@headless-lms/server 0.2.0 → 0.4.0

package/dist/http/routes/students.js

@@ -1,13 +1,13 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
-import { Student, StudentAnalytics, StudentIdParam, StudentsPage, StudentsQuery, UpdateStudentBody } from "../schemas/students.js";
+import { Student, StudentAnalytics, StudentIdParam, StudentsPage, StudentsQuery } from "../schemas/students.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/students.ts
 async function studentsRoutes(app, container) {
 	const r = app.withTypeProvider();
-	const students = container.reporting.students;
+	const students = container.reporting.admin;
 	r.route({
 		method: "GET",
 		url: "/api/students",
@@ -15,13 +15,17 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "listStudents",
 			tags: ["Organizations"],
-			summary: "List students",
+			summary: "List students (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			querystring: StudentsQuery,
-			response: { 200: StudentsPage }
+			response: {
+				200: StudentsPage,
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			return students.list(scope.orgId, req.query);
+			return students.listStudents(scope.orgId, req.query);
 		}
 	});
 	r.route({
@@ -31,16 +35,17 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "getStudent",
 			tags: ["Organizations"],
-			summary: "Get a student by id",
+			summary: "Get a student (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			params: StudentIdParam,
 			response: {
 				200: Student,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			const student = await students.get(scope.orgId, req.params.id);
+			const student = await students.getStudent(scope.orgId, req.params.id);
 			if (!student) throw new NotFoundError("Student", req.params.id);
 			return student;
 		}
@@ -52,48 +57,21 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "getStudentAnalytics",
 			tags: ["Reporting"],
-			summary: "A student's learner record: per-course progress and completion",
+			summary: "A student's learner record (staff)",
+			description: "Staff only (owner, admin, instructor). Per-course progress and completion.",
 			params: StudentIdParam,
 			response: {
 				200: StudentAnalytics,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
-			const analytics = await students.analytics(scope.orgId, req.params.id);
+			const analytics = await students.studentAnalytics(scope.orgId, req.params.id);
 			if (!analytics) throw new NotFoundError("Student", req.params.id);
 			return analytics;
 		}
 	});
-	r.route({
-		method: "PATCH",
-		url: "/api/students/:id",
-		preHandler: app.requireOrgSession,
-		schema: {
-			operationId: "updateStudent",
-			tags: ["Organizations"],
-			summary: "Update a student's profile",
-			params: StudentIdParam,
-			body: UpdateStudentBody,
-			response: {
-				200: Student,
-				404: ErrorBody,
-				409: ErrorBody
-			}
-		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			await container.organizations.updateStudent({
-				orgId: scope.orgId,
-				orgUserId: req.params.id,
-				...req.body
-			});
-			const student = await students.get(scope.orgId, req.params.id);
-			if (!student) throw new NotFoundError("Student", req.params.id);
-			return student;
-		}
-	});
 	r.route({
 		method: "POST",
 		url: "/api/students/:id/invite/resend",
@@ -101,17 +79,20 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "resendStudentInvite",
 			tags: ["Organizations"],
-			summary: "Re-send a pending student's invite email",
+			summary: "Re-send a pending student's invite email (staff)",
+			description: "Owner or admin only. Issues a new token, so the previous link stops working. 404 when the student has no pending invite; 409 when it was already accepted.",
 			params: StudentIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody,
-				409: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
 			await container.organizations.resendStudentInvite({
+				id: scope.orgUserId,
+				role: scope.role
+			}, {
 				orgId: scope.orgId,
 				orgUserId: req.params.id,
 				inviterUserId: scope.userId
@@ -126,16 +107,20 @@ async function studentsRoutes(app, container) {
 		schema: {
 			operationId: "deleteStudent",
 			tags: ["Organizations"],
-			summary: "Delete a student",
+			summary: "Delete a student (staff)",
+			description: "Owner or admin only. 409 when the person has written posts, comments or messages.",
 			params: StudentIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
 			const scope = await resolveScope(container, req);
-			await container.organizations.deleteOrgUser(scope.orgId, req.params.id);
+			await container.organizations.deleteOrgUser(scope.orgId, {
+				id: scope.orgUserId,
+				role: scope.role
+			}, req.params.id);
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/students.js.map

@@ -1 +1 @@
-{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/routes/students.ts"],"sourcesContent":["// HTTP routes for students: the reporting-backed list/read endpoints, the\n// delete, and re-issuing a pending invite. There is no create here — adding a\n// student IS inviting one, at /api/organizations/invites, which provisions the\n// student record up front.\nimport type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ErrorBody,\n  Student,\n  StudentAnalytics,\n  StudentIdParam,\n  StudentsPage,\n  StudentsQuery,\n  UpdateStudentBody,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function studentsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const students = container.reporting.students;\n\n  r.route({\n    method: 'GET',\n    url: '/api/students',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listStudents',\n      tags: ['Organizations'],\n      summary: 'List students',\n      querystring: StudentsQuery,\n      response: { 200: StudentsPage },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return students.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudent',\n      tags: ['Organizations'],\n      summary: 'Get a student by id',\n      params: StudentIdParam,\n      response: { 200: Student, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudentAnalytics',\n      tags: ['Reporting'],\n      summary: \"A student's learner record: per-course progress and completion\",\n      params: StudentIdParam,\n      response: { 200: StudentAnalytics, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const analytics = await students.analytics(scope.orgId, req.params.id);\n      if (!analytics) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return analytics;\n    },\n  });\n\n  // Corrects the person behind the student row. The write lands in identity\n  // (the person is global); organizations owns the rule that this org user is\n  // a student here, and reconciles their pending invite when the address moves.\n  r.route({\n    method: 'PATCH',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateStudent',\n      tags: ['Organizations'],\n      summary: \"Update a student's profile\",\n      params: StudentIdParam,\n      body: UpdateStudentBody,\n      response: { 200: Student, 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.updateStudent({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        ...req.body,\n      });\n      // Re-read through the report so the response is the same shape the list\n      // and detail GETs return, aggregates included.\n      const student = await students.get(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  // Re-mints the token on the student's pending invite and emails it. Lives\n  // here rather than under invites because the admin app knows the student,\n  // not the invitation.\n  r.route({\n    method: 'POST',\n    url: '/api/students/:id/invite/resend',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resendStudentInvite',\n      tags: ['Organizations'],\n      summary: \"Re-send a pending student's invite email\",\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody, 409: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.resendStudentInvite({\n        orgId: scope.orgId,\n        orgUserId: req.params.id,\n        inviterUserId: scope.userId,\n      });\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteStudent',\n      tags: ['Organizations'],\n      summary: 'Delete a student',\n      params: StudentIdParam,\n      response: { 204: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.deleteOrgUser(scope.orgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAoBA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,WAAW,UAAU,UAAU;CAErC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,UAAU,EAAE,KAAK,aAAa;EAChC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,KAAK;GAAU;EAC3C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,KAAK;GAAU;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,YAAY,MAAM,SAAS,UAAU,MAAM,OAAO,IAAI,OAAO,EAAE;GACrE,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,KAAK;IAAW,KAAK;GAAU;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc;IAC1C,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,GAAG,IAAI;GACT,CAAC;GAGD,MAAM,UAAU,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;IAAW,KAAK;GAAU;EAC5D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,oBAAoB;IAChD,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,eAAe,MAAM;GACvB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE;GACtE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/routes/students.ts"],"sourcesContent":["// HTTP routes for students: the reporting-backed list/read endpoints, the\n// delete, and re-issuing a pending invite. There is no create here — adding a\n// student IS inviting one, at /api/organizations/invites, which provisions the\n// student record up front.\nimport type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Student,\n  StudentAnalytics,\n  StudentIdParam,\n  StudentsPage,\n  StudentsQuery,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function studentsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const students = container.reporting.admin;\n\n  r.route({\n    method: 'GET',\n    url: '/api/students',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listStudents',\n      tags: ['Organizations'],\n      summary: 'List students (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: StudentsQuery,\n      response: { 200: StudentsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return students.listStudents(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudent',\n      tags: ['Organizations'],\n      summary: 'Get a student (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: StudentIdParam,\n      response: { 200: Student, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const student = await students.getStudent(scope.orgId, req.params.id);\n      if (!student) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return student;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/students/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getStudentAnalytics',\n      tags: ['Reporting'],\n      summary: \"A student's learner record (staff)\",\n      description: 'Staff only (owner, admin, instructor). Per-course progress and completion.',\n      params: StudentIdParam,\n      response: { 200: StudentAnalytics, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const analytics = await students.studentAnalytics(scope.orgId, req.params.id);\n      if (!analytics) {\n        throw new NotFoundError('Student', req.params.id);\n      }\n      return analytics;\n    },\n  });\n\n  // Re-mints the token on the student's pending invite and emails it. Lives\n  // here rather than under invites because the admin app knows the student,\n  // not the invitation.\n  r.route({\n    method: 'POST',\n    url: '/api/students/:id/invite/resend',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resendStudentInvite',\n      tags: ['Organizations'],\n      summary: \"Re-send a pending student's invite email (staff)\",\n      description:\n        'Owner or admin only. Issues a new token, so the previous link stops working. 404 when the student has no pending invite; 409 when it was already accepted.',\n      params: StudentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.resendStudentInvite(\n        { id: scope.orgUserId, role: scope.role },\n        {\n          orgId: scope.orgId,\n          orgUserId: req.params.id,\n          inviterUserId: scope.userId,\n        },\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/students/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteStudent',\n      tags: ['Organizations'],\n      summary: 'Delete a student (staff)',\n      description:\n        'Owner or admin only. 409 when the person has written posts, comments or messages.',\n      params: StudentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.organizations.deleteOrgUser(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.id,\n      );\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAmBA,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,WAAW,UAAU,UAAU;CAErC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,SAAS,aAAa,MAAM,OAAO,IAAI,KAAK;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,SAAS,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,YAAY,MAAM,SAAS,iBAAiB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC5E,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAKD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,oBAC5B;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC;IACE,OAAO,MAAM;IACb,WAAW,IAAI,OAAO;IACtB,eAAe,MAAM;GACvB,CACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,cAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,EACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/webhooks.js

@@ -1,11 +1,11 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
 import { AutomationIdParam, CreateWebhookBody, CreatedWebhook, UpdateWebhookBody, Webhook, WebhookSecret } from "../schemas/automations.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/webhooks.ts
-const DELIVERY_DESCRIPTION = "Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.";
+const DELIVERY_DESCRIPTION = "Staff only (owner, admin, instructor). `url` must be a public address: localhost and private network addresses are refused when saved and when delivering. Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.";
 async function webhooksRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const automations = container.automations;
@@ -17,8 +17,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "listWebhooks",
 			tags,
-			summary: "List the organization's webhooks",
-			response: { 200: z.array(Webhook) }
+			summary: "List the organization's webhooks (staff)",
+			description: "Staff only (owner, admin, instructor). Signing secrets are not included.",
+			response: {
+				200: z.array(Webhook),
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -32,12 +36,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "createWebhook",
 			tags,
-			summary: "Create a webhook — returns its signing secret",
+			summary: "Create a webhook (staff)",
 			description: DELIVERY_DESCRIPTION,
 			body: CreateWebhookBody,
 			response: {
 				201: CreatedWebhook,
-				400: ErrorBody
+				...refusals(400, 403)
 			}
 		},
 		handler: async (req, reply) => {
@@ -53,11 +57,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "getWebhook",
 			tags,
-			summary: "Get a webhook by id",
+			summary: "Get a webhook (staff)",
+			description: "Staff only (owner, admin, instructor). The signing secret is not included.",
 			params: AutomationIdParam,
 			response: {
 				200: Webhook,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -74,13 +79,13 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "updateWebhook",
 			tags,
-			summary: "Change a webhook's URL, events, description or enabled flag",
+			summary: "Change a webhook's URL, events, description or enabled flag (staff)",
+			description: "Staff only (owner, admin, instructor). Changes only the fields sent. 400 when an event is reserved or unknown.",
 			params: AutomationIdParam,
 			body: UpdateWebhookBody,
 			response: {
 				200: Webhook,
-				400: ErrorBody,
-				404: ErrorBody
+				...refusals(400, 403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -97,11 +102,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "deleteWebhook",
 			tags,
-			summary: "Delete a webhook and its signing secret — its delivery history is kept",
+			summary: "Delete a webhook and its signing secret (staff)",
+			description: "Staff only (owner, admin, instructor). Its delivery history is kept.",
 			params: AutomationIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req, reply) => {
@@ -117,11 +123,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "getWebhookSecret",
 			tags,
-			summary: "Reveal a webhook's signing secret",
+			summary: "Reveal a webhook's signing secret (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			params: AutomationIdParam,
 			response: {
 				200: WebhookSecret,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -138,11 +145,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "rotateWebhookSecret",
 			tags,
-			summary: "Replace a webhook's signing secret — the old one stops working immediately",
+			summary: "Replace a webhook's signing secret (staff)",
+			description: "Staff only (owner, admin, instructor). The old secret stops working immediately.",
 			params: AutomationIdParam,
 			response: {
 				200: WebhookSecret,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {

package/dist/http/routes/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","names":[],"sources":["../../../src/http/routes/webhooks.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AutomationIdParam,\n  CreatedWebhook,\n  CreateWebhookBody,\n  ErrorBody,\n  UpdateWebhookBody,\n  Webhook,\n  WebhookSecret,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nconst DELIVERY_DESCRIPTION =\n  \"Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.\";\n\nexport async function webhooksRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const automations = container.automations;\n  const tags = ['Automations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listWebhooks',\n      tags,\n      summary: \"List the organization's webhooks\",\n      response: { 200: z.array(Webhook) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return automations.listWebhooks(scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createWebhook',\n      tags,\n      summary: 'Create a webhook — returns its signing secret',\n      description: DELIVERY_DESCRIPTION,\n      body: CreateWebhookBody,\n      response: { 201: CreatedWebhook, 400: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.createWebhook(scope.orgId, req.body);\n      return reply.code(201).send(webhook);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhook',\n      tags,\n      summary: 'Get a webhook by id',\n      params: AutomationIdParam,\n      response: { 200: Webhook, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.getWebhook(scope.orgId, req.params.id);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateWebhook',\n      tags,\n      summary: \"Change a webhook's URL, events, description or enabled flag\",\n      params: AutomationIdParam,\n      body: UpdateWebhookBody,\n      response: { 200: Webhook, 400: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.updateWebhook(scope.orgId, req.params.id, req.body);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteWebhook',\n      tags,\n      summary: 'Delete a webhook and its signing secret — its delivery history is kept',\n      params: AutomationIdParam,\n      response: { 204: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const deleted = await automations.deleteWebhook(scope.orgId, req.params.id);\n      if (!deleted) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id/secret',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhookSecret',\n      tags,\n      summary: \"Reveal a webhook's signing secret\",\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.revealWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks/:id/secret/rotate',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'rotateWebhookSecret',\n      tags,\n      summary: \"Replace a webhook's signing secret — the old one stops working immediately\",\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.rotateWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,MAAM,uBACJ;AAEF,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,cAAc,UAAU;CAC9B,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,UAAU,EAAE,KAAK,EAAE,MAAM,OAAO,EAAE;EACpC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,YAAY,aAAa,MAAM,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,KAAK;GAAU;EAClD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,IAAI;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,KAAK;GAAU;EAC3C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACvE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,KAAK;IAAW,KAAK;GAAU;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GACpF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,IAAI,CAAC,MADiB,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE,GAExE,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,KAAK;GAAU;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,KAAK;GAAU;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"webhooks.js","names":[],"sources":["../../../src/http/routes/webhooks.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AutomationIdParam,\n  CreatedWebhook,\n  CreateWebhookBody,\n  UpdateWebhookBody,\n  Webhook,\n  WebhookSecret,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nconst DELIVERY_DESCRIPTION =\n  \"Staff only (owner, admin, instructor). `url` must be a public address: localhost and private network addresses are refused when saved and when delivering. Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.\";\n\nexport async function webhooksRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const automations = container.automations;\n  const tags = ['Automations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listWebhooks',\n      tags,\n      summary: \"List the organization's webhooks (staff)\",\n      description: 'Staff only (owner, admin, instructor). Signing secrets are not included.',\n      response: { 200: z.array(Webhook), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return automations.listWebhooks(scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createWebhook',\n      tags,\n      summary: 'Create a webhook (staff)',\n      description: DELIVERY_DESCRIPTION,\n      body: CreateWebhookBody,\n      response: { 201: CreatedWebhook, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.createWebhook(scope.orgId, req.body);\n      return reply.code(201).send(webhook);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhook',\n      tags,\n      summary: 'Get a webhook (staff)',\n      description: 'Staff only (owner, admin, instructor). The signing secret is not included.',\n      params: AutomationIdParam,\n      response: { 200: Webhook, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.getWebhook(scope.orgId, req.params.id);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateWebhook',\n      tags,\n      summary: \"Change a webhook's URL, events, description or enabled flag (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Changes only the fields sent. 400 when an event is reserved or unknown.',\n      params: AutomationIdParam,\n      body: UpdateWebhookBody,\n      response: { 200: Webhook, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.updateWebhook(scope.orgId, req.params.id, req.body);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteWebhook',\n      tags,\n      summary: 'Delete a webhook and its signing secret (staff)',\n      description: 'Staff only (owner, admin, instructor). Its delivery history is kept.',\n      params: AutomationIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const deleted = await automations.deleteWebhook(scope.orgId, req.params.id);\n      if (!deleted) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id/secret',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhookSecret',\n      tags,\n      summary: \"Reveal a webhook's signing secret (staff)\",\n      description: 'Staff only (owner, admin, instructor).',\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.revealWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks/:id/secret/rotate',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'rotateWebhookSecret',\n      tags,\n      summary: \"Replace a webhook's signing secret (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The old secret stops working immediately.',\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.rotateWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,MAAM,uBACJ;AAEF,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,cAAc,UAAU;CAC9B,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK,EAAE,MAAM,OAAO;IAAG,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,YAAY,aAAa,MAAM,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,IAAI;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACvE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GACpF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,IAAI,CAAC,MADiB,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE,GAExE,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes.js

@@ -1,7 +1,9 @@
+import { communitiesRoutes } from "./routes/communities.js";
+import { communityModerationRoutes } from "./routes/community-moderation.js";
 import { coursesRoutes } from "./routes/courses.js";
 import { downloadsRoutes } from "./routes/downloads.js";
 import { bundlesRoutes } from "./routes/bundles.js";
-import { learnRoutes } from "./routes/learn/index.js";
+import { memberRoutes } from "./routes/member/index.js";
 import { discussionRoutes } from "./routes/discussion.js";
 import { activitiesRoutes } from "./routes/activities.js";
 import { studentsRoutes } from "./routes/students.js";
@@ -13,6 +15,7 @@ import { dashboardRoutes } from "./routes/dashboard.js";
 import { courseAnalyticsRoutes } from "./routes/course-analytics.js";
 import { assetsRoutes } from "./routes/assets.js";
 import { integrationsRoutes } from "./routes/integrations.js";
+import { accessRoutes } from "./routes/access.js";
 //#region src/http/routes.ts
 function registerRoutes(app, container) {
 	app.get("/health", async () => ({ status: "ok" }));
@@ -22,9 +25,11 @@ function registerRoutes(app, container) {
 	app.register(async (instance) => {
 		instance.addHook("onRequest", instance.requireOrgSession);
 		await coursesRoutes(instance, container);
+		await communitiesRoutes(instance, container);
+		await communityModerationRoutes(instance, container);
 		await downloadsRoutes(instance, container);
 		await bundlesRoutes(instance, container);
-		await learnRoutes(instance, container);
+		await memberRoutes(instance, container);
 		await discussionRoutes(instance, container);
 		await activitiesRoutes(instance, container);
 		await studentsRoutes(instance, container);
@@ -35,6 +40,7 @@ function registerRoutes(app, container) {
 		await courseAnalyticsRoutes(instance, container);
 		await assetsRoutes(instance, container);
 		await integrationsRoutes(instance, container);
+		await accessRoutes(instance, container);
 	});
 }
 //#endregion

package/dist/http/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":[],"sources":["../../src/http/routes.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { coursesRoutes } from './routes/courses.js';\nimport { downloadsRoutes } from './routes/downloads.js';\nimport { bundlesRoutes } from './routes/bundles.js';\nimport { learnRoutes } from './routes/learn/index.js';\nimport { discussionRoutes } from './routes/discussion.js';\nimport { activitiesRoutes } from './routes/activities.js';\nimport { studentsRoutes } from './routes/students.js';\nimport { entitlementsRoutes } from './routes/entitlements.js';\nimport { automationsRoutes } from './routes/automations.js';\nimport { webhooksRoutes } from './routes/webhooks.js';\nimport { organizationsRoutes } from './routes/organizations.js';\nimport { dashboardRoutes } from './routes/dashboard.js';\nimport { courseAnalyticsRoutes } from './routes/course-analytics.js';\nimport { assetsRoutes } from './routes/assets.js';\nimport { integrationsRoutes } from './routes/integrations.js';\n\nexport function registerRoutes(app: FastifyInstance, container: Container): void {\n  app.get('/health', async () => ({ status: 'ok' }));\n\n  app.register(async (instance) => {\n    // instance.addHook('onRequest', instance.requireSession);\n    await organizationsRoutes(instance, container);\n  });\n\n  app.register(async (instance) => {\n    instance.addHook('onRequest', instance.requireOrgSession);\n    await coursesRoutes(instance, container);\n    await downloadsRoutes(instance, container);\n    await bundlesRoutes(instance, container);\n    await learnRoutes(instance, container);\n    await discussionRoutes(instance, container);\n    await activitiesRoutes(instance, container);\n    await studentsRoutes(instance, container);\n    await entitlementsRoutes(instance, container);\n    await automationsRoutes(instance, container);\n    await webhooksRoutes(instance, container);\n    await dashboardRoutes(instance, container);\n    await courseAnalyticsRoutes(instance, container);\n    await assetsRoutes(instance, container);\n    await integrationsRoutes(instance, container);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,SAAgB,eAAe,KAAsB,WAA4B;CAC/E,IAAI,IAAI,WAAW,aAAa,EAAE,QAAQ,KAAK,EAAE;CAEjD,IAAI,SAAS,OAAO,aAAa;EAE/B,MAAM,oBAAoB,UAAU,SAAS;CAC/C,CAAC;CAED,IAAI,SAAS,OAAO,aAAa;EAC/B,SAAS,QAAQ,aAAa,SAAS,iBAAiB;EACxD,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,YAAY,UAAU,SAAS;EACrC,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,sBAAsB,UAAU,SAAS;EAC/C,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,mBAAmB,UAAU,SAAS;CAC9C,CAAC;AACH"}
+{"version":3,"file":"routes.js","names":[],"sources":["../../src/http/routes.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { communitiesRoutes } from './routes/communities.js';\nimport { communityModerationRoutes } from './routes/community-moderation.js';\nimport { coursesRoutes } from './routes/courses.js';\nimport { downloadsRoutes } from './routes/downloads.js';\nimport { bundlesRoutes } from './routes/bundles.js';\nimport { memberRoutes } from './routes/member/index.js';\nimport { discussionRoutes } from './routes/discussion.js';\nimport { activitiesRoutes } from './routes/activities.js';\nimport { studentsRoutes } from './routes/students.js';\nimport { entitlementsRoutes } from './routes/entitlements.js';\nimport { automationsRoutes } from './routes/automations.js';\nimport { webhooksRoutes } from './routes/webhooks.js';\nimport { organizationsRoutes } from './routes/organizations.js';\nimport { dashboardRoutes } from './routes/dashboard.js';\nimport { courseAnalyticsRoutes } from './routes/course-analytics.js';\nimport { assetsRoutes } from './routes/assets.js';\nimport { integrationsRoutes } from './routes/integrations.js';\nimport { accessRoutes } from './routes/access.js';\n\nexport function registerRoutes(app: FastifyInstance, container: Container): void {\n  app.get('/health', async () => ({ status: 'ok' }));\n\n  app.register(async (instance) => {\n    // instance.addHook('onRequest', instance.requireSession);\n    await organizationsRoutes(instance, container);\n  });\n\n  app.register(async (instance) => {\n    instance.addHook('onRequest', instance.requireOrgSession);\n    await coursesRoutes(instance, container);\n    await communitiesRoutes(instance, container);\n    await communityModerationRoutes(instance, container);\n    await downloadsRoutes(instance, container);\n    await bundlesRoutes(instance, container);\n    await memberRoutes(instance, container);\n    await discussionRoutes(instance, container);\n    await activitiesRoutes(instance, container);\n    await studentsRoutes(instance, container);\n    await entitlementsRoutes(instance, container);\n    await automationsRoutes(instance, container);\n    await webhooksRoutes(instance, container);\n    await dashboardRoutes(instance, container);\n    await courseAnalyticsRoutes(instance, container);\n    await assetsRoutes(instance, container);\n    await integrationsRoutes(instance, container);\n    await accessRoutes(instance, container);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,eAAe,KAAsB,WAA4B;CAC/E,IAAI,IAAI,WAAW,aAAa,EAAE,QAAQ,KAAK,EAAE;CAEjD,IAAI,SAAS,OAAO,aAAa;EAE/B,MAAM,oBAAoB,UAAU,SAAS;CAC/C,CAAC;CAED,IAAI,SAAS,OAAO,aAAa;EAC/B,SAAS,QAAQ,aAAa,SAAS,iBAAiB;EACxD,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,0BAA0B,UAAU,SAAS;EACnD,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,sBAAsB,UAAU,SAAS;EAC/C,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,aAAa,UAAU,SAAS;CACxC,CAAC;AACH"}

package/dist/http/schemas/access.d.ts

@@ -0,0 +1,146 @@
+import { z } from "zod";
+//#region src/http/schemas/access.d.ts
+declare const ScopeOption: z.ZodObject<{
+  scope: z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>;
+  allowed: z.ZodBoolean;
+}, z.core.$strip>;
+declare const ScopeOptionList: z.ZodArray<z.ZodObject<{
+  scope: z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>;
+  allowed: z.ZodBoolean;
+}, z.core.$strip>>;
+declare const ConnectedApp: z.ZodObject<{
+  clientId: z.ZodString;
+  name: z.ZodString;
+  iconUrl: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  connectedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strip>;
+declare const ConnectedAppList: z.ZodArray<z.ZodObject<{
+  clientId: z.ZodString;
+  name: z.ZodString;
+  iconUrl: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  connectedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strip>>;
+declare const ClientIdParam: z.ZodObject<{
+  clientId: z.ZodString;
+}, z.core.$strip>;
+declare const ApiKey: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+}, z.core.$strip>;
+declare const ApiKeyList: z.ZodArray<z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+}, z.core.$strip>>;
+declare const CreatedApiKey: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+  key: z.ZodString;
+}, z.core.$strip>;
+declare const CreateApiKey: z.ZodObject<{
+  name: z.ZodString;
+  scopes: z.ZodArray<z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>>;
+}, z.core.$strip>;
+declare const ApiKeyIdParam: z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strip>;
+//#endregion
+export { ApiKey, ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedApp, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOption, ScopeOptionList };
+//# sourceMappingURL=access.d.ts.map

package/dist/http/schemas/access.js

@@ -0,0 +1,36 @@
+import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { z } from "zod";
+//#region src/http/schemas/access.ts
+const ScopeOption = z.object({
+	scope: z.enum(ACCESS_SCOPES),
+	allowed: z.boolean()
+});
+const ScopeOptionList = z.array(ScopeOption);
+const ConnectedApp = z.object({
+	clientId: z.string(),
+	name: z.string(),
+	iconUrl: z.string().nullable(),
+	scopes: z.array(z.string()),
+	connectedAt: z.coerce.date()
+});
+const ConnectedAppList = z.array(ConnectedApp);
+const ClientIdParam = z.object({ clientId: z.string() });
+const ApiKey = z.object({
+	id: z.string(),
+	name: z.string().nullable(),
+	start: z.string().nullable(),
+	scopes: z.array(z.string()),
+	createdAt: z.coerce.date(),
+	lastUsedAt: z.coerce.date().nullable()
+});
+const ApiKeyList = z.array(ApiKey);
+const CreatedApiKey = ApiKey.extend({ key: z.string() });
+const CreateApiKey = z.object({
+	name: z.string().trim().min(1).max(80),
+	scopes: z.array(z.enum(ACCESS_SCOPES)).min(1)
+});
+const ApiKeyIdParam = z.object({ id: z.string() });
+//#endregion
+export { ApiKey, ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedApp, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOption, ScopeOptionList };
+
+//# sourceMappingURL=access.js.map

package/dist/http/schemas/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/schemas/access.ts"],"sourcesContent":["import { z } from 'zod';\nimport { ACCESS_SCOPES } from '@headless-lms/core/organizations';\n\nexport const ScopeOption = z.object({ scope: z.enum(ACCESS_SCOPES), allowed: z.boolean() });\nexport const ScopeOptionList = z.array(ScopeOption);\n\nexport const ConnectedApp = z.object({\n  clientId: z.string(),\n  name: z.string(),\n  iconUrl: z.string().nullable(),\n  scopes: z.array(z.string()),\n  connectedAt: z.coerce.date(),\n});\nexport const ConnectedAppList = z.array(ConnectedApp);\nexport const ClientIdParam = z.object({ clientId: z.string() });\n\nexport const ApiKey = z.object({\n  id: z.string(),\n  name: z.string().nullable(),\n  start: z.string().nullable(),\n  scopes: z.array(z.string()),\n  createdAt: z.coerce.date(),\n  lastUsedAt: z.coerce.date().nullable(),\n});\nexport const ApiKeyList = z.array(ApiKey);\nexport const CreatedApiKey = ApiKey.extend({ key: z.string() });\nexport const CreateApiKey = z.object({\n  name: z.string().trim().min(1).max(80),\n  scopes: z.array(z.enum(ACCESS_SCOPES)).min(1),\n});\nexport const ApiKeyIdParam = z.object({ id: z.string() });\n"],"mappings":";;;AAGA,MAAa,cAAc,EAAE,OAAO;CAAE,OAAO,EAAE,KAAK,aAAa;CAAG,SAAS,EAAE,QAAQ;AAAE,CAAC;AAC1F,MAAa,kBAAkB,EAAE,MAAM,WAAW;AAElD,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,OAAO;CACnB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;CAC1B,aAAa,EAAE,OAAO,KAAK;AAC7B,CAAC;AACD,MAAa,mBAAmB,EAAE,MAAM,YAAY;AACpD,MAAa,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE9D,MAAa,SAAS,EAAE,OAAO;CAC7B,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;CAC1B,WAAW,EAAE,OAAO,KAAK;CACzB,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,SAAS;AACvC,CAAC;AACD,MAAa,aAAa,EAAE,MAAM,MAAM;AACxC,MAAa,gBAAgB,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9D,MAAa,eAAe,EAAE,OAAO;CACnC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACrC,QAAQ,EAAE,MAAM,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AACD,MAAa,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC"}

package/dist/http/schemas/activities.d.ts

@@ -9,6 +9,7 @@ declare const Activity: z.ZodObject<{
   settings: z.ZodNullable<z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>>;
   createdAt: z.ZodCoercedDate<unknown>;
   updatedAt: z.ZodCoercedDate<unknown>;
+  assetUrls: z.ZodRecord<z.ZodString, z.ZodString>;
 }, z.core.$strict>;
 type Activity = z.infer<typeof Activity>;
 declare const ActivityAsset: z.ZodObject<{
@@ -42,7 +43,7 @@ declare const ModuleList: z.ZodArray<z.ZodObject<{
   updatedAt: z.ZodCoercedDate<unknown>;
 }, z.core.$strict>>;
 type ModuleList = z.infer<typeof ModuleList>;
-/** A course's activities as bare rows, ordered by (moduleId, seq). */
+/** A course's activities, each with the stable file URLs of the files it links, ordered by (moduleId, seq). */
 declare const ActivityList: z.ZodArray<z.ZodObject<{
   orgId: z.ZodString;
   id: z.ZodString;
@@ -52,6 +53,7 @@ declare const ActivityList: z.ZodArray<z.ZodObject<{
   settings: z.ZodNullable<z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>>;
   createdAt: z.ZodCoercedDate<unknown>;
   updatedAt: z.ZodCoercedDate<unknown>;
+  assetUrls: z.ZodRecord<z.ZodString, z.ZodString>;
 }, z.core.$strict>>;
 type ActivityList = z.infer<typeof ActivityList>;
 /** A course's activity→asset link rows, ordered by (activityId, seq). */