@headless-lms/server 0.2.0 → 0.4.0

package/dist/http/routes/member/posts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posts.js","names":[],"sources":["../../../../src/http/routes/member/posts.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\nimport {\n  CommentView,\n  CommunityParam,\n  CommunitySpaceParam,\n  CreatePost,\n  FeedQuery,\n  FlagReason,\n  PageQuery,\n  PostCommentsPage,\n  PostComment,\n  PostFeedPage,\n  PostFlag,\n  PostIdParam,\n  PostView,\n  Reactions,\n  ResolvePostFlags,\n  SchedulePost,\n  SetPostReactions,\n  SetPostSubscription,\n  SetReaction,\n  SpaceQueue,\n  UpdatePost,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberPostRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const posts = container.posts;\n  const tags = ['Posts'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/feed',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberFeed',\n      tags,\n      summary: 'Published posts across the spaces you can open',\n      description:\n        'For a member of the community. Pinned posts first, then newest first. 404 when you are not a member.',\n      params: CommunityParam,\n      querystring: PageQuery,\n      response: { 200: PostFeedPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.memberFeed(req.orgId, actor, req.params.communityId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/own-posts',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listOwnPosts',\n      tags,\n      summary: 'Your own posts in a community, newest first',\n      description:\n        'For a member of the community. Your posts in any status, drafts included, in the spaces you can open. 404 when you are not a member.',\n      params: CommunityParam,\n      querystring: PageQuery,\n      response: { 200: PostFeedPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.listOwn(req.orgId, actor, req.params.communityId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/bookmarks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listBookmarkedPosts',\n      tags,\n      summary: 'The posts you bookmarked in a community, newest bookmark first',\n      description:\n        'For a member of the community. Only posts you can still read. 404 when you are not a member.',\n      params: CommunityParam,\n      querystring: PageQuery,\n      response: { 200: PostFeedPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.listBookmarked(req.orgId, actor, req.params.communityId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/feed',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getSpaceFeed',\n      tags,\n      summary: 'Published posts in a space',\n      description:\n        'For anyone who can open the space (403 otherwise). Filter by `topicId`; an unknown topic is a 404.',\n      params: CommunitySpaceParam,\n      querystring: FeedQuery,\n      response: { 200: PostFeedPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.spaceFeed(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.query,\n      );\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/queue',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getSpaceQueue',\n      tags,\n      summary: 'The moderation queue of a space you moderate',\n      description:\n        'For a moderator who can open the space. Posts awaiting review, and the open flags on posts and on comments in the space. Each list holds at most the 100 oldest entries: pending posts by creation, flags by when they were raised; working the queue brings in the next ones.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceQueue, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.moderationQueue(req.orgId, actor, req.params.communityId, req.params.spaceId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/posts',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createPost',\n      tags,\n      summary: 'Create a post',\n      description:\n        'For anyone who can open the space. `mode` decides the status: `draft`, `scheduled`, or on `submit` `published`, or `pending` when the space requires review and you are not staff. 409 when the space has topics and none is given. 400 when a schedule is missing or in the past. 503 when a scheduled post could not be timed; the post is then kept as a draft, and `details.postId` names it, so open that draft instead of creating the post again.',\n      params: CommunitySpaceParam,\n      body: CreatePost,\n      response: { 201: PostView, ...refusals(400, 403, 404, 409, 503) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const post = await posts.create(req.orgId, actor, {\n        ...req.body,\n        communityId: req.params.communityId,\n        spaceId: req.params.spaceId,\n      });\n      req.log.info({ postId: post.id, status: post.status }, 'post created');\n      return reply.code(201).send(post);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/posts/:postId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getPost',\n      tags,\n      summary: 'Read a post',\n      description:\n        'For anyone who can open the space while the post is published; for its author in any status; for moderators also while it is pending or removed. Any other post is a 404.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.getPost(req.orgId, actor, req.params.postId);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/posts/:postId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updatePost',\n      tags,\n      summary: 'Edit your own post',\n      description:\n        'Author only. Changes only the fields sent. 409 when the post is removed, or the topic rules of the space are not met.',\n      params: PostIdParam,\n      body: UpdatePost,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.update(req.orgId, req.params.postId, actor, req.body);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/submission',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'submitPost',\n      tags,\n      summary: 'Submit your draft or scheduled post',\n      description:\n        'Author only. Publishes it now, or holds it for review when the space requires review and you are not staff. A scheduled post is no longer published at its time. 409 when the post is not a draft or scheduled.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.submit(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/schedule',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'schedulePost',\n      tags,\n      summary: 'Schedule your post',\n      description:\n        'Author only. Schedules a draft, or moves a scheduled post to a new time; the post is submitted at `scheduledAt`. 409 when it is already submitted or removed, or the time is not in the future. 503 when the time could not be set; a draft stays a draft and a moved post keeps its previous time, and `details.postId` names the post.',\n      params: PostIdParam,\n      body: SchedulePost,\n      response: { 200: PostView, ...refusals(403, 404, 409, 503) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.schedule(req.orgId, req.params.postId, actor, req.body.scheduledAt);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/unschedule',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'unschedulePost',\n      tags,\n      summary: 'Unschedule your post',\n      description:\n        'Author only. The scheduled post becomes a draft and is not submitted at its time. 409 when the post is not scheduled.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.unschedule(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/approval',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'approvePost',\n      tags,\n      summary: 'Publish a post that awaits review in a space you moderate',\n      description:\n        'For a moderator who can open the space. 409 when the post is not awaiting review.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.approve(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/removal',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removePost',\n      tags,\n      summary: 'Remove your post, or one in a space you moderate',\n      description:\n        \"For the author or a moderator. Takes a published or pending post down; a moderator removing someone else's post resolves its open flags as `removed`. 409 when it is already removed or was never submitted.\",\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.remove(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/restoration',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'restorePost',\n      tags,\n      summary: 'Restore a removed post in a space you moderate',\n      description: 'For a moderator who can open the space. 409 when the post is not removed.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.restore(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/pin',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'pinPost',\n      tags,\n      summary: 'Pin a post in a space you moderate',\n      description: 'For a moderator. Pinned posts lead the feeds. 409 when the post is removed.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.pin(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/unpin',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'unpinPost',\n      tags,\n      summary: 'Unpin a post in a space you moderate',\n      description: 'For a moderator. 409 when the post is removed.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.unpin(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/comments/close',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'closePostComments',\n      tags,\n      summary: 'Close comments on a post in a space you moderate',\n      description:\n        'For a moderator. Nobody can comment until they are opened again. 409 when the post is removed.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.closeComments(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/comments/open',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'openPostComments',\n      tags,\n      summary: 'Open comments on a post in a space you moderate',\n      description: 'For a moderator. 409 when the post is removed.',\n      params: PostIdParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.openComments(req.orgId, req.params.postId, actor);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/posts/:postId/reactions',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setPostReactionPolicy',\n      tags,\n      summary: 'Turn reactions on or off for a post in a space you moderate',\n      description:\n        \"For a moderator. Overrides the space's reactions setting for this post. 409 when the post is removed.\",\n      params: PostIdParam,\n      body: SetPostReactions,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.setReactions(req.orgId, req.params.postId, actor, req.body.enabled);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/posts/:postId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setPostReaction',\n      tags,\n      summary: 'Set your reaction on a post',\n      description:\n        'For anyone who can read the post, while reactions are on for it (403 otherwise). Replaces any reaction you already had and returns the new counts.',\n      params: PostIdParam,\n      body: SetReaction,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.setReaction(req.orgId, req.params.postId, actor, req.body.emoji);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/posts/:postId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'clearPostReaction',\n      tags,\n      summary: 'Withdraw your reaction from a post',\n      description:\n        'For anyone who can read the post, while reactions are on for it (403 otherwise). Returns the new counts.',\n      params: PostIdParam,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return posts.setReaction(req.orgId, req.params.postId, actor, null);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/posts/:postId/subscription',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setPostSubscription',\n      tags,\n      summary: 'Follow or mute a post, or clear either',\n      description:\n        'For anyone who can read the post. `following` notifies you of its new comments. `muted` stops its activity notifying you, until `mutedUntil` when given; mentions and actions on you still notify. `none` clears both.',\n      params: PostIdParam,\n      body: SetPostSubscription,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await container.subscriptions.setPost(req.orgId, actor, req.params.postId, req.body);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/bookmark',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'bookmarkPost',\n      tags,\n      summary: 'Bookmark a post',\n      description: 'For anyone who can read the post. Bookmarking twice is harmless.',\n      params: PostIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await posts.bookmark(req.orgId, req.params.postId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/posts/:postId/bookmark',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'unbookmarkPost',\n      tags,\n      summary: 'Remove a bookmark',\n      description: 'For anyone who can read the post. Harmless when you have not bookmarked it.',\n      params: PostIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await posts.unbookmark(req.orgId, req.params.postId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/flags',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'flagPost',\n      tags,\n      summary: 'Flag a post for the moderators',\n      description:\n        'For anyone who can read the post. Flagging it again while your flag is open returns that flag.',\n      params: PostIdParam,\n      body: FlagReason,\n      response: { 201: PostFlag, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const flag = await posts.flag(req.orgId, req.params.postId, actor, req.body.reason);\n      return reply.code(201).send(flag);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/flags/resolution',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resolvePostFlags',\n      tags,\n      summary: 'Dismiss the open flags on a post in a space you moderate',\n      description:\n        'For a moderator who can open the space. Closes every open flag and leaves the post up.',\n      params: PostIdParam,\n      body: ResolvePostFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await posts.resolveFlags(req.orgId, req.params.postId, actor, req.body.resolution);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/posts/:postId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listPostComments',\n      tags,\n      summary: \"Read a post's comments\",\n      description:\n        'For anyone who can read the post. Pages by top-level comment, oldest first. Each page carries its top-level comments and all of their replies; `total` counts top-level comments.',\n      params: PostIdParam,\n      querystring: PageQuery,\n      response: { 200: PostCommentsPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.discussion.postComments(req.orgId, req.params.postId, actor, req.query);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/posts/:postId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createPostComment',\n      tags,\n      summary: 'Comment on a post',\n      description:\n        'For anyone who can read the post, while its comments are open (403 otherwise). Replies nest one level. 409 when the post is not published.',\n      params: PostIdParam,\n      body: PostComment,\n      response: { 201: CommentView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const comment = await container.discussion.postComment(req.orgId, {\n        actor,\n        postId: req.params.postId,\n        parentId: req.body.parentId,\n        body: req.body.body,\n      });\n      return reply.code(201).send(comment);\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AA8BA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,QAAQ,UAAU;CACxB,MAAM,OAAO,CAAC,OAAO;CAErB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,WAAW,IAAI,OAAO,OAAO,IAAI,OAAO,aAAa,IAAI,KAAK;EAC7E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,QAAQ,IAAI,OAAO,OAAO,IAAI,OAAO,aAAa,IAAI,KAAK;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,eAAe,IAAI,OAAO,OAAO,IAAI,OAAO,aAAa,IAAI,KAAK;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,UACX,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KACN;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,OAAO,aAAa,IAAI,OAAO,OAAO;EAC3F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,MAAM,OAAO,IAAI,OAAO,OAAO;IAChD,GAAG,IAAI;IACP,aAAa,IAAI,OAAO;IACxB,SAAS,IAAI,OAAO;GACtB,CAAC;GACD,IAAI,IAAI,KAAK;IAAE,QAAQ,KAAK;IAAI,QAAQ,KAAK;GAAO,GAAG,cAAc;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;EAClC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,QAAQ,IAAI,OAAO,OAAO,IAAI,OAAO,MAAM;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,OAAO,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,IAAI;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,OAAO,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,SAAS,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,WAAW;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,WAAW,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EAC7D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,OAAO,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,IAAI,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,MAAM,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EACxD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,cAAc,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;EAC/D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,OAAO;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,YAAY,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,MAAM,YAAY,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI;EACpE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,UAAU,cAAc,QAAQ,IAAI,OAAO,OAAO,IAAI,OAAO,QAAQ,IAAI,IAAI;GACnF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,MAAM,SAAS,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;GACxD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,MAAM,WAAW,IAAI,OAAO,IAAI,OAAO,QAAQ,KAAK;GAC1D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,MAAM,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,MAAM;GAClF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;EAClC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK,UAAU;GACjF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,WAAW,aAAa,IAAI,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,KAAK;EACzF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,UAAU,MAAM,UAAU,WAAW,YAAY,IAAI,OAAO;IAChE;IACA,QAAQ,IAAI,OAAO;IACnB,UAAU,IAAI,KAAK;IACnB,MAAM,IAAI,KAAK;GACjB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;AACH"}

package/dist/http/routes/member/profile.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/profile.d.ts
+declare function memberProfileRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberProfileRoutes };
+//# sourceMappingURL=profile.d.ts.map

package/dist/http/routes/member/profile.js

@@ -0,0 +1,48 @@
+import { refusals } from "../../schemas/shared.js";
+import { UpdateProfile, UserProfile } from "../../schemas/profile.js";
+import "../../schemas/index.js";
+import { actorOf } from "./actor.js";
+//#region src/http/routes/member/profile.ts
+async function memberProfileRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const tags = ["Profile"];
+	r.route({
+		method: "GET",
+		url: "/api/member/profile",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberProfile",
+			tags,
+			summary: "Read your profile",
+			description: "For any signed-in person. The profile is yours across organizations; `imageUrl` is set only when the photo was uploaded in this organization. Before you save one, every field is empty.",
+			response: { 200: UserProfile }
+		},
+		handler: async (req) => {
+			return container.identity.profileOf(req.orgId, req.userId);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/profile",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateMemberProfile",
+			tags,
+			summary: "Update your profile",
+			description: "For a member of the organization. Changes only the fields sent; null clears one. 404 when `imageAssetId` is not a finalized image you uploaded here.",
+			body: UpdateProfile,
+			response: {
+				200: UserProfile,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			return container.identity.updateProfile(req.orgId, req.userId, req.userId, orgUser.id, req.body);
+		}
+	});
+}
+//#endregion
+export { memberProfileRoutes };
+
+//# sourceMappingURL=profile.js.map

package/dist/http/routes/member/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","names":[],"sources":["../../../../src/http/routes/member/profile.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\nimport { UpdateProfile, UserProfile, refusals } from '../../schemas/index.js';\n\nexport async function memberProfileRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Profile'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/profile',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberProfile',\n      tags,\n      summary: 'Read your profile',\n      description:\n        'For any signed-in person. The profile is yours across organizations; `imageUrl` is set only when the photo was uploaded in this organization. Before you save one, every field is empty.',\n      response: { 200: UserProfile },\n    },\n    handler: async (req) => {\n      return container.identity.profileOf(req.orgId, req.userId);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/profile',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberProfile',\n      tags,\n      summary: 'Update your profile',\n      description:\n        'For a member of the organization. Changes only the fields sent; null clears one. 404 when `imageAssetId` is not a finalized image you uploaded here.',\n      body: UpdateProfile,\n      response: { 200: UserProfile, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return container.identity.updateProfile(\n        req.orgId,\n        req.userId,\n        req.userId,\n        orgUser.id,\n        req.body,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;AAMA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,SAAS,UAAU,IAAI,OAAO,IAAI,MAAM;EAC3D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,UAAU,SAAS,cACxB,IAAI,OACJ,IAAI,QACJ,IAAI,QACJ,QAAQ,IACR,IAAI,IACN;EACF;CACF,CAAC;AACH"}

package/dist/http/routes/member/progress.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/progress.d.ts
+declare function memberProgressRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberProgressRoutes };
+//# sourceMappingURL=progress.d.ts.map

package/dist/http/routes/member/progress.js

@@ -0,0 +1,60 @@
+import { refusals } from "../../schemas/shared.js";
+import { CourseProgress, MemberCourseIdParam, ProgressStatus, ReportProgress } from "../../schemas/member.js";
+import "../../schemas/index.js";
+import { actorOf } from "./actor.js";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/http/routes/member/progress.ts
+async function memberProgressRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const member = container.reporting.member;
+	r.route({
+		method: "POST",
+		url: "/api/member/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reportProgress",
+			tags: ["Progress"],
+			summary: "Report usage on an activity; the progress service decides completion",
+			description: "For a member who can open the course. Reports facts, never a decision: the service decides whether the activity is complete. 404 when the activity or its course is not published, or you cannot open it.",
+			body: ReportProgress,
+			response: {
+				200: ProgressStatus,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			return { status: (await container.progress.report(req.orgId, {
+				orgUserId: orgUser.id,
+				activityId: req.body.activity,
+				reports: req.body.reports
+			})).completedAt ? "completed" : "in-progress" };
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/courses/:courseId/progress",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberCourseProgress",
+			tags: ["Progress"],
+			summary: "Your progress in one course",
+			description: "For a member of the organization, derived from the course's current structure. 404 when the course is not published or you do not hold it.",
+			params: MemberCourseIdParam,
+			response: {
+				200: CourseProgress,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const orgUser = await actorOf(container, req.orgId, req.userId);
+			const view = await member.courseProgress(req.orgId, orgUser.id, req.params.courseId);
+			if (!view) throw new NotFoundError("Course", req.params.courseId);
+			return view;
+		}
+	});
+}
+//#endregion
+export { memberProgressRoutes };
+
+//# sourceMappingURL=progress.js.map

package/dist/http/routes/member/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","names":[],"sources":["../../../../src/http/routes/member/progress.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  CourseProgress,\n  MemberCourseIdParam,\n  ProgressStatus,\n  ReportProgress,\n  refusals,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberProgressRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reportProgress',\n      tags: ['Progress'],\n      summary: 'Report usage on an activity; the progress service decides completion',\n      description:\n        'For a member who can open the course. Reports facts, never a decision: the service decides whether the activity is complete. 404 when the activity or its course is not published, or you cannot open it.',\n      body: ReportProgress,\n      response: { 200: ProgressStatus, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const record = await container.progress.report(req.orgId, {\n        orgUserId: orgUser.id,\n        activityId: req.body.activity,\n        reports: req.body.reports,\n      });\n      return { status: record.completedAt ? ('completed' as const) : ('in-progress' as const) };\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/progress',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourseProgress',\n      tags: ['Progress'],\n      summary: 'Your progress in one course',\n      description:\n        \"For a member of the organization, derived from the course's current structure. 404 when the course is not published or you do not hold it.\",\n      params: MemberCourseIdParam,\n      response: { 200: CourseProgress, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const view = await member.courseProgress(req.orgId, orgUser.id, req.params.courseId);\n      if (!view) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return view;\n    },\n  });\n}\n"],"mappings":";;;;;;AAaA,eAAsB,qBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAM9D,OAAO,EAAE,SAAQ,MALI,UAAU,SAAS,OAAO,IAAI,OAAO;IACxD,WAAW,QAAQ;IACnB,YAAY,IAAI,KAAK;IACrB,SAAS,IAAI,KAAK;GACpB,CAAC,EAAA,CACuB,cAAe,cAAyB,cAAwB;EAC1F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,UAAU;GACjB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,OAAO,MAAM,OAAO,eAAe,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACnF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes/organizations.js

@@ -1,11 +1,13 @@
-import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
+import { refusals } from "../schemas/shared.js";
+import { resolveConfiguratorScope, resolveScope } from "../scope.js";
 import { CreateOrganization, Organization, UpdateOrganization } from "../schemas/organizations.js";
-import { Member, MemberIdParam, MembersPage, MembersQuery, UpdateMemberRole } from "../schemas/members.js";
+import { MemberIdParam, MemberRoleChange, MembersPage, MembersQuery, UpdateMemberRole } from "../schemas/members.js";
 import { AcceptInvite, AcceptInviteResult, CreateInvite, GetInviteResult, Invite, InviteTokenParam } from "../schemas/invites.js";
+import { NotificationCategoryDefaults, NotificationCategoryList, NotificationChannelInfos, NotificationListScopeQuery, NotificationTypeInfos, ReplaceNotificationCategories } from "../schemas/notifications.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
+import { typesForList } from "@headless-lms/core/shared/notification-categories";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/organizations.ts
 async function organizationsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -19,6 +21,7 @@ async function organizationsRoutes(app, container) {
 			operationId: "createOrganization",
 			tags,
 			summary: "Create an organization and make it active",
+			description: "For any signed-in person, including one with no organization yet. The caller becomes its owner.",
 			body: CreateOrganization,
 			response: { 201: Organization }
 		},
@@ -39,11 +42,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "updateOrganization",
 			tags,
-			summary: "Update the active organization",
+			summary: "Update the active organization (staff)",
+			description: "Owner or admin. Changes its name or slug; 409 when the slug is taken.",
 			body: UpdateOrganization,
 			response: {
 				200: Organization,
-				409: ErrorBody
+				...refusals(403, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -64,9 +68,13 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "listMembers",
 			tags,
-			summary: "List organization members",
+			summary: "List the organization's team members (staff)",
+			description: "Staff only (owner, admin, instructor). The team: everyone in the organization who is not a student.",
 			querystring: MembersQuery,
-			response: { 200: MembersPage }
+			response: {
+				200: MembersPage,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -80,13 +88,13 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "updateMemberRole",
 			tags,
-			summary: "Change a member's role",
+			summary: "Change a member's role (staff)",
+			description: "Owner or admin only. The owner role can be neither granted nor changed (409), and only a moderator can become a student.",
 			params: MemberIdParam,
 			body: UpdateMemberRole,
 			response: {
-				200: Member,
-				404: ErrorBody,
-				409: ErrorBody
+				200: MemberRoleChange,
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req) => {
@@ -96,7 +104,10 @@ async function organizationsRoutes(app, container) {
 				authOrgId: scope.authOrgId,
 				headers: req.headers
 			};
-			const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);
+			const member = await organizations.updateMemberRole(ctx, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id, req.body.role);
 			if (!member) throw new NotFoundError("Member", req.params.id);
 			return member;
 		}
@@ -108,12 +119,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "removeMember",
 			tags,
-			summary: "Remove an organization member",
+			summary: "Remove an organization member (staff)",
+			description: "Owner or admin only. Removing a pending member cancels their invite. The owner cannot be removed (409).",
 			params: MemberIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody,
-				409: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
@@ -123,7 +134,10 @@ async function organizationsRoutes(app, container) {
 				authOrgId: scope.authOrgId,
 				headers: req.headers
 			};
-			if (!await organizations.removeMember(ctx, req.params.id)) throw new NotFoundError("Member", req.params.id);
+			if (!await organizations.removeMember(ctx, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id)) throw new NotFoundError("Member", req.params.id);
 			return reply.code(204).send();
 		}
 	});
@@ -134,16 +148,20 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "createInvite",
 			tags,
-			summary: "Invite a member or student into the active organization",
+			summary: "Invite a member or student into the active organization (staff)",
+			description: "Owner or admin only. A student is created by this call, so their access can be granted before they accept. 409 when a student with that email is already in the organization.",
 			body: CreateInvite,
 			response: {
 				201: Invite,
-				409: ErrorBody
+				...refusals(403, 409)
 			}
 		},
-		handler: async (req) => {
+		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
 			const invite = await organizations.createInvite({
+				id: scope.orgUserId,
+				role: scope.role
+			}, {
 				orgId: scope.orgId,
 				inviterUserId: scope.userId,
 				email: req.body.email,
@@ -152,8 +170,15 @@ async function organizationsRoutes(app, container) {
 				...req.body.lastName !== void 0 && { lastName: req.body.lastName },
 				sendEmail: req.body.sendEmail
 			});
-			req.log.debug({ invite }, "created invite");
-			return invite;
+			req.log.debug({ inviteId: invite.id }, "created invite");
+			return reply.code(201).send({
+				id: invite.id,
+				email: invite.email,
+				role: invite.role,
+				status: invite.status,
+				expiresAt: invite.expiresAt,
+				createdAt: invite.createdAt
+			});
 		}
 	});
 	r.route({
@@ -163,10 +188,11 @@ async function organizationsRoutes(app, container) {
 			operationId: "getInvite",
 			tags,
 			summary: "Read an invite by its token",
+			description: "Public: no session needed. The same 404 answers forged, expired and accepted tokens, so a probe learns nothing.",
 			params: InviteTokenParam,
 			response: {
 				200: GetInviteResult,
-				404: ErrorBody
+				...refusals(404)
 			}
 		},
 		handler: async (req) => {
@@ -187,11 +213,12 @@ async function organizationsRoutes(app, container) {
 		schema: {
 			operationId: "acceptInvite",
 			tags,
-			summary: "Accept an invite with the logged-in account",
+			summary: "Accept an invite with the signed-in account",
+			description: "For any signed-in person whose email matches the invitation. Makes the invite's organization the session's active one. 400 when the token is invalid or expired, or the email does not match.",
 			body: AcceptInvite,
 			response: {
 				200: AcceptInviteResult,
-				400: ErrorBody
+				...refusals(400, 404)
 			}
 		},
 		handler: async (req) => {
@@ -212,6 +239,125 @@ async function organizationsRoutes(app, container) {
 			return {};
 		}
 	});
+	const notificationTags = ["Notifications"];
+	r.route({
+		method: "GET",
+		url: "/api/notification-types",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listNotificationTypes",
+			tags: notificationTags,
+			summary: "List the notification types a category list can cover (staff)",
+			description: "Owner or admin only. `scope=org` lists the types the org list can cover, `scope=community` those a community list can cover. Each type carries all its scopes, so an editor can tell which types can be per space.",
+			querystring: NotificationListScopeQuery,
+			response: {
+				200: NotificationTypeInfos,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			await resolveConfiguratorScope(container, req);
+			return typesForList(container.notificationTypes, req.query.scope);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/notification-channels",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listNotificationChannels",
+			tags: notificationTags,
+			summary: "List the notification channels this deployment can deliver on (staff)",
+			description: "Owner or admin only. `inApp` is always first.",
+			response: {
+				200: NotificationChannelInfos,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			await resolveConfiguratorScope(container, req);
+			return container.notificationChannels.list().map((channel) => ({ channel }));
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/notification-categories",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getOrgNotificationCategories",
+			tags: notificationTags,
+			summary: "Get the organization's notification categories (staff)",
+			description: "Owner or admin only. The list in use for notifications outside any community, with `source` saying whether it is the default or a stored list.",
+			response: {
+				200: NotificationCategoryList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveConfiguratorScope(container, req);
+			return container.notificationCategories.org.get(scope.orgId, scope.orgId);
+		}
+	});
+	r.route({
+		method: "PUT",
+		url: "/api/notification-categories",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "replaceOrgNotificationCategories",
+			tags: notificationTags,
+			summary: "Replace the organization's notification categories (staff)",
+			description: "Owner or admin only. Stores the whole list. 422 when a key repeats, a type cannot be in the org list, a reason is not allowed for its type, a channel is not configured, or earlier categories already cover everything a category covers.",
+			body: ReplaceNotificationCategories,
+			response: {
+				200: NotificationCategoryList,
+				...refusals(400, 403, 422)
+			}
+		},
+		handler: async (req) => {
+			const scope = await resolveConfiguratorScope(container, req);
+			return container.notificationCategories.org.replace(scope.orgId, scope.orgId, req.body.categories);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/notification-categories",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "resetOrgNotificationCategories",
+			tags: notificationTags,
+			summary: "Go back to the default notification categories for the organization (staff)",
+			description: "Owner or admin only. Removes the stored list; the default applies again.",
+			response: {
+				204: z.void(),
+				...refusals(403)
+			}
+		},
+		handler: async (req, reply) => {
+			const scope = await resolveConfiguratorScope(container, req);
+			await container.notificationCategories.org.reset(scope.orgId, scope.orgId);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/notification-categories/defaults",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getDefaultNotificationCategories",
+			tags: notificationTags,
+			summary: "Get the default notification categories (staff)",
+			description: "Owner or admin only. The default org list (`scope=org`) or community list (`scope=community`), offering only the configured channels.",
+			querystring: NotificationListScopeQuery,
+			response: {
+				200: NotificationCategoryDefaults,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			await resolveConfiguratorScope(container, req);
+			return { categories: (req.query.scope === "org" ? container.notificationCategories.org : container.notificationCategories.community).defaults() };
+		}
+	});
 }
 //#endregion
 export { organizationsRoutes };

package/dist/http/routes/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","names":[],"sources":["../../../src/http/routes/organizations.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AcceptInvite,\n  AcceptInviteResult,\n  CreateInvite,\n  CreateOrganization,\n  ErrorBody,\n  Invite,\n  Member,\n  MemberIdParam,\n  MembersPage,\n  MembersQuery,\n  GetInviteResult,\n  InviteTokenParam,\n  Organization,\n  UpdateMemberRole,\n  UpdateOrganization,\n} from '../schemas/index.js';\nimport type { MemberWriteContext } from '@headless-lms/core/organizations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function organizationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const organizations = container.organizations;\n  const tags = ['Organizations'];\n\n  // Create a new organization on the caller's behalf and make it their active\n  // org. This is the API's own front door for org creation — it drives Better\n  // Auth internally, so callers use the typed SDK, not the auth namespace. No\n  // resolveScope here: the caller has no active org yet, only a session.\n  r.route({\n    method: 'POST',\n    url: '/api/organizations',\n    // Session only: a first-time signup has no active org yet, so requiring one\n    // here would 401 the very call that produces it.\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'createOrganization',\n      tags,\n      summary: 'Create an organization and make it active',\n      body: CreateOrganization,\n      response: { 201: Organization },\n    },\n    handler: async (req, reply) => {\n      const org = await container.orgProvider.createOrganization(req.headers, req.body);\n      return reply.code(201).send({\n        name: org.name,\n        slug: org.slug,\n        id: org.id,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  // Update the caller's active organization (name/slug). Writes go through Better\n  // Auth, which enforces the caller's org-update permission (owner/admin).\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateOrganization',\n      tags,\n      summary: 'Update the active organization',\n      body: UpdateOrganization,\n      response: { 200: Organization, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const org = await container.orgProvider.updateOrganization(\n        req.headers,\n        scope.authOrgId,\n        req.body,\n      );\n      return reply.send({\n        id: org.id,\n        name: org.name,\n        slug: org.slug,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMembers',\n      tags,\n      summary: 'List organization members',\n      querystring: MembersQuery,\n      response: { 200: MembersPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return organizations.listMembers(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations/members/:id/role',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberRole',\n      tags,\n      summary: \"Change a member's role\",\n      params: MemberIdParam,\n      body: UpdateMemberRole,\n      response: { 200: Member, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const member = await organizations.updateMemberRole(ctx, req.params.id, req.body.role);\n      if (!member) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return member;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/organizations/members/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMember',\n      tags,\n      summary: 'Remove an organization member',\n      params: MemberIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const removed = await organizations.removeMember(ctx, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createInvite',\n      tags,\n      summary: 'Invite a member or student into the active organization',\n      body: CreateInvite,\n      response: { 201: Invite, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      // Domain ids, not the session's auth ids: invites FK to organizations.id\n      // and users.id.\n      const scope = await resolveScope(container, req);\n      const invite = await organizations.createInvite({\n        orgId: scope.orgId,\n        inviterUserId: scope.userId,\n        email: req.body.email,\n        role: req.body.role,\n        ...(req.body.firstName !== undefined && { firstName: req.body.firstName }),\n        ...(req.body.lastName !== undefined && { lastName: req.body.lastName }),\n        sendEmail: req.body.sendEmail,\n      });\n\n      req.log.debug({ invite }, 'created invite');\n      return invite;\n    },\n  });\n\n  // The invite landing page's first call, made before the invitee has any\n  // session — so no guard. It turns the emailed token into the two facts the\n  // page needs: who the invitation is for, and whether that address already has\n  // an account. The email comes from the invitation row rather than the URL, so\n  // it cannot be steered by editing the link.\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/invites/:token',\n    schema: {\n      operationId: 'getInvite',\n      tags,\n      summary: 'Read an invite by its token',\n      params: InviteTokenParam,\n      response: { 200: GetInviteResult, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const invite = await organizations.peekInvite(req.params.token);\n      if (!invite) {\n        // Same answer for forged, expired, and already-accepted tokens: a\n        // probe learns nothing about which invitations exist.\n        throw new NotFoundError('Invite', 'token');\n      }\n      // Whether the address already has a login is deliberately not answered\n      // here. The mirror cannot say — an admin's student is a person long\n      // before they are an account — and asking the auth engine would mean\n      // reading its tables for one boolean. The sign-up form discovers it\n      // instead: a duplicate signup comes back 422 and the page flips to\n      // sign-in.\n      const person = await container.identity.getUserByEmail(invite.email);\n      return {\n        email: invite.email,\n        firstName: person?.firstName ?? null,\n        lastName: person?.lastName ?? null,\n      };\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites/accept',\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'acceptInvite',\n      tags,\n      summary: 'Accept an invite with the logged-in account',\n      body: AcceptInvite,\n      response: { 200: AcceptInviteResult, 400: ErrorBody },\n    },\n    handler: async (req) => {\n      // No active org yet, so no resolveScope — but acceptInvite links a domain\n      // users.id, never the auth account id.\n      const user = await container.identity.getUserByExternalId(req.authUser.id);\n      if (!user) {\n        throw new NotFoundError('User', req.authUser.id);\n      }\n      const accepted = await container.organizations.acceptInvite({\n        token: req.body.token,\n        userId: user.id,\n        email: req.authUser.email,\n      });\n\n      // The session predates this grant, so it carries no active org and every\n      // org-scoped read would 401. Students are never org members, so the org\n      // plugin's set-active cannot do it — stamp the session row directly.\n      const org = await container.organizations.getById(accepted.orgId);\n      if (!org) {\n        throw new NotFoundError('Organization', accepted.orgId);\n      }\n      const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);\n\n      req.log.info({ accepted, stamped }, 'accepted invite');\n      return {};\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AAyBA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,gBAAgB,UAAU;CAChC,MAAM,OAAO,CAAC,eAAe;CAM7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EAGL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,IAAI,IAAI;GAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,KAAK;GAAU;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAAM,MAAM,UAAU,YAAY,mBACtC,IAAI,SACJ,MAAM,WACN,IAAI,IACN;GACA,OAAO,MAAM,KAAK;IAChB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,YAAY;EAC/B;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,cAAc,YAAY,MAAM,OAAO,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;IAAW,KAAK;GAAU;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GACA,MAAM,SAAS,MAAM,cAAc,iBAAiB,KAAK,IAAI,OAAO,IAAI,IAAI,KAAK,IAAI;GACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GAEA,IAAI,CAAC,MADiB,cAAc,aAAa,KAAK,IAAI,OAAO,EAAE,GAEjE,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,KAAK;GAAU;EAC1C;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,cAAc,aAAa;IAC9C,OAAO,MAAM;IACb,eAAe,MAAM;IACrB,OAAO,IAAI,KAAK;IAChB,MAAM,IAAI,KAAK;IACf,GAAI,IAAI,KAAK,cAAc,KAAA,KAAa,EAAE,WAAW,IAAI,KAAK,UAAU;IACxE,GAAI,IAAI,KAAK,aAAa,KAAA,KAAa,EAAE,UAAU,IAAI,KAAK,SAAS;IACrE,WAAW,IAAI,KAAK;GACtB,CAAC;GAED,IAAI,IAAI,MAAM,EAAE,OAAO,GAAG,gBAAgB;GAC1C,OAAO;EACT;CACF,CAAC;CAOD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,KAAK;GAAU;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,SAAS,MAAM,cAAc,WAAW,IAAI,OAAO,KAAK;GAC9D,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,UAAU,OAAO;GAQ3C,MAAM,SAAS,MAAM,UAAU,SAAS,eAAe,OAAO,KAAK;GACnE,OAAO;IACL,OAAO,OAAO;IACd,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY;GAChC;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,MAAM;GACN,UAAU;IAAE,KAAK;IAAoB,KAAK;GAAU;EACtD;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,IAAI,SAAS,EAAE;GACzE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;GAEjD,MAAM,WAAW,MAAM,UAAU,cAAc,aAAa;IAC1D,OAAO,IAAI,KAAK;IAChB,QAAQ,KAAK;IACb,OAAO,IAAI,SAAS;GACtB,CAAC;GAKD,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK;GAChE,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,SAAS,KAAK;GAExD,MAAM,UAAU,MAAM,UAAU,SAAS,wBAAwB,IAAI,SAAS,IAAI,EAAE;GAEpF,IAAI,IAAI,KAAK;IAAE;IAAU;GAAQ,GAAG,iBAAiB;GACrD,OAAO,CAAC;EACV;CACF,CAAC;AACH"}
+{"version":3,"file":"organizations.js","names":[],"sources":["../../../src/http/routes/organizations.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AcceptInvite,\n  AcceptInviteResult,\n  CreateInvite,\n  CreateOrganization,\n  Invite,\n  MemberIdParam,\n  NotificationCategoryDefaults,\n  NotificationCategoryList,\n  NotificationChannelInfos,\n  NotificationListScopeQuery,\n  NotificationTypeInfos,\n  ReplaceNotificationCategories,\n  MemberRoleChange,\n  MembersPage,\n  MembersQuery,\n  GetInviteResult,\n  InviteTokenParam,\n  Organization,\n  UpdateMemberRole,\n  UpdateOrganization,\n  refusals,\n} from '../schemas/index.js';\nimport type { MemberWriteContext } from '@headless-lms/core/organizations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveConfiguratorScope, resolveScope } from '../scope.js';\nimport { typesForList } from '@headless-lms/core/shared/notification-categories';\n\nexport async function organizationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const organizations = container.organizations;\n  const tags = ['Organizations'];\n\n  // Create a new organization on the caller's behalf and make it their active\n  // org. This is the API's own front door for org creation — it drives Better\n  // Auth internally, so callers use the typed SDK, not the auth namespace. No\n  // resolveScope here: the caller has no active org yet, only a session.\n  r.route({\n    method: 'POST',\n    url: '/api/organizations',\n    // Session only: a first-time signup has no active org yet, so requiring one\n    // here would 401 the very call that produces it.\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'createOrganization',\n      tags,\n      summary: 'Create an organization and make it active',\n      description:\n        'For any signed-in person, including one with no organization yet. The caller becomes its owner.',\n      body: CreateOrganization,\n      response: { 201: Organization },\n    },\n    handler: async (req, reply) => {\n      const org = await container.orgProvider.createOrganization(req.headers, req.body);\n      return reply.code(201).send({\n        name: org.name,\n        slug: org.slug,\n        id: org.id,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  // Update the caller's active organization (name/slug). Writes go through Better\n  // Auth, which enforces the caller's org-update permission (owner/admin).\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateOrganization',\n      tags,\n      summary: 'Update the active organization (staff)',\n      description: 'Owner or admin. Changes its name or slug; 409 when the slug is taken.',\n      body: UpdateOrganization,\n      response: { 200: Organization, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const org = await container.orgProvider.updateOrganization(\n        req.headers,\n        scope.authOrgId,\n        req.body,\n      );\n      return reply.send({\n        id: org.id,\n        name: org.name,\n        slug: org.slug,\n        createdAt: org.createdAt.toISOString(),\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMembers',\n      tags,\n      summary: \"List the organization's team members (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The team: everyone in the organization who is not a student.',\n      querystring: MembersQuery,\n      response: { 200: MembersPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return organizations.listMembers(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/organizations/members/:id/role',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberRole',\n      tags,\n      summary: \"Change a member's role (staff)\",\n      description:\n        'Owner or admin only. The owner role can be neither granted nor changed (409), and only a moderator can become a student.',\n      params: MemberIdParam,\n      body: UpdateMemberRole,\n      response: { 200: MemberRoleChange, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const member = await organizations.updateMemberRole(\n        ctx,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n        req.body.role,\n      );\n      if (!member) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return member;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/organizations/members/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMember',\n      tags,\n      summary: 'Remove an organization member (staff)',\n      description:\n        'Owner or admin only. Removing a pending member cancels their invite. The owner cannot be removed (409).',\n      params: MemberIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const ctx: MemberWriteContext = {\n        orgId: scope.orgId,\n        authOrgId: scope.authOrgId,\n        headers: req.headers,\n      };\n      const removed = await organizations.removeMember(\n        ctx,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n      );\n      if (!removed) {\n        throw new NotFoundError('Member', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createInvite',\n      tags,\n      summary: 'Invite a member or student into the active organization (staff)',\n      description:\n        'Owner or admin only. A student is created by this call, so their access can be granted before they accept. 409 when a student with that email is already in the organization.',\n      body: CreateInvite,\n      response: { 201: Invite, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      // Domain ids, not the session's auth ids: invites FK to organizations.id\n      // and users.id.\n      const scope = await resolveScope(container, req);\n      const invite = await organizations.createInvite(\n        { id: scope.orgUserId, role: scope.role },\n        {\n          orgId: scope.orgId,\n          inviterUserId: scope.userId,\n          email: req.body.email,\n          role: req.body.role,\n          ...(req.body.firstName !== undefined && { firstName: req.body.firstName }),\n          ...(req.body.lastName !== undefined && { lastName: req.body.lastName }),\n          sendEmail: req.body.sendEmail,\n        },\n      );\n\n      req.log.debug({ inviteId: invite.id }, 'created invite');\n      return reply.code(201).send({\n        id: invite.id,\n        email: invite.email,\n        role: invite.role,\n        status: invite.status,\n        expiresAt: invite.expiresAt,\n        createdAt: invite.createdAt,\n      });\n    },\n  });\n\n  // The invite landing page's first call, made before the invitee has any\n  // session — so no guard. It turns the emailed token into the two facts the\n  // page needs: who the invitation is for, and whether that address already has\n  // an account. The email comes from the invitation row rather than the URL, so\n  // it cannot be steered by editing the link.\n  r.route({\n    method: 'GET',\n    url: '/api/organizations/invites/:token',\n    schema: {\n      operationId: 'getInvite',\n      tags,\n      summary: 'Read an invite by its token',\n      description:\n        'Public: no session needed. The same 404 answers forged, expired and accepted tokens, so a probe learns nothing.',\n      params: InviteTokenParam,\n      response: { 200: GetInviteResult, ...refusals(404) },\n    },\n    handler: async (req) => {\n      const invite = await organizations.peekInvite(req.params.token);\n      if (!invite) {\n        // Same answer for forged, expired, and already-accepted tokens: a\n        // probe learns nothing about which invitations exist.\n        throw new NotFoundError('Invite', 'token');\n      }\n      // Whether the address already has a login is deliberately not answered\n      // here. The mirror cannot say — an admin's student is a person long\n      // before they are an account — and asking the auth engine would mean\n      // reading its tables for one boolean. The sign-up form discovers it\n      // instead: a duplicate signup comes back 422 and the page flips to\n      // sign-in.\n      const person = await container.identity.getUserByEmail(invite.email);\n      return {\n        email: invite.email,\n        firstName: person?.firstName ?? null,\n        lastName: person?.lastName ?? null,\n      };\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/organizations/invites/accept',\n    preHandler: app.requireSession,\n    schema: {\n      operationId: 'acceptInvite',\n      tags,\n      summary: 'Accept an invite with the signed-in account',\n      description:\n        \"For any signed-in person whose email matches the invitation. Makes the invite's organization the session's active one. 400 when the token is invalid or expired, or the email does not match.\",\n      body: AcceptInvite,\n      response: { 200: AcceptInviteResult, ...refusals(400, 404) },\n    },\n    handler: async (req) => {\n      // No active org yet, so no resolveScope — but acceptInvite links a domain\n      // users.id, never the auth account id.\n      const user = await container.identity.getUserByExternalId(req.authUser.id);\n      if (!user) {\n        throw new NotFoundError('User', req.authUser.id);\n      }\n      const accepted = await container.organizations.acceptInvite({\n        token: req.body.token,\n        userId: user.id,\n        email: req.authUser.email,\n      });\n\n      // The session predates this grant, so it carries no active org and every\n      // org-scoped read would 401. Students are never org members, so the org\n      // plugin's set-active cannot do it — stamp the session row directly.\n      const org = await container.organizations.getById(accepted.orgId);\n      if (!org) {\n        throw new NotFoundError('Organization', accepted.orgId);\n      }\n      const stamped = await container.sessions.stampActiveOrganization(req.headers, org.id);\n\n      req.log.info({ accepted, stamped }, 'accepted invite');\n      return {};\n    },\n  });\n\n  const notificationTags = ['Notifications'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/notification-types',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listNotificationTypes',\n      tags: notificationTags,\n      summary: 'List the notification types a category list can cover (staff)',\n      description:\n        'Owner or admin only. `scope=org` lists the types the org list can cover, `scope=community` those a community list can cover. Each type carries all its scopes, so an editor can tell which types can be per space.',\n      querystring: NotificationListScopeQuery,\n      response: { 200: NotificationTypeInfos, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveConfiguratorScope(container, req);\n      return typesForList(container.notificationTypes, req.query.scope);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/notification-channels',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listNotificationChannels',\n      tags: notificationTags,\n      summary: 'List the notification channels this deployment can deliver on (staff)',\n      description: 'Owner or admin only. `inApp` is always first.',\n      response: { 200: NotificationChannelInfos, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveConfiguratorScope(container, req);\n      return container.notificationChannels.list().map((channel) => ({ channel }));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/notification-categories',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getOrgNotificationCategories',\n      tags: notificationTags,\n      summary: \"Get the organization's notification categories (staff)\",\n      description:\n        'Owner or admin only. The list in use for notifications outside any community, with `source` saying whether it is the default or a stored list.',\n      response: { 200: NotificationCategoryList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveConfiguratorScope(container, req);\n      return container.notificationCategories.org.get(scope.orgId, scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/notification-categories',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'replaceOrgNotificationCategories',\n      tags: notificationTags,\n      summary: \"Replace the organization's notification categories (staff)\",\n      description:\n        'Owner or admin only. Stores the whole list. 422 when a key repeats, a type cannot be in the org list, a reason is not allowed for its type, a channel is not configured, or earlier categories already cover everything a category covers.',\n      body: ReplaceNotificationCategories,\n      response: { 200: NotificationCategoryList, ...refusals(400, 403, 422) },\n    },\n    handler: async (req) => {\n      const scope = await resolveConfiguratorScope(container, req);\n      return container.notificationCategories.org.replace(\n        scope.orgId,\n        scope.orgId,\n        req.body.categories,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/notification-categories',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resetOrgNotificationCategories',\n      tags: notificationTags,\n      summary: 'Go back to the default notification categories for the organization (staff)',\n      description: 'Owner or admin only. Removes the stored list; the default applies again.',\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveConfiguratorScope(container, req);\n      await container.notificationCategories.org.reset(scope.orgId, scope.orgId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/notification-categories/defaults',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDefaultNotificationCategories',\n      tags: notificationTags,\n      summary: 'Get the default notification categories (staff)',\n      description:\n        'Owner or admin only. The default org list (`scope=org`) or community list (`scope=community`), offering only the configured channels.',\n      querystring: NotificationListScopeQuery,\n      response: { 200: NotificationCategoryDefaults, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveConfiguratorScope(container, req);\n      const service =\n        req.query.scope === 'org'\n          ? container.notificationCategories.org\n          : container.notificationCategories.community;\n      return { categories: service.defaults() };\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;AAgCA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,gBAAgB,UAAU;CAChC,MAAM,OAAO,CAAC,eAAe;CAM7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EAGL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,MAAM,MAAM,UAAU,YAAY,mBAAmB,IAAI,SAAS,IAAI,IAAI;GAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,MAAM,IAAI;IACV,MAAM,IAAI;IACV,IAAI,IAAI;IACR,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAAM,MAAM,UAAU,YAAY,mBACtC,IAAI,SACJ,MAAM,WACN,IAAI,IACN;GACA,OAAO,MAAM,KAAK;IAChB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,cAAc,YAAY,MAAM,OAAO,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GACA,MAAM,SAAS,MAAM,cAAc,iBACjC,KACA;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,IACX,IAAI,KAAK,IACX;GACA,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,MAA0B;IAC9B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,SAAS,IAAI;GACf;GAMA,IAAI,CAAC,MALiB,cAAc,aAClC,KACA;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,EACb,GAEE,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAG7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,cAAc,aACjC;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC;IACE,OAAO,MAAM;IACb,eAAe,MAAM;IACrB,OAAO,IAAI,KAAK;IAChB,MAAM,IAAI,KAAK;IACf,GAAI,IAAI,KAAK,cAAc,KAAA,KAAa,EAAE,WAAW,IAAI,KAAK,UAAU;IACxE,GAAI,IAAI,KAAK,aAAa,KAAA,KAAa,EAAE,UAAU,IAAI,KAAK,SAAS;IACrE,WAAW,IAAI,KAAK;GACtB,CACF;GAEA,IAAI,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,GAAG,gBAAgB;GACvD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,IAAI,OAAO;IACX,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,WAAW,OAAO;GACpB,CAAC;EACH;CACF,CAAC;CAOD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,SAAS,MAAM,cAAc,WAAW,IAAI,OAAO,KAAK;GAC9D,IAAI,CAAC,QAGH,MAAM,IAAI,cAAc,UAAU,OAAO;GAQ3C,MAAM,SAAS,MAAM,UAAU,SAAS,eAAe,OAAO,KAAK;GACnE,OAAO;IACL,OAAO,OAAO;IACd,WAAW,QAAQ,aAAa;IAChC,UAAU,QAAQ,YAAY;GAChC;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,IAAI,SAAS,EAAE;GACzE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,QAAQ,IAAI,SAAS,EAAE;GAEjD,MAAM,WAAW,MAAM,UAAU,cAAc,aAAa;IAC1D,OAAO,IAAI,KAAK;IAChB,QAAQ,KAAK;IACb,OAAO,IAAI,SAAS;GACtB,CAAC;GAKD,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,SAAS,KAAK;GAChE,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,SAAS,KAAK;GAExD,MAAM,UAAU,MAAM,UAAU,SAAS,wBAAwB,IAAI,SAAS,IAAI,EAAE;GAEpF,IAAI,IAAI,KAAK;IAAE;IAAU;GAAQ,GAAG,iBAAiB;GACrD,OAAO,CAAC;EACV;CACF,CAAC;CAED,MAAM,mBAAmB,CAAC,eAAe;CAEzC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAuB,GAAG,SAAS,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,yBAAyB,WAAW,GAAG;GAC7C,OAAO,aAAa,UAAU,mBAAmB,IAAI,MAAM,KAAK;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,yBAAyB,WAAW,GAAG;GAC7C,OAAO,UAAU,qBAAqB,KAAK,CAAC,CAAC,KAAK,aAAa,EAAE,QAAQ,EAAE;EAC7E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,yBAAyB,WAAW,GAAG;GAC3D,OAAO,UAAU,uBAAuB,IAAI,IAAI,MAAM,OAAO,MAAM,KAAK;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,yBAAyB,WAAW,GAAG;GAC3D,OAAO,UAAU,uBAAuB,IAAI,QAC1C,MAAM,OACN,MAAM,OACN,IAAI,KAAK,UACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,yBAAyB,WAAW,GAAG;GAC3D,MAAM,UAAU,uBAAuB,IAAI,MAAM,MAAM,OAAO,MAAM,KAAK;GACzE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM;GACN,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAA8B,GAAG,SAAS,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,yBAAyB,WAAW,GAAG;GAK7C,OAAO,EAAE,aAHP,IAAI,MAAM,UAAU,QAChB,UAAU,uBAAuB,MACjC,UAAU,uBAAuB,UAAA,CACV,SAAS,EAAE;EAC1C;CACF,CAAC;AACH"}