@ftisindia/create-app 0.1.5 → 0.2.0

package/template/scripts/push-form.ts

@@ -0,0 +1,124 @@
+/**
+ * Push a form-definition JSON file into an organisation — headless
+ * definitions-as-code, through the REAL engine path (save-time lint, RBAC,
+ * audit rows, versioning). Nothing is bypassed: the script impersonates an
+ * existing member (their CASL permissions apply; org owners pass everything).
+ *
+ *   npm run forms:push -- --file src/modules/forms/definitions/my-form.form.json \
+ *       --org <org-id-or-slug> --user <member-email> [--publish]
+ *
+ * Idempotent: if the file matches the latest stored version's schema, nothing
+ * new is created (with --publish, a matching DRAFT is published in place).
+ * Runs under ts-node (it bootstraps Nest — tsx drops decorator metadata).
+ */
+import { readFileSync } from 'node:fs';
+import { NestFactory } from '@nestjs/core';
+import type { FormDefinition } from '@ftisindia/form-builder';
+import { AppModule } from '../src/app.module';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { RbacCacheService } from '../src/modules/access-control/application/services/rbac-cache.service';
+import { FormsDefinitionsService } from '../src/modules/forms/application/services/forms-definitions.service';
+import { RequestContextService } from '../src/modules/request-context/application/services/request-context.service';
+
+function argValue(flag: string): string | undefined {
+  const index = process.argv.indexOf(flag);
+  return index !== -1 ? process.argv[index + 1] : undefined;
+}
+
+function stableStringify(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>)
+      .filter(([, v]) => v !== undefined)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
+    return `{${entries.join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/** Version/status are managed by the engine — compare the authored content only. */
+function normalized(schema: FormDefinition): string {
+  const { version: _version, status: _status, ...rest } = schema;
+  return stableStringify(rest);
+}
+
+async function main() {
+  const file = argValue('--file');
+  const orgRef = argValue('--org');
+  const userEmail = argValue('--user');
+  const publish = process.argv.includes('--publish');
+  if (!file || !orgRef || !userEmail) {
+    throw new Error(
+      'Usage: npm run forms:push -- --file <path> --org <org-id-or-slug> --user <member-email> [--publish]',
+    );
+  }
+
+  const definition = JSON.parse(readFileSync(file, 'utf8')) as FormDefinition;
+  if (!definition.key) {
+    throw new Error(`${file} does not look like a form definition (missing "key").`);
+  }
+
+  const app = await NestFactory.createApplicationContext(AppModule, {
+    logger: ['error', 'warn'],
+  });
+  try {
+    const prisma = app.get(PrismaService);
+    const user = await prisma.user.findFirst({ where: { email: userEmail } });
+    if (!user) {
+      throw new Error(`No user found with email "${userEmail}".`);
+    }
+    const org = await prisma.organisation.findFirst({
+      where: { OR: [{ id: orgRef }, { slug: orgRef }] },
+    });
+    if (!org) {
+      throw new Error(`No organisation found with id or slug "${orgRef}".`);
+    }
+
+    // Real membership + permissions — the engine's authz seam sees exactly
+    // what this user could do over HTTP.
+    const rbac = await app.get(RbacCacheService).getContext(user.id, org.id);
+    const requestContext = app.get(RequestContextService);
+    const definitions = app.get(FormsDefinitionsService);
+
+    await requestContext.run(
+      { source: 'worker', orgId: org.id, userId: user.id, rbac },
+      async () => {
+        const latest = await prisma.formDefinition.findFirst({
+          where: { orgId: org.id, key: definition.key },
+          orderBy: { version: 'desc' },
+        });
+
+        if (latest && normalized(latest.schema as unknown as FormDefinition) === normalized(definition)) {
+          if (publish && latest.status === 'DRAFT') {
+            await definitions.publish(org.id, definition.key, latest.version);
+            console.log(`Unchanged content — published existing draft v${latest.version}.`);
+          } else {
+            console.log(
+              `No changes — "${definition.key}" v${latest.version} (${latest.status}) already matches ${file}.`,
+            );
+          }
+          return;
+        }
+
+        const created = await definitions.create(org.id, {
+          definition: definition as unknown as Record<string, unknown>,
+        });
+        console.log(`Created "${created.key}" v${created.version} (DRAFT).`);
+        if (publish) {
+          await definitions.publish(org.id, created.key, created.version);
+          console.log(`Published "${created.key}" v${created.version}.`);
+        }
+      },
+    );
+  } finally {
+    await app.close();
+  }
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

package/template/src/app.module.ts

@@ -2,15 +2,26 @@ import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { APP_GUARD } from '@nestjs/core';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
-import { appConfig, authConfig, databaseConfig, rbacConfig, validate } from './config';
+import {
+  appConfig,
+  authConfig,
+  databaseConfig,
+  formsConfig,
+  rbacConfig,
+  reportsConfig,
+  validate,
+} from './config';
 import { PrismaModule } from './database/prisma/prisma.module';
 import { AccessControlModule } from './modules/access-control/access-control.module';
 import { AuditModule } from './modules/audit/audit.module';
 import { AuthModule } from './modules/auth/auth.module';
+import { FormsModule } from './modules/forms/forms.module';
 import { HealthModule } from './modules/health/health.module';
 import { InvitationsModule } from './modules/invitations/invitations.module';
 import { MembershipsModule } from './modules/memberships/memberships.module';
 import { OrganisationsModule } from './modules/organisations/organisations.module';
+import { ReportsModule } from './modules/reports/reports.module';
+import { ReportsFormsModule } from './modules/reports/reports-forms.module';
 import { RequestContextModule } from './modules/request-context/request-context.module';
 import { SampleModule } from './modules/sample/sample.module';
 import { SettingsModule } from './modules/settings/settings.module';
@@ -21,15 +32,21 @@ import { SettingsModule } from './modules/settings/settings.module';
       isGlobal: true,
       cache: true,
       expandVariables: true,
-      load: [appConfig, authConfig, databaseConfig, rbacConfig],
+      load: [appConfig, authConfig, databaseConfig, formsConfig, rbacConfig, reportsConfig],
       validate,
     }),
-    ThrottlerModule.forRoot([
-      {
-        ttl: 60_000,
-        limit: 100,
-      },
-    ]),
+    ThrottlerModule.forRoot({
+      throttlers: [
+        {
+          ttl: 60_000,
+          limit: 100,
+        },
+      ],
+      // Most e2e suites create many users/submissions in seconds; enable
+      // throttling only in the dedicated abuse-control suite.
+      skipIf: () =>
+        process.env.NODE_ENV === 'test' && process.env.E2E_THROTTLE_ENABLED !== 'true',
+    }),
     PrismaModule,
     HealthModule,
     AuthModule,
@@ -40,6 +57,11 @@ import { SettingsModule } from './modules/settings/settings.module';
     MembershipsModule,
     InvitationsModule,
     SettingsModule,
+    FormsModule,
+    ReportsModule,
+    // Optional bridge: adds form-backed reports + delegated grid verbs. Remove
+    // this line and ReportsModule keeps working over custom sources alone.
+    ReportsFormsModule,
     SampleModule,
   ],
   providers: [

package/template/src/common/dto/membership-response.dto.ts

@@ -55,6 +55,7 @@ export class MembershipListResponseDto {
   items!: MembershipResponseDto[];
 
   @ApiPropertyOptional({
+    type: String,
     example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
     format: 'uuid',
     nullable: true,

package/template/src/common/dto/role-summary.dto.ts

@@ -10,9 +10,9 @@ export class RoleSummaryDto {
   @ApiProperty({ example: 'Owner' })
   name!: string;
 
-  @ApiPropertyOptional({ example: 'Full organisation access.', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'Full organisation access.', nullable: true })
   description?: string | null;
 
-  @ApiPropertyOptional({ example: true })
-  isSystemSeeded?: boolean;
+  @ApiProperty({ example: true })
+  isSystemSeeded!: boolean;
 }

package/template/src/common/dto/user-summary.dto.ts

@@ -7,13 +7,13 @@ export class UserSummaryDto {
   })
   id!: string;
 
-  @ApiPropertyOptional({ example: 'owner@example.com', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'owner@example.com', nullable: true })
   email?: string | null;
 
-  @ApiPropertyOptional({ example: '+14155552671', nullable: true })
+  @ApiPropertyOptional({ type: String, example: '+14155552671', nullable: true })
   mobile?: string | null;
 
-  @ApiPropertyOptional({ example: 'Starter Owner', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'Starter Owner', nullable: true })
   displayName?: string | null;
 }
 

package/template/src/config/env.validation.ts

@@ -66,8 +66,36 @@ export const envSchema = z
     CORS_CREDENTIALS: booleanFromEnv.default(false),
     RBAC_CACHE_TTL_SECONDS: z.coerce.number().int().positive().default(60),
     ORG_CONTEXT_MODE: z.literal('path').default('path'),
+    FORMS_OUTBOX_ENABLED: booleanFromEnv.default(true),
+    FORMS_OUTBOX_POLL_MS: z.coerce.number().int().positive().default(5000),
+    FORMS_OUTBOX_HEARTBEAT_MS: z.coerce.number().int().positive().default(60_000),
+    FORMS_FILE_GC_INTERVAL_MS: z.coerce.number().int().positive().default(3_600_000),
+    FORMS_FILE_TEMP_TTL_HOURS: z.coerce.number().int().positive().default(24),
+    FORMS_MAX_UPLOAD_MB: z.coerce.number().int().positive().default(25),
+    FORMS_FILE_STORAGE_DIR: z.string().trim().min(1).default('./var/uploads'),
+    FORMS_SCHEMA_CHECK: z.enum(['on', 'off']).default('on'),
+    REPORTS_SCHEMA_CHECK: z.enum(['on', 'off']).default('on'),
+    // HMAC secret for report cursors and bulk-action tokens (report design
+    // §5.3/§6.3). Optional: when empty, a key is derived from JWT_SECRET via
+    // HKDF so existing apps need no new mandatory env. Rotating it invalidates
+    // outstanding cursors/tokens — clients restart from page one by design.
+    REPORTS_TOKEN_SECRET: z.string().trim().optional().default(''),
+    // Reports-owned async-export worker + file storage (report design §9).
+    REPORTS_EXPORT_WORKER_ENABLED: booleanFromEnv.default(true),
+    REPORTS_EXPORT_POLL_MS: z.coerce.number().int().positive().default(5000),
+    REPORTS_EXPORT_STORAGE_DIR: z.string().trim().min(1).default('./var/report-exports'),
+    REPORTS_EXPORT_RETENTION_DAYS: z.coerce.number().int().nonnegative().default(7),
+    REPORTS_EXPORT_RETENTION_SWEEP_MS: z.coerce.number().int().positive().default(3_600_000),
   })
   .superRefine((env, ctx) => {
+    if (env.REPORTS_TOKEN_SECRET.length > 0 && env.REPORTS_TOKEN_SECRET.length < 32) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['REPORTS_TOKEN_SECRET'],
+        message: 'REPORTS_TOKEN_SECRET must be at least 32 characters when set',
+      });
+    }
+
     const corsOrigins = parseCorsOrigins(env.CORS_ORIGINS);
 
     if (env.CORS_CREDENTIALS && corsOrigins.includes('*')) {

package/template/src/config/forms.config.ts

@@ -0,0 +1,13 @@
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
+
+export default registerAs('forms', () => ({
+  outboxEnabled: getEnv().FORMS_OUTBOX_ENABLED,
+  outboxPollMs: getEnv().FORMS_OUTBOX_POLL_MS,
+  outboxHeartbeatMs: getEnv().FORMS_OUTBOX_HEARTBEAT_MS,
+  fileGcIntervalMs: getEnv().FORMS_FILE_GC_INTERVAL_MS,
+  fileTempTtlHours: getEnv().FORMS_FILE_TEMP_TTL_HOURS,
+  maxUploadMb: getEnv().FORMS_MAX_UPLOAD_MB,
+  storageDir: getEnv().FORMS_FILE_STORAGE_DIR,
+  schemaCheck: getEnv().FORMS_SCHEMA_CHECK,
+}));

package/template/src/config/index.ts

@@ -1,5 +1,7 @@
 export { default as appConfig } from './app.config';
 export { default as authConfig } from './auth.config';
 export { default as databaseConfig } from './database.config';
+export { default as formsConfig } from './forms.config';
 export { default as rbacConfig } from './rbac.config';
+export { default as reportsConfig } from './reports.config';
 export { validate } from './env.validation';

package/template/src/config/openapi.ts

@@ -0,0 +1,12 @@
+import { DocumentBuilder } from '@nestjs/swagger';
+
+export function buildOpenApiConfig() {
+  return new DocumentBuilder()
+    .setTitle('Foundation Starter API')
+    .setDescription(
+      'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
+    )
+    .setVersion('0.1.0')
+    .addBearerAuth()
+    .build();
+}

package/template/src/config/reports-secret.ts

@@ -0,0 +1,15 @@
+import { hkdfSync } from 'node:crypto';
+
+/**
+ * Key bytes for report cursor/action-token HMACs (report design §5.3/§6.3).
+ * Uses REPORTS_TOKEN_SECRET verbatim when configured; otherwise derives a
+ * dedicated 32-byte key from JWT_SECRET via HKDF-SHA256 so the raw JWT secret
+ * never signs report tokens directly.
+ */
+export function createHkdfSync(reportsSecret: string, jwtSecret: string): Uint8Array {
+  if (reportsSecret.length > 0) {
+    return new TextEncoder().encode(reportsSecret);
+  }
+
+  return new Uint8Array(hkdfSync('sha256', jwtSecret, '', 'ftis-reports-tokens', 32));
+}

package/template/src/config/reports.config.ts

@@ -0,0 +1,18 @@
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
+import { createHkdfSync } from './reports-secret';
+
+export default registerAs('reports', () => ({
+  schemaCheck: getEnv().REPORTS_SCHEMA_CHECK,
+  // Resolved key bytes for cursor/action-token HMACs (report design §5.3/§6.3):
+  // REPORTS_TOKEN_SECRET when set, else HKDF-derived from JWT_SECRET so the raw
+  // JWT secret never signs report tokens directly.
+  tokenSecret: createHkdfSync(getEnv().REPORTS_TOKEN_SECRET, getEnv().JWT_SECRET),
+  // Reports-owned async-export worker + file storage (report design §9) — no
+  // dependency on the forms outbox or UploadedFile machinery.
+  exportWorkerEnabled: getEnv().REPORTS_EXPORT_WORKER_ENABLED,
+  exportPollMs: getEnv().REPORTS_EXPORT_POLL_MS,
+  exportStorageDir: getEnv().REPORTS_EXPORT_STORAGE_DIR,
+  exportRetentionDays: getEnv().REPORTS_EXPORT_RETENTION_DAYS,
+  exportRetentionSweepMs: getEnv().REPORTS_EXPORT_RETENTION_SWEEP_MS,
+}));

package/template/src/main.ts

@@ -1,9 +1,10 @@
 import { ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
-import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { SwaggerModule } from '@nestjs/swagger';
 import { AppModule } from './app.module';
 import { HttpExceptionFilter } from './common/filters/http-exception.filter';
+import { buildOpenApiConfig } from './config/openapi';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
@@ -32,17 +33,7 @@ async function bootstrap() {
     }),
   );
 
-  const document = SwaggerModule.createDocument(
-    app,
-    new DocumentBuilder()
-      .setTitle('Foundation Starter API')
-      .setDescription(
-        'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
-      )
-      .setVersion('0.1.0')
-      .addBearerAuth()
-      .build(),
-  );
+  const document = SwaggerModule.createDocument(app, buildOpenApiConfig());
   SwaggerModule.setup('docs', app, document, {
     swaggerOptions: {
       persistAuthorization: true,

package/template/src/modules/access-control/dto/access-control-response.dto.ts

@@ -20,6 +20,7 @@ export class PermissionResponseDto {
   subject!: string;
 
   @ApiPropertyOptional({
+    type: String,
     example: 'Read organisation memberships.',
     nullable: true,
   })
@@ -57,6 +58,7 @@ export class RoleResponseDto {
   name!: string;
 
   @ApiPropertyOptional({
+    type: String,
     example: 'Can review support-facing records.',
     nullable: true,
   })
@@ -83,6 +85,7 @@ export class RoleListResponseDto {
   items!: RoleResponseDto[];
 
   @ApiPropertyOptional({
+    type: String,
     example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
     format: 'uuid',
     nullable: true,

package/template/src/modules/access-control/dto/current-access-control-response.dto.ts

@@ -26,6 +26,10 @@ export class CurrentAccessControlResponseDto {
   @ApiProperty({ example: true })
   isBillingContact!: boolean;
 
-  @ApiProperty({ enum: permissionKeys, example: ['organisations.read', 'settings.read'] })
+  @ApiProperty({
+    enum: permissionKeys,
+    isArray: true,
+    example: ['organisations.read', 'settings.read'],
+  })
   permissionKeys!: PermissionKey[];
 }

package/template/src/modules/access-control/types/permission-key.ts

@@ -17,6 +17,33 @@ export const permissionKeys = [
   'settings.update',
   'audit.read',
   'platform.admin',
+  // Form builder (@ftisindia/form-builder). Kept as literals so the as-const
+  // tuple stays narrow; test/forms-permission-sync.spec.ts asserts these match
+  // the engine's FORM_PERMISSION_KEYS export exactly.
+  'forms.read',
+  'forms.create',
+  'forms.update',
+  'forms.publish',
+  'forms.archive',
+  'forms.wireDangerous',
+  'forms.managePublicAccess',
+  'formSubmissions.read',
+  'formSubmissions.create',
+  // Row-level edits delegated from report grids (report design §6.1) — and any
+  // other surface that patches submissions through the form engine.
+  'formSubmissions.update',
+  'formSubmissions.export',
+  'formDataSources.manage',
+  // Report builder (@ftisindia/report-builder). Kept as literals so the
+  // as-const tuple stays narrow; test/reports-permission-sync.spec.ts asserts
+  // these match the engine's REPORT_PERMISSION_KEYS export exactly.
+  'reports.read',
+  'reports.create',
+  'reports.update',
+  'reports.publish',
+  'reports.archive',
+  'reports.export',
+  'reportTags.manage',
 ] as const;
 
 export type PermissionKey = (typeof permissionKeys)[number];

package/template/src/modules/access-control/types/route-permission-registry.ts

@@ -126,4 +126,187 @@ export const routePermissionRegistry: RoutePermissionEntry[] = [
     path: '/organisations/:orgId/sample/echo',
     permissions: ['organisations.update'],
   },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms',
+    permissions: ['forms.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms',
+    permissions: ['forms.create'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey',
+    permissions: ['forms.read'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/render',
+    permissions: ['formSubmissions.create'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/versions/:version',
+    permissions: ['forms.read'],
+  },
+  {
+    method: 'PATCH',
+    path: '/organisations/:orgId/forms/:formKey/versions/:version',
+    permissions: ['forms.update'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/versions/:version/publish',
+    permissions: ['forms.publish'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/versions/:version/archive',
+    permissions: ['forms.archive'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/versions/:version/public-access',
+    permissions: ['forms.managePublicAccess'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/submissions',
+    permissions: ['formSubmissions.create'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/submissions/validate',
+    permissions: ['formSubmissions.create'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/submissions',
+    permissions: ['formSubmissions.read'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/submissions/:submissionId',
+    permissions: ['formSubmissions.read'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/data-sources',
+    permissions: ['formDataSources.manage'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/data-sources/:dataSourceKey/options',
+    permissions: ['formSubmissions.create'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/forms/:formKey/files',
+    permissions: ['formSubmissions.create'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/files/:fileId',
+    permissions: ['formSubmissions.read'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/forms/:formKey/submissions/export',
+    permissions: ['formSubmissions.export'],
+  },
+  // Report builder (@ftisindia/report-builder) — report design §10. Row
+  // actions carry an additional per-action permission check inside the engine
+  // (attach-time and execute-time, §6.1); the route gate below is the base.
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports',
+    permissions: ['reports.create'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports/exports/:jobId',
+    permissions: ['reports.export'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports/exports/:jobId/download',
+    permissions: ['reports.export'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports/:key',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'PATCH',
+    path: '/organisations/:orgId/reports/:key',
+    permissions: ['reports.update'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/publish',
+    permissions: ['reports.publish'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/archive',
+    permissions: ['reports.archive'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports/:key/meta',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/query',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'GET',
+    path: '/organisations/:orgId/reports/:key/views',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/views',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/views/shared',
+    permissions: ['reports.update'],
+  },
+  {
+    method: 'PATCH',
+    path: '/organisations/:orgId/reports/:key/views/:viewId',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'DELETE',
+    path: '/organisations/:orgId/reports/:key/views/:viewId',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/actions/:name/prepare',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/actions/:name',
+    permissions: ['reports.read'],
+  },
+  {
+    method: 'POST',
+    path: '/organisations/:orgId/reports/:key/export',
+    permissions: ['reports.export'],
+  },
 ];