@headless-lms/core 0.4.0 → 0.6.0

package/dist/reporting/member/service.js

@@ -1,7 +1,12 @@
-import { isStaffRole } from "../../organizations/roles.js";
-import { channelOrder } from "../../shared/notification-categories.js";
+import { PERMISSION_KEYS } from "../../types/schemas/organizations.js";
+import { NotFoundError } from "../../shared/errors.js";
 import { seesSpace } from "../../entitlements/rules.js";
+import { channelOrder } from "../../shared/notification-categories.js";
+import { eventSight } from "../../content/event-sight.js";
 import { resolveChannels } from "../../shared/notification-settings.js";
+import { applicableCategories } from "../../automations/notifications/applicable.js";
+import { attendeeFace, attendeeView } from "../events/index.js";
+import { eventCalendar } from "./calendar.js";
 //#region src/reporting/member/service.ts
 function refKey(ref) {
 	return `${ref.type}:${ref.id}`;
@@ -22,6 +27,24 @@ function itemView(ref, titles) {
 function isActivityPublished(settings) {
 	return settings?.published !== false;
 }
+const READ_OF = {
+	course: "courses:read",
+	download: "downloads:read",
+	community: "communities:read",
+	event: "events:read"
+};
+const THUMBNAIL_OF = {
+	course: "Course thumbnail",
+	download: "Download thumbnail",
+	community: "Community thumbnail",
+	event: "Event thumbnail"
+};
+const SPACE_IMAGE_ASSET = {
+	cover: (space) => space.coverAssetId,
+	background: (space) => space.backgroundAssetId,
+	icon: (space) => space.iconAssetId
+};
+const EVENT_FACES = 10;
 var MemberReportServiceImpl = class {
 	repo;
 	content;
@@ -29,12 +52,15 @@ var MemberReportServiceImpl = class {
 	files;
 	fileUrls;
 	access;
+	people;
 	notificationList;
 	titles;
 	subscriptions;
 	notificationCategories;
 	notificationSettings;
 	channels;
+	studentPortalUrl;
+	now;
 	constructor(params) {
 		this.repo = params.repo;
 		this.content = params.content;
@@ -42,35 +68,56 @@ var MemberReportServiceImpl = class {
 		this.files = params.files;
 		this.fileUrls = params.fileUrls;
 		this.access = params.access;
+		this.people = params.people;
 		this.notificationList = params.notifications;
 		this.titles = params.titles;
 		this.subscriptions = params.subscriptions;
 		this.notificationCategories = params.notificationCategories;
 		this.notificationSettings = params.notificationSettings;
 		this.channels = params.channels;
+		this.studentPortalUrl = params.studentPortalUrl.replace(/\/+$/, "");
+		this.now = params.now ?? (() => /* @__PURE__ */ new Date());
 	}
-	async communityNotificationSettings(orgId, actor, userId, communityId) {
-		if (!await this.access.isCommunityMember(orgId, actor, communityId)) return null;
+	system(actor) {
+		return this.people.systemActor(actor.orgId);
+	}
+	viewer(actor) {
+		const role = actor.permissions.roleOn();
+		return {
+			orgUserId: actor.id,
+			orgRole: {
+				key: role.key,
+				name: role.name
+			},
+			permissions: PERMISSION_KEYS.filter((p) => actor.permissions.anywhere(p)),
+			orgPermissions: PERMISSION_KEYS.filter((p) => actor.permissions.has(p))
+		};
+	}
+	async communityNotificationSettings(communityId, actor) {
+		if (!await this.access.isCommunityMember(communityId, actor)) throw new NotFoundError("Community", communityId);
+		const orgId = actor.orgId;
+		const system = this.system(actor);
 		const [list, settings, spaceIds, spaces, community] = await Promise.all([
-			this.notificationCategories.community.get(orgId, communityId),
-			this.notificationSettings.get(orgId, userId, { communityId }),
-			this.access.openSpaceIds(orgId, actor, communityId),
-			this.content.listSpaces(orgId, communityId),
-			this.content.getCommunity(orgId, communityId)
+			this.notificationCategories.community.get(communityId, system),
+			this.notificationSettings.get(orgId, actor.userId, { communityId }),
+			this.access.openSpaceIds(communityId, actor),
+			this.content.listSpaces(communityId, system),
+			this.content.findCommunity(communityId, system)
 		]);
 		const open = new Set(spaceIds);
 		return {
 			communityId,
 			digest: community?.settings.digest ?? null,
-			categories: this.settingsView(list.categories, settings, spaces.filter((space) => open.has(space.id)).map((space) => ({
+			categories: this.settingsView(applicableCategories(list.categories, actor.permissions, { communityId }), settings, spaces.filter((space) => open.has(space.id)).map((space) => ({
 				spaceId: space.id,
 				name: space.name
 			})))
 		};
 	}
-	async orgNotificationSettings(orgId, userId) {
-		const [list, settings] = await Promise.all([this.notificationCategories.org.get(orgId, orgId), this.notificationSettings.get(orgId, userId, "org")]);
-		return { categories: this.settingsView(list.categories, settings, []) };
+	async orgNotificationSettings(actor) {
+		const orgId = actor.orgId;
+		const [list, settings] = await Promise.all([this.notificationCategories.org.get(orgId, this.system(actor)), this.notificationSettings.get(orgId, actor.userId, "org")]);
+		return { categories: this.settingsView(applicableCategories(list.categories, actor.permissions, "org"), settings, []) };
 	}
 	settingsView(categories, settings, spaces) {
 		const configured = channelOrder(this.channels.list());
@@ -97,27 +144,28 @@ var MemberReportServiceImpl = class {
 			return view;
 		});
 	}
-	async notifications(orgId, actor, userId, filter, page) {
-		const listed = await this.notificationList.list(orgId, userId, filter, page);
+	async notifications(filter, page, actor) {
+		const listed = await this.notificationList.list(filter, page, actor);
 		return {
-			rows: await this.describeNotifications(orgId, actor, listed.items),
+			rows: await this.describeNotifications(actor, listed.items),
 			total: listed.total,
 			page: page.page,
 			pageSize: page.pageSize,
 			unreadCount: listed.unreadCount
 		};
 	}
-	async notification(orgId, actor, userId, notificationId) {
-		const found = await this.notificationList.get(orgId, userId, notificationId);
-		if (!found) return null;
-		const [view] = await this.describeNotifications(orgId, actor, [found]);
-		return view ?? null;
+	async notification(notificationId, actor) {
+		const found = await this.notificationList.get(notificationId, actor);
+		const [view] = found ? await this.describeNotifications(actor, [found]) : [];
+		if (!view) throw new NotFoundError("Notification", notificationId);
+		return view;
 	}
-	async notificationUnreadCounts(orgId, actor, userId) {
-		const communityIds = await this.access.openCommunityIds(orgId, actor);
-		return this.notificationList.unreadCounts(orgId, userId, communityIds);
+	async notificationUnreadCounts(actor) {
+		const communityIds = await this.access.openCommunityIds(actor);
+		return this.notificationList.unreadCounts(communityIds, actor);
 	}
-	async describeNotifications(orgId, actor, rows) {
+	async describeNotifications(actor, rows) {
+		const orgId = actor.orgId;
 		const refs = rows.flatMap((row) => [
 			...row.subject ? [row.subject] : [],
 			...row.parent ? [row.parent] : [],
@@ -130,11 +178,11 @@ var MemberReportServiceImpl = class {
 				id: row.spaceId
 			}] : []
 		]);
-		const actorIds = [...new Set(rows.flatMap((row) => row.actorOrgUserId ?? []))];
+		const actorIds = [...new Set(rows.flatMap((row) => row.actorId ?? []))];
 		const [people, discussionTitles, contentTitles] = await Promise.all([
 			this.repo.people(orgId, actorIds),
-			this.titles.discussion.titlesFor(orgId, actor, refs),
-			this.titles.content.titlesFor(orgId, actor, refs)
+			this.titles.discussion.titlesFor(refs, actor),
+			this.titles.content.titlesFor(refs, actor)
 		]);
 		const titles = {
 			...contentTitles,
@@ -142,7 +190,7 @@ var MemberReportServiceImpl = class {
 		};
 		const personById = new Map(people.map((person) => [person.orgUserId, person]));
 		return rows.map((row) => {
-			const person = row.actorOrgUserId ? personById.get(row.actorOrgUserId) : void 0;
+			const person = row.actorId ? personById.get(row.actorId) : void 0;
 			const community = row.communityId ? titles[`community:${row.communityId}`] : void 0;
 			const space = row.spaceId ? titles[`space:${row.spaceId}`] : void 0;
 			return {
@@ -164,7 +212,7 @@ var MemberReportServiceImpl = class {
 				actor: person ? {
 					orgUserId: person.orgUserId,
 					name: person.displayName,
-					imageUrl: person.imageAssetId ? this.fileUrls.personImage(person.orgUserId) : null
+					imageUrl: person.imageAssetId ? this.fileUrls.publicImage(orgId, person.orgUserId, person.imageAssetId) : null
 				} : null,
 				subject: itemView(row.subject, titles),
 				parent: itemView(row.parent, titles),
@@ -173,27 +221,44 @@ var MemberReportServiceImpl = class {
 			};
 		});
 	}
-	async listCourses(orgId, orgUserId) {
-		const ids = await this.access.listAccessibleContent(orgId, orgUserId, "course");
-		return (await Promise.all(ids.map((id) => this.content.getCourse(orgId, id)))).filter((c) => c !== null && c.status === "published");
+	async opensCourse(courseId, actor) {
+		const reads = actor.permissions.has("courses:read", courseId);
+		if (!reads && !await this.access.hasAccess(actor.orgId, actor.id, courseId)) return null;
+		const course = await this.content.findCourse(courseId, this.system(actor));
+		return course && (reads || course.status === "published") ? course : null;
+	}
+	async opensDownload(downloadId, actor) {
+		const reads = actor.permissions.has("downloads:read", downloadId);
+		if (!reads && !await this.access.hasAccess(actor.orgId, actor.id, downloadId)) return null;
+		const download = await this.content.findDownload(downloadId, this.system(actor));
+		return download && (reads || download.status === "published") ? download : null;
 	}
-	async getCourse(orgId, orgUserId, courseId) {
-		if (!await this.access.hasAccess(orgId, orgUserId, courseId)) return null;
-		const course = await this.content.getCourse(orgId, courseId);
-		return course && course.status === "published" ? course : null;
+	async listCourses(actor) {
+		const ids = await this.access.listAccessibleContent(actor.orgId, actor.id, "course");
+		const system = this.system(actor);
+		return (await Promise.all(ids.map((id) => this.content.findCourse(id, system)))).filter((c) => c !== null && c.status === "published");
 	}
-	async listModules(orgId, orgUserId, courseId) {
-		if (!await this.getCourse(orgId, orgUserId, courseId)) return null;
-		return this.content.listCourseModules(orgId, courseId);
+	async requireCourse(courseId, actor) {
+		const course = await this.opensCourse(courseId, actor);
+		if (!course) throw new NotFoundError("Course", courseId);
+		return course;
 	}
-	async listActivities(orgId, orgUserId, courseId) {
-		if (!await this.getCourse(orgId, orgUserId, courseId)) return null;
-		return (await this.content.listCourseActivityViews(orgId, courseId)).filter((a) => isActivityPublished(a.settings));
+	getCourse(courseId, actor) {
+		return this.requireCourse(courseId, actor);
 	}
-	async courseProgress(orgId, orgUserId, courseId) {
-		if (!await this.getCourse(orgId, orgUserId, courseId)) return null;
-		const ids = (await this.content.listCourseActivities(orgId, courseId)).filter((a) => isActivityPublished(a.settings)).map((a) => a.id);
-		const records = await this.progress.listByTargets(orgId, orgUserId, ids);
+	async listModules(courseId, actor) {
+		await this.requireCourse(courseId, actor);
+		return this.content.listCourseModules(courseId, this.system(actor));
+	}
+	async listActivities(courseId, actor) {
+		await this.requireCourse(courseId, actor);
+		return (await this.content.listCourseActivityViews(courseId, this.system(actor))).filter((a) => isActivityPublished(a.settings));
+	}
+	async courseProgress(courseId, actor) {
+		await this.requireCourse(courseId, actor);
+		const orgId = actor.orgId;
+		const ids = (await this.content.listCourseActivities(courseId, this.system(actor))).filter((a) => isActivityPublished(a.settings)).map((a) => a.id);
+		const records = await this.progress.listByTargets(orgId, actor.id, ids);
 		const activities = {};
 		const positions = {};
 		let done = 0;
@@ -204,7 +269,7 @@ var MemberReportServiceImpl = class {
 			if (r.position != null) positions[r.targetId] = r.position;
 		}
 		const courseRecord = await this.progress.get(orgId, {
-			orgUserId,
+			orgUserId: actor.id,
 			targetType: "course",
 			targetId: courseId
 		});
@@ -215,86 +280,244 @@ var MemberReportServiceImpl = class {
 			positions
 		};
 	}
-	async listDownloads(orgId, orgUserId) {
-		const ids = await this.access.listAccessibleContent(orgId, orgUserId, "download");
-		return (await Promise.all(ids.map((id) => this.content.getDownload(orgId, id)))).filter((d) => d !== null && d.status === "published");
+	async listDownloads(actor) {
+		const ids = await this.access.listAccessibleContent(actor.orgId, actor.id, "download");
+		const system = this.system(actor);
+		return (await Promise.all(ids.map((id) => this.content.findDownload(id, system)))).filter((d) => d !== null && d.status === "published");
 	}
-	async getDownload(orgId, orgUserId, downloadId) {
-		if (!await this.access.hasAccess(orgId, orgUserId, downloadId)) return null;
-		const download = await this.content.getDownload(orgId, downloadId);
-		if (!download || download.status !== "published") return null;
+	async getDownload(downloadId, actor) {
+		const download = await this.opensDownload(downloadId, actor);
+		if (!download) throw new NotFoundError("Download", downloadId);
 		return {
 			download,
-			assets: await this.content.listDownloadAssets(orgId, downloadId)
+			assets: await this.content.listDownloadAssets(downloadId, this.system(actor))
 		};
 	}
-	async thumbnailFile(orgId, actor, owner, id) {
-		const item = owner === "course" ? await this.content.getCourse(orgId, id) : owner === "download" ? await this.content.getDownload(orgId, id) : await this.content.getCommunity(orgId, id);
-		if (!item?.thumbnailAssetId || item.status !== "published" && !isStaffRole(actor.role)) return null;
-		return this.files.signFile(orgId, item.thumbnailAssetId);
+	async thumbnailFile(owner, id, actor) {
+		const system = this.system(actor);
+		const item = owner === "event" ? (await this.seeEvents([id], actor))[0]?.event : owner === "course" ? await this.content.findCourse(id, system) : owner === "download" ? await this.content.findDownload(id, system) : await this.content.findCommunity(id, system);
+		if (!item?.thumbnailAssetId || owner !== "event" && item.status !== "published" && !actor.permissions.has(READ_OF[owner], id)) throw new NotFoundError(THUMBNAIL_OF[owner], id);
+		return signed(await this.files.signFile(actor.orgId, item.thumbnailAssetId), THUMBNAIL_OF[owner], id);
+	}
+	async spaceImageFile(spaceId, image, actor) {
+		const system = this.system(actor);
+		const space = await this.content.getSpace(spaceId, system);
+		const assetId = space ? SPACE_IMAGE_ASSET[image](space) : null;
+		const community = space ? await this.content.findCommunity(space.communityId, system) : null;
+		if (!space || !assetId || !community || community.status !== "published" && !actor.permissions.has("communities:read", space.communityId)) throw new NotFoundError("Space image", spaceId);
+		return signed(await this.files.signFile(actor.orgId, assetId), "Space image", spaceId);
 	}
-	async activityFile(orgId, actor, activityId, assetId) {
-		const activity = await this.content.getActivity(orgId, activityId);
-		if (!activity) return null;
-		if (!isStaffRole(actor.role)) {
-			if (!isActivityPublished(activity.settings) || !await this.getCourse(orgId, actor.id, activity.courseId)) return null;
+	async activityFile(activityId, assetId, actor) {
+		const system = this.system(actor);
+		const activity = await this.content.getActivity(activityId, system);
+		if (!activity) throw new NotFoundError("Lesson file", assetId);
+		if (!actor.permissions.has("courses:read", activity.courseId)) {
+			if (!isActivityPublished(activity.settings) || !await this.opensCourse(activity.courseId, actor)) throw new NotFoundError("Lesson file", assetId);
 		}
-		if (!(await this.content.listCourseActivityAssets(orgId, activity.courseId)).some((link) => link.activityId === activityId && link.assetId === assetId)) return null;
-		return this.files.signFile(orgId, assetId);
-	}
-	async downloadFile(orgId, actor, downloadId, assetId) {
-		if (!isStaffRole(actor.role) && !await this.getDownload(orgId, actor.id, downloadId)) return null;
-		const file = (await this.content.listDownloadAssets(orgId, downloadId)).find((f) => f.assetId === assetId);
-		if (!file) return null;
-		return this.files.signFile(orgId, assetId, { saveAs: file.displayName ?? file.filename });
-	}
-	async personImage(orgId, orgUserId) {
-		const [person] = await this.repo.people(orgId, [orgUserId]);
-		if (!person?.imageAssetId) return null;
-		return this.files.signFile(orgId, person.imageAssetId);
-	}
-	async directory(orgId, actor, communityId, query) {
-		if (!await this.access.isCommunityMember(orgId, actor, communityId)) return null;
-		if (!await this.content.getCommunity(orgId, communityId)) return null;
-		const page = await this.repo.directory(orgId, communityId, query);
+		if (!(await this.content.listCourseActivityAssets(activity.courseId, system)).some((link) => link.activityId === activityId && link.assetId === assetId)) throw new NotFoundError("Lesson file", assetId);
+		return signed(await this.files.signFile(actor.orgId, assetId), "Lesson file", assetId);
+	}
+	async downloadFile(downloadId, assetId, actor) {
+		if (!await this.opensDownload(downloadId, actor)) throw new NotFoundError("Download file", assetId);
+		const file = (await this.content.listDownloadAssets(downloadId, this.system(actor))).find((f) => f.assetId === assetId);
+		if (!file) throw new NotFoundError("Download file", assetId);
+		return signed(await this.files.signFile(actor.orgId, assetId, { saveAs: file.displayName ?? file.filename }), "Download file", assetId);
+	}
+	async seeEvents(ids, actor) {
+		if (ids.length === 0) return [];
+		const system = this.system(actor);
+		const [events, attended] = await Promise.all([this.content.findEvents(ids, system), ids.length === 1 ? this.access.hasAccess(actor.orgId, actor.id, ids[0]).then((attending) => attending ? [ids[0]] : []) : this.access.listAccessibleContent(actor.orgId, actor.id, "event")]);
+		const attending = new Set(attended);
+		const byId = new Map(events.map((event) => [event.id, event]));
+		return ids.flatMap((id) => {
+			const event = byId.get(id);
+			if (!event) return [];
+			const sight = eventSight(event, {
+				canRead: actor.permissions.has("events:read", id),
+				attending: attending.has(id)
+			});
+			return sight ? [{
+				event,
+				sight,
+				attending: attending.has(id)
+			}] : [];
+		});
+	}
+	async requireEvent(eventId, actor) {
+		const [seen] = await this.seeEvents([eventId], actor);
+		if (!seen) throw new NotFoundError("Event", eventId);
+		return seen;
+	}
+	async eventSummaries(seen, actor, now) {
+		const ids = seen.map((item) => item.event.id);
+		const attended = seen.filter((item) => item.attending).map((item) => item.event.id);
+		const [faces, direct] = await Promise.all([this.repo.eventFaces(actor.orgId, ids, EVENT_FACES), attended.length > 0 ? this.repo.directEventGrants(actor.orgId, actor.id, attended) : Promise.resolve([])]);
+		const leaves = new Set(direct);
+		return seen.map((item) => this.eventSummary(item, faces[item.event.id] ?? {
+			total: 0,
+			rows: []
+		}, leaves.has(item.event.id), actor, now));
+	}
+	eventSummary(seen, faces, canLeave, actor, now) {
+		const { event, sight, attending } = seen;
+		const id = event.id;
+		const canOpen = sight !== "public";
+		const capacity = event.settings.capacity;
+		const attendeeCount = faces.total;
+		const ended = event.endsAt.getTime() <= now.getTime();
+		const recording = sight === "read" || sight === "attendee" && ended && event.settings.replay ? event.recording : null;
+		const writes = actor.permissions.has("events:write", id);
+		const canManageAttendees = actor.permissions.has("access:write") || writes;
+		return {
+			orgId: event.orgId,
+			id,
+			type: event.type,
+			title: event.title,
+			thumbnailAssetId: event.thumbnailAssetId,
+			thumbnailUrl: event.thumbnailUrl,
+			status: event.status,
+			startsAt: event.startsAt,
+			endsAt: event.endsAt,
+			timeZone: event.timeZone,
+			location: canOpen ? event.location : null,
+			recording,
+			settings: {
+				type: event.settings.type,
+				capacity,
+				replay: event.settings.replay
+			},
+			attendeeCount,
+			attendees: faces.rows.map((row) => attendeeFace(actor.orgId, row, this.fileUrls)),
+			placesLeft: capacity === null ? null : Math.max(capacity - attendeeCount, 0),
+			viewer: {
+				attending,
+				canRegister: event.status === "published" && !attending && event.settings.type === "public" && event.startsAt.getTime() > now.getTime() && (capacity === null || attendeeCount < capacity),
+				canOpen,
+				canLeave,
+				canManageAttendees,
+				canAddAttendees: canManageAttendees && event.status === "published" && !ended,
+				canEdit: writes,
+				canCancel: writes,
+				canDelete: actor.permissions.has("events:delete", id)
+			}
+		};
+	}
+	async getEvent(eventId, actor) {
+		const seen = await this.requireEvent(eventId, actor);
+		const now = this.now();
+		const [[summary], files] = await Promise.all([this.eventSummaries([seen], actor, now), seen.sight === "public" ? Promise.resolve({}) : this.content.eventFilesFor([eventId], this.system(actor))]);
+		return {
+			...summary,
+			description: seen.event.description,
+			files: files[eventId] ?? []
+		};
+	}
+	async listEvents(query, actor) {
+		const now = this.now();
+		const reads = actor.permissions.where("events:read");
+		const page = await this.repo.events(actor.orgId, query, {
+			orgUserId: actor.id,
+			readAll: reads.org,
+			readIds: reads.content
+		}, now);
+		const rows = await this.eventSummaries(await this.seeEvents(page.rows, actor), actor, now);
+		return {
+			...page,
+			rows
+		};
+	}
+	async eventCalendar(eventId, actor) {
+		const { event, sight } = await this.requireEvent(eventId, actor);
+		return eventCalendar(event, {
+			pageUrl: `${this.studentPortalUrl}/events/${encodeURIComponent(event.id)}`,
+			withLocation: sight !== "public",
+			now: this.now()
+		});
+	}
+	async eventAttendees(eventId, query, actor) {
+		actor.permissions.require("events:read", eventId);
+		if (!await this.content.findEvent(eventId, this.system(actor))) throw new NotFoundError("Event", eventId);
+		const page = await this.repo.eventAttendees(actor.orgId, eventId, query);
 		return {
 			...page,
-			rows: page.rows.map((row) => ({
-				...row,
-				imageUrl: row.imageAssetId ? this.fileUrls.personImage(row.orgUserId) : null
-			}))
+			rows: page.rows.map((row) => attendeeView(actor.orgId, row, this.fileUrls))
 		};
 	}
-	async communityHome(orgId, actor, communityId) {
-		if (!await this.access.isCommunityMember(orgId, actor, communityId)) return null;
-		const community = await this.content.getCommunity(orgId, communityId);
-		if (!community) return null;
-		const spaces = await this.content.listSpaces(orgId, communityId);
+	async eventFile(eventId, assetId, actor) {
+		const [seen] = await this.seeEvents([eventId], actor);
+		if (!seen || seen.sight === "public") throw new NotFoundError("Event file", assetId);
+		const file = (await this.content.eventFilesFor([eventId], this.system(actor)))[eventId]?.find((f) => f.assetId === assetId);
+		if (!file) throw new NotFoundError("Event file", assetId);
+		return signed(await this.files.signFile(actor.orgId, assetId, { saveAs: file.displayName ?? file.filename }), "Event file", assetId);
+	}
+	async directory(communityId, query, actor) {
+		if (!await this.access.isCommunityMember(communityId, actor)) throw new NotFoundError("Community", communityId);
+		const orgId = actor.orgId;
+		if (!await this.content.findCommunity(communityId, this.system(actor))) throw new NotFoundError("Community", communityId);
+		const readers = await this.people.holders(orgId, "communities:read", communityId);
+		const page = await this.repo.directory(orgId, communityId, query, readers);
+		const permissions = await this.people.permissionsOfMany(orgId, page.rows.map((row) => row.orgUserId));
+		return {
+			...page,
+			rows: page.rows.map((row) => {
+				const held = permissions.get(row.orgUserId);
+				const item = held?.roleOn(communityId);
+				const org = held?.roleOn();
+				return {
+					...row,
+					imageUrl: row.imageAssetId ? this.fileUrls.publicImage(orgId, row.orgUserId, row.imageAssetId) : null,
+					team: (item?.team ?? false) || (org?.team ?? false),
+					roleName: item?.team ? item.name : org?.team ? org.name : null,
+					opensEverySpace: (held?.has("communities:read", communityId) || held?.has("communities:moderate", communityId)) ?? false
+				};
+			})
+		};
+	}
+	async communityHome(communityId, actor) {
+		if (!await this.access.isCommunityMember(communityId, actor)) throw new NotFoundError("Community", communityId);
+		const system = this.system(actor);
+		const community = await this.content.findCommunity(communityId, system);
+		if (!community) throw new NotFoundError("Community", communityId);
+		const [spaces, everySpace] = await Promise.all([this.content.listSpaces(communityId, system), this.access.opensEverySpace(actor, communityId)]);
+		const itemRole = actor.permissions.roleOn(communityId);
+		const orgRole = actor.permissions.roleOn();
+		const role = itemRole.team || !orgRole.team ? itemRole : orgRole;
 		return {
 			communityId,
 			title: community.title,
 			description: community.description,
 			thumbnailUrl: community.thumbnailUrl,
 			dm: community.settings.dm,
-			spaces: await this.homeSpaces(orgId, actor, communityId, spaces)
+			spaces: await this.homeSpaces(actor, communityId, spaces, everySpace),
+			viewer: {
+				permissions: PERMISSION_KEYS.filter((p) => actor.permissions.has(p, communityId)),
+				opensEverySpace: everySpace,
+				team: itemRole.team || orgRole.team,
+				roleName: role.name,
+				canCreateEvents: actor.permissions.has("events:write")
+			}
 		};
 	}
-	async communitySpace(orgId, actor, communityId, spaceId) {
-		if (!await this.access.isCommunityMember(orgId, actor, communityId)) return null;
-		const space = await this.content.getSpace(orgId, spaceId);
-		if (!space || space.communityId !== communityId) return null;
-		const [view] = await this.homeSpaces(orgId, actor, communityId, [space]);
-		return view ?? null;
+	async communitySpace(communityId, spaceId, actor) {
+		if (!await this.access.isCommunityMember(communityId, actor)) throw new NotFoundError("Space", spaceId);
+		const space = await this.content.getSpace(spaceId, this.system(actor));
+		if (!space || space.communityId !== communityId) throw new NotFoundError("Space", spaceId);
+		const everySpace = await this.access.opensEverySpace(actor, communityId);
+		const [view] = await this.homeSpaces(actor, communityId, [space], everySpace);
+		if (!view) throw new NotFoundError("Space", spaceId);
+		return view;
 	}
-	async homeSpaces(orgId, actor, communityId, spaces) {
+	async homeSpaces(actor, communityId, spaces, everySpace) {
+		const orgId = actor.orgId;
+		const excluding = await this.access.everySpaceOpeners(orgId, communityId);
 		const [openIds, counts, standings, subscribed] = await Promise.all([
-			this.access.openSpaceIds(orgId, actor, communityId),
-			this.repo.spaceMemberCounts(orgId, communityId),
-			this.access.spaceStandings(orgId, actor, communityId),
+			this.access.openSpaceIds(communityId, actor),
+			this.repo.spaceMemberCounts(orgId, communityId, excluding),
+			this.access.spaceStandings(communityId, actor),
 			this.subscriptions.viewerSubscriptions(orgId, actor.id, "space", spaces.map((space) => space.id), /* @__PURE__ */ new Date())
 		]);
 		const open = new Set(openIds);
-		const seen = spaces.filter((space) => seesSpace(actor.role, space.accessRule, standings[space.id]));
+		const seen = spaces.filter((space) => seesSpace(everySpace, space.accessRule, standings[space.id]));
 		return Promise.all(seen.map(async (space) => {
 			const memberCount = counts[space.id] ?? 0;
 			const base = {
@@ -302,7 +525,10 @@ var MemberReportServiceImpl = class {
 				name: space.name,
 				memberCount,
 				accessRule: space.accessRule,
-				standing: standingOf(space, open.has(space.id), memberCount, standings[space.id])
+				standing: standingOf(space, open.has(space.id), memberCount, standings[space.id]),
+				coverUrl: space.coverUrl,
+				backgroundUrl: space.backgroundUrl,
+				iconUrl: space.iconUrl
 			};
 			if (!open.has(space.id)) return {
 				...base,
@@ -318,30 +544,31 @@ var MemberReportServiceImpl = class {
 					id: topic.id,
 					name: topic.name
 				})),
-				links: await this.linkViews(orgId, actor, space.links),
+				links: await this.linkViews(actor, space.links),
 				subscription: subscribed[space.id] ?? null
 			};
 		}));
 	}
-	async linkViews(orgId, actor, links) {
-		const shown = (status) => status === "published" || isStaffRole(actor.role);
+	async linkViews(actor, links) {
+		const system = this.system(actor);
+		const shown = (type, id, status) => status === "published" || actor.permissions.has(READ_OF[type], id);
 		return (await Promise.all(links.map(async (link) => {
-			const course = await this.content.getCourse(orgId, link.contentId);
-			if (course) return shown(course.status) ? {
+			const course = await this.content.findCourse(link.contentId, system);
+			if (course) return shown("course", link.contentId, course.status) ? {
 				id: link.id,
 				contentId: link.contentId,
 				type: "course",
 				title: course.title
 			} : null;
-			const download = await this.content.getDownload(orgId, link.contentId);
-			if (download) return shown(download.status) ? {
+			const download = await this.content.findDownload(link.contentId, system);
+			if (download) return shown("download", link.contentId, download.status) ? {
 				id: link.id,
 				contentId: link.contentId,
 				type: "download",
 				title: download.title
 			} : null;
-			const community = await this.content.getCommunity(orgId, link.contentId);
-			if (community) return shown(community.status) ? {
+			const community = await this.content.findCommunity(link.contentId, system);
+			if (community) return shown("community", link.contentId, community.status) ? {
 				id: link.id,
 				contentId: link.contentId,
 				type: "community",
@@ -351,6 +578,10 @@ var MemberReportServiceImpl = class {
 		}))).filter((view) => view !== null);
 	}
 };
+function signed(url, what, id) {
+	if (!url) throw new NotFoundError(what, id);
+	return url;
+}
 function standingOf(space, open, memberCount, status) {
 	if (space.accessRule === "all_members" || open && status !== "active") return "open";
 	if (status === "active") return "member";