@headless-lms/server 0.2.0 → 0.3.0

package/dist/http/routes/member/profile.js

@@ -0,0 +1,48 @@
+import { refusals } from "../../schemas/shared.js";
+import { UpdateProfile, UserProfile } from "../../schemas/profile.js";
+import "../../schemas/index.js";
+import { actorOf } from "./actor.js";
+//#region src/http/routes/member/profile.ts
+async function memberProfileRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const tags = ["Profile"];
+	r.route({
+		method: "GET",
+		url: "/api/member/profile",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberProfile",
+			tags,
+			summary: "Read your profile",
+			description: "For any signed-in person. The profile is yours across organizations; `imageUrl` is set only when the photo was uploaded in this organization. Before you save one, every field is empty.",
+			response: { 200: UserProfile }
+		},
+		handler: async (req) => {
+			return container.identity.profileOf(req.orgId, req.userId);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/profile",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateMemberProfile",
+			tags,
+			summary: "Update your profile",
+			description: "For a member of the organization. Changes only the fields sent; null clears one. 404 when `imageAssetId` is not a finalized image you uploaded here.",
+			body: UpdateProfile,
+			response: {
+				200: UserProfile,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			return container.identity.updateProfile(req.orgId, req.userId, req.userId, orgUser.id, req.body);
+		}
+	});
+}
+//#endregion
+export { memberProfileRoutes };
+
+//# sourceMappingURL=profile.js.map

package/dist/http/routes/member/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","names":[],"sources":["../../../../src/http/routes/member/profile.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\nimport { UpdateProfile, UserProfile, refusals } from '../../schemas/index.js';\n\nexport async function memberProfileRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Profile'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/profile',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberProfile',\n      tags,\n      summary: 'Read your profile',\n      description:\n        'For any signed-in person. The profile is yours across organizations; `imageUrl` is set only when the photo was uploaded in this organization. Before you save one, every field is empty.',\n      response: { 200: UserProfile },\n    },\n    handler: async (req) => {\n      return container.identity.profileOf(req.orgId, req.userId);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/profile',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberProfile',\n      tags,\n      summary: 'Update your profile',\n      description:\n        'For a member of the organization. Changes only the fields sent; null clears one. 404 when `imageAssetId` is not a finalized image you uploaded here.',\n      body: UpdateProfile,\n      response: { 200: UserProfile, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return container.identity.updateProfile(\n        req.orgId,\n        req.userId,\n        req.userId,\n        orgUser.id,\n        req.body,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;AAMA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,SAAS,UAAU,IAAI,OAAO,IAAI,MAAM;EAC3D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,UAAU,SAAS,cACxB,IAAI,OACJ,IAAI,QACJ,IAAI,QACJ,QAAQ,IACR,IAAI,IACN;EACF;CACF,CAAC;AACH"}

package/dist/http/routes/member/progress.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/progress.d.ts
+declare function memberProgressRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberProgressRoutes };
+//# sourceMappingURL=progress.d.ts.map

package/dist/http/routes/member/progress.js

@@ -0,0 +1,60 @@
+import { refusals } from "../../schemas/shared.js";
+import { CourseProgress, MemberCourseIdParam, ProgressStatus, ReportProgress } from "../../schemas/member.js";
+import "../../schemas/index.js";
+import { actorOf } from "./actor.js";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/http/routes/member/progress.ts
+async function memberProgressRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const member = container.reporting.member;
+	r.route({
+		method: "POST",
+		url: "/api/member/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reportProgress",
+			tags: ["Progress"],
+			summary: "Report usage on an activity; the progress service decides completion",
+			description: "For a member who can open the course. Reports facts, never a decision: the service decides whether the activity is complete. 404 when the activity or its course is not published, or you cannot open it.",
+			body: ReportProgress,
+			response: {
+				200: ProgressStatus,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			return { status: (await container.progress.report(req.orgId, {
+				orgUserId: orgUser.id,
+				activityId: req.body.activity,
+				reports: req.body.reports
+			})).completedAt ? "completed" : "in-progress" };
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/courses/:courseId/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberCourseProgress",
+			tags: ["Progress"],
+			summary: "Your progress in one course",
+			description: "For a member of the organization, derived from the course's current structure. 404 when the course is not published or you do not hold it.",
+			params: MemberCourseIdParam,
+			response: {
+				200: CourseProgress,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			const view = await member.courseProgress(req.orgId, orgUser.id, req.params.courseId);
+			if (!view) throw new NotFoundError("Course", req.params.courseId);
+			return view;
+		}
+	});
+}
+//#endregion
+export { memberProgressRoutes };
+
+//# sourceMappingURL=progress.js.map

package/dist/http/routes/member/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","names":[],"sources":["../../../../src/http/routes/member/progress.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  CourseProgress,\n  MemberCourseIdParam,\n  ProgressStatus,\n  ReportProgress,\n  refusals,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberProgressRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reportProgress',\n      tags: ['Progress'],\n      summary: 'Report usage on an activity; the progress service decides completion',\n      description:\n        'For a member who can open the course. Reports facts, never a decision: the service decides whether the activity is complete. 404 when the activity or its course is not published, or you cannot open it.',\n      body: ReportProgress,\n      response: { 200: ProgressStatus, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const record = await container.progress.report(req.orgId, {\n        orgUserId: orgUser.id,\n        activityId: req.body.activity,\n        reports: req.body.reports,\n      });\n      return { status: record.completedAt ? ('completed' as const) : ('in-progress' as const) };\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourseProgress',\n      tags: ['Progress'],\n      summary: 'Your progress in one course',\n      description:\n        \"For a member of the organization, derived from the course's current structure. 404 when the course is not published or you do not hold it.\",\n      params: MemberCourseIdParam,\n      response: { 200: CourseProgress, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const view = await member.courseProgress(req.orgId, orgUser.id, req.params.courseId);\n      if (!view) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return view;\n    },\n  });\n}\n"],"mappings":";;;;;;AAaA,eAAsB,qBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAM9D,OAAO,EAAE,SAAQ,MALI,UAAU,SAAS,OAAO,IAAI,OAAO;IACxD,WAAW,QAAQ;IACnB,YAAY,IAAI,KAAK;IACrB,SAAS,IAAI,KAAK;GACpB,CAAC,EAAA,CACuB,cAAe,cAAyB,cAAwB;EAC1F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,OAAO,MAAM,OAAO,eAAe,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes/organizations.js

@@ -1,11 +1,11 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
 import { CreateOrganization, Organization, UpdateOrganization } from "../schemas/organizations.js";
-import { Member, MemberIdParam, MembersPage, MembersQuery, UpdateMemberRole } from "../schemas/members.js";
+import { MemberIdParam, MemberRoleChange, MembersPage, MembersQuery, UpdateMemberRole } from "../schemas/members.js";
 import { AcceptInvite, AcceptInviteResult, CreateInvite, GetInviteResult, Invite, InviteTokenParam } from "../schemas/invites.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/organizations.ts
 async function organizationsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -19,6 +19,7 @@ async function organizationsRoutes(app, container) {
 			operationId: "createOrganization",
 			tags,
 			summary: "Create an organization and make it active",
+			description: "For any signed-in person, including one with no organization yet. The caller becomes its owner.",
 			body: CreateOrganization,
 			response: { 201: Organization }
 		},
@@ -39,11 +40,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "updateOrganization",
 			tags,
-			summary: "Update the active organization",
+			summary: "Update the active organization (staff)",
+			description: "Owner or admin. Changes its name or slug; 409 when the slug is taken.",
 			body: UpdateOrganization,
 			response: {
 				200: Organization,
-				409: ErrorBody
+				...refusals(403, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -64,9 +66,13 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "listMembers",
 			tags,
-			summary: "List organization members",
+			summary: "List the organization's team members (staff)",
+			description: "Staff only (owner, admin, instructor). The team: everyone in the organization who is not a student.",
 			querystring: MembersQuery,
-			response: { 200: MembersPage }
+			response: {
+				200: MembersPage,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -80,13 +86,13 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "updateMemberRole",
 			tags,
-			summary: "Change a member's role",
+			summary: "Change a member's role (staff)",
+			description: "Owner or admin only. The owner role can be neither granted nor changed (409), and only a moderator can become a student.",
 			params: MemberIdParam,
 			body: UpdateMemberRole,
 			response: {
-				200: Member,
-				404: ErrorBody,
-				409: ErrorBody
+				200: MemberRoleChange,
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req) => {
@@ -96,7 +102,10 @@ async function organizationsRoutes(app, container) {
 				authOrgId: scope.authOrgId,
 				headers: req.headers
 			};
-			const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);
+			const member = await organizations.updateMemberRole(ctx, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id, req.body.role);
 			if (!member) throw new NotFoundError("Member", req.params.id);
 			return member;
 		}
@@ -108,12 +117,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "removeMember",
 			tags,
-			summary: "Remove an organization member",
+			summary: "Remove an organization member (staff)",
+			description: "Owner or admin only. Removing a pending member cancels their invite. The owner cannot be removed (409).",
 			params: MemberIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody,
-				409: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -123,7 +132,10 @@ async function organizationsRoutes(app, container) {
 				authOrgId: scope.authOrgId,
 				headers: req.headers
 			};
-			if (!await organizations.removeMember(ctx, req.params.id)) throw new NotFoundError("Member", req.params.id);
+			if (!await organizations.removeMember(ctx, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id)) throw new NotFoundError("Member", req.params.id);
 			return reply.code(204).send();
 		}
 	});
@@ -134,16 +146,20 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "createInvite",
 			tags,
-			summary: "Invite a member or student into the active organization",
+			summary: "Invite a member or student into the active organization (staff)",
+			description: "Owner or admin only. A student is created by this call, so their access can be granted before they accept. 409 when a student with that email is already in the organization.",
 			body: CreateInvite,
 			response: {
 				201: Invite,
-				409: ErrorBody
+				...refusals(403, 409)
 			}
 		},
-		handler: async (req) => {
+		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
 			const invite = await organizations.createInvite({
+				id: scope.orgUserId,
+				role: scope.role
+			}, {
 				orgId: scope.orgId,
 				inviterUserId: scope.userId,
 				email: req.body.email,
@@ -152,8 +168,15 @@ async function organizationsRoutes(app, container) {
 				...req.body.lastName !== void 0 && { lastName: req.body.lastName },
 				sendEmail: req.body.sendEmail
 			});
-			req.log.debug({ invite }, "created invite");
-			return invite;
+			req.log.debug({ inviteId: invite.id }, "created invite");
+			return reply.code(201).send({
+				id: invite.id,
+				email: invite.email,
+				role: invite.role,
+				status: invite.status,
+				expiresAt: invite.expiresAt,
+				createdAt: invite.createdAt
+			});
 		}
 	});
 	r.route({
@@ -163,10 +186,11 @@ async function organizationsRoutes(app, container) {
 			operationId: "getInvite",
 			tags,
 			summary: "Read an invite by its token",
+			description: "Public: no session needed. The same 404 answers forged, expired and accepted tokens, so a probe learns nothing.",
 			params: InviteTokenParam,
 			response: {
 				200: GetInviteResult,
-				404: ErrorBody
+				...refusals(404)
 			}
 		},
 		handler: async (req) => {
@@ -187,11 +211,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "acceptInvite",
 			tags,
-			summary: "Accept an invite with the logged-in account",
+			summary: "Accept an invite with the signed-in account",
+			description: "For any signed-in person whose email matches the invitation. Makes the invite's organization the session's active one. 400 when the token is invalid or expired, or the email does not match.",
 			body: AcceptInvite,
 			response: {
 				200: AcceptInviteResult,
-				400: ErrorBody
+				...refusals(400, 404)
 			}
 		},
 		handler: async (req) => {

package/dist/http/routes/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","names":[],"sources":["../../../src/http/routes/organizations.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AcceptInvite,\n  AcceptInviteResult,\n  CreateInvite,\n  CreateOrganization,\n  ErrorBody,\n  Invite,\n  Member,\n  MemberIdParam,\n  MembersPage,\n  MembersQuery,\n  GetInviteResult,\n  InviteTokenParam,\n  Organization,\n  UpdateMemberRole,\n  UpdateOrganization,\n} from '../schemas/index.js';\nimport type { MemberWriteContext } from '@headless-lms/core/organizations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function organizationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const organizations = container.organizations;\n  const tags = ['Organizations'];\n\n  // Create a new organization on the caller's behalf and make it their active\n  // org. This is the API's own front door for org creation — it drives Better\n  // Auth internally, so callers use the typed SDK, not the auth namespace. No\n  // resolveScope here: the caller has no active org yet, only a session.\n  r.route({\n    method: 'POST',\n    url: '/api/organizations',\n    // Session only: a first-time signup has no active org yet, so requiring one\n    // here would 401 the very call that produces it.\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'createOrganization',\n      tags,\n      summary: 'Create an organization and make it active',\n      body: CreateOrganization,\n      response: { 201: Organization },\n    },\n    handler: async (req, reply) => {\n      const org = await container.orgProvider.createOrganization(req.headers, req.body);\n      return reply.code(201).send({\n        name: org.name,\n        slug: org.slug,\n        id: org.id,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  // Update the caller's active organization (name/slug). Writes go through Better\n  // Auth, which enforces the caller's org-update permission (owner/admin).\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateOrganization',\n      tags,\n      summary: 'Update the active organization',\n      body: UpdateOrganization,\n      response: { 200: Organization, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const org = await container.orgProvider.updateOrganization(\n        req.headers,\n        scope.authOrgId,\n        req.body,\n      );\n      return reply.send({\n        id: org.id,\n        name: org.name,\n        slug: org.slug,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMembers',\n      tags,\n      summary: 'List organization members',\n      querystring: MembersQuery,\n      response: { 200: MembersPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return organizations.listMembers(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations/members/:id/role',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberRole',\n      tags,\n      summary: \"Change a member's role\",\n      params: MemberIdParam,\n      body: UpdateMemberRole,\n      response: { 200: Member, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);\n      if (!member) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return member;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/organizations/members/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMember',\n      tags,\n      summary: 'Remove an organization member',\n      params: MemberIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const removed = await organizations.removeMember(ctx, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createInvite',\n      tags,\n      summary: 'Invite a member or student into the active organization',\n      body: CreateInvite,\n      response: { 201: Invite, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      // Domain ids, not the session's auth ids: invites FK to organizations.id\n      // and users.id.\n      const scope = await resolveScope(container, req);\n      const invite = await organizations.createInvite({\n        orgId: scope.orgId,\n        inviterUserId: scope.userId,\n        email: req.body.email,\n        role: req.body.role,\n        ...(req.body.firstName !== undefined && { firstName: req.body.firstName }),\n        ...(req.body.lastName !== undefined && { lastName: req.body.lastName }),\n        sendEmail: req.body.sendEmail,\n      });\n\n      req.log.debug({ invite }, 'created invite');\n      return invite;\n    },\n  });\n\n  // The invite landing page's first call, made before the invitee has any\n  // session — so no guard. It turns the emailed token into the two facts the\n  // page needs: who the invitation is for, and whether that address already has\n  // an account. The email comes from the invitation row rather than the URL, so\n  // it cannot be steered by editing the link.\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/invites/:token',\n    schema: {\n      operationId: 'getInvite',\n      tags,\n      summary: 'Read an invite by its token',\n      params: InviteTokenParam,\n      response: { 200: GetInviteResult, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const invite = await organizations.peekInvite(req.params.token);\n      if (!invite) {\n        // Same answer for forged, expired, and already-accepted tokens: a\n        // probe learns nothing about which invitations exist.\n        throw new NotFoundError('Invite', 'token');\n      }\n      // Whether the address already has a login is deliberately not answered\n      // here. The mirror cannot say — an admin's student is a person long\n      // before they are an account — and asking the auth engine would mean\n      // reading its tables for one boolean. The sign-up form discovers it\n      // instead: a duplicate signup comes back 422 and the page flips to\n      // sign-in.\n      const person = await container.identity.getUserByEmail(invite.email);\n      return {\n        email: invite.email,\n        firstName: person?.firstName ?? null,\n        lastName: person?.lastName ?? null,\n      };\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites/accept',\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'acceptInvite',\n      tags,\n      summary: 'Accept an invite with the logged-in account',\n      body: AcceptInvite,\n      response: { 200: AcceptInviteResult, 400: ErrorBody },\n    },\n    handler: async (req) => {\n      // No active org yet, so no resolveScope — but acceptInvite links a domain\n      // users.id, never the auth account id.\n      const user = await container.identity.getUserByExternalId(req.authUser.id);\n      if (!user) {\n        throw new NotFoundError('User', req.authUser.id);\n      }\n      const accepted = await container.organizations.acceptInvite({\n        token: req.body.token,\n        userId: user.id,\n        email: req.authUser.email,\n      });\n\n      // The session predates this grant, so it carries no active org and every\n      // org-scoped read would 401. Students are never org members, so the org\n      // plugin's set-active cannot do it — stamp the session row directly.\n      const org = await container.organizations.getById(accepted.orgId);\n      if (!org) {\n        throw new NotFoundError('Organization', accepted.orgId);\n      }\n      const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);\n\n      req.log.info({ accepted, stamped }, 'accepted invite');\n      return {};\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AAyBA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,gBAAgB,UAAU;CAChC,MAAM,OAAO,CAAC,eAAe;CAM7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EAGL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,IAAI,IAAI;GAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,KAAK;GAAU;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAAM,MAAM,UAAU,YAAY,mBACtC,IAAI,SACJ,MAAM,WACN,IAAI,IACN;GACA,OAAO,MAAM,KAAK;IAChB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,cAAc,YAAY,MAAM,OAAO,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;IAAW,KAAK;GAAU;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GACA,MAAM,SAAS,MAAM,cAAc,iBAAiB,KAAK,IAAI,OAAO,IAAI,IAAI,KAAK,IAAI;GACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GAEA,IAAI,CAAC,MADiB,cAAc,aAAa,KAAK,IAAI,OAAO,EAAE,GAEjE,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;GAAU;EAC1C;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,cAAc,aAAa;IAC9C,OAAO,MAAM;IACb,eAAe,MAAM;IACrB,OAAO,IAAI,KAAK;IAChB,MAAM,IAAI,KAAK;IACf,GAAI,IAAI,KAAK,cAAc,KAAA,KAAa,EAAE,WAAW,IAAI,KAAK,UAAU;IACxE,GAAI,IAAI,KAAK,aAAa,KAAA,KAAa,EAAE,UAAU,IAAI,KAAK,SAAS;IACrE,WAAW,IAAI,KAAK;GACtB,CAAC;GAED,IAAI,IAAI,MAAM,EAAE,OAAO,GAAG,gBAAgB;GAC1C,OAAO;EACT;CACF,CAAC;CAOD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,KAAK;GAAU;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,SAAS,MAAM,cAAc,WAAW,IAAI,OAAO,KAAK;GAC9D,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,UAAU,OAAO;GAQ3C,MAAM,SAAS,MAAM,UAAU,SAAS,eAAe,OAAO,KAAK;GACnE,OAAO;IACL,OAAO,OAAO;IACd,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY;GAChC;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAoB,KAAK;GAAU;EACtD;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,IAAI,SAAS,EAAE;GACzE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;GAEjD,MAAM,WAAW,MAAM,UAAU,cAAc,aAAa;IAC1D,OAAO,IAAI,KAAK;IAChB,QAAQ,KAAK;IACb,OAAO,IAAI,SAAS;GACtB,CAAC;GAKD,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK;GAChE,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,SAAS,KAAK;GAExD,MAAM,UAAU,MAAM,UAAU,SAAS,wBAAwB,IAAI,SAAS,IAAI,EAAE;GAEpF,IAAI,IAAI,KAAK;IAAE;IAAU;GAAQ,GAAG,iBAAiB;GACrD,OAAO,CAAC;EACV;CACF,CAAC;AACH"}
+{"version":3,"file":"organizations.js","names":[],"sources":["../../../src/http/routes/organizations.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AcceptInvite,\n  AcceptInviteResult,\n  CreateInvite,\n  CreateOrganization,\n  Invite,\n  MemberIdParam,\n  MemberRoleChange,\n  MembersPage,\n  MembersQuery,\n  GetInviteResult,\n  InviteTokenParam,\n  Organization,\n  UpdateMemberRole,\n  UpdateOrganization,\n  refusals,\n} from '../schemas/index.js';\nimport type { MemberWriteContext } from '@headless-lms/core/organizations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function organizationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const organizations = container.organizations;\n  const tags = ['Organizations'];\n\n  // Create a new organization on the caller's behalf and make it their active\n  // org. This is the API's own front door for org creation — it drives Better\n  // Auth internally, so callers use the typed SDK, not the auth namespace. No\n  // resolveScope here: the caller has no active org yet, only a session.\n  r.route({\n    method: 'POST',\n    url: '/api/organizations',\n    // Session only: a first-time signup has no active org yet, so requiring one\n    // here would 401 the very call that produces it.\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'createOrganization',\n      tags,\n      summary: 'Create an organization and make it active',\n      description:\n        'For any signed-in person, including one with no organization yet. The caller becomes its owner.',\n      body: CreateOrganization,\n      response: { 201: Organization },\n    },\n    handler: async (req, reply) => {\n      const org = await container.orgProvider.createOrganization(req.headers, req.body);\n      return reply.code(201).send({\n        name: org.name,\n        slug: org.slug,\n        id: org.id,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  // Update the caller's active organization (name/slug). Writes go through Better\n  // Auth, which enforces the caller's org-update permission (owner/admin).\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateOrganization',\n      tags,\n      summary: 'Update the active organization (staff)',\n      description: 'Owner or admin. Changes its name or slug; 409 when the slug is taken.',\n      body: UpdateOrganization,\n      response: { 200: Organization, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const org = await container.orgProvider.updateOrganization(\n        req.headers,\n        scope.authOrgId,\n        req.body,\n      );\n      return reply.send({\n        id: org.id,\n        name: org.name,\n        slug: org.slug,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMembers',\n      tags,\n      summary: \"List the organization's team members (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The team: everyone in the organization who is not a student.',\n      querystring: MembersQuery,\n      response: { 200: MembersPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return organizations.listMembers(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations/members/:id/role',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberRole',\n      tags,\n      summary: \"Change a member's role (staff)\",\n      description:\n        'Owner or admin only. The owner role can be neither granted nor changed (409), and only a moderator can become a student.',\n      params: MemberIdParam,\n      body: UpdateMemberRole,\n      response: { 200: MemberRoleChange, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const member = await organizations.updateMemberRole(\n        ctx,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n        req.body.role,\n      );\n      if (!member) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return member;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/organizations/members/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMember',\n      tags,\n      summary: 'Remove an organization member (staff)',\n      description:\n        'Owner or admin only. Removing a pending member cancels their invite. The owner cannot be removed (409).',\n      params: MemberIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const removed = await organizations.removeMember(\n        ctx,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n      );\n      if (!removed) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createInvite',\n      tags,\n      summary: 'Invite a member or student into the active organization (staff)',\n      description:\n        'Owner or admin only. A student is created by this call, so their access can be granted before they accept. 409 when a student with that email is already in the organization.',\n      body: CreateInvite,\n      response: { 201: Invite, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      // Domain ids, not the session's auth ids: invites FK to organizations.id\n      // and users.id.\n      const scope = await resolveScope(container, req);\n      const invite = await organizations.createInvite(\n        { id: scope.orgUserId, role: scope.role },\n        {\n          orgId: scope.orgId,\n          inviterUserId: scope.userId,\n          email: req.body.email,\n          role: req.body.role,\n          ...(req.body.firstName !== undefined && { firstName: req.body.firstName }),\n          ...(req.body.lastName !== undefined && { lastName: req.body.lastName }),\n          sendEmail: req.body.sendEmail,\n        },\n      );\n\n      req.log.debug({ inviteId: invite.id }, 'created invite');\n      return reply.code(201).send({\n        id: invite.id,\n        email: invite.email,\n        role: invite.role,\n        status: invite.status,\n        expiresAt: invite.expiresAt,\n        createdAt: invite.createdAt,\n      });\n    },\n  });\n\n  // The invite landing page's first call, made before the invitee has any\n  // session — so no guard. It turns the emailed token into the two facts the\n  // page needs: who the invitation is for, and whether that address already has\n  // an account. The email comes from the invitation row rather than the URL, so\n  // it cannot be steered by editing the link.\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/invites/:token',\n    schema: {\n      operationId: 'getInvite',\n      tags,\n      summary: 'Read an invite by its token',\n      description:\n        'Public: no session needed. The same 404 answers forged, expired and accepted tokens, so a probe learns nothing.',\n      params: InviteTokenParam,\n      response: { 200: GetInviteResult, ...refusals(404) },\n    },\n    handler: async (req) => {\n      const invite = await organizations.peekInvite(req.params.token);\n      if (!invite) {\n        // Same answer for forged, expired, and already-accepted tokens: a\n        // probe learns nothing about which invitations exist.\n        throw new NotFoundError('Invite', 'token');\n      }\n      // Whether the address already has a login is deliberately not answered\n      // here. The mirror cannot say — an admin's student is a person long\n      // before they are an account — and asking the auth engine would mean\n      // reading its tables for one boolean. The sign-up form discovers it\n      // instead: a duplicate signup comes back 422 and the page flips to\n      // sign-in.\n      const person = await container.identity.getUserByEmail(invite.email);\n      return {\n        email: invite.email,\n        firstName: person?.firstName ?? null,\n        lastName: person?.lastName ?? null,\n      };\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites/accept',\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'acceptInvite',\n      tags,\n      summary: 'Accept an invite with the signed-in account',\n      description:\n        \"For any signed-in person whose email matches the invitation. Makes the invite's organization the session's active one. 400 when the token is invalid or expired, or the email does not match.\",\n      body: AcceptInvite,\n      response: { 200: AcceptInviteResult, ...refusals(400, 404) },\n    },\n    handler: async (req) => {\n      // No active org yet, so no resolveScope — but acceptInvite links a domain\n      // users.id, never the auth account id.\n      const user = await container.identity.getUserByExternalId(req.authUser.id);\n      if (!user) {\n        throw new NotFoundError('User', req.authUser.id);\n      }\n      const accepted = await container.organizations.acceptInvite({\n        token: req.body.token,\n        userId: user.id,\n        email: req.authUser.email,\n      });\n\n      // The session predates this grant, so it carries no active org and every\n      // org-scoped read would 401. Students are never org members, so the org\n      // plugin's set-active cannot do it — stamp the session row directly.\n      const org = await container.organizations.getById(accepted.orgId);\n      if (!org) {\n        throw new NotFoundError('Organization', accepted.orgId);\n      }\n      const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);\n\n      req.log.info({ accepted, stamped }, 'accepted invite');\n      return {};\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AAyBA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,gBAAgB,UAAU;CAChC,MAAM,OAAO,CAAC,eAAe;CAM7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EAGL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,IAAI,IAAI;GAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAAM,MAAM,UAAU,YAAY,mBACtC,IAAI,SACJ,MAAM,WACN,IAAI,IACN;GACA,OAAO,MAAM,KAAK;IAChB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,cAAc,YAAY,MAAM,OAAO,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GACA,MAAM,SAAS,MAAM,cAAc,iBACjC,KACA;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,IACX,IAAI,KAAK,IACX;GACA,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GAMA,IAAI,CAAC,MALiB,cAAc,aAClC,KACA;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,EACb,GAEE,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAG7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,cAAc,aACjC;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC;IACE,OAAO,MAAM;IACb,eAAe,MAAM;IACrB,OAAO,IAAI,KAAK;IAChB,MAAM,IAAI,KAAK;IACf,GAAI,IAAI,KAAK,cAAc,KAAA,KAAa,EAAE,WAAW,IAAI,KAAK,UAAU;IACxE,GAAI,IAAI,KAAK,aAAa,KAAA,KAAa,EAAE,UAAU,IAAI,KAAK,SAAS;IACrE,WAAW,IAAI,KAAK;GACtB,CACF;GAEA,IAAI,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,GAAG,gBAAgB;GACvD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,IAAI,OAAO;IACX,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,WAAW,OAAO;GACpB,CAAC;EACH;CACF,CAAC;CAOD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,SAAS,MAAM,cAAc,WAAW,IAAI,OAAO,KAAK;GAC9D,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,UAAU,OAAO;GAQ3C,MAAM,SAAS,MAAM,UAAU,SAAS,eAAe,OAAO,KAAK;GACnE,OAAO;IACL,OAAO,OAAO;IACd,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY;GAChC;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,IAAI,SAAS,EAAE;GACzE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;GAEjD,MAAM,WAAW,MAAM,UAAU,cAAc,aAAa;IAC1D,OAAO,IAAI,KAAK;IAChB,QAAQ,KAAK;IACb,OAAO,IAAI,SAAS;GACtB,CAAC;GAKD,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK;GAChE,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,SAAS,KAAK;GAExD,MAAM,UAAU,MAAM,UAAU,SAAS,wBAAwB,IAAI,SAAS,IAAI,EAAE;GAEpF,IAAI,IAAI,KAAK;IAAE;IAAU;GAAQ,GAAG,iBAAiB;GACrD,OAAO,CAAC;EACV;CACF,CAAC;AACH"}

package/dist/http/routes/students.js

@@ -1,13 +1,13 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
-import { Student, StudentAnalytics, StudentIdParam, StudentsPage, StudentsQuery, UpdateStudentBody } from "../schemas/students.js";
+import { Student, StudentAnalytics, StudentIdParam, StudentsPage, StudentsQuery } from "../schemas/students.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/students.ts
 async function studentsRoutes(app, container) {
 	const r = app.withTypeProvider();
-	const students = container.reporting.students;
+	const students = container.reporting.admin;
 	r.route({
 		method: "GET",
 		url: "/api/students",
@@ -15,13 +15,17 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "listStudents",
 			tags: ["Organizations"],
-			summary: "List students",
+			summary: "List students (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			querystring: StudentsQuery,
-			response: { 200: StudentsPage }
+			response: {
+				200: StudentsPage,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			return students.list(scope.orgId, req.query);
+			return students.listStudents(scope.orgId, req.query);
 		}
 	});
 	r.route({
@@ -31,16 +35,17 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "getStudent",
 			tags: ["Organizations"],
-			summary: "Get a student by id",
+			summary: "Get a student (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			params: StudentIdParam,
 			response: {
 				200: Student,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			const student = await students.get(scope.orgId, req.params.id);
+			const student = await students.getStudent(scope.orgId, req.params.id);
 			if (!student) throw new NotFoundError("Student", req.params.id);
 			return student;
 		}
@@ -52,48 +57,21 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "getStudentAnalytics",
 			tags: ["Reporting"],
-			summary: "A student's learner record: per-course progress and completion",
+			summary: "A student's learner record (staff)",
+			description: "Staff only (owner, admin, instructor). Per-course progress and completion.",
 			params: StudentIdParam,
 			response: {
 				200: StudentAnalytics,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			const analytics = await students.analytics(scope.orgId, req.params.id);
+			const analytics = await students.studentAnalytics(scope.orgId, req.params.id);
 			if (!analytics) throw new NotFoundError("Student", req.params.id);
 			return analytics;
 		}
 	});
-	r.route({
-		method: "PATCH",
-		url: "/api/students/:id",
-		preHandler: app.requireOrgSession,
-		schema: {
-			operationId: "updateStudent",
-			tags: ["Organizations"],
-			summary: "Update a student's profile",
-			params: StudentIdParam,
-			body: UpdateStudentBody,
-			response: {
-				200: Student,
-				404: ErrorBody,
-				409: ErrorBody
-			}
-		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			await container.organizations.updateStudent({
-				orgId: scope.orgId,
-				orgUserId: req.params.id,
-				...req.body
-			});
-			const student = await students.get(scope.orgId, req.params.id);
-			if (!student) throw new NotFoundError("Student", req.params.id);
-			return student;
-		}
-	});
 	r.route({
 		method: "POST",
 		url: "/api/students/:id/invite/resend",
@@ -101,17 +79,20 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "resendStudentInvite",
 			tags: ["Organizations"],
-			summary: "Re-send a pending student's invite email",
+			summary: "Re-send a pending student's invite email (staff)",
+			description: "Owner or admin only. Issues a new token, so the previous link stops working. 404 when the student has no pending invite; 409 when it was already accepted.",
 			params: StudentIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody,
-				409: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
 			await container.organizations.resendStudentInvite({
+				id: scope.orgUserId,
+				role: scope.role
+			}, {
 				orgId: scope.orgId,
 				orgUserId: req.params.id,
 				inviterUserId: scope.userId
@@ -126,16 +107,20 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "deleteStudent",
 			tags: ["Organizations"],
-			summary: "Delete a student",
+			summary: "Delete a student (staff)",
+			description: "Owner or admin only. 409 when the person has written posts, comments or messages.",
 			params: StudentIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
-			await container.organizations.deleteOrgUser(scope.orgId, req.params.id);
+			await container.organizations.deleteOrgUser(scope.orgId, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id);
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/students.js.map

@@ -1 +1 @@
-{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/routes/students.ts"],"sourcesContent":["// HTTP routes for students: the reporting-backed list/read endpoints, the\n// delete, and re-issuing a pending invite. There is no create here — adding a\n// student IS inviting one, at /api/organizations/invites, which provisions the\n// student record up front.\nimport type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ErrorBody,\n  Student,\n  StudentAnalytics,\n  StudentIdParam,\n  StudentsPage,\n  StudentsQuery,\n  UpdateStudentBody,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function studentsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const students = container.reporting.students;\n\n  r.route({\n    method: 'GET',\n    url: '/api/students',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listStudents',\n      tags: ['Organizations'],\n      summary: 'List students',\n      querystring: StudentsQuery,\n      response: { 200: StudentsPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return students.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudent',\n      tags: ['Organizations'],\n      summary: 'Get a student by id',\n      params: StudentIdParam,\n      response: { 200: Student, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudentAnalytics',\n      tags: ['Reporting'],\n      summary: \"A student's learner record: per-course progress and completion\",\n      params: StudentIdParam,\n      response: { 200: StudentAnalytics, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const analytics = await students.analytics(scope.orgId, req.params.id);\n      if (!analytics) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return analytics;\n    },\n  });\n\n  // Corrects the person behind the student row. The write lands in identity\n  // (the person is global); organizations owns the rule that this org user is\n  // a student here, and reconciles their pending invite when the address moves.\n  r.route({\n    method: 'PATCH',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateStudent',\n      tags: ['Organizations'],\n      summary: \"Update a student's profile\",\n      params: StudentIdParam,\n      body: UpdateStudentBody,\n      response: { 200: Student, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.updateStudent({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        ...req.body,\n      });\n      // Re-read through the report so the response is the same shape the list\n      // and detail GETs return, aggregates included.\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  // Re-mints the token on the student's pending invite and emails it. Lives\n  // here rather than under invites because the admin app knows the student,\n  // not the invitation.\n  r.route({\n    method: 'POST',\n    url: '/api/students/:id/invite/resend',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resendStudentInvite',\n      tags: ['Organizations'],\n      summary: \"Re-send a pending student's invite email\",\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.resendStudentInvite({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        inviterUserId: scope.userId,\n      });\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteStudent',\n      tags: ['Organizations'],\n      summary: 'Delete a student',\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.deleteOrgUser(scope.orgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAoBA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,WAAW,UAAU,UAAU;CAErC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,KAAK;GAAU;EAC3C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,KAAK;GAAU;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,YAAY,MAAM,SAAS,UAAU,MAAM,OAAO,IAAI,OAAO,EAAE;GACrE,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,KAAK;IAAW,KAAK;GAAU;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc;IAC1C,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,GAAG,IAAI;GACT,CAAC;GAGD,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,oBAAoB;IAChD,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,eAAe,MAAM;GACvB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE;GACtE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/routes/students.ts"],"sourcesContent":["// HTTP routes for students: the reporting-backed list/read endpoints, the\n// delete, and re-issuing a pending invite. There is no create here — adding a\n// student IS inviting one, at /api/organizations/invites, which provisions the\n// student record up front.\nimport type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Student,\n  StudentAnalytics,\n  StudentIdParam,\n  StudentsPage,\n  StudentsQuery,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function studentsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const students = container.reporting.admin;\n\n  r.route({\n    method: 'GET',\n    url: '/api/students',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listStudents',\n      tags: ['Organizations'],\n      summary: 'List students (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: StudentsQuery,\n      response: { 200: StudentsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return students.listStudents(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudent',\n      tags: ['Organizations'],\n      summary: 'Get a student (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: StudentIdParam,\n      response: { 200: Student, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const student = await students.getStudent(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudentAnalytics',\n      tags: ['Reporting'],\n      summary: \"A student's learner record (staff)\",\n      description: 'Staff only (owner, admin, instructor). Per-course progress and completion.',\n      params: StudentIdParam,\n      response: { 200: StudentAnalytics, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const analytics = await students.studentAnalytics(scope.orgId, req.params.id);\n      if (!analytics) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return analytics;\n    },\n  });\n\n  // Re-mints the token on the student's pending invite and emails it. Lives\n  // here rather than under invites because the admin app knows the student,\n  // not the invitation.\n  r.route({\n    method: 'POST',\n    url: '/api/students/:id/invite/resend',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resendStudentInvite',\n      tags: ['Organizations'],\n      summary: \"Re-send a pending student's invite email (staff)\",\n      description:\n        'Owner or admin only. Issues a new token, so the previous link stops working. 404 when the student has no pending invite; 409 when it was already accepted.',\n      params: StudentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.resendStudentInvite(\n        { id: scope.orgUserId, role: scope.role },\n        {\n          orgId: scope.orgId,\n          orgUserId: req.params.id,\n          inviterUserId: scope.userId,\n        },\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteStudent',\n      tags: ['Organizations'],\n      summary: 'Delete a student (staff)',\n      description:\n        'Owner or admin only. 409 when the person has written posts, comments or messages.',\n      params: StudentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.deleteOrgUser(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n      );\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAmBA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,WAAW,UAAU,UAAU;CAErC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,SAAS,aAAa,MAAM,OAAO,IAAI,KAAK;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,SAAS,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,YAAY,MAAM,SAAS,iBAAiB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC5E,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,oBAC5B;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC;IACE,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,eAAe,MAAM;GACvB,CACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,EACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}