(0).toUpperCase() + str.slice(1);
 }
 
-export async function createCalculation(
-  commands: CommandManager,
-  identifier: string,
-) {
-  await commands.atomic(async () => {
-    await commands.createCmd.createCalculation(identifier);
+export async function createCalculation(ws: Workspace, identifier: string) {
+  await ws.atomic(async () => {
+    await ws.resources.create(identifier, 'calculations', {});
 
     // Set displayName to capitalized version of identifier
-    const project = await commands.showCmd.showProject();
+    const project = await ws.settings.info();
     await updateResourceWithOperation(
-      commands,
+      ws,
       { prefix: project.prefix, type: 'calculations', identifier },
       {
         updateKey: { key: 'displayName' },

package/src/domain/cardTypes/index.ts

@@ -1,17 +1,8 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
+import { ResourceNotFoundError } from '@cyberismo/data-handler';
 import * as cardTypeService from './service.js';
 import {
   createCardTypeSchema,
@@ -39,10 +30,10 @@ const router = new Hono();
  *         description: project_path not set or other internal error
  */
 router.get('/', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
+  const ws = c.get('ws');
 
   try {
-    const cardTypes = await cardTypeService.getCardTypes(commands);
+    const cardTypes = await cardTypeService.getCardTypes(ws);
     return c.json(cardTypes);
   } catch (error) {
     return c.json(
@@ -87,11 +78,11 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', createCardTypeSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { identifier, workflowName } = c.req.valid('json');
 
     try {
-      await cardTypeService.createCardType(commands, identifier, workflowName);
+      await cardTypeService.createCardType(ws, identifier, workflowName);
       return c.json({ message: 'Card type created successfully' });
     } catch (error) {
       return c.json(
@@ -153,16 +144,15 @@ router.patch(
   zValidator('param', cardTypeNameParamSchema),
   zValidator('json', fieldVisibilityBodySchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { cardTypeName } = c.req.valid('param');
     const body = c.req.valid('json');
 
     try {
-      await cardTypeService.updateFieldVisibility(commands, cardTypeName, body);
+      await cardTypeService.updateFieldVisibility(ws, cardTypeName, body);
       return c.json({ message: 'Field visibility updated successfully' });
     } catch (error) {
-      // TODO: Implement NotFoundError etc and handle them globally
-      if (error instanceof Error && error.message.includes('does not exist')) {
+      if (error instanceof ResourceNotFoundError) {
         return c.json({ error: error.message }, 404);
       }
       return c.json(

package/src/domain/cardTypes/schema.ts

@@ -1,15 +1,6 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+
 import { z } from 'zod';
 import { identifierSchema } from '../../common/validationSchemas.js';
 

package/src/domain/cardTypes/service.ts

@@ -1,31 +1,26 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
-import { resourceName, type CommandManager } from '@cyberismo/data-handler';
+import {
+  ResourceNotFoundError,
+  resourceName,
+  type Workspace,
+} from '@cyberismo/data-handler';
 import type { VisibilityGroup, FieldVisibilityBody } from './schema.js';
 
-export async function getCardTypes(commands: CommandManager) {
-  const cardTypesWithDetails =
-    await commands.showCmd.showCardTypesWithDetails();
+export async function getCardTypes(ws: Workspace) {
+  const cardTypesWithDetails = await ws.resources.contents('cardTypes');
   return cardTypesWithDetails;
 }
 
 export async function createCardType(
-  commands: CommandManager,
+  ws: Workspace,
   cardTypeName: string,
   workflowName: string,
 ) {
-  await commands.createCmd.createCardType(cardTypeName, workflowName);
+  await ws.resources.create(cardTypeName, 'cardTypes', {
+    workflow: workflowName,
+  });
 }
 
 const groupToKey: Record<Exclude<VisibilityGroup, 'hidden'>, string> = {
@@ -48,19 +43,16 @@ function getCurrentGroup(
  * Handles moving fields between visibility groups and reordering within groups.
  */
 export async function updateFieldVisibility(
-  commands: CommandManager,
+  ws: Workspace,
   cardTypeName: string,
   body: FieldVisibilityBody,
 ): Promise<void> {
   const { fieldName, group: targetGroup, index: targetIndex } = body;
   const target = resourceName(cardTypeName);
 
-  await commands.atomic(async () => {
+  await ws.atomic(async () => {
     // Read is now inside the write lock
-    const cardType = await commands.showCmd.showResource(
-      cardTypeName,
-      'cardTypes',
-    );
+    const cardType = await ws.resources.show(cardTypeName, 'cardTypes');
     if (!cardType) {
       throw new Error(`Card type '${cardTypeName}' not found`);
     }
@@ -74,7 +66,8 @@ export async function updateFieldVisibility(
       (f: { name: string }) => f.name === fieldName,
     );
     if (!fieldExists) {
-      throw new Error(
+      throw new ResourceNotFoundError(
+        fieldName,
         `Field '${fieldName}' does not exist in card type '${cardTypeName}'. `,
       );
     }
@@ -88,7 +81,7 @@ export async function updateFieldVisibility(
     // If same group, just handle reordering
     if (currentGroup === targetGroup) {
       if (targetGroup !== 'hidden' && targetIndex !== undefined) {
-        await commands.updateCmd.apply({
+        await ws.changes.apply({
           kind: 'edit',
           target,
           updateKey: { key: groupToKey[targetGroup] },
@@ -100,7 +93,7 @@ export async function updateFieldVisibility(
 
     // Remove from current group (if not hidden)
     if (currentGroup !== 'hidden') {
-      await commands.updateCmd.apply({
+      await ws.changes.apply({
         kind: 'edit',
         target,
         updateKey: { key: groupToKey[currentGroup] },
@@ -110,7 +103,7 @@ export async function updateFieldVisibility(
 
     // Add to new group (if not hidden)
     if (targetGroup !== 'hidden') {
-      await commands.updateCmd.apply({
+      await ws.changes.apply({
         kind: 'edit',
         target,
         updateKey: { key: groupToKey[targetGroup] },
@@ -118,7 +111,7 @@ export async function updateFieldVisibility(
       });
 
       if (targetIndex !== undefined) {
-        await commands.updateCmd.apply({
+        await ws.changes.apply({
           kind: 'edit',
           target,
           updateKey: { key: groupToKey[targetGroup] },