@headless-lms/server 0.2.0 → 0.3.0

package/dist/http/routes/entitlements.js

@@ -1,5 +1,5 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
 import { Entitlement, EntitlementIdParam, EntitlementsPage, EntitlementsQuery, GrantEntitlement, SetEntitlementStatus } from "../schemas/entitlements.js";
 import "../schemas/index.js";
 import { NotFoundError } from "@headless-lms/core/shared/errors";
@@ -14,9 +14,13 @@ async function entitlementsRoutes(app, container) {
 		schema: {
 			operationId: "listEntitlements",
 			tags: ["Entitlements"],
-			summary: "List entitlements",
+			summary: "List entitlements (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			querystring: EntitlementsQuery,
-			response: { 200: EntitlementsPage }
+			response: {
+				200: EntitlementsPage,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -30,9 +34,13 @@ async function entitlementsRoutes(app, container) {
 		schema: {
 			operationId: "grantEntitlement",
 			tags: ["Entitlements"],
-			summary: "Grant a student access to a piece of content",
+			summary: "Grant a person access to content or a bundle (staff)",
+			description: "Staff only (owner, admin, instructor). Name exactly one of `contentId` and `bundleId`. A bundle grant covers whatever the bundle holds, now and later.",
 			body: GrantEntitlement,
-			response: { 201: Entitlement }
+			response: {
+				201: Entitlement,
+				...refusals(403, 409)
+			}
 		},
 		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
@@ -47,12 +55,13 @@ async function entitlementsRoutes(app, container) {
 		schema: {
 			operationId: "setEntitlementStatus",
 			tags: ["Entitlements"],
-			summary: "Revoke or reinstate an entitlement",
+			summary: "Revoke or reinstate an entitlement (staff)",
+			description: "Staff only (owner, admin, instructor). Access follows the status at once.",
 			params: EntitlementIdParam,
 			body: SetEntitlementStatus,
 			response: {
 				200: Entitlement,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {

package/dist/http/routes/entitlements.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlements.js","names":[],"sources":["../../../src/http/routes/entitlements.ts"],"sourcesContent":["// HTTP routes for the entitlements context (a student's access grant to a piece of content).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Entitlement,\n  EntitlementIdParam,\n  EntitlementsPage,\n  EntitlementsQuery,\n  ErrorBody,\n  GrantEntitlement,\n  SetEntitlementStatus,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function entitlementsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const entitlements = container.entitlements;\n\n  r.route({\n    method: 'GET',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEntitlements',\n      tags: ['Entitlements'],\n      summary: 'List entitlements',\n      querystring: EntitlementsQuery,\n      response: { 200: EntitlementsPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return entitlements.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'grantEntitlement',\n      tags: ['Entitlements'],\n      summary: 'Grant a student access to a piece of content',\n      body: GrantEntitlement,\n      response: { 201: Entitlement },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.grant(scope.orgId, req.body);\n      return reply.code(201).send(entitlement);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/entitlements/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setEntitlementStatus',\n      tags: ['Entitlements'],\n      summary: 'Revoke or reinstate an entitlement',\n      params: EntitlementIdParam,\n      body: SetEntitlementStatus,\n      response: { 200: Entitlement, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.setStatus(scope.orgId, req.params.id, req.body.status);\n      if (!entitlement) {\n        throw new NotFoundError('Entitlement', req.params.id);\n      }\n      return entitlement;\n    },\n  });\n}\n"],"mappings":";;;;;;AAgBA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAE/B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,iBAAiB;EACpC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,KAAK,MAAM,OAAO,IAAI,KAAK;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,MAAM;GACN,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,MAAM,MAAM,OAAO,IAAI,IAAI;GAClE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,WAAW;EACzC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,KAAK;GAAU;EAC/C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,UAAU,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,MAAM;GAC5F,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,eAAe,IAAI,OAAO,EAAE;GAEtD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"entitlements.js","names":[],"sources":["../../../src/http/routes/entitlements.ts"],"sourcesContent":["// HTTP routes for the entitlements context (a student's access grant to a piece of content).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Entitlement,\n  EntitlementIdParam,\n  EntitlementsPage,\n  EntitlementsQuery,\n  GrantEntitlement,\n  SetEntitlementStatus,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function entitlementsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const entitlements = container.entitlements;\n\n  r.route({\n    method: 'GET',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEntitlements',\n      tags: ['Entitlements'],\n      summary: 'List entitlements (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: EntitlementsQuery,\n      response: { 200: EntitlementsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return entitlements.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'grantEntitlement',\n      tags: ['Entitlements'],\n      summary: 'Grant a person access to content or a bundle (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Name exactly one of `contentId` and `bundleId`. A bundle grant covers whatever the bundle holds, now and later.',\n      body: GrantEntitlement,\n      response: { 201: Entitlement, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.grant(scope.orgId, req.body);\n      return reply.code(201).send(entitlement);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/entitlements/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setEntitlementStatus',\n      tags: ['Entitlements'],\n      summary: 'Revoke or reinstate an entitlement (staff)',\n      description: 'Staff only (owner, admin, instructor). Access follows the status at once.',\n      params: EntitlementIdParam,\n      body: SetEntitlementStatus,\n      response: { 200: Entitlement, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.setStatus(scope.orgId, req.params.id, req.body.status);\n      if (!entitlement) {\n        throw new NotFoundError('Entitlement', req.params.id);\n      }\n      return entitlement;\n    },\n  });\n}\n"],"mappings":";;;;;;AAgBA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAE/B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,KAAK,MAAM,OAAO,IAAI,KAAK;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,MAAM,MAAM,OAAO,IAAI,IAAI;GAClE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,WAAW;EACzC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,UAAU,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,MAAM;GAC5F,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,eAAe,IAAI,OAAO,EAAE;GAEtD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes/integrations.js

@@ -1,8 +1,9 @@
-import { ErrorBody } from "../schemas/shared.js";
+import { refusals } from "../schemas/shared.js";
+import { resolveScope } from "../scope.js";
 import { ActionInvocationResult, AvailableIntegrationsList, ConfigureRequest, ConnectRequest, Connection, ConnectionActionParams, ConnectionIdParam, ConnectionsList, InvokeActionRequest, ReconnectRequest } from "../schemas/integrations.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/integrations.ts
 function toApi(connection) {
 	const { credentialRef: _credentialRef, ...rest } = connection;
@@ -23,17 +24,21 @@ async function integrationsRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const integrations = container.integrations;
 	const tags = ["Integrations"];
+	const staff = async (req) => {
+		await resolveScope(container, req);
+	};
 	r.route({
 		method: "GET",
 		url: "/api/integrations/available",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "listAvailableIntegrations",
 			tags,
-			summary: "List the integrations this deployment supports, with their config schemas",
+			summary: "List the integrations this deployment supports (staff)",
+			description: "Staff only (owner, admin, instructor). Each with the JSON Schemas of its config, its secrets and its actions.",
 			response: {
 				200: AvailableIntegrationsList,
-				401: ErrorBody
+				...refusals(403)
 			}
 		},
 		handler: async () => integrations.available()
@@ -41,15 +46,15 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "GET",
 		url: "/api/integrations",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "listConnections",
 			tags,
-			summary: "List the organization's integration connections",
+			summary: "List the organization's integration connections (staff)",
+			description: "Staff only (owner, admin, instructor). Secrets are never returned.",
 			response: {
 				200: ConnectionsList,
-				400: ErrorBody,
-				401: ErrorBody
+				...refusals(403)
 			}
 		},
 		handler: async (req, reply) => {
@@ -61,17 +66,16 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "POST",
 		url: "/api/integrations",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "connectIntegration",
 			tags,
-			summary: "Connect an integration (stores its secrets encrypted)",
+			summary: "Connect an integration (staff)",
+			description: "Staff only (owner, admin, instructor). Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.",
 			body: ConnectRequest,
 			response: {
 				201: Connection,
-				400: ErrorBody,
-				401: ErrorBody,
-				409: ErrorBody
+				...refusals(400, 403, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -84,17 +88,16 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "GET",
 		url: "/api/integrations/:id",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "getConnection",
 			tags,
-			summary: "Get a connection",
+			summary: "Get a connection (staff)",
+			description: "Staff only (owner, admin, instructor). Secrets are never returned.",
 			params: ConnectionIdParam,
 			response: {
 				200: Connection,
-				400: ErrorBody,
-				401: ErrorBody,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req, reply) => {
@@ -108,18 +111,17 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "PATCH",
 		url: "/api/integrations/:id",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "configureConnection",
 			tags,
-			summary: "Change a connection's configuration or active flag",
+			summary: "Change a connection's configuration or active flag (staff)",
+			description: "Staff only (owner, admin, instructor). 400 when the config is invalid for the integration.",
 			params: ConnectionIdParam,
 			body: ConfigureRequest,
 			response: {
 				200: Connection,
-				400: ErrorBody,
-				401: ErrorBody,
-				404: ErrorBody
+				...refusals(400, 403, 404)
 			}
 		},
 		handler: async (req, reply) => {
@@ -133,18 +135,17 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "POST",
 		url: "/api/integrations/:id/reconnect",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "reconnectIntegration",
 			tags,
-			summary: "Replace a connection's secrets (re-authenticate)",
+			summary: "Replace a connection's secrets (staff)",
+			description: "Staff only (owner, admin, instructor). The new secrets replace the stored ones.",
 			params: ConnectionIdParam,
 			body: ReconnectRequest,
 			response: {
 				200: Connection,
-				400: ErrorBody,
-				401: ErrorBody,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req, reply) => {
@@ -158,20 +159,17 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "POST",
 		url: "/api/integrations/:id/actions/:actionId",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "invokeConnectionAction",
 			tags,
-			summary: "Invoke one of a connection's actions (e.g. a listing that feeds a picker)",
+			summary: "Invoke one of a connection's actions (staff)",
+			description: "Staff only (owner, admin, instructor). Runs the action, such as a listing that feeds a picker, with `input` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.",
 			params: ConnectionActionParams,
 			body: InvokeActionRequest,
 			response: {
 				200: ActionInvocationResult,
-				400: ErrorBody,
-				401: ErrorBody,
-				404: ErrorBody,
-				409: ErrorBody,
-				502: ErrorBody
+				...refusals(400, 403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -183,17 +181,16 @@ async function integrationsRoutes(app, container) {
 	r.route({
 		method: "DELETE",
 		url: "/api/integrations/:id",
-		preHandler: app.requireOrgSession,
+		preHandler: staff,
 		schema: {
 			operationId: "disconnectIntegration",
 			tags,
-			summary: "Disconnect an integration (destroys its stored secrets)",
+			summary: "Disconnect an integration (staff)",
+			description: "Staff only (owner, admin, instructor). Destroys its stored secrets.",
 			params: ConnectionIdParam,
 			response: {
 				204: z.void(),
-				400: ErrorBody,
-				401: ErrorBody,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req, reply) => {

package/dist/http/routes/integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.js","names":[],"sources":["../../../src/http/routes/integrations.ts"],"sourcesContent":["// HTTP routes for integrations (an org's connections to external services).\n// All require a session with an active organization. Credentials are\n// write-only: accepted on connect/reconnect, never present in a response —\n// `toApi` strips the credentialRef so not even the reference leaks.\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActionInvocationResult,\n  AvailableIntegrationsList,\n  ConfigureRequest,\n  ConnectRequest,\n  Connection,\n  ConnectionActionParams,\n  ConnectionIdParam,\n  ConnectionsList,\n  ErrorBody,\n  InvokeActionRequest,\n  ReconnectRequest,\n} from '../schemas/index.js';\nimport type { Connection as DomainConnection } from '@headless-lms/core/integrations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\n\nfunction toApi(connection: DomainConnection): Connection {\n  const { credentialRef: _credentialRef, ...rest } = connection;\n  return rest;\n}\n\n/** Resolve the session's active org to the domain org id, or 400 and return null. */\nasync function resolveOrgId(req: FastifyRequest, reply: FastifyReply): Promise<string | null> {\n  if (!req.orgId) {\n    await reply.code(400).send({ error: 'no_active_org', message: 'No active organization' });\n    return null;\n  }\n  return req.orgId;\n}\n\nexport async function integrationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const integrations = container.integrations;\n  const tags = ['Integrations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/available',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listAvailableIntegrations',\n      tags,\n      summary: 'List the integrations this deployment supports, with their config schemas',\n      response: { 200: AvailableIntegrationsList, 401: ErrorBody },\n    },\n    handler: async () => integrations.available(),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnections',\n      tags,\n      summary: \"List the organization's integration connections\",\n      response: { 200: ConnectionsList, 400: ErrorBody, 401: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      return (await integrations.list(orgId)).map(toApi);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'connectIntegration',\n      tags,\n      summary: 'Connect an integration (stores its secrets encrypted)',\n      body: ConnectRequest,\n      response: { 201: Connection, 400: ErrorBody, 401: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.connect(orgId, req.body);\n      return reply.code(201).send(toApi(connection));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getConnection',\n      tags,\n      summary: 'Get a connection',\n      params: ConnectionIdParam,\n      response: { 200: Connection, 400: ErrorBody, 401: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.get(orgId, req.params.id);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/integrations/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'configureConnection',\n      tags,\n      summary: \"Change a connection's configuration or active flag\",\n      params: ConnectionIdParam,\n      body: ConfigureRequest,\n      response: { 200: Connection, 400: ErrorBody, 401: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.configure(orgId, req.params.id, req.body);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/reconnect',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reconnectIntegration',\n      tags,\n      summary: \"Replace a connection's secrets (re-authenticate)\",\n      params: ConnectionIdParam,\n      body: ReconnectRequest,\n      response: { 200: Connection, 400: ErrorBody, 401: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.reconnect(orgId, req.params.id, req.body.secrets);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/actions/:actionId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'invokeConnectionAction',\n      tags,\n      summary: \"Invoke one of a connection's actions (e.g. a listing that feeds a picker)\",\n      params: ConnectionActionParams,\n      body: InvokeActionRequest,\n      response: {\n        200: ActionInvocationResult,\n        400: ErrorBody,\n        401: ErrorBody,\n        404: ErrorBody,\n        409: ErrorBody,\n        502: ErrorBody,\n      },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const output = await integrations.invoke(\n        orgId,\n        req.params.id,\n        req.params.actionId,\n        req.body.input ?? {},\n      );\n      return { output: output as Record<string, unknown> };\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/integrations/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'disconnectIntegration',\n      tags,\n      summary: 'Disconnect an integration (destroys its stored secrets)',\n      params: ConnectionIdParam,\n      response: { 204: z.void(), 400: ErrorBody, 401: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const removed = await integrations.disconnect(orgId, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAwBA,SAAS,MAAM,YAA0C;CACvD,MAAM,EAAE,eAAe,gBAAgB,GAAG,SAAS;CACnD,OAAO;AACT;;AAGA,eAAe,aAAa,KAAqB,OAA6C;CAC5F,IAAI,CAAC,IAAI,OAAO;EACd,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAiB,SAAS;EAAyB,CAAC;EACxF,OAAO;CACT;CACA,OAAO,IAAI;AACb;AAEA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAC/B,MAAM,OAAO,CAAC,cAAc;CAE5B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,UAAU;IAAE,KAAK;IAA2B,KAAK;GAAU;EAC7D;EACA,SAAS,YAAY,aAAa,UAAU;CAC9C,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,UAAU;IAAE,KAAK;IAAiB,KAAK;IAAW,KAAK;GAAU;EACnE;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,QAAQ,MAAM,aAAa,KAAK,KAAK,EAAA,CAAG,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,KAAK;IAAW,KAAK;IAAW,KAAK;GAAU;EAC9E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,QAAQ,OAAO,IAAI,IAAI;GAC7D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,UAAU,CAAC;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,KAAK;IAAW,KAAK;IAAW,KAAK;GAAU;EAC9E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,EAAE;GAC9D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,KAAK;IAAW,KAAK;IAAW,KAAK;GAAU;EAC9E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GAC9E,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,KAAK;IAAW,KAAK;IAAW,KAAK;GAAU;EAC9E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO;GACtF,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IACR,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;GACP;EACF;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAQF,OAAO,EAAE,QAAQ,MANI,aAAa,OAChC,OACA,IAAI,OAAO,IACX,IAAI,OAAO,UACX,IAAI,KAAK,SAAS,CAAC,CACrB,EACmD;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;IAAW,KAAK;GAAU;EAC5E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAGF,IAAI,CAAC,MADiB,aAAa,WAAW,OAAO,IAAI,OAAO,EAAE,GAEhE,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"integrations.js","names":[],"sources":["../../../src/http/routes/integrations.ts"],"sourcesContent":["// HTTP routes for integrations (an org's connections to external services).\n// All require a session with an active organization. Credentials are\n// write-only: accepted on connect/reconnect, never present in a response —\n// `toApi` strips the credentialRef so not even the reference leaks.\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActionInvocationResult,\n  AvailableIntegrationsList,\n  ConfigureRequest,\n  ConnectRequest,\n  Connection,\n  ConnectionActionParams,\n  ConnectionIdParam,\n  ConnectionsList,\n  InvokeActionRequest,\n  ReconnectRequest,\n  refusals,\n} from '../schemas/index.js';\nimport type { Connection as DomainConnection } from '@headless-lms/core/integrations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nfunction toApi(connection: DomainConnection): Connection {\n  const { credentialRef: _credentialRef, ...rest } = connection;\n  return rest;\n}\n\n/** Resolve the session's active org to the domain org id, or 400 and return null. */\nasync function resolveOrgId(req: FastifyRequest, reply: FastifyReply): Promise<string | null> {\n  if (!req.orgId) {\n    await reply.code(400).send({ error: 'no_active_org', message: 'No active organization' });\n    return null;\n  }\n  return req.orgId;\n}\n\nexport async function integrationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const integrations = container.integrations;\n  const tags = ['Integrations'];\n  const staff = async (req: FastifyRequest) => {\n    await resolveScope(container, req);\n  };\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/available',\n    preHandler: staff,\n    schema: {\n      operationId: 'listAvailableIntegrations',\n      tags,\n      summary: 'List the integrations this deployment supports (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Each with the JSON Schemas of its config, its secrets and its actions.',\n      response: { 200: AvailableIntegrationsList, ...refusals(403) },\n    },\n    handler: async () => integrations.available(),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations',\n    preHandler: staff,\n    schema: {\n      operationId: 'listConnections',\n      tags,\n      summary: \"List the organization's integration connections (staff)\",\n      description: 'Staff only (owner, admin, instructor). Secrets are never returned.',\n      response: { 200: ConnectionsList, ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      return (await integrations.list(orgId)).map(toApi);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations',\n    preHandler: staff,\n    schema: {\n      operationId: 'connectIntegration',\n      tags,\n      summary: 'Connect an integration (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.',\n      body: ConnectRequest,\n      response: { 201: Connection, ...refusals(400, 403, 409) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.connect(orgId, req.body);\n      return reply.code(201).send(toApi(connection));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'getConnection',\n      tags,\n      summary: 'Get a connection (staff)',\n      description: 'Staff only (owner, admin, instructor). Secrets are never returned.',\n      params: ConnectionIdParam,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.get(orgId, req.params.id);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'configureConnection',\n      tags,\n      summary: \"Change a connection's configuration or active flag (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). 400 when the config is invalid for the integration.',\n      params: ConnectionIdParam,\n      body: ConfigureRequest,\n      response: { 200: Connection, ...refusals(400, 403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.configure(orgId, req.params.id, req.body);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/reconnect',\n    preHandler: staff,\n    schema: {\n      operationId: 'reconnectIntegration',\n      tags,\n      summary: \"Replace a connection's secrets (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The new secrets replace the stored ones.',\n      params: ConnectionIdParam,\n      body: ReconnectRequest,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.reconnect(orgId, req.params.id, req.body.secrets);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/actions/:actionId',\n    preHandler: staff,\n    schema: {\n      operationId: 'invokeConnectionAction',\n      tags,\n      summary: \"Invoke one of a connection's actions (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Runs the action, such as a listing that feeds a picker, with `input` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.',\n      params: ConnectionActionParams,\n      body: InvokeActionRequest,\n      response: { 200: ActionInvocationResult, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const output = await integrations.invoke(\n        orgId,\n        req.params.id,\n        req.params.actionId,\n        req.body.input ?? {},\n      );\n      return { output: output as Record<string, unknown> };\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'disconnectIntegration',\n      tags,\n      summary: 'Disconnect an integration (staff)',\n      description: 'Staff only (owner, admin, instructor). Destroys its stored secrets.',\n      params: ConnectionIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const removed = await integrations.disconnect(orgId, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAyBA,SAAS,MAAM,YAA0C;CACvD,MAAM,EAAE,eAAe,gBAAgB,GAAG,SAAS;CACnD,OAAO;AACT;;AAGA,eAAe,aAAa,KAAqB,OAA6C;CAC5F,IAAI,CAAC,IAAI,OAAO;EACd,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAiB,SAAS;EAAyB,CAAC;EACxF,OAAO;CACT;CACA,OAAO,IAAI;AACb;AAEA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAC/B,MAAM,OAAO,CAAC,cAAc;CAC5B,MAAM,QAAQ,OAAO,QAAwB;EAC3C,MAAM,aAAa,WAAW,GAAG;CACnC;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAA2B,GAAG,SAAS,GAAG;GAAE;EAC/D;EACA,SAAS,YAAY,aAAa,UAAU;CAC9C,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,QAAQ,MAAM,aAAa,KAAK,KAAK,EAAA,CAAG,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,QAAQ,OAAO,IAAI,IAAI;GAC7D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,UAAU,CAAC;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,EAAE;GAC9D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GAC9E,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO;GACtF,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAwB,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC3E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAQF,OAAO,EAAE,QAAQ,MANI,aAAa,OAChC,OACA,IAAI,OAAO,IACX,IAAI,OAAO,UACX,IAAI,KAAK,SAAS,CAAC,CACrB,EACmD;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAGF,IAAI,CAAC,MADiB,aAAa,WAAW,OAAO,IAAI,OAAO,EAAE,GAEhE,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/actor.d.ts

@@ -0,0 +1,14 @@
+import { Container } from "../../../app/container.js";
+//#region src/http/routes/member/actor.d.ts
+declare function actorOf(container: Container, orgId: string, userId: string): Promise<{
+  id: string;
+  orgId: string;
+  userId: string;
+  role: "owner" | "admin" | "instructor" | "moderator" | "student";
+  status: "invited" | "active";
+  createdAt: Date;
+  updatedAt: Date;
+}>;
+//#endregion
+export { actorOf };
+//# sourceMappingURL=actor.d.ts.map

package/dist/http/routes/member/actor.js

@@ -0,0 +1,11 @@
+import { ForbiddenError } from "@headless-lms/core/shared/errors";
+//#region src/http/routes/member/actor.ts
+async function actorOf(container, orgId, userId) {
+	const orgUser = await container.organizations.getOrgUser(orgId, userId);
+	if (!orgUser) throw new ForbiddenError("You are not a member of this organization");
+	return orgUser;
+}
+//#endregion
+export { actorOf };
+
+//# sourceMappingURL=actor.js.map

package/dist/http/routes/member/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","names":[],"sources":["../../../../src/http/routes/member/actor.ts"],"sourcesContent":["import { ForbiddenError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\n\nexport async function actorOf(container: Container, orgId: string, userId: string) {\n  const orgUser = await container.organizations.getOrgUser(orgId, userId);\n  if (!orgUser) {\n    throw new ForbiddenError('You are not a member of this organization');\n  }\n  return orgUser;\n}\n"],"mappings":";;AAGA,eAAsB,QAAQ,WAAsB,OAAe,QAAgB;CACjF,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,OAAO,MAAM;CACtE,IAAI,CAAC,SACH,MAAM,IAAI,eAAe,2CAA2C;CAEtE,OAAO;AACT"}

package/dist/http/routes/member/assets.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/assets.d.ts
+declare function memberAssetsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberAssetsRoutes };
+//# sourceMappingURL=assets.d.ts.map

package/dist/http/routes/member/assets.js

@@ -0,0 +1,79 @@
+import { refusals } from "../../schemas/shared.js";
+import { Asset, AssetIdParam, RequestMemberUpload, UploadTicket } from "../../schemas/assets.js";
+import "../../schemas/index.js";
+import { actorOf } from "./actor.js";
+import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/http/routes/member/assets.ts
+const tags = ["Assets"];
+async function memberAssetsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	r.route({
+		method: "POST",
+		url: "/api/member/uploads",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "requestMemberUpload",
+			tags,
+			summary: "Register an image you are about to upload and get a presigned upload URL",
+			description: "For a member of the organization. Member uploads are images only (409 otherwise). The asset is yours: only you can finalize it or attach it to your profile, a post or a message. You can delete it while nothing references it.",
+			body: RequestMemberUpload,
+			response: {
+				201: UploadTicket,
+				...refusals(403, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await actorOf(container, req.orgId, req.userId);
+			const ticket = await container.assets.requestMemberUpload(req.orgId, actor.id, req.body);
+			return reply.code(201).send(ticket);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/uploads/:id/finalize",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "finalizeMemberUpload",
+			tags,
+			summary: "Confirm an upload you started",
+			description: "Uploader only; anyone else gets 404. Reads the stored size and content type. A file that is not an image or is over the size limit is discarded and answered with 409. A finalized file moves where the upload URL no longer reaches; finalizing it again returns it unchanged.",
+			params: AssetIdParam,
+			response: {
+				200: Asset,
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await actorOf(container, req.orgId, req.userId);
+			const asset = await container.assets.confirmOwn(req.orgId, req.params.id, actor.id);
+			if (!asset) throw new NotFoundError("Asset", req.params.id);
+			return asset;
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/uploads/:id",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteMemberUpload",
+			tags,
+			summary: "Delete an upload of yours that nothing references",
+			description: "Uploader only; anyone else gets 404. 409 while a profile, post or message still uses it.",
+			params: AssetIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await actorOf(container, req.orgId, req.userId);
+			if (!await container.assets.removeOwn(req.orgId, req.params.id, actor.id)) throw new NotFoundError("Asset", req.params.id);
+			return reply.code(204).send();
+		}
+	});
+}
+//#endregion
+export { memberAssetsRoutes };
+
+//# sourceMappingURL=assets.js.map

package/dist/http/routes/member/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","names":[],"sources":["../../../../src/http/routes/member/assets.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  Asset,\n  AssetIdParam,\n  RequestMemberUpload,\n  UploadTicket,\n  refusals,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { actorOf } from './actor.js';\nimport type { Container } from '../../../app/container.js';\n\nconst tags = ['Assets'];\n\nexport async function memberAssetsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/uploads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'requestMemberUpload',\n      tags,\n      summary: 'Register an image you are about to upload and get a presigned upload URL',\n      description:\n        'For a member of the organization. Member uploads are images only (409 otherwise). The asset is yours: only you can finalize it or attach it to your profile, a post or a message. You can delete it while nothing references it.',\n      body: RequestMemberUpload,\n      response: { 201: UploadTicket, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const ticket = await container.assets.requestMemberUpload(req.orgId, actor.id, req.body);\n      return reply.code(201).send(ticket);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/uploads/:id/finalize',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'finalizeMemberUpload',\n      tags,\n      summary: 'Confirm an upload you started',\n      description:\n        'Uploader only; anyone else gets 404. Reads the stored size and content type. A file that is not an image or is over the size limit is discarded and answered with 409. A finalized file moves where the upload URL no longer reaches; finalizing it again returns it unchanged.',\n      params: AssetIdParam,\n      response: { 200: Asset, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const asset = await container.assets.confirmOwn(req.orgId, req.params.id, actor.id);\n      if (!asset) {\n        throw new NotFoundError('Asset', req.params.id);\n      }\n      return asset;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/uploads/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteMemberUpload',\n      tags,\n      summary: 'Delete an upload of yours that nothing references',\n      description:\n        'Uploader only; anyone else gets 404. 409 while a profile, post or message still uses it.',\n      params: AssetIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const removed = await container.assets.removeOwn(req.orgId, req.params.id, actor.id);\n      if (!removed) {\n        throw new NotFoundError('Asset', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAcA,MAAM,OAAO,CAAC,QAAQ;AAEtB,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,SAAS,MAAM,UAAU,OAAO,oBAAoB,IAAI,OAAO,MAAM,IAAI,IAAI,IAAI;GACvF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,QAAQ,MAAM,UAAU,OAAO,WAAW,IAAI,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE;GAClF,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,SAAS,IAAI,OAAO,EAAE;GAEhD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAE5D,IAAI,CAAC,MADiB,UAAU,OAAO,UAAU,IAAI,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,GAEjF,MAAM,IAAI,cAAc,SAAS,IAAI,OAAO,EAAE;GAEhD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/chats.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/chats.d.ts
+declare function memberChatRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberChatRoutes };
+//# sourceMappingURL=chats.d.ts.map