@headless-lms/core 0.4.0 → 0.6.0

package/dist/discussion/posts.js

@@ -1,14 +1,16 @@
 import { genId } from "../shared/id.js";
 import { ConflictError, ForbiddenError, InvalidInputError, NotFoundError, UnavailableError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
-import { canModerate, isStaffRole } from "../organizations/roles.js";
 import { discussionEvents } from "./events.js";
 import { authorView } from "./authors.js";
 import { keepAllowed, mentionTokens, mentionViews } from "./mentions.js";
+import { skipsReview, teamBadge } from "./rules.js";
 import { POST_PUBLISH_JOB } from "./jobs.js";
 import { activeSubscription } from "./subscriptions.js";
 import "./ports.js";
 //#region src/discussion/posts.ts
+const MAX_BODY_ASSETS = 20;
+const INLINE_TYPES = /^(image\/(png|jpeg|gif|webp|avif)|video\/.+|audio\/.+|application\/pdf)$/i;
 const PUBLISHED_ONLY = ["published"];
 const MODERATOR_VISIBLE = [
 	"published",
@@ -32,6 +34,7 @@ var PostServiceImpl = class {
 	mentions;
 	images;
 	fileUrls;
+	bodies;
 	uow;
 	scheduler;
 	logger;
@@ -46,22 +49,27 @@ var PostServiceImpl = class {
 		this.mentions = params.mentions;
 		this.images = params.images;
 		this.fileUrls = params.fileUrls;
+		this.bodies = params.bodies;
 		this.uow = params.uow;
 		this.scheduler = params.scheduler;
 		this.logger = params.logger ?? noopLogger;
 	}
-	async visibleTitles(orgId, actor, postIds) {
+	async visibleTitles(postIds, actor) {
+		const orgId = actor.orgId;
 		const found = await this.repo.findMany(orgId, [...new Set(postIds)]);
 		const communityIds = [...new Set(found.map((post) => post.communityId))];
-		const open = new Set((await Promise.all(communityIds.map((communityId) => this.access.openSpaceIds(orgId, actor, communityId)))).flat());
+		const open = new Set((await Promise.all(communityIds.map((communityId) => this.access.openSpaceIds(communityId, actor)))).flat());
 		return Object.fromEntries(found.filter((post) => open.has(post.spaceId) && this.canSee(actor, post)).map((post) => [post.id, post.title]));
 	}
 	publishedBetween(orgId, communityId, from, to) {
 		return this.repo.publishedBetween(orgId, communityId, from, to);
 	}
-	async create(orgId, actor, input) {
-		const space = await this.requireOpen(orgId, actor, input.spaceId, input.communityId);
+	async create(input, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireOpen(actor, input.spaceId, input.communityId);
 		await this.requireOwnedImage(orgId, actor.id, input.coverAssetId);
+		const parsed = this.bodies.parse(input.body);
+		await this.requireBodyAssets(orgId, actor.id, parsed.assetIds);
 		this.assertTopic(space, input.topicId);
 		const now = /* @__PURE__ */ new Date();
 		const landing = this.initial(input, space, actor, now);
@@ -83,7 +91,7 @@ var PostServiceImpl = class {
 			updatedAt: now,
 			...landing
 		};
-		const mentioned = await this.mentionable(orgId, space.id, post.title, post.body);
+		const mentioned = await this.mentionable(orgId, space.id, post.title, parsed.mentions);
 		const saved = await this.uow.run(async ({ posts, mentions, outbox }) => {
 			const created = await posts.insert(orgId, post);
 			await mentions.sync(orgId, "post", created.id, mentioned, now);
@@ -103,17 +111,21 @@ var PostServiceImpl = class {
 			actorId: actor.id
 		});
 		if (saved.status === "scheduled") await this.arm(orgId, actor, saved, null);
-		return this.viewOf(orgId, actor, saved);
+		await this.syncCover(saved);
+		return this.viewOf(actor, saved);
 	}
-	async update(orgId, postId, actor, patch) {
-		const { post, space } = await this.loadVisible(orgId, actor, postId);
+	async update(postId, patch, actor) {
+		const orgId = actor.orgId;
+		const { post, space } = await this.loadVisible(actor, postId);
 		this.assertAuthor(actor, post);
 		if (post.status === "removed") throw new ConflictError("This post was removed");
 		if (patch.topicId !== void 0) this.assertTopic(space, patch.topicId);
 		if (typeof patch.coverAssetId === "string") await this.requireOwnedImage(orgId, actor.id, patch.coverAssetId);
-		if (!this.patchChanges(post, patch)) return this.viewOf(orgId, actor, post);
+		const parsed = this.bodies.parse(patch.body ?? post.body);
+		if (patch.body !== void 0) await this.requireBodyAssets(orgId, actor.id, parsed.assetIds);
+		if (!this.patchChanges(post, patch)) return this.viewOf(actor, post);
 		const retext = patch.title !== void 0 || patch.body !== void 0;
-		const candidates = retext ? await this.mentionable(orgId, post.spaceId, patch.title ?? post.title, patch.body ?? post.body) : [];
+		const candidates = retext ? await this.mentionable(orgId, post.spaceId, patch.title ?? post.title, parsed.mentions) : [];
 		const updated = await this.uow.run(async ({ posts, mentions, outbox }) => {
 			const next = await this.mustUpdate(posts, orgId, postId, patch);
 			const added = retext ? await mentions.sync(orgId, "post", postId, candidates, /* @__PURE__ */ new Date()) : [];
@@ -126,14 +138,16 @@ var PostServiceImpl = class {
 			fields: Object.keys(patch),
 			actorId: actor.id
 		});
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
-	async submit(orgId, postId, actor) {
-		const { post, space } = await this.loadVisible(orgId, actor, postId);
+	async submit(postId, actor) {
+		const orgId = actor.orgId;
+		const { post, space } = await this.loadVisible(actor, postId);
 		this.assertAuthor(actor, post);
 		if (post.status !== "draft" && post.status !== "scheduled") throw new ConflictError("This post cannot be submitted");
 		this.assertTopic(space, post.topicId);
-		const saved = await this.commitSubmission(orgId, post, space, actor.role, actor, /* @__PURE__ */ new Date());
+		const saved = await this.commitSubmission(orgId, post, space, skipsReview(actor.permissions, { communityId: post.communityId }), actor, /* @__PURE__ */ new Date());
 		this.logger.info("post submitted", {
 			orgId,
 			postId,
@@ -141,10 +155,12 @@ var PostServiceImpl = class {
 			actorId: actor.id
 		});
 		if (post.status === "scheduled") await this.disarm(orgId, postId);
-		return this.viewOf(orgId, actor, saved);
+		await this.syncCover(saved);
+		return this.viewOf(actor, saved);
 	}
-	async schedule(orgId, postId, actor, scheduledAt) {
-		const { post } = await this.loadVisible(orgId, actor, postId);
+	async schedule(postId, scheduledAt, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId);
 		this.assertAuthor(actor, post);
 		if (post.status === "published" || post.status === "removed" || post.status === "pending") throw new ConflictError("This post cannot be scheduled");
 		if (scheduledAt <= /* @__PURE__ */ new Date()) throw new InvalidInputError("A scheduled time must be in the future");
@@ -166,10 +182,12 @@ var PostServiceImpl = class {
 			actorId: actor.id
 		});
 		await this.arm(orgId, actor, updated, post.status === "scheduled" ? post.scheduledAt : null);
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
-	async unschedule(orgId, postId, actor) {
-		const { post } = await this.loadVisible(orgId, actor, postId);
+	async unschedule(postId, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId);
 		this.assertAuthor(actor, post);
 		if (post.status !== "scheduled") throw new ConflictError("This post is not scheduled");
 		const updated = await this.uow.run(async ({ posts, outbox }) => {
@@ -184,7 +202,8 @@ var PostServiceImpl = class {
 			actorId: actor.id
 		});
 		await this.disarm(orgId, postId);
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
 	async publishScheduled(orgId, postId, now) {
 		const post = await this.repo.find(orgId, postId);
@@ -207,7 +226,7 @@ var PostServiceImpl = class {
 			});
 			return;
 		}
-		const space = await this.content.getSpace(orgId, post.spaceId);
+		const space = await this.content.getSpace(post.spaceId, this.authors.systemActor(orgId));
 		if (!space) {
 			this.logger.error("scheduled post has no space", {
 				orgId,
@@ -216,16 +235,17 @@ var PostServiceImpl = class {
 			});
 			return;
 		}
-		const role = await this.authors.roleOf(orgId, post.orgUserId);
-		const refused = !await this.submittable(orgId, post, space, role);
-		const patch = refused ? DRAFT : this.submissionOf(space.settings.requireReview, role, now);
-		const saved = await this.uow.run(async ({ posts, mentions, outbox }) => {
+		const author = await this.authors.actorFor(orgId, post.orgUserId);
+		const refused = author === null || !await this.submittable(post, space, author);
+		const patch = author === null || refused ? DRAFT : this.submissionOf(space.settings.requireReview, skipsReview(author.permissions, { communityId: post.communityId }), now);
+		const mentioned = await this.mentionedOpeners(orgId, post);
+		const saved = await this.uow.run(async ({ posts, outbox }) => {
 			const next = await posts.updateIf(orgId, postId, {
 				status: "scheduled",
 				dueBy: now
 			}, patch);
 			if (!next) return null;
-			await outbox.append([await this.landed(mentions, orgId, next, this.meta(null, post.status))]);
+			await outbox.append([this.landed(orgId, next, this.meta(null, post.status), mentioned)]);
 			return next;
 		});
 		if (!saved) {
@@ -241,6 +261,7 @@ var PostServiceImpl = class {
 			status: saved.status,
 			refused
 		});
+		await this.syncCover(saved);
 	}
 	async arm(orgId, actor, post, previousScheduledAt) {
 		if (post.scheduledAt === null) return;
@@ -267,6 +288,9 @@ var PostServiceImpl = class {
 		});
 		throw new UnavailableError("The post could not be scheduled; try again", { postId: post.id });
 	}
+	syncCover(post) {
+		return this.images.syncPublicImages(post.orgId, post.id, post.status === "published" && post.coverAssetId ? [post.coverAssetId] : []);
+	}
 	async disarm(orgId, postId) {
 		try {
 			await this.scheduler.cancel(POST_PUBLISH_JOB, postId);
@@ -278,19 +302,21 @@ var PostServiceImpl = class {
 			});
 		}
 	}
-	async approve(orgId, postId, actor, communityId) {
-		const { post } = await this.loadVisible(orgId, actor, postId, communityId);
-		if (!this.canModerate(actor)) throw new ForbiddenError("You cannot review this post");
+	async approve(postId, communityId, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId, communityId);
+		this.requireModerator(actor, post, "approve");
 		if (post.status !== "pending") throw new ConflictError("This post is not awaiting review");
 		const now = /* @__PURE__ */ new Date();
-		const updated = await this.uow.run(async ({ posts, mentions, outbox }) => {
+		const mentioned = await this.mentionedOpeners(orgId, post);
+		const updated = await this.uow.run(async ({ posts, outbox }) => {
 			const next = await this.mustUpdate(posts, orgId, postId, {
 				status: "published",
 				publishedAt: now,
 				scheduledAt: null,
 				removedBy: null
 			});
-			await outbox.append([await this.landed(mentions, orgId, next, this.meta(actor, post.status))]);
+			await outbox.append([this.landed(orgId, next, this.meta(actor, post.status), mentioned)]);
 			return next;
 		});
 		this.logger.info("post approved", {
@@ -298,11 +324,13 @@ var PostServiceImpl = class {
 			postId,
 			actorId: actor.id
 		});
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
-	async remove(orgId, postId, actor, communityId) {
-		const { post } = await this.loadVisible(orgId, actor, postId, communityId);
-		if (post.orgUserId !== actor.id && !this.canModerate(actor)) throw new ForbiddenError("You cannot remove this post");
+	async remove(postId, communityId, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId, communityId);
+		if (post.orgUserId !== actor.id) this.requireModerator(actor, post, "remove");
 		if (post.status === "removed") throw new ConflictError("This post was removed");
 		if (post.status !== "published" && post.status !== "pending") throw new ConflictError("This post cannot be removed");
 		const updated = await this.uow.run(async ({ posts, outbox }) => {
@@ -327,16 +355,19 @@ var PostServiceImpl = class {
 			postId,
 			actorId: actor.id
 		});
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
-	async restore(orgId, postId, actor, communityId) {
-		const { post, space } = await this.loadVisible(orgId, actor, postId, communityId);
-		if (!this.canModerate(actor)) throw new ForbiddenError("You cannot moderate this post");
+	async restore(postId, communityId, actor) {
+		const orgId = actor.orgId;
+		const { post, space } = await this.loadVisible(actor, postId, communityId);
+		this.requireModerator(actor, post, "restore");
 		if (post.status !== "removed") throw new ConflictError("This post was not removed");
 		const now = /* @__PURE__ */ new Date();
-		const role = await this.authors.roleOf(orgId, post.orgUserId);
+		const author = (await this.authors.permissionsOfMany(orgId, [post.orgUserId])).get(post.orgUserId);
+		const skips = author !== void 0 && skipsReview(author, { communityId: post.communityId });
 		const updated = await this.uow.run(async ({ posts, outbox }) => {
-			const next = await this.mustUpdate(posts, orgId, postId, this.submissionOf(space.settings.requireReview, role, now));
+			const next = await this.mustUpdate(posts, orgId, postId, this.submissionOf(space.settings.requireReview, skips, now));
 			const metadata = this.meta(actor, post.status);
 			await outbox.append([next.status === "published" ? this.published(orgId, next, metadata, []) : this.updated(orgId, next, metadata)]);
 			return next;
@@ -347,25 +378,27 @@ var PostServiceImpl = class {
 			status: updated.status,
 			actorId: actor.id
 		});
-		return this.viewOf(orgId, actor, updated);
+		await this.syncCover(updated);
+		return this.viewOf(actor, updated);
 	}
-	pin(orgId, postId, actor) {
-		return this.moderate(orgId, postId, actor, { pinned: true }, (post) => post.pinned, "post pinned");
+	pin(postId, actor) {
+		return this.moderate(postId, actor, { pinned: true }, (post) => post.pinned, "post pinned");
 	}
-	unpin(orgId, postId, actor) {
-		return this.moderate(orgId, postId, actor, { pinned: false }, (post) => !post.pinned, "post unpinned");
+	unpin(postId, actor) {
+		return this.moderate(postId, actor, { pinned: false }, (post) => !post.pinned, "post unpinned");
 	}
-	closeComments(orgId, postId, actor) {
-		return this.moderate(orgId, postId, actor, { commentsClosed: true }, (post) => post.commentsClosed === true, "post comments closed");
+	closeComments(postId, actor) {
+		return this.moderate(postId, actor, { commentsClosed: true }, (post) => post.commentsClosed === true, "post comments closed");
 	}
-	openComments(orgId, postId, actor) {
-		return this.moderate(orgId, postId, actor, { commentsClosed: false }, (post) => post.commentsClosed === false, "post comments opened");
+	openComments(postId, actor) {
+		return this.moderate(postId, actor, { commentsClosed: false }, (post) => post.commentsClosed === false, "post comments opened");
 	}
-	setReactions(orgId, postId, actor, enabled) {
-		return this.moderate(orgId, postId, actor, { reactionsEnabled: enabled }, (post) => post.reactionsEnabled === enabled, "post reactions changed");
+	setReactions(postId, enabled, actor) {
+		return this.moderate(postId, actor, { reactionsEnabled: enabled }, (post) => post.reactionsEnabled === enabled, "post reactions changed");
 	}
-	async setReaction(orgId, postId, actor, emoji) {
-		const { post, space } = await this.loadVisible(orgId, actor, postId);
+	async setReaction(postId, emoji, actor) {
+		const orgId = actor.orgId;
+		const { post, space } = await this.loadVisible(actor, postId);
 		if (!(post.reactionsEnabled ?? space.settings.reactions)) throw new ForbiddenError("Reactions are off on this post");
 		await this.uow.run(async ({ posts, outbox }) => {
 			if (!await posts.setReaction(orgId, postId, actor.id, emoji) || emoji === null) return;
@@ -388,8 +421,9 @@ var PostServiceImpl = class {
 		});
 		return (await this.repo.reactionsOf(orgId, [postId], actor.id))[postId] ?? { reactions: {} };
 	}
-	async bookmark(orgId, postId, actor) {
-		await this.loadVisible(orgId, actor, postId);
+	async bookmark(postId, actor) {
+		const orgId = actor.orgId;
+		await this.loadVisible(actor, postId);
 		await this.repo.bookmark(orgId, postId, actor.id);
 		this.logger.debug("post bookmarked", {
 			orgId,
@@ -397,8 +431,9 @@ var PostServiceImpl = class {
 			orgUserId: actor.id
 		});
 	}
-	async unbookmark(orgId, postId, actor) {
-		await this.loadVisible(orgId, actor, postId);
+	async unbookmark(postId, actor) {
+		const orgId = actor.orgId;
+		await this.loadVisible(actor, postId);
 		await this.repo.unbookmark(orgId, postId, actor.id);
 		this.logger.debug("post unbookmarked", {
 			orgId,
@@ -406,8 +441,9 @@ var PostServiceImpl = class {
 			orgUserId: actor.id
 		});
 	}
-	async flag(orgId, postId, actor, reason) {
-		const { post } = await this.loadVisible(orgId, actor, postId);
+	async flag(postId, reason, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId);
 		const now = /* @__PURE__ */ new Date();
 		const flag = {
 			orgId,
@@ -446,9 +482,10 @@ var PostServiceImpl = class {
 		});
 		return saved;
 	}
-	async resolveFlags(orgId, postId, actor, resolution, communityId) {
-		await this.loadVisible(orgId, actor, postId, communityId);
-		if (!this.canModerate(actor)) throw new ForbiddenError("You cannot work this queue");
+	async resolveFlags(postId, resolution, communityId, actor) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId, communityId);
+		this.requireModerator(actor, post, "resolve flags");
 		await this.repo.resolveFlags(orgId, postId, {
 			resolvedAt: /* @__PURE__ */ new Date(),
 			resolvedBy: actor.id,
@@ -461,10 +498,11 @@ var PostServiceImpl = class {
 			actorId: actor.id
 		});
 	}
-	async spaceFeed(orgId, actor, communityId, spaceId, query) {
-		const space = await this.requireOpen(orgId, actor, spaceId, communityId);
+	async spaceFeed(communityId, spaceId, query, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireOpen(actor, spaceId, communityId);
 		if (query.topicId && !space.topics.some((topic) => topic.id === query.topicId)) throw new NotFoundError("Topic", query.topicId);
-		const page = await this.feedPage(orgId, actor, [spaceId], query);
+		const page = await this.feedPage(actor, [spaceId], query);
 		this.logger.debug("space feed read", {
 			orgId,
 			spaceId,
@@ -472,9 +510,10 @@ var PostServiceImpl = class {
 		});
 		return page;
 	}
-	async memberFeed(orgId, actor, communityId, query) {
-		const spaceIds = await this.openSpaceIdsIn(orgId, actor, communityId);
-		const page = await this.feedPage(orgId, actor, spaceIds, query);
+	async memberFeed(communityId, query, actor) {
+		const orgId = actor.orgId;
+		const spaceIds = await this.openSpaceIdsIn(actor, communityId);
+		const page = await this.feedPage(actor, spaceIds, query);
 		this.logger.debug("member feed read", {
 			orgId,
 			communityId,
@@ -483,12 +522,13 @@ var PostServiceImpl = class {
 		});
 		return page;
 	}
-	async openSpaceIdsIn(orgId, actor, communityId) {
-		if (!await this.access.isCommunityMember(orgId, actor, communityId)) throw new NotFoundError("Community", communityId);
-		return this.access.openSpaceIds(orgId, actor, communityId);
+	async openSpaceIdsIn(actor, communityId) {
+		if (!await this.access.isCommunityMember(communityId, actor)) throw new NotFoundError("Community", communityId);
+		return this.access.openSpaceIds(communityId, actor);
 	}
-	async listOwn(orgId, actor, communityId, query) {
-		const spaceIds = await this.openSpaceIdsIn(orgId, actor, communityId);
+	async listOwn(communityId, query, actor) {
+		const orgId = actor.orgId;
+		const spaceIds = await this.openSpaceIdsIn(actor, communityId);
 		const page = await this.repo.listByAuthor(orgId, actor.id, spaceIds, query);
 		this.logger.debug("own posts read", {
 			orgId,
@@ -497,14 +537,15 @@ var PostServiceImpl = class {
 		});
 		return {
 			...page,
-			rows: await this.viewsOf(orgId, actor, page.rows)
+			rows: await this.viewsOf(actor, page.rows)
 		};
 	}
-	async listBookmarked(orgId, actor, communityId, query) {
-		const spaceIds = await this.openSpaceIdsIn(orgId, actor, communityId);
+	async listBookmarked(communityId, query, actor) {
+		const orgId = actor.orgId;
+		const spaceIds = await this.openSpaceIdsIn(actor, communityId);
 		const page = await this.repo.listBookmarked(orgId, actor.id, spaceIds, {
 			...query,
-			visibleStatuses: this.visibleStatuses(actor)
+			visibleStatuses: this.visibleStatuses(actor, communityId)
 		});
 		this.logger.debug("bookmarked posts read", {
 			orgId,
@@ -513,27 +554,47 @@ var PostServiceImpl = class {
 		});
 		return {
 			...page,
-			rows: await this.viewsOf(orgId, actor, page.rows)
+			rows: await this.viewsOf(actor, page.rows)
 		};
 	}
-	async coverFile(orgId, actor, postId) {
-		const post = await this.repo.find(orgId, postId);
-		if (!post?.coverAssetId || !this.canSee(actor, post)) return null;
-		const space = await this.content.getSpace(orgId, post.spaceId);
-		if (!space || !await this.access.canOpen(orgId, actor, space)) return null;
-		return this.images.signFile(orgId, post.coverAssetId);
-	}
-	async getPost(orgId, actor, postId) {
-		const { post } = await this.loadVisible(orgId, actor, postId);
+	async coverFile(postId, actor) {
+		const post = await this.repo.find(actor.orgId, postId);
+		return this.signShown(actor, post, post?.coverAssetId ?? null, "Post cover", postId);
+	}
+	async assetFile(postId, assetId, actor) {
+		const post = await this.repo.find(actor.orgId, postId);
+		const [upload] = post !== null && this.bodies.parse(post.body).assetIds.includes(assetId) ? await this.images.memberUploads(actor.orgId, [assetId]) : [];
+		return this.signShown(actor, post, upload ? assetId : null, "Post file", assetId, upload && !INLINE_TYPES.test(upload.contentType) ? upload.filename : void 0);
+	}
+	async signShown(actor, post, assetId, label, id, saveAs) {
+		const orgId = actor.orgId;
+		if (!post || !assetId || !this.canSee(actor, post)) throw new NotFoundError(label, id);
+		const space = await this.content.getSpace(post.spaceId, this.authors.systemActor(orgId));
+		if (!space || !await this.access.canOpen(space, actor)) throw new NotFoundError(label, id);
+		const url = await this.images.signFile(orgId, assetId, saveAs ? { saveAs } : {});
+		if (!url) throw new NotFoundError(label, id);
+		return url;
+	}
+	async getPost(postId, actor) {
+		const { post } = await this.loadVisible(actor, postId);
 		this.logger.debug("post read", {
-			orgId,
+			orgId: actor.orgId,
 			postId
 		});
-		return this.viewOf(orgId, actor, post);
+		return this.viewOf(actor, post);
 	}
-	async moderationQueue(orgId, actor, communityId, spaceId) {
-		await this.requireOpen(orgId, actor, spaceId, communityId);
-		if (!this.canModerate(actor)) throw new ForbiddenError("You cannot work this queue");
+	async moderationQueue(communityId, spaceId, actor) {
+		const orgId = actor.orgId;
+		const space = await this.requireOpen(actor, spaceId, communityId);
+		if (!actor.permissions.has("communities:moderate", space.communityId)) {
+			this.logger.warn("space queue refused — not a moderator", {
+				orgId,
+				communityId,
+				spaceId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("You need communities:moderate");
+		}
 		const [pending, flags, openCommentFlags] = await Promise.all([
 			this.repo.listPending(orgId, spaceId, 100),
 			this.repo.listOpenFlags(orgId, spaceId, 100),
@@ -547,47 +608,67 @@ var PostServiceImpl = class {
 			commentFlags: openCommentFlags.length
 		});
 		return {
-			pending: await this.viewsOf(orgId, actor, pending),
+			pending: await this.viewsOf(actor, pending),
 			flags,
-			commentFlags: openCommentFlags
+			commentFlags: await this.flaggedCommentViews(actor, space.communityId, openCommentFlags)
 		};
 	}
-	visible(orgId, actor, postId) {
-		return this.loadVisible(orgId, actor, postId);
+	async flaggedCommentViews(actor, communityId, flags) {
+		if (flags.length === 0) return [];
+		const orgId = actor.orgId;
+		const authorIds = [...new Set(flags.map((flag) => flag.comment.orgUserId))];
+		const [records, permissions] = await Promise.all([this.profiles.authorsOf(orgId, authorIds), this.authors.permissionsOfMany(orgId, authorIds)]);
+		return flags.map((flag) => {
+			const record = records[flag.comment.orgUserId];
+			if (!record) throw new NotFoundError("Member", flag.comment.orgUserId);
+			return {
+				...flag,
+				comment: {
+					...flag.comment,
+					author: authorView(orgId, record, this.fileUrls, teamBadge(permissions.get(flag.comment.orgUserId), communityId))
+				}
+			};
+		});
+	}
+	visible(postId, actor) {
+		return this.loadVisible(actor, postId);
 	}
 	find(orgId, postId) {
 		return this.repo.find(orgId, postId);
 	}
-	async submittable(orgId, post, space, role) {
-		if (role === null || !this.topicFits(space, post.topicId)) return false;
-		return this.access.canOpen(orgId, {
-			id: post.orgUserId,
-			role
-		}, space);
+	async submittable(post, space, author) {
+		if (!this.topicFits(space, post.topicId)) return false;
+		return this.access.canOpen(space, author);
 	}
-	async feedPage(orgId, actor, spaceIds, query) {
-		const page = await this.repo.listPublished(orgId, spaceIds, query);
+	async feedPage(actor, spaceIds, query) {
+		const page = await this.repo.listPublished(actor.orgId, spaceIds, query);
 		return {
 			...page,
-			rows: await this.viewsOf(orgId, actor, page.rows)
+			rows: await this.viewsOf(actor, page.rows)
 		};
 	}
-	async viewOf(orgId, actor, post) {
-		const [view] = await this.viewsOf(orgId, actor, [post]);
+	async viewOf(actor, post) {
+		const [view] = await this.viewsOf(actor, [post]);
 		return view;
 	}
-	async viewsOf(orgId, actor, posts) {
+	async viewsOf(actor, posts) {
 		if (posts.length === 0) return [];
+		const orgId = actor.orgId;
 		const postIds = posts.map((post) => post.id);
+		const authorIds = [...new Set(posts.map((post) => post.orgUserId))];
 		const now = /* @__PURE__ */ new Date();
-		const [records, reactions, commentCounts, subscribed, bookmarked, mentioned] = await Promise.all([
-			this.profiles.authorsOf(orgId, [...new Set(posts.map((post) => post.orgUserId))]),
+		const bodyAssets = new Map(posts.map((post) => [post.id, this.bodies.parse(post.body).assetIds]));
+		const [records, permissions, reactions, commentCounts, subscribed, bookmarked, mentioned, uploads] = await Promise.all([
+			this.profiles.authorsOf(orgId, authorIds),
+			this.authors.permissionsOfMany(orgId, authorIds),
 			this.repo.reactionsOf(orgId, postIds, actor.id),
 			this.comments.publishedCommentCounts(orgId, postIds),
 			this.subscriptions.forViewer(orgId, actor.id, "post", postIds),
 			this.repo.bookmarkedAmong(orgId, postIds, actor.id),
-			mentionViews(this.mentions, this.profiles, orgId, "post", postIds)
+			mentionViews(this.mentions, this.profiles, orgId, "post", postIds),
+			this.images.memberUploads(orgId, [...new Set([...bodyAssets.values()].flat())])
 		]);
+		const uploadOf = new Map(uploads.map((upload) => [upload.id, upload]));
 		const subscriptionOf = new Map(subscribed.map((row) => [row.itemId, row]));
 		const saved = new Set(bookmarked);
 		return posts.map((post) => {
@@ -596,8 +677,17 @@ var PostServiceImpl = class {
 			const counts = reactions[post.id];
 			return {
 				...post,
-				coverUrl: post.coverAssetId ? this.fileUrls.postCover(post.id) : null,
-				author: authorView(orgId, record, this.fileUrls),
+				coverUrl: !post.coverAssetId ? null : post.status === "published" ? this.fileUrls.publicImage(orgId, post.id, post.coverAssetId) : this.fileUrls.postCover(post.id),
+				assets: Object.fromEntries((bodyAssets.get(post.id) ?? []).flatMap((assetId) => {
+					const upload = uploadOf.get(assetId);
+					return upload ? [[assetId, {
+						url: this.fileUrls.postAsset(post.id, assetId),
+						kind: upload.kind,
+						filename: upload.filename,
+						size: upload.size
+					}]] : [];
+				})),
+				author: authorView(orgId, record, this.fileUrls, teamBadge(permissions.get(post.orgUserId), post.communityId)),
 				reactions: counts?.reactions ?? {},
 				viewerReaction: counts?.viewerReaction ?? null,
 				commentCount: commentCounts[post.id] ?? 0,
@@ -607,19 +697,21 @@ var PostServiceImpl = class {
 			};
 		});
 	}
-	async commitSubmission(orgId, post, space, role, actor, now) {
-		return this.uow.run(async ({ posts, mentions, outbox }) => {
-			const next = await posts.updateIf(orgId, post.id, { status: post.status }, this.submissionOf(space.settings.requireReview, role, now));
+	async commitSubmission(orgId, post, space, skips, actor, now) {
+		const mentioned = await this.mentionedOpeners(orgId, post);
+		return this.uow.run(async ({ posts, outbox }) => {
+			const next = await posts.updateIf(orgId, post.id, { status: post.status }, this.submissionOf(space.settings.requireReview, skips, now));
 			if (!next) throw new ConflictError("This post cannot be submitted");
-			await outbox.append([await this.landed(mentions, orgId, next, this.meta(actor, post.status))]);
+			await outbox.append([this.landed(orgId, next, this.meta(actor, post.status), mentioned)]);
 			return next;
 		});
 	}
-	async moderate(orgId, postId, actor, patch, unchanged, log) {
-		const { post } = await this.loadVisible(orgId, actor, postId);
-		if (!this.canModerate(actor)) throw new ForbiddenError("You cannot moderate this post");
+	async moderate(postId, actor, patch, unchanged, log) {
+		const orgId = actor.orgId;
+		const { post } = await this.loadVisible(actor, postId);
+		this.requireModerator(actor, post, log);
 		if (post.status === "removed") throw new ConflictError("This post was removed");
-		if (unchanged(post)) return this.viewOf(orgId, actor, post);
+		if (unchanged(post)) return this.viewOf(actor, post);
 		const updated = await this.uow.run(async ({ posts, outbox }) => {
 			const next = await this.mustUpdate(posts, orgId, postId, patch);
 			await outbox.append([this.updated(orgId, next, this.meta(actor, next.status === "pending" ? post.status : void 0))]);
@@ -630,7 +722,7 @@ var PostServiceImpl = class {
 			postId,
 			actorId: actor.id
 		});
-		return this.viewOf(orgId, actor, updated);
+		return this.viewOf(actor, updated);
 	}
 	async mustUpdate(posts, orgId, postId, patch) {
 		const next = await posts.update(orgId, postId, patch);
@@ -654,10 +746,10 @@ var PostServiceImpl = class {
 				removedBy: null
 			};
 		}
-		return this.submissionOf(space.settings.requireReview, actor.role, now);
+		return this.submissionOf(space.settings.requireReview, skipsReview(actor.permissions, { communityId: space.communityId }), now);
 	}
-	submissionOf(requireReview, role, now) {
-		if (requireReview && !(role && isStaffRole(role))) return {
+	submissionOf(requireReview, skips, now) {
+		if (requireReview && !skips) return {
 			status: "pending",
 			scheduledAt: null,
 			publishedAt: null,
@@ -681,20 +773,31 @@ var PostServiceImpl = class {
 			throw new NotFoundError("Asset", assetId);
 		}
 	}
-	async openSpace(orgId, actor, spaceId, communityId) {
-		const space = await this.content.getSpace(orgId, spaceId);
-		if (!space || communityId !== void 0 && space.communityId !== communityId) return null;
-		return await this.access.canOpen(orgId, actor, space) ? space : null;
+	async requireBodyAssets(orgId, orgUserId, assetIds) {
+		if (assetIds.length > MAX_BODY_ASSETS) throw new InvalidInputError(`A post shows at most ${MAX_BODY_ASSETS} files`);
+		for (const assetId of assetIds) if (!await this.images.ownsUpload(orgId, assetId, orgUserId)) {
+			this.logger.debug("body file refused", {
+				orgId,
+				orgUserId,
+				assetId
+			});
+			throw new NotFoundError("Asset", assetId);
+		}
+	}
+	async openSpace(actor, spaceId, communityId) {
+		const space = await this.content.getSpace(spaceId, this.authors.systemActor(actor.orgId));
+		if (!space || communityId != null && space.communityId !== communityId) return null;
+		return await this.access.canOpen(space, actor) ? space : null;
 	}
-	async requireOpen(orgId, actor, spaceId, communityId) {
-		const space = await this.openSpace(orgId, actor, spaceId, communityId);
+	async requireOpen(actor, spaceId, communityId) {
+		const space = await this.openSpace(actor, spaceId, communityId);
 		if (!space) throw new NotFoundError("Space", spaceId);
 		return space;
 	}
-	async loadVisible(orgId, actor, postId, communityId) {
-		const post = await this.repo.find(orgId, postId);
-		if (!post || communityId !== void 0 && post.communityId !== communityId) throw new NotFoundError("Post", postId);
-		const space = await this.openSpace(orgId, actor, post.spaceId);
+	async loadVisible(actor, postId, communityId) {
+		const post = await this.repo.find(actor.orgId, postId);
+		if (!post || communityId != null && post.communityId !== communityId) throw new NotFoundError("Post", postId);
+		const space = await this.openSpace(actor, post.spaceId);
 		if (!space || !this.canSee(actor, post)) throw new NotFoundError("Post", postId);
 		return {
 			post,
@@ -702,25 +805,34 @@ var PostServiceImpl = class {
 		};
 	}
 	canSee(actor, post) {
-		return post.orgUserId === actor.id || this.visibleStatuses(actor).includes(post.status);
+		return post.orgUserId === actor.id || this.visibleStatuses(actor, post.communityId).includes(post.status);
 	}
-	visibleStatuses(actor) {
-		return this.canModerate(actor) ? MODERATOR_VISIBLE : PUBLISHED_ONLY;
+	visibleStatuses(actor, communityId) {
+		return this.moderates(actor.permissions, communityId) ? MODERATOR_VISIBLE : PUBLISHED_ONLY;
 	}
-	canModerate(actor) {
-		return canModerate(actor.role);
+	moderates(permissions, communityId) {
+		return permissions.has("communities:moderate", communityId);
+	}
+	requireModerator(actor, post, action) {
+		if (!this.moderates(actor.permissions, post.communityId)) {
+			this.logger.warn("post moderation refused — not a moderator", {
+				orgId: actor.orgId,
+				postId: post.id,
+				communityId: post.communityId,
+				action,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("You need communities:moderate");
+		}
 	}
 	assertAuthor(actor, post) {
 		if (post.orgUserId !== actor.id) throw new ForbiddenError("You can change only your own post");
 	}
 	topicFits(space, topicId) {
-		if (topicId === null) return space.topics.length === 0;
-		return space.topics.some((topic) => topic.id === topicId);
+		return topicId === null || space.topics.some((topic) => topic.id === topicId);
 	}
 	assertTopic(space, topicId) {
-		if (this.topicFits(space, topicId)) return;
-		if (topicId === null) throw new InvalidInputError("This space requires a topic");
-		throw new NotFoundError("Topic", topicId);
+		if (topicId !== null && !this.topicFits(space, topicId)) throw new NotFoundError("Topic", topicId);
 	}
 	patchChanges(post, patch) {
 		return Object.keys(patch).some((key) => {
@@ -731,15 +843,17 @@ var PostServiceImpl = class {
 		});
 	}
 	async mentionable(orgId, spaceId, title, body) {
-		return this.openersOf(orgId, spaceId, mentionTokens(title, body));
+		return this.openersOf(orgId, spaceId, [.../* @__PURE__ */ new Set([...mentionTokens(title), ...body])]);
 	}
 	async openersOf(orgId, spaceId, orgUserIds) {
 		if (orgUserIds.length === 0) return [];
 		return keepAllowed(orgUserIds, await this.access.spaceOpenersAmong(orgId, spaceId, orgUserIds));
 	}
-	async landed(mentions, orgId, post, metadata) {
+	async mentionedOpeners(orgId, post) {
+		return this.openersOf(orgId, post.spaceId, await this.mentions.ofItem(orgId, "post", post.id));
+	}
+	landed(orgId, post, metadata, mentioned) {
 		if (post.status !== "published") return this.updated(orgId, post, metadata);
-		const mentioned = await this.openersOf(orgId, post.spaceId, await mentions.ofItem(orgId, "post", post.id));
 		return this.published(orgId, post, metadata, mentioned);
 	}
 	published(orgId, post, metadata, mentionedOrgUserIds) {
@@ -764,7 +878,7 @@ var PostServiceImpl = class {
 	}
 	meta(actor, previousStatus) {
 		return {
-			...actor ? { actorOrgUserId: actor.id } : {},
+			...actor ? { actorId: actor.id } : {},
 			...previousStatus !== void 0 ? { previousStatus } : {}
 		};
 	}