@harborclient/team-hub 0.2.3 → 0.2.4

package/dist/cli.js

@@ -6043,6 +6043,12 @@ function canAccessEnvironment(user, environmentId) {
   }
   return user.environmentAccess.includes(environmentId);
 }
+function canDeleteCollection(user, collection) {
+  return canUseDataApi(user) && canAccessCollection(user, collection.id) && collection.createdByUserId === user.id && !collection.deletionLocked;
+}
+function canDeleteRequest(user, request) {
+  return canUseDataApi(user) && canAccessCollection(user, request.collectionId) && request.createdByUserId === user.id;
+}
 function canCreateCollection(user) {
   return user.role === "user" && hasWildcardAccess(user.collectionAccess);
 }
@@ -6718,6 +6724,80 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "GET",
+    url: "/admin/collections/:collectionId/folders",
+    schema: {
+      params: collectionIdParamSchema,
+      response: {
+        200: listFoldersResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Lists folders in a collection for operator inspection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.findCollectionById(request.params.collectionId);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        const folders = await db.listFolders(request.params.collectionId);
+        return reply.send({
+          folders: folders.map((folder) => serializeFolder(folder))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "GET",
+    url: "/admin/collections/:collectionId/requests",
+    schema: {
+      params: collectionIdParamSchema,
+      response: {
+        200: listRequestsResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Lists saved requests in a collection for operator inspection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.findCollectionById(request.params.collectionId);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        const requests = await db.listRequests(request.params.collectionId);
+        return reply.send({
+          requests: requests.map((savedRequest) => serializeSavedRequest(savedRequest))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "GET",
     url: "/admin/environments",
@@ -6787,6 +6867,41 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/requests/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a saved request regardless of collection access lists.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const existingRequest = await db.findRequestById(request.params.id);
+        if (!existingRequest) {
+          void reply.code(404).send({ error: "Request not found" });
+          return;
+        }
+        await db.deleteRequest(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "PUT",
     url: "/admin/collections/:id",
@@ -7350,12 +7465,6 @@ async function registerCollectionRoutes(app, db) {
     handler: async (request, reply) => {
       try {
         const user = requireAuthenticatedUser(request);
-        if (denyUnlessAllowed(
-          reply,
-          canUseDataApi(user) && canAccessCollection(user, request.params.id)
-        )) {
-          return;
-        }
         const collection = await db.findCollectionById(request.params.id);
         if (!collection) {
           void reply.code(404).send({ error: "Collection not found" });
@@ -7364,6 +7473,9 @@ async function registerCollectionRoutes(app, db) {
         if (collection.deletionLocked) {
           throw new DeletionLockedError("collection");
         }
+        if (denyUnlessAllowed(reply, canDeleteCollection(user, collection))) {
+          return;
+        }
         await db.deleteCollection(request.params.id, user.id);
         return reply.code(204).send(null);
       } catch (error) {
@@ -7892,10 +8004,7 @@ async function registerRequestRoutes(app, db) {
         if (!existingRequest) {
           return reply.code(404).send({ error: "Request not found" });
         }
-        if (denyUnlessAllowed(
-          reply,
-          canUseDataApi(user) && canAccessCollection(user, existingRequest.collectionId)
-        )) {
+        if (denyUnlessAllowed(reply, canDeleteRequest(user, existingRequest))) {
           return;
         }
         await db.deleteRequest(request.params.id, user.id);