@headless-lms/server 0.1.0 → 0.3.0

package/dist/http/plugins/openapi.js

@@ -1,59 +1,109 @@
-import { jsonSchemaTransform } from "fastify-type-provider-zod";
+import { ErrorBody, ValidationErrorBody } from "../schemas/shared.js";
+import { version } from "../../packages/server/package.js";
+import { jsonSchemaTransform, jsonSchemaTransformObject } from "fastify-type-provider-zod";
 import swagger from "@fastify/swagger";
 import swaggerUi from "@fastify/swagger-ui";
 //#region src/http/plugins/openapi.ts
+const PUBLIC_ROUTES = /* @__PURE__ */ new Set(["GET /api/organizations/invites/:token"]);
+function withDefaultResponses(schema, method, url) {
+	if (!schema || !url.startsWith("/api/") || url.startsWith("/api/auth/")) return schema;
+	const response = { ...schema.response ?? {} };
+	if ((schema.body || schema.querystring || schema.params) && !response["400"]) response["400"] = ValidationErrorBody;
+	if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response["401"]) response["401"] = ErrorBody;
+	if (!response["500"]) response["500"] = ErrorBody;
+	return {
+		...schema,
+		response
+	};
+}
 function registerOpenApi(app, config) {
 	app.register(swagger, {
 		openapi: {
 			info: {
 				title: "Headless LMS API",
-				version: "0.0.0"
+				version,
+				description: "API documentation for the Headless LMS platform",
+				license: {
+					name: "MIT",
+					url: "https://opensource.org/licenses/MIT"
+				}
 			},
 			servers: [{ url: config.publicUrl }],
 			tags: [
 				{
 					name: "Organizations",
-					description: "Organizations and member management"
+					description: "The tenant: its members, roles, invites and students"
 				},
 				{
-					name: "Courses",
-					description: "Course authoring: courses, modules, activities"
+					name: "Content",
+					description: "Authored content: courses and downloads, their structure and delivery"
 				},
 				{
-					name: "Learn",
-					description: "Student-facing course delivery"
+					name: "Entitlements",
+					description: "Access grants to content"
 				},
 				{
-					name: "Students",
-					description: "Students and their enrollments"
+					name: "Progress",
+					description: "Per-student progress and completion through course content"
 				},
 				{
-					name: "Entitlements",
-					description: "Access grants to content"
+					name: "Discussion",
+					description: "Learner comments, replies, reactions and moderation"
 				},
 				{
-					name: "Progress",
-					description: "Completion tracking"
+					name: "Communities",
+					description: "Communities, their spaces, topics, and direct-message settings"
 				},
 				{
-					name: "Automations",
-					description: "Trigger/action workflows"
+					name: "Posts",
+					description: "Posts in a space, reactions, and the moderation queue"
 				},
 				{
-					name: "Dashboard",
-					description: "Back-office overview"
+					name: "Chats",
+					description: "Direct and group chats inside one community"
+				},
+				{
+					name: "Profile",
+					description: "The signed-in member profile"
+				},
+				{
+					name: "Notifications",
+					description: "What happened to the signed-in member, and how they want to be told"
 				},
 				{
 					name: "Assets",
-					description: "Media library and uploads"
+					description: "The org media library: uploads, serving and lifecycle"
+				},
+				{
+					name: "Files",
+					description: "Stable file URLs that check access and redirect to a signed storage URL"
+				},
+				{
+					name: "Automations",
+					description: "Workflows and webhooks that react to system events"
 				},
 				{
 					name: "Integrations",
-					description: "Third-party integration connections"
+					description: "Connections to external services"
+				},
+				{
+					name: "Reporting",
+					description: "Reporting and analytics"
+				},
+				{
+					name: "Access",
+					description: "Access scopes, connected apps and API keys"
 				}
 			]
 		},
-		transform: jsonSchemaTransform
+		transform: (input) => {
+			const method = String(Array.isArray(input.route.method) ? input.route.method[0] : input.route.method);
+			return jsonSchemaTransform({
+				...input,
+				schema: withDefaultResponses(input.schema, method, input.url)
+			});
+		},
+		transformObject: jsonSchemaTransformObject
 	});
 	app.register(swaggerUi, { routePrefix: "/docs" });
 }

package/dist/http/plugins/openapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.js","names":[],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: { title: 'Headless LMS API', version: '0.0.0' },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        { name: 'Organizations', description: 'Organizations and member management' },\n        { name: 'Courses', description: 'Course authoring: courses, modules, activities' },\n        { name: 'Learn', description: 'Student-facing course delivery' },\n        { name: 'Students', description: 'Students and their enrollments' },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        { name: 'Progress', description: 'Completion tracking' },\n        { name: 'Automations', description: 'Trigger/action workflows' },\n        { name: 'Dashboard', description: 'Back-office overview' },\n        { name: 'Assets', description: 'Media library and uploads' },\n        { name: 'Integrations', description: 'Third-party integration connections' },\n      ],\n    },\n    transform: jsonSchemaTransform,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;AAUA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IAAE,OAAO;IAAoB,SAAS;GAAQ;GACpD,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KAAE,MAAM;KAAiB,aAAa;IAAsC;IAC5E;KAAE,MAAM;KAAW,aAAa;IAAiD;IACjF;KAAE,MAAM;KAAS,aAAa;IAAiC;IAC/D;KAAE,MAAM;KAAY,aAAa;IAAiC;IAClE;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KAAE,MAAM;KAAY,aAAa;IAAsB;IACvD;KAAE,MAAM;KAAe,aAAa;IAA2B;IAC/D;KAAE,MAAM;KAAa,aAAa;IAAuB;IACzD;KAAE,MAAM;KAAU,aAAa;IAA4B;IAC3D;KAAE,MAAM;KAAgB,aAAa;IAAsC;GAC7E;EACF;EACA,WAAW;CACb,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}
+{"version":3,"file":"openapi.js","names":["pkg.version"],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform, jsonSchemaTransformObject } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\nimport { ErrorBody, ValidationErrorBody } from '../schemas/shared.js';\nimport pkg from '../../../package.json' with { type: 'json' };\n\nconst PUBLIC_ROUTES = new Set(['GET /api/organizations/invites/:token']);\n\ntype RouteSchema = {\n  body?: unknown;\n  querystring?: unknown;\n  params?: unknown;\n  response?: Record<string, unknown>;\n};\n\nfunction withDefaultResponses(\n  schema: RouteSchema | undefined,\n  method: string,\n  url: string,\n): RouteSchema | undefined {\n  if (!schema || !url.startsWith('/api/') || url.startsWith('/api/auth/')) {\n    return schema;\n  }\n  const response: Record<string, unknown> = { ...(schema.response ?? {}) };\n  if ((schema.body || schema.querystring || schema.params) && !response['400']) {\n    response['400'] = ValidationErrorBody;\n  }\n  if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response['401']) {\n    response['401'] = ErrorBody;\n  }\n  if (!response['500']) {\n    response['500'] = ErrorBody;\n  }\n  return { ...schema, response };\n}\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: {\n        title: 'Headless LMS API',\n        version: pkg.version,\n        description: 'API documentation for the Headless LMS platform',\n        license: {\n          name: 'MIT',\n          url: 'https://opensource.org/licenses/MIT',\n        },\n      },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        {\n          name: 'Organizations',\n          description: 'The tenant: its members, roles, invites and students',\n        },\n        {\n          name: 'Content',\n          description: 'Authored content: courses and downloads, their structure and delivery',\n        },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        {\n          name: 'Progress',\n          description: 'Per-student progress and completion through course content',\n        },\n        { name: 'Discussion', description: 'Learner comments, replies, reactions and moderation' },\n        {\n          name: 'Communities',\n          description: 'Communities, their spaces, topics, and direct-message settings',\n        },\n        { name: 'Posts', description: 'Posts in a space, reactions, and the moderation queue' },\n        { name: 'Chats', description: 'Direct and group chats inside one community' },\n        { name: 'Profile', description: 'The signed-in member profile' },\n        {\n          name: 'Notifications',\n          description: 'What happened to the signed-in member, and how they want to be told',\n        },\n        { name: 'Assets', description: 'The org media library: uploads, serving and lifecycle' },\n        {\n          name: 'Files',\n          description: 'Stable file URLs that check access and redirect to a signed storage URL',\n        },\n        { name: 'Automations', description: 'Workflows and webhooks that react to system events' },\n        { name: 'Integrations', description: 'Connections to external services' },\n        { name: 'Reporting', description: 'Reporting and analytics' },\n        { name: 'Access', description: 'Access scopes, connected apps and API keys' },\n      ],\n    },\n    transform: (input) => {\n      const method = String(\n        Array.isArray(input.route.method) ? input.route.method[0] : input.route.method,\n      );\n      return jsonSchemaTransform({\n        ...input,\n        schema: withDefaultResponses(input.schema as RouteSchema | undefined, method, input.url),\n      } as typeof input);\n    },\n    transformObject: jsonSchemaTransformObject,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;;;AAYA,MAAM,gCAAgB,IAAI,IAAI,CAAC,uCAAuC,CAAC;AASvE,SAAS,qBACP,QACA,QACA,KACyB;CACzB,IAAI,CAAC,UAAU,CAAC,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,YAAY,GACpE,OAAO;CAET,MAAM,WAAoC,EAAE,GAAI,OAAO,YAAY,CAAC,EAAG;CACvE,KAAK,OAAO,QAAQ,OAAO,eAAe,OAAO,WAAW,CAAC,SAAS,QACpE,SAAS,SAAS;CAEpB,IAAI,CAAC,cAAc,IAAI,GAAG,OAAO,GAAG,KAAK,KAAK,CAAC,SAAS,QACtD,SAAS,SAAS;CAEpB,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;CAEpB,OAAO;EAAE,GAAG;EAAQ;CAAS;AAC/B;AAEA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IACJ,OAAO;IACEA;IACT,aAAa;IACb,SAAS;KACP,MAAM;KACN,KAAK;IACP;GACF;GACA,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAc,aAAa;IAAsD;IACzF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAwD;IACtF;KAAE,MAAM;KAAS,aAAa;IAA8C;IAC5E;KAAE,MAAM;KAAW,aAAa;IAA+B;IAC/D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAU,aAAa;IAAwD;IACvF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAe,aAAa;IAAqD;IACzF;KAAE,MAAM;KAAgB,aAAa;IAAmC;IACxE;KAAE,MAAM;KAAa,aAAa;IAA0B;IAC5D;KAAE,MAAM;KAAU,aAAa;IAA6C;GAC9E;EACF;EACA,YAAY,UAAU;GACpB,MAAM,SAAS,OACb,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,MAC1E;GACA,OAAO,oBAAoB;IACzB,GAAG;IACH,QAAQ,qBAAqB,MAAM,QAAmC,QAAQ,MAAM,GAAG;GACzF,CAAiB;EACnB;EACA,iBAAiB;CACnB,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}

package/dist/http/routes/access.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/access.d.ts
+declare function accessRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { accessRoutes };
+//# sourceMappingURL=access.d.ts.map

package/dist/http/routes/access.js

@@ -0,0 +1,140 @@
+import { refusals } from "../schemas/shared.js";
+import { resolveScope } from "../scope.js";
+import { ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOptionList } from "../schemas/access.js";
+import "../schemas/index.js";
+import { assertRoleHoldsScopes, scopeOptions } from "@headless-lms/core/organizations";
+import { z } from "zod";
+//#region src/http/routes/access.ts
+async function accessRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const tags = ["Access"];
+	r.route({
+		method: "GET",
+		url: "/api/access/scopes",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listAccessScopes",
+			tags,
+			summary: "Every access scope and whether your role can grant it",
+			description: "Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.",
+			response: {
+				200: ScopeOptionList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			return scopeOptions((await resolveScope(container, req)).role);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/access/apps",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listConnectedApps",
+			tags,
+			summary: "Apps connected to this organization as you",
+			description: "Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.",
+			response: {
+				200: ConnectedAppList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return container.auth.listConnectedApps(req.headers, scope.authOrgId);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/access/apps/:clientId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "revokeConnectedApp",
+			tags,
+			summary: "Disconnect an app",
+			description: "Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.",
+			params: ClientIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403)
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/access/api-keys",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listApiKeys",
+			tags,
+			summary: "Your API keys for this organization",
+			description: "Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.",
+			response: {
+				200: ApiKeyList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return container.auth.listApiKeys(req.headers, scope.authOrgId);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/access/api-keys",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "createApiKey",
+			tags,
+			summary: "Create an API key",
+			description: "Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.",
+			body: CreateApiKey,
+			response: {
+				201: CreatedApiKey,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			assertRoleHoldsScopes(scope.role, req.body.scopes);
+			const created = await container.auth.createApiKey({
+				authUserId: req.authUser.id,
+				orgId: scope.authOrgId,
+				name: req.body.name,
+				scopes: req.body.scopes
+			});
+			return reply.code(201).send(created);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/access/api-keys/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteApiKey",
+			tags,
+			summary: "Delete an API key",
+			description: "Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.",
+			params: ApiKeyIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);
+			return reply.code(204).send();
+		}
+	});
+}
+//#endregion
+export { accessRoutes };
+
+//# sourceMappingURL=access.js.map

package/dist/http/routes/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/routes/access.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport { assertRoleHoldsScopes, scopeOptions } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport {\n  ApiKeyIdParam,\n  ApiKeyList,\n  ClientIdParam,\n  ConnectedAppList,\n  CreateApiKey,\n  CreatedApiKey,\n  refusals,\n  ScopeOptionList,\n} from '../schemas/index.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function accessRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Access'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/scopes',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listAccessScopes',\n      tags,\n      summary: 'Every access scope and whether your role can grant it',\n      description:\n        'Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.',\n      response: { 200: ScopeOptionList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return scopeOptions(scope.role);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/apps',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnectedApps',\n      tags,\n      summary: 'Apps connected to this organization as you',\n      description:\n        'Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.',\n      response: { 200: ConnectedAppList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listConnectedApps(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/apps/:clientId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeConnectedApp',\n      tags,\n      summary: 'Disconnect an app',\n      description:\n        'Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.',\n      params: ClientIdParam,\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeys',\n      tags,\n      summary: 'Your API keys for this organization',\n      description:\n        'Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.',\n      response: { 200: ApiKeyList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listApiKeys(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createApiKey',\n      tags,\n      summary: 'Create an API key',\n      description:\n        'Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.',\n      body: CreateApiKey,\n      response: { 201: CreatedApiKey, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      assertRoleHoldsScopes(scope.role, req.body.scopes);\n      const created = await container.auth.createApiKey({\n        authUserId: req.authUser.id,\n        orgId: scope.authOrgId,\n        name: req.body.name,\n        scopes: req.body.scopes,\n      });\n      return reply.code(201).send(created);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/api-keys/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteApiKey',\n      tags,\n      summary: 'Delete an API key',\n      description:\n        'Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.',\n      params: ApiKeyIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAiBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,QAAQ;CAEtB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GAEtB,OAAO,cAAa,MADA,aAAa,WAAW,GAAG,EAAA,CACrB,IAAI;EAChC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,kBAAkB,IAAI,SAAS,MAAM,SAAS;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,mBAAmB,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,QAAQ;GACzF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,YAAY,IAAI,SAAS,MAAM,SAAS;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,sBAAsB,MAAM,MAAM,IAAI,KAAK,MAAM;GACjD,MAAM,UAAU,MAAM,UAAU,KAAK,aAAa;IAChD,YAAY,IAAI,SAAS;IACzB,OAAO,MAAM;IACb,MAAM,IAAI,KAAK;IACf,QAAQ,IAAI,KAAK;GACnB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,aAAa,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,EAAE;GAC7E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/activities.js

@@ -1,11 +1,12 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ActivityPathParam, CourseIdPathParam, CreateModule, ModuleList, ModulePathParam, ReorderInput, SaveActivity, UpdateModule } from "../schemas/activities.js";
+import { ActivityAssetList, ActivityList, ActivityPathParam, CourseIdPathParam, CreateModule, ModuleList, ModulePathParam, ReorderInput, SaveActivity, UpdateModule } from "../schemas/activities.js";
 import "../schemas/index.js";
 //#region src/http/routes/activities.ts
 async function activitiesRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const content = container.content;
-	const tags = ["Courses"];
+	const tags = ["Content"];
 	r.route({
 		method: "GET",
 		url: "/api/courses/:courseId/modules",
@@ -13,15 +14,59 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listModules",
 			tags,
-			summary: "List a course's modules",
+			summary: "List a course's modules (staff)",
+			description: "Staff only (owner, admin, instructor). Modules in order, each with its activities.",
 			params: CourseIdPathParam,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
 			return content.listCourseModules(scope.orgId, req.params.courseId);
 		}
 	});
+	r.route({
+		method: "GET",
+		url: "/api/courses/:courseId/activities",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listActivities",
+			tags,
+			summary: "List a course's activities (staff)",
+			description: "Staff only (owner, admin, instructor). Every activity, published or not.",
+			params: CourseIdPathParam,
+			response: {
+				200: ActivityList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return content.listCourseActivityViews(scope.orgId, req.params.courseId);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/courses/:courseId/activity-assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listActivityAssets",
+			tags,
+			summary: "List the library files each activity of a course uses (staff)",
+			description: "Staff only (owner, admin, instructor). One row per activity and file, as recorded when the activity was saved.",
+			params: CourseIdPathParam,
+			response: {
+				200: ActivityAssetList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return content.listCourseActivityAssets(scope.orgId, req.params.courseId);
+		}
+	});
 	r.route({
 		method: "POST",
 		url: "/api/courses/:courseId/modules",
@@ -29,10 +74,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createModule",
 			tags,
-			summary: "Add a module",
+			summary: "Add a module (staff)",
+			description: "Staff only (owner, admin, instructor). Added last. Returns the course's modules.",
 			params: CourseIdPathParam,
 			body: CreateModule,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -46,10 +95,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderModules",
 			tags,
-			summary: "Reorder modules",
+			summary: "Reorder a course's modules (staff)",
+			description: "Staff only (owner, admin, instructor). Ids that are not modules of the course are ignored. Returns the course's modules.",
 			params: CourseIdPathParam,
 			body: ReorderInput,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -63,10 +116,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateModule",
 			tags,
-			summary: "Rename a module",
+			summary: "Rename a module (staff)",
+			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
 			params: ModulePathParam,
 			body: UpdateModule,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -80,9 +137,13 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteModule",
 			tags,
-			summary: "Delete a module",
+			summary: "Delete a module (staff)",
+			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
 			params: ModulePathParam,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -96,10 +157,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderActivities",
 			tags,
-			summary: "Reorder activities in a module",
+			summary: "Reorder the activities in a module (staff)",
+			description: "Staff only (owner, admin, instructor). Send every activity id of the module once (409 otherwise). Returns the course's modules.",
 			params: ModulePathParam,
 			body: ReorderInput,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404, 409)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -113,10 +178,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createActivity",
 			tags,
-			summary: "Add an activity",
+			summary: "Add an activity (staff)",
+			description: "Staff only (owner, admin, instructor). Records the library files the activity uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
 			params: ModulePathParam,
 			body: SaveActivity,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404, 409)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -130,10 +199,14 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateActivity",
 			tags,
-			summary: "Update an activity",
+			summary: "Update an activity (staff)",
+			description: "Staff only (owner, admin, instructor). Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
 			params: ActivityPathParam,
 			body: SaveActivity,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404, 409)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -147,9 +220,13 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteActivity",
 			tags,
-			summary: "Delete an activity",
+			summary: "Delete an activity (staff)",
+			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
 			params: ActivityPathParam,
-			response: { 200: ModuleList }
+			response: {
+				200: ModuleList,
+				...refusals(403, 404)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);

package/dist/http/routes/activities.js.map

@@ -1 +1 @@
-{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/routes/activities.ts"],"sourcesContent":["// HTTP routes for course modules + activities. Write operations return the\n// course's full, reordered module list (how the editor re-renders). Nested under\n// courses. All require a session with an active organization; handlers resolve\n// the session's active org to the domain org id and scope every call by it.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityPathParam,\n  CourseIdPathParam,\n  CreateModule,\n  ModuleList,\n  ModulePathParam,\n  ReorderInput,\n  SaveActivity,\n  UpdateModule,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function activitiesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  // Modules/activities are part of the content aggregate; grouped under the Courses tag.\n  const content = container.content;\n  const tags = ['Courses'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listModules',\n      tags,\n      summary: \"List a course's modules\",\n      params: CourseIdPathParam,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseModules(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createModule',\n      tags,\n      summary: 'Add a module',\n      params: CourseIdPathParam,\n      body: CreateModule,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.createModule(scope.orgId, req.params.courseId, req.body.title);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderModules',\n      tags,\n      summary: 'Reorder modules',\n      params: CourseIdPathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderModules(scope.orgId, req.params.courseId, req.body.orderedIds);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateModule',\n      tags,\n      summary: 'Rename a module',\n      params: ModulePathParam,\n      body: UpdateModule,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.updateModule(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.title,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteModule',\n      tags,\n      summary: 'Delete a module',\n      params: ModulePathParam,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteModule(scope.orgId, req.params.courseId, req.params.moduleId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderActivities',\n      tags,\n      summary: 'Reorder activities in a module',\n      params: ModulePathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderActivities(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.orderedIds,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createActivity',\n      tags,\n      summary: 'Add an activity',\n      params: ModulePathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateActivity',\n      tags,\n      summary: 'Update an activity',\n      params: ActivityPathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body,\n        req.params.activityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteActivity',\n      tags,\n      summary: 'Delete an activity',\n      params: ActivityPathParam,\n      response: { 200: ModuleList },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.params.activityId,\n      );\n    },\n  });\n}\n"],"mappings":";;;;AAmBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAEhD,MAAM,UAAU,UAAU;CAC1B,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBAAkB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,UAAU;EACrF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,KACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,QAAQ;EACnF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,UACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,IAAI,IAAI;EAC7F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,MACJ,IAAI,OAAO,UACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU,EAAE,KAAK,WAAW;EAC9B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,OAAO,UACb;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/routes/activities.ts"],"sourcesContent":["// HTTP routes for course modules + activities. Write operations return the\n// course's full, reordered module list (how the editor re-renders). Nested under\n// courses. All require a session with an active organization; handlers resolve\n// the session's active org to the domain org id and scope every call by it.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityAssetList,\n  ActivityList,\n  ActivityPathParam,\n  CourseIdPathParam,\n  CreateModule,\n  ModuleList,\n  ModulePathParam,\n  ReorderInput,\n  SaveActivity,\n  UpdateModule,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function activitiesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  // Modules/activities are part of the content aggregate; grouped under the Courses tag.\n  const content = container.content;\n  const tags = ['Content'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listModules',\n      tags,\n      summary: \"List a course's modules (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Modules in order, each with its activities.',\n      params: CourseIdPathParam,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseModules(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivities',\n      tags,\n      summary: \"List a course's activities (staff)\",\n      description: 'Staff only (owner, admin, instructor). Every activity, published or not.',\n      params: CourseIdPathParam,\n      response: { 200: ActivityList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseActivityViews(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activity-assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivityAssets',\n      tags,\n      summary: 'List the library files each activity of a course uses (staff)',\n      description:\n        'Staff only (owner, admin, instructor). One row per activity and file, as recorded when the activity was saved.',\n      params: CourseIdPathParam,\n      response: { 200: ActivityAssetList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseActivityAssets(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createModule',\n      tags,\n      summary: 'Add a module (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Added last. Returns the course's modules.\",\n      params: CourseIdPathParam,\n      body: CreateModule,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.createModule(scope.orgId, req.params.courseId, req.body.title);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderModules',\n      tags,\n      summary: \"Reorder a course's modules (staff)\",\n      description:\n        \"Staff only (owner, admin, instructor). Ids that are not modules of the course are ignored. Returns the course's modules.\",\n      params: CourseIdPathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderModules(scope.orgId, req.params.courseId, req.body.orderedIds);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateModule',\n      tags,\n      summary: 'Rename a module (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: UpdateModule,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.updateModule(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.title,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteModule',\n      tags,\n      summary: 'Delete a module (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ModulePathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteModule(scope.orgId, req.params.courseId, req.params.moduleId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderActivities',\n      tags,\n      summary: 'Reorder the activities in a module (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Send every activity id of the module once (409 otherwise). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderActivities(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.orderedIds,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createActivity',\n      tags,\n      summary: 'Add an activity (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Records the library files the activity uses; each must be a ready library file (409 otherwise). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateActivity',\n      tags,\n      summary: 'Update an activity (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). Returns the course's modules.\",\n      params: ActivityPathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body,\n        req.params.activityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteActivity',\n      tags,\n      summary: 'Delete an activity (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ActivityPathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.params.activityId,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;AAsBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAEhD,MAAM,UAAU,UAAU;CAC1B,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBAAkB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,wBAAwB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACzE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,yBAAyB,MAAM,OAAO,IAAI,OAAO,QAAQ;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,UAAU;EACrF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,KACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,QAAQ;EACnF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,UACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,IAAI,IAAI;EAC7F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,MACJ,IAAI,OAAO,UACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,OAAO,UACb;EACF;CACF,CAAC;AACH"}