@headless-lms/server 0.1.0

package/dist/http/routes/learn/downloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"downloads.js","names":[],"sources":["../../../../src/http/routes/learn/downloads.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  DownloadAssetParams,\n  DownloadIdParam,\n  ErrorBody,\n  LearnDownload,\n  LearnDownloads,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { UnauthorizedError } from '../../plugins/auth.js';\n\nexport async function learnDownloadsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const learn = container.reporting.learn;\n\n  r.route({\n    method: 'GET',\n    url: '/api/learn/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listLearnDownloads',\n      tags: ['Learn'],\n      summary: 'Downloads the student is actively entitled to',\n      response: { 200: LearnDownloads },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      return learn.listDownloads(req.orgId, orgUser.id);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/learn/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getLearnDownload',\n      tags: ['Learn'],\n      summary: 'One entitled download and its ordered assets',\n      params: DownloadIdParam,\n      response: { 200: LearnDownload, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      const result = await learn.getDownload(req.orgId, orgUser.id, req.params.downloadId);\n      if (!result) {\n        throw new NotFoundError('Download', req.params.downloadId);\n      }\n      return result;\n    },\n  });\n\n  // One stable, resolvable URL per asset. Drops into an <a href download> in\n  // any frontend — no JS, no SDK, no CORS preflight. The signed target is\n  // minted per request and short-lived.\n  r.route({\n    method: 'GET',\n    url: '/api/learn/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getLearnDownloadAsset',\n      tags: ['Learn'],\n      summary: 'Redirect to a short-lived signed URL for an entitled asset',\n      params: DownloadAssetParams,\n      response: { 302: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      const signed = await learn.downloadAssetUrl(\n        req.orgId,\n        orgUser.id,\n        req.params.downloadId,\n        req.params.assetId,\n      );\n      if (!signed) {\n        // Always 404, never 403 — a 403 confirms the resource exists to\n        // someone not entitled to it.\n        throw new NotFoundError('Download asset', req.params.assetId);\n      }\n      return reply\n        .header('cache-control', 'no-store')\n        .header('referrer-policy', 'no-referrer')\n        .redirect(signed.url, 302);\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,qBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,QAAQ,UAAU,UAAU;CAElC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,UAAU,EAAE,KAAK,eAAe;EAClC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAE9B,OAAO,MAAM,cAAc,IAAI,OAAO,QAAQ,EAAE;EAClD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,KAAK;GAAU;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,SAAS,MAAM,MAAM,YAAY,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,UAAU;GACnF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,YAAY,IAAI,OAAO,UAAU;GAE3D,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,SAAS,MAAM,MAAM,iBACzB,IAAI,OACJ,QAAQ,IACR,IAAI,OAAO,YACX,IAAI,OAAO,OACb;GACA,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,kBAAkB,IAAI,OAAO,OAAO;GAE9D,OAAO,MACJ,OAAO,iBAAiB,UAAU,CAAC,CACnC,OAAO,mBAAmB,aAAa,CAAC,CACxC,SAAS,OAAO,KAAK,GAAG;EAC7B;CACF,CAAC;AACH"}

package/dist/http/routes/learn/index.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/learn/index.d.ts
+declare function learnRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { learnRoutes };
+//# sourceMappingURL=index.d.ts.map

package/dist/http/routes/learn/index.js

@@ -0,0 +1,19 @@
+import { learnAssetsRoutes } from "./assets.js";
+import { learnCommentsRoutes } from "./comments.js";
+import { learnCoursesRoutes } from "./courses.js";
+import { learnDownloadsRoutes } from "./downloads.js";
+import { learnOrgRoutes } from "./org.js";
+import { learnProgressRoutes } from "./progress.js";
+//#region src/http/routes/learn/index.ts
+async function learnRoutes(app, container) {
+	await learnOrgRoutes(app, container);
+	await learnCoursesRoutes(app, container);
+	await learnProgressRoutes(app, container);
+	await learnCommentsRoutes(app, container);
+	await learnAssetsRoutes(app, container);
+	await learnDownloadsRoutes(app, container);
+}
+//#endregion
+export { learnRoutes };
+
+//# sourceMappingURL=index.js.map

package/dist/http/routes/learn/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/http/routes/learn/index.ts"],"sourcesContent":["// HTTP routes for the student-facing Learn surface. Session-guarded like every\n// back-office route, but scoped by the session's `org_users` row —\n// the reads gate on the person's enrollments, not on staff role. One file per\n// resource; everything under `/api/learn` lives in this directory and nowhere\n// else.\nimport type { FastifyInstance } from 'fastify';\nimport type { Container } from '../../../app/container.js';\nimport { learnAssetsRoutes } from './assets.js';\nimport { learnCommentsRoutes } from './comments.js';\nimport { learnCoursesRoutes } from './courses.js';\nimport { learnDownloadsRoutes } from './downloads.js';\nimport { learnOrgRoutes } from './org.js';\nimport { learnProgressRoutes } from './progress.js';\n\nexport async function learnRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  await learnOrgRoutes(app, container);\n  await learnCoursesRoutes(app, container);\n  await learnProgressRoutes(app, container);\n  await learnCommentsRoutes(app, container);\n  await learnAssetsRoutes(app, container);\n  await learnDownloadsRoutes(app, container);\n}\n"],"mappings":";;;;;;;AAcA,eAAsB,YAAY,KAAsB,WAAqC;CAC3F,MAAM,eAAe,KAAK,SAAS;CACnC,MAAM,mBAAmB,KAAK,SAAS;CACvC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,kBAAkB,KAAK,SAAS;CACtC,MAAM,qBAAqB,KAAK,SAAS;AAC3C"}

package/dist/http/routes/learn/org.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/learn/org.d.ts
+declare function learnOrgRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { learnOrgRoutes };
+//# sourceMappingURL=org.d.ts.map

package/dist/http/routes/learn/org.js

@@ -0,0 +1,50 @@
+import { UnauthorizedError } from "../../plugins/auth.js";
+import { LearnOrg, LearnViewer } from "../../schemas/learn.js";
+import "../../schemas/index.js";
+//#region src/http/routes/learn/org.ts
+async function learnOrgRoutes(app, container) {
+	const r = app.withTypeProvider();
+	r.route({
+		method: "GET",
+		url: "/api/learn/org",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getLearnOrg",
+			tags: ["Learn"],
+			summary: "Get the portal org's public identity (branding)",
+			response: { 200: LearnOrg }
+		},
+		handler: async (req) => {
+			const org = await container.organizations.getById(req.orgId);
+			if (!org) throw new UnauthorizedError("session organization not found");
+			return {
+				id: org.id,
+				name: org.name,
+				slug: org.slug
+			};
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/learn/viewer",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getLearnViewer",
+			tags: ["Learn"],
+			summary: "Get the caller's identity within the session's org",
+			response: { 200: LearnViewer }
+		},
+		handler: async (req) => {
+			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
+			if (!orgUser) throw new UnauthorizedError();
+			return {
+				orgUserId: orgUser.id,
+				role: orgUser.role
+			};
+		}
+	});
+}
+//#endregion
+export { learnOrgRoutes };
+
+//# sourceMappingURL=org.js.map

package/dist/http/routes/learn/org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.js","names":[],"sources":["../../../../src/http/routes/learn/org.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { LearnOrg, LearnViewer } from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { UnauthorizedError } from '../../plugins/auth.js';\n\nexport async function learnOrgRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/learn/org',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getLearnOrg',\n      tags: ['Learn'],\n      summary: \"Get the portal org's public identity (branding)\",\n      response: { 200: LearnOrg },\n    },\n    handler: async (req) => {\n      // The session's org (from `activeOrganizationId`) — surface its display\n      // identity for the portal brand.\n      const org = await container.organizations.getById(req.orgId);\n      if (!org) {\n        throw new UnauthorizedError('session organization not found');\n      }\n      return { id: org.id, name: org.name, slug: org.slug };\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/learn/viewer',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getLearnViewer',\n      tags: ['Learn'],\n      summary: \"Get the caller's identity within the session's org\",\n      response: { 200: LearnViewer },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      return { orgUserId: orgUser.id, role: orgUser.role };\n    },\n  });\n}\n"],"mappings":";;;;AAMA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,UAAU,EAAE,KAAK,SAAS;EAC5B;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,IAAI,KAAK;GAC3D,IAAI,CAAC,KACH,MAAM,IAAI,kBAAkB,gCAAgC;GAE9D,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;GAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAE9B,OAAO;IAAE,WAAW,QAAQ;IAAI,MAAM,QAAQ;GAAK;EACrD;CACF,CAAC;AACH"}

package/dist/http/routes/learn/progress.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/learn/progress.d.ts
+declare function learnProgressRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { learnProgressRoutes };
+//# sourceMappingURL=progress.d.ts.map

package/dist/http/routes/learn/progress.js

@@ -0,0 +1,63 @@
+import { UnauthorizedError } from "../../plugins/auth.js";
+import { ErrorBody } from "../../schemas/shared.js";
+import { CourseProgress, LearnCourseIdParam, ProgressStatus, ReportProgress } from "../../schemas/learn.js";
+import "../../schemas/index.js";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/http/routes/learn/progress.ts
+async function learnProgressRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const learn = container.reporting.learn;
+	r.route({
+		method: "POST",
+		url: "/api/learn/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reportProgress",
+			tags: ["Learn"],
+			summary: "Report usage on a target; the progress service decides completion",
+			body: ReportProgress,
+			response: {
+				200: ProgressStatus,
+				404: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
+			if (!orgUser) throw new UnauthorizedError();
+			const activity = await container.content.getActivity(req.orgId, req.body.activity);
+			if (!activity) throw new NotFoundError("Activity", req.body.activity);
+			if (!await learn.getCourse(req.orgId, orgUser.id, activity.courseId)) throw new NotFoundError("Activity", req.body.activity);
+			return { status: (await container.progress.report(req.orgId, {
+				orgUserId: orgUser.id,
+				activityId: req.body.activity,
+				reports: req.body.reports
+			})).completedAt ? "completed" : "in-progress" };
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/learn/courses/:courseId/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getLearnCourseProgress",
+			tags: ["Learn"],
+			summary: "The student's progress in one course",
+			params: LearnCourseIdParam,
+			response: {
+				200: CourseProgress,
+				404: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
+			if (!orgUser) throw new UnauthorizedError();
+			const view = await learn.courseProgress(req.orgId, orgUser.id, req.params.courseId);
+			if (!view) throw new NotFoundError("Course", req.params.courseId);
+			return view;
+		}
+	});
+}
+//#endregion
+export { learnProgressRoutes };
+
+//# sourceMappingURL=progress.js.map

package/dist/http/routes/learn/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","names":[],"sources":["../../../../src/http/routes/learn/progress.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  CourseProgress,\n  ErrorBody,\n  LearnCourseIdParam,\n  ProgressStatus,\n  ReportProgress,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { UnauthorizedError } from '../../plugins/auth.js';\n\nexport async function learnProgressRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const learn = container.reporting.learn;\n\n  r.route({\n    method: 'POST',\n    url: '/api/learn/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reportProgress',\n      tags: ['Learn'],\n      summary: 'Report usage on a target; the progress service decides completion',\n      body: ReportProgress,\n      response: { 200: ProgressStatus, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      // The activity carries its course, then the same enrollment gate as every\n      // Learn read.\n      const activity = await container.content.getActivity(req.orgId, req.body.activity);\n      if (!activity) {\n        throw new NotFoundError('Activity', req.body.activity);\n      }\n      const course = await learn.getCourse(req.orgId, orgUser.id, activity.courseId);\n      if (!course) {\n        throw new NotFoundError('Activity', req.body.activity);\n      }\n      const record = await container.progress.report(req.orgId, {\n        orgUserId: orgUser.id,\n        activityId: req.body.activity,\n        reports: req.body.reports,\n      });\n      return { status: record.completedAt ? ('completed' as const) : ('in-progress' as const) };\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/learn/courses/:courseId/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getLearnCourseProgress',\n      tags: ['Learn'],\n      summary: \"The student's progress in one course\",\n      params: LearnCourseIdParam,\n      response: { 200: CourseProgress, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new UnauthorizedError();\n      }\n      const view = await learn.courseProgress(req.orgId, orgUser.id, req.params.courseId);\n      if (!view) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return view;\n    },\n  });\n}\n"],"mappings":";;;;;;AAaA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,QAAQ,UAAU,UAAU;CAElC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,KAAK;GAAU;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAI9B,MAAM,WAAW,MAAM,UAAU,QAAQ,YAAY,IAAI,OAAO,IAAI,KAAK,QAAQ;GACjF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,YAAY,IAAI,KAAK,QAAQ;GAGvD,IAAI,CAAC,MADgB,MAAM,UAAU,IAAI,OAAO,QAAQ,IAAI,SAAS,QAAQ,GAE3E,MAAM,IAAI,cAAc,YAAY,IAAI,KAAK,QAAQ;GAOvD,OAAO,EAAE,SAAQ,MALI,UAAU,SAAS,OAAO,IAAI,OAAO;IACxD,WAAW,QAAQ;IACnB,YAAY,IAAI,KAAK;IACrB,SAAS,IAAI,KAAK;GACpB,CAAC,EAAA,CACuB,cAAe,cAAyB,cAAwB;EAC1F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,OAAO;GACd,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,KAAK;GAAU;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,OAAO,MAAM,MAAM,eAAe,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GAClF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes/organizations.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/organizations.d.ts
+declare function organizationsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { organizationsRoutes };
+//# sourceMappingURL=organizations.d.ts.map

package/dist/http/routes/organizations.js

@@ -0,0 +1,219 @@
+import { resolveScope } from "../scope.js";
+import { ErrorBody } from "../schemas/shared.js";
+import { CreateOrganization, Organization, UpdateOrganization } from "../schemas/organizations.js";
+import { Member, MemberIdParam, MembersPage, MembersQuery, UpdateMemberRole } from "../schemas/members.js";
+import { AcceptInvite, AcceptInviteResult, CreateInvite, GetInviteResult, Invite, InviteTokenParam } from "../schemas/invites.js";
+import "../schemas/index.js";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+import { z } from "zod";
+//#region src/http/routes/organizations.ts
+async function organizationsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const organizations = container.organizations;
+	const tags = ["Organizations"];
+	r.route({
+		method: "POST",
+		url: "/api/organizations",
+		preHandler: app.requireSession,
+		schema: {
+			operationId: "createOrganization",
+			tags,
+			summary: "Create an organization and make it active",
+			body: CreateOrganization,
+			response: { 201: Organization }
+		},
+		handler: async (req, reply) => {
+			const org = await container.orgProvider.createOrganization(req.headers, req.body);
+			return reply.code(201).send({
+				name: org.name,
+				slug: org.slug,
+				id: org.id,
+				createdAt: org.createdAt.toISOString()
+			});
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/organizations",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateOrganization",
+			tags,
+			summary: "Update the active organization",
+			body: UpdateOrganization,
+			response: {
+				200: Organization,
+				409: ErrorBody
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			const org = await container.orgProvider.updateOrganization(req.headers, scope.authOrgId, req.body);
+			return reply.send({
+				id: org.id,
+				name: org.name,
+				slug: org.slug,
+				createdAt: org.createdAt.toISOString()
+			});
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/organizations/members",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMembers",
+			tags,
+			summary: "List organization members",
+			querystring: MembersQuery,
+			response: { 200: MembersPage }
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return organizations.listMembers(scope.orgId, req.query);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/organizations/members/:id/role",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateMemberRole",
+			tags,
+			summary: "Change a member's role",
+			params: MemberIdParam,
+			body: UpdateMemberRole,
+			response: {
+				200: Member,
+				404: ErrorBody,
+				409: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			const ctx = {
+				orgId: scope.orgId,
+				authOrgId: scope.authOrgId,
+				headers: req.headers
+			};
+			const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);
+			if (!member) throw new NotFoundError("Member", req.params.id);
+			return member;
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/organizations/members/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMember",
+			tags,
+			summary: "Remove an organization member",
+			params: MemberIdParam,
+			response: {
+				204: z.void(),
+				404: ErrorBody,
+				409: ErrorBody
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			const ctx = {
+				orgId: scope.orgId,
+				authOrgId: scope.authOrgId,
+				headers: req.headers
+			};
+			if (!await organizations.removeMember(ctx, req.params.id)) throw new NotFoundError("Member", req.params.id);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/organizations/invites",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "createInvite",
+			tags,
+			summary: "Invite a member or student into the active organization",
+			body: CreateInvite,
+			response: {
+				201: Invite,
+				409: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			const invite = await organizations.createInvite({
+				orgId: scope.orgId,
+				inviterUserId: scope.userId,
+				email: req.body.email,
+				role: req.body.role,
+				...req.body.firstName !== void 0 && { firstName: req.body.firstName },
+				...req.body.lastName !== void 0 && { lastName: req.body.lastName },
+				sendEmail: req.body.sendEmail
+			});
+			req.log.debug({ invite }, "created invite");
+			return invite;
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/organizations/invites/:token",
+		schema: {
+			operationId: "getInvite",
+			tags,
+			summary: "Read an invite by its token",
+			params: InviteTokenParam,
+			response: {
+				200: GetInviteResult,
+				404: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const invite = await organizations.peekInvite(req.params.token);
+			if (!invite) throw new NotFoundError("Invite", "token");
+			const person = await container.identity.getUserByEmail(invite.email);
+			return {
+				email: invite.email,
+				firstName: person?.firstName ?? null,
+				lastName: person?.lastName ?? null
+			};
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/organizations/invites/accept",
+		preHandler: app.requireSession,
+		schema: {
+			operationId: "acceptInvite",
+			tags,
+			summary: "Accept an invite with the logged-in account",
+			body: AcceptInvite,
+			response: {
+				200: AcceptInviteResult,
+				400: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const user = await container.identity.getUserByExternalId(req.authUser.id);
+			if (!user) throw new NotFoundError("User", req.authUser.id);
+			const accepted = await container.organizations.acceptInvite({
+				token: req.body.token,
+				userId: user.id,
+				email: req.authUser.email
+			});
+			const org = await container.organizations.getById(accepted.orgId);
+			if (!org) throw new NotFoundError("Organization", accepted.orgId);
+			const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);
+			req.log.info({
+				accepted,
+				stamped
+			}, "accepted invite");
+			return {};
+		}
+	});
+}
+//#endregion
+export { organizationsRoutes };
+
+//# sourceMappingURL=organizations.js.map

package/dist/http/routes/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","names":[],"sources":["../../../src/http/routes/organizations.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AcceptInvite,\n  AcceptInviteResult,\n  CreateInvite,\n  CreateOrganization,\n  ErrorBody,\n  Invite,\n  Member,\n  MemberIdParam,\n  MembersPage,\n  MembersQuery,\n  GetInviteResult,\n  InviteTokenParam,\n  Organization,\n  UpdateMemberRole,\n  UpdateOrganization,\n} from '../schemas/index.js';\nimport type { MemberWriteContext } from '@headless-lms/core/organizations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function organizationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const organizations = container.organizations;\n  const tags = ['Organizations'];\n\n  // Create a new organization on the caller's behalf and make it their active\n  // org. This is the API's own front door for org creation — it drives Better\n  // Auth internally, so callers use the typed SDK, not the auth namespace. No\n  // resolveScope here: the caller has no active org yet, only a session.\n  r.route({\n    method: 'POST',\n    url: '/api/organizations',\n    // Session only: a first-time signup has no active org yet, so requiring one\n    // here would 401 the very call that produces it.\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'createOrganization',\n      tags,\n      summary: 'Create an organization and make it active',\n      body: CreateOrganization,\n      response: { 201: Organization },\n    },\n    handler: async (req, reply) => {\n      const org = await container.orgProvider.createOrganization(req.headers, req.body);\n      return reply.code(201).send({\n        name: org.name,\n        slug: org.slug,\n        id: org.id,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  // Update the caller's active organization (name/slug). Writes go through Better\n  // Auth, which enforces the caller's org-update permission (owner/admin).\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateOrganization',\n      tags,\n      summary: 'Update the active organization',\n      body: UpdateOrganization,\n      response: { 200: Organization, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const org = await container.orgProvider.updateOrganization(req.headers, scope.authOrgId, req.body);\n      return reply.send({\n        id: org.id,\n        name: org.name,\n        slug: org.slug,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMembers',\n      tags,\n      summary: 'List organization members',\n      querystring: MembersQuery,\n      response: { 200: MembersPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return organizations.listMembers(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations/members/:id/role',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberRole',\n      tags,\n      summary: \"Change a member's role\",\n      params: MemberIdParam,\n      body: UpdateMemberRole,\n      response: { 200: Member, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);\n      if (!member) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return member;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/organizations/members/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMember',\n      tags,\n      summary: 'Remove an organization member',\n      params: MemberIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const removed = await organizations.removeMember(ctx, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createInvite',\n      tags,\n      summary: 'Invite a member or student into the active organization',\n      body: CreateInvite,\n      response: { 201: Invite, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      // Domain ids, not the session's auth ids: invites FK to organizations.id\n      // and users.id.\n      const scope = await resolveScope(container, req);\n      const invite = await organizations.createInvite({\n        orgId: scope.orgId,\n        inviterUserId: scope.userId,\n        email: req.body.email,\n        role: req.body.role,\n        ...(req.body.firstName !== undefined && { firstName: req.body.firstName }),\n        ...(req.body.lastName !== undefined && { lastName: req.body.lastName }),\n        sendEmail: req.body.sendEmail,\n      });\n\n      req.log.debug({ invite }, 'created invite');\n      return invite;\n    },\n  });\n\n  // The invite landing page's first call, made before the invitee has any\n  // session — so no guard. It turns the emailed token into the two facts the\n  // page needs: who the invitation is for, and whether that address already has\n  // an account. The email comes from the invitation row rather than the URL, so\n  // it cannot be steered by editing the link.\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/invites/:token',\n    schema: {\n      operationId: 'getInvite',\n      tags,\n      summary: 'Read an invite by its token',\n      params: InviteTokenParam,\n      response: { 200: GetInviteResult, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const invite = await organizations.peekInvite(req.params.token);\n      if (!invite) {\n        // Same answer for forged, expired, and already-accepted tokens: a\n        // probe learns nothing about which invitations exist.\n        throw new NotFoundError('Invite', 'token');\n      }\n      // Whether the address already has a login is deliberately not answered\n      // here. The mirror cannot say — an admin's student is a person long\n      // before they are an account — and asking the auth engine would mean\n      // reading its tables for one boolean. The sign-up form discovers it\n      // instead: a duplicate signup comes back 422 and the page flips to\n      // sign-in.\n      const person = await container.identity.getUserByEmail(invite.email);\n      return {\n        email: invite.email,\n        firstName: person?.firstName ?? null,\n        lastName: person?.lastName ?? null,\n      };\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites/accept',\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'acceptInvite',\n      tags,\n      summary: 'Accept an invite with the logged-in account',\n      body: AcceptInvite,\n      response: { 200: AcceptInviteResult, 400: ErrorBody },\n    },\n    handler: async (req) => {\n      // No active org yet, so no resolveScope — but acceptInvite links a domain\n      // users.id, never the auth account id.\n      const user = await container.identity.getUserByExternalId(req.authUser.id);\n      if (!user) {\n        throw new NotFoundError('User', req.authUser.id);\n      }\n      const accepted = await container.organizations.acceptInvite({\n        token: req.body.token,\n        userId: user.id,\n        email: req.authUser.email,\n      });\n\n      // The session predates this grant, so it carries no active org and every\n      // org-scoped read would 401. Students are never org members, so the org\n      // plugin's set-active cannot do it — stamp the session row directly.\n      const org = await container.organizations.getById(accepted.orgId);\n      if (!org) {\n        throw new NotFoundError('Organization', accepted.orgId);\n      }\n      const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);\n\n      req.log.info({ accepted, stamped }, 'accepted invite');\n      return {};\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AAyBA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,gBAAgB,UAAU;CAChC,MAAM,OAAO,CAAC,eAAe;CAM7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EAGL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,IAAI,IAAI;GAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,KAAK;GAAU;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,MAAM,WAAW,IAAI,IAAI;GACjG,OAAO,MAAM,KAAK;IAChB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,cAAc,YAAY,MAAM,OAAO,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;IAAW,KAAK;GAAU;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GACA,MAAM,SAAS,MAAM,cAAc,iBAAiB,KAAK,IAAI,OAAO,IAAI,IAAI,KAAK,IAAI;GACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GAEA,IAAI,CAAC,MADiB,cAAc,aAAa,KAAK,IAAI,OAAO,EAAE,GAEjE,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;GAAU;EAC1C;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,cAAc,aAAa;IAC9C,OAAO,MAAM;IACb,eAAe,MAAM;IACrB,OAAO,IAAI,KAAK;IAChB,MAAM,IAAI,KAAK;IACf,GAAI,IAAI,KAAK,cAAc,KAAA,KAAa,EAAE,WAAW,IAAI,KAAK,UAAU;IACxE,GAAI,IAAI,KAAK,aAAa,KAAA,KAAa,EAAE,UAAU,IAAI,KAAK,SAAS;IACrE,WAAW,IAAI,KAAK;GACtB,CAAC;GAED,IAAI,IAAI,MAAM,EAAE,OAAO,GAAG,gBAAgB;GAC1C,OAAO;EACT;CACF,CAAC;CAOD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,KAAK;GAAU;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,SAAS,MAAM,cAAc,WAAW,IAAI,OAAO,KAAK;GAC9D,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,UAAU,OAAO;GAQ3C,MAAM,SAAS,MAAM,UAAU,SAAS,eAAe,OAAO,KAAK;GACnE,OAAO;IACL,OAAO,OAAO;IACd,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY;GAChC;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAoB,KAAK;GAAU;EACtD;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,IAAI,SAAS,EAAE;GACzE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;GAEjD,MAAM,WAAW,MAAM,UAAU,cAAc,aAAa;IAC1D,OAAO,IAAI,KAAK;IAChB,QAAQ,KAAK;IACb,OAAO,IAAI,SAAS;GACtB,CAAC;GAKD,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK;GAChE,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,SAAS,KAAK;GAExD,MAAM,UAAU,MAAM,UAAU,SAAS,wBAAwB,IAAI,SAAS,IAAI,EAAE;GAEpF,IAAI,IAAI,KAAK;IAAE;IAAU;GAAQ,GAAG,iBAAiB;GACrD,OAAO,CAAC;EACV;CACF,CAAC;AACH"}

package/dist/http/routes/progress.d.ts

@@ -0,0 +1,6 @@
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/progress.d.ts
+declare function progressRoutes(_app: FastifyInstance): Promise<void>;
+//#endregion
+export { progressRoutes };
+//# sourceMappingURL=progress.d.ts.map

package/dist/http/routes/progress.js

@@ -0,0 +1,6 @@
+//#region src/http/routes/progress.ts
+async function progressRoutes(_app) {}
+//#endregion
+export { progressRoutes };
+
+//# sourceMappingURL=progress.js.map

package/dist/http/routes/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","names":[],"sources":["../../../src/http/routes/progress.ts"],"sourcesContent":["// HTTP routes for the progress context. Stub.\nimport type { FastifyInstance } from 'fastify';\n\nexport async function progressRoutes(_app: FastifyInstance): Promise<void> {\n  // register progress routes here\n}\n"],"mappings":";AAGA,eAAsB,eAAe,MAAsC,CAE3E"}

package/dist/http/routes/students.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/students.d.ts
+declare function studentsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { studentsRoutes };
+//# sourceMappingURL=students.d.ts.map

package/dist/http/routes/students.js

@@ -0,0 +1,125 @@
+import { resolveScope } from "../scope.js";
+import { ErrorBody } from "../schemas/shared.js";
+import { Student, StudentIdParam, StudentsPage, StudentsQuery, UpdateStudentBody } from "../schemas/students.js";
+import "../schemas/index.js";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+import { z } from "zod";
+//#region src/http/routes/students.ts
+async function studentsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const students = container.reporting.students;
+	r.route({
+		method: "GET",
+		url: "/api/students",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listStudents",
+			tags: ["Students"],
+			summary: "List students",
+			querystring: StudentsQuery,
+			response: { 200: StudentsPage }
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			return students.list(scope.orgId, req.query);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/students/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getStudent",
+			tags: ["Students"],
+			summary: "Get a student by id",
+			params: StudentIdParam,
+			response: {
+				200: Student,
+				404: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			const student = await students.get(scope.orgId, req.params.id);
+			if (!student) throw new NotFoundError("Student", req.params.id);
+			return student;
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/students/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateStudent",
+			tags: ["Students"],
+			summary: "Update a student's profile",
+			params: StudentIdParam,
+			body: UpdateStudentBody,
+			response: {
+				200: Student,
+				404: ErrorBody,
+				409: ErrorBody
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveScope(container, req);
+			await container.organizations.updateStudent({
+				orgId: scope.orgId,
+				orgUserId: req.params.id,
+				...req.body
+			});
+			const student = await students.get(scope.orgId, req.params.id);
+			if (!student) throw new NotFoundError("Student", req.params.id);
+			return student;
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/students/:id/invite/resend",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "resendStudentInvite",
+			tags: ["Students"],
+			summary: "Re-send a pending student's invite email",
+			params: StudentIdParam,
+			response: {
+				204: z.void(),
+				404: ErrorBody,
+				409: ErrorBody
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			await container.organizations.resendStudentInvite({
+				orgId: scope.orgId,
+				orgUserId: req.params.id,
+				inviterUserId: scope.userId
+			});
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/students/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteStudent",
+			tags: ["Students"],
+			summary: "Delete a student",
+			params: StudentIdParam,
+			response: {
+				204: z.void(),
+				404: ErrorBody
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveScope(container, req);
+			await container.organizations.deleteOrgUser(scope.orgId, req.params.id);
+			return reply.code(204).send();
+		}
+	});
+}
+//#endregion
+export { studentsRoutes };
+
+//# sourceMappingURL=students.js.map

package/dist/http/routes/students.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/routes/students.ts"],"sourcesContent":["// HTTP routes for students: the reporting-backed list/read endpoints, the\n// delete, and re-issuing a pending invite. There is no create here — adding a\n// student IS inviting one, at /api/organizations/invites, which provisions the\n// student record up front.\nimport type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ErrorBody,\n  Student,\n  StudentIdParam,\n  StudentsPage,\n  StudentsQuery,\n  UpdateStudentBody,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function studentsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const students = container.reporting.students;\n\n  r.route({\n    method: 'GET',\n    url: '/api/students',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listStudents',\n      tags: ['Students'],\n      summary: 'List students',\n      querystring: StudentsQuery,\n      response: { 200: StudentsPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return students.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudent',\n      tags: ['Students'],\n      summary: 'Get a student by id',\n      params: StudentIdParam,\n      response: { 200: Student, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  // Corrects the person behind the student row. The write lands in identity\n  // (the person is global); organizations owns the rule that this org user is\n  // a student here, and reconciles their pending invite when the address moves.\n  r.route({\n    method: 'PATCH',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateStudent',\n      tags: ['Students'],\n      summary: \"Update a student's profile\",\n      params: StudentIdParam,\n      body: UpdateStudentBody,\n      response: { 200: Student, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.updateStudent({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        ...req.body,\n      });\n      // Re-read through the report so the response is the same shape the list\n      // and detail GETs return, aggregates included.\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  // Re-mints the token on the student's pending invite and emails it. Lives\n  // here rather than under invites because the admin app knows the student,\n  // not the invitation.\n  r.route({\n    method: 'POST',\n    url: '/api/students/:id/invite/resend',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resendStudentInvite',\n      tags: ['Students'],\n      summary: \"Re-send a pending student's invite email\",\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.resendStudentInvite({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        inviterUserId: scope.userId,\n      });\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteStudent',\n      tags: ['Students'],\n      summary: 'Delete a student',\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.deleteOrgUser(scope.orgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAmBA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,WAAW,UAAU,UAAU;CAErC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,KAAK;GAAU;EAC3C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,KAAK;IAAW,KAAK;GAAU;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc;IAC1C,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,GAAG,IAAI;GACT,CAAC;GAGD,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,oBAAoB;IAChD,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,eAAe,MAAM;GACvB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE;GACtE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes.d.ts
+declare function registerRoutes(app: FastifyInstance, container: Container): void;
+//#endregion
+export { registerRoutes };
+//# sourceMappingURL=routes.d.ts.map