@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/routes/bundles.js

@@ -1,9 +1,8 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { AddBundleItem, Bundle, BundleIdParam, BundleItem, BundleItemParams, BundlesPage, BundlesQuery, CreateBundle, UpdateBundle } from "../schemas/bundles.js";
 import "../schemas/index.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/bundles.ts
 async function bundlesRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -15,8 +14,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "listBundles",
 			tags: ["Content"],
-			summary: "List bundles (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "List bundles",
+			description: "Requires `bundles:read`.",
 			querystring: BundlesQuery,
 			response: {
 				200: BundlesPage,
@@ -24,8 +23,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listBundles(scope.orgId, req.query);
+			const actor = await resolveActor(container, req);
+			return content.listBundles(req.query, actor);
 		}
 	});
 	r.route({
@@ -35,8 +34,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "getBundle",
 			tags: ["Content"],
-			summary: "Get a bundle (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Get a bundle",
+			description: "Requires `bundles:read`.",
 			params: BundleIdParam,
 			response: {
 				200: Bundle,
@@ -44,10 +43,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const bundle = await content.getBundle(scope.orgId, req.params.bundleId);
-			if (!bundle) throw new NotFoundError("Bundle", req.params.bundleId);
-			return bundle;
+			const actor = await resolveActor(container, req);
+			return content.getBundle(req.params.bundleId, actor);
 		}
 	});
 	r.route({
@@ -57,8 +54,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "createBundle",
 			tags: ["Content"],
-			summary: "Create a bundle, optionally with initial content (staff)",
-			description: "Staff only (owner, admin, instructor). 404 when an initial content id is unknown.",
+			summary: "Create a bundle, optionally with initial content",
+			description: `Requires \`bundles:write\`. 404 when an initial content id is unknown.`,
 			body: CreateBundle,
 			response: {
 				201: Bundle,
@@ -66,8 +63,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			const bundle = await content.createBundle(scope.orgId, req.body);
+			const actor = await resolveActor(container, req);
+			const bundle = await content.createBundle(req.body, actor);
 			return reply.code(201).send(bundle);
 		}
 	});
@@ -78,8 +75,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "updateBundle",
 			tags: ["Content"],
-			summary: "Rename a bundle (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Rename a bundle",
+			description: "Requires `bundles:write`.",
 			params: BundleIdParam,
 			body: UpdateBundle,
 			response: {
@@ -88,8 +85,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.updateBundle(scope.orgId, req.params.bundleId, req.body);
+			const actor = await resolveActor(container, req);
+			return content.updateBundle(req.params.bundleId, req.body, actor);
 		}
 	});
 	r.route({
@@ -99,8 +96,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "deleteBundle",
 			tags: ["Content"],
-			summary: "Delete a bundle (staff)",
-			description: "Staff only (owner, admin, instructor). Its content survives; access granted through the bundle ends.",
+			summary: "Delete a bundle",
+			description: `Requires \`bundles:delete\`. Its content survives; access granted through the bundle ends.`,
 			params: BundleIdParam,
 			response: {
 				204: z.void(),
@@ -108,8 +105,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await content.deleteBundle(scope.orgId, req.params.bundleId);
+			const actor = await resolveActor(container, req);
+			await content.deleteBundle(req.params.bundleId, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -120,8 +117,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "listBundleItems",
 			tags: ["Content"],
-			summary: "List a bundle's content (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "List a bundle's content",
+			description: "Requires `bundles:read`.",
 			params: BundleIdParam,
 			response: {
 				200: z.array(BundleItem),
@@ -129,8 +126,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listBundleItems(scope.orgId, req.params.bundleId);
+			const actor = await resolveActor(container, req);
+			return content.listBundleItems(req.params.bundleId, actor);
 		}
 	});
 	r.route({
@@ -140,8 +137,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "addBundleItem",
 			tags: ["Content"],
-			summary: "Add content to a bundle (staff)",
-			description: "Staff only (owner, admin, instructor). Everyone who holds the bundle can open the content from then on. Returns the bundle's content.",
+			summary: "Add content to a bundle",
+			description: `Requires \`bundles:write\`. Everyone who holds the bundle can open the content from then on. Returns the bundle's content.`,
 			params: BundleIdParam,
 			body: AddBundleItem,
 			response: {
@@ -150,8 +147,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.addBundleItem(scope.orgId, req.params.bundleId, req.body.contentId);
+			const actor = await resolveActor(container, req);
+			return content.addBundleItem(req.params.bundleId, req.body.contentId, actor);
 		}
 	});
 	r.route({
@@ -161,8 +158,8 @@ async function bundlesRoutes(app, container) {
 		schema: {
 			operationId: "removeBundleItem",
 			tags: ["Content"],
-			summary: "Remove content from a bundle (staff)",
-			description: "Staff only (owner, admin, instructor). The content survives; access to it through the bundle ends. Returns the bundle's content.",
+			summary: "Remove content from a bundle",
+			description: `Requires \`bundles:write\`. The content survives; access to it through the bundle ends. Returns the bundle's content.`,
 			params: BundleItemParams,
 			response: {
 				200: z.array(BundleItem),
@@ -170,8 +167,8 @@ async function bundlesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.removeBundleItem(scope.orgId, req.params.bundleId, req.params.contentId);
+			const actor = await resolveActor(container, req);
+			return content.removeBundleItem(req.params.bundleId, req.params.contentId, actor);
 		}
 	});
 }

package/dist/http/routes/bundles.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundles.js","names":[],"sources":["../../../src/http/routes/bundles.ts"],"sourcesContent":["// HTTP routes for bundles — named groupings of content items. Request +\n// response are validated against the shared contract schemas by the Zod type\n// provider, and @fastify/swagger reads the same schemas to build the OpenAPI\n// spec.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AddBundleItem,\n  Bundle,\n  BundleIdParam,\n  BundleItem,\n  BundleItemParams,\n  BundlesPage,\n  BundlesQuery,\n  CreateBundle,\n  UpdateBundle,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { resolveScope } from '../scope.js';\n\nexport async function bundlesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listBundles',\n      tags: ['Content'],\n      summary: 'List bundles (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: BundlesQuery,\n      response: { 200: BundlesPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listBundles(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getBundle',\n      tags: ['Content'],\n      summary: 'Get a bundle (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: BundleIdParam,\n      response: { 200: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const bundle = await content.getBundle(scope.orgId, req.params.bundleId);\n      if (!bundle) {\n        throw new NotFoundError('Bundle', req.params.bundleId);\n      }\n      return bundle;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/bundles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createBundle',\n      tags: ['Content'],\n      summary: 'Create a bundle, optionally with initial content (staff)',\n      description:\n        'Staff only (owner, admin, instructor). 404 when an initial content id is unknown.',\n      body: CreateBundle,\n      response: { 201: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const bundle = await content.createBundle(scope.orgId, req.body);\n      return reply.code(201).send(bundle);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateBundle',\n      tags: ['Content'],\n      summary: 'Rename a bundle (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: BundleIdParam,\n      body: UpdateBundle,\n      response: { 200: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.updateBundle(scope.orgId, req.params.bundleId, req.body);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteBundle',\n      tags: ['Content'],\n      summary: 'Delete a bundle (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Its content survives; access granted through the bundle ends.',\n      params: BundleIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await content.deleteBundle(scope.orgId, req.params.bundleId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles/:bundleId/items',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listBundleItems',\n      tags: ['Content'],\n      summary: \"List a bundle's content (staff)\",\n      description: 'Staff only (owner, admin, instructor).',\n      params: BundleIdParam,\n      response: { 200: z.array(BundleItem), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listBundleItems(scope.orgId, req.params.bundleId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/bundles/:bundleId/items',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addBundleItem',\n      tags: ['Content'],\n      summary: 'Add content to a bundle (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Everyone who holds the bundle can open the content from then on. Returns the bundle's content.\",\n      params: BundleIdParam,\n      body: AddBundleItem,\n      response: { 200: z.array(BundleItem), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.addBundleItem(scope.orgId, req.params.bundleId, req.body.contentId);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/bundles/:bundleId/items/:contentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeBundleItem',\n      tags: ['Content'],\n      summary: 'Remove content from a bundle (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). The content survives; access to it through the bundle ends. Returns the bundle's content.\",\n      params: BundleItemParams,\n      response: { 200: z.array(BundleItem), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.removeBundleItem(scope.orgId, req.params.bundleId, req.params.contentId);\n    },\n  });\n}\n"],"mappings":";;;;;;;AAuBA,eAAsB,cAAc,KAAsB,WAAqC;CAC7F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,OAAO,IAAI,OAAO,QAAQ;GACvE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,OAAO,IAAI,IAAI;GAC/D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,IAAI;EACxE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,QAAQ;GAC3D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,gBAAgB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,SAAS;EACnF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,SAAS;EACxF;CACF,CAAC;AACH"}
+{"version":3,"file":"bundles.js","names":[],"sources":["../../../src/http/routes/bundles.ts"],"sourcesContent":["// HTTP routes for bundles — named groupings of content items. Request +\n// response are validated against the shared contract schemas by the Zod type\n// provider, and @fastify/swagger reads the same schemas to build the OpenAPI\n// spec.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AddBundleItem,\n  Bundle,\n  BundleIdParam,\n  BundleItem,\n  BundleItemParams,\n  BundlesPage,\n  BundlesQuery,\n  CreateBundle,\n  UpdateBundle,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function bundlesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listBundles',\n      tags: ['Content'],\n      summary: 'List bundles',\n      description: 'Requires `bundles:read`.',\n      querystring: BundlesQuery,\n      response: { 200: BundlesPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listBundles(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getBundle',\n      tags: ['Content'],\n      summary: 'Get a bundle',\n      description: 'Requires `bundles:read`.',\n      params: BundleIdParam,\n      response: { 200: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.getBundle(req.params.bundleId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/bundles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createBundle',\n      tags: ['Content'],\n      summary: 'Create a bundle, optionally with initial content',\n      description: `Requires \\`bundles:write\\`. 404 when an initial content id is unknown.`,\n      body: CreateBundle,\n      response: { 201: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const bundle = await content.createBundle(req.body, actor);\n      return reply.code(201).send(bundle);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateBundle',\n      tags: ['Content'],\n      summary: 'Rename a bundle',\n      description: 'Requires `bundles:write`.',\n      params: BundleIdParam,\n      body: UpdateBundle,\n      response: { 200: Bundle, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateBundle(req.params.bundleId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/bundles/:bundleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteBundle',\n      tags: ['Content'],\n      summary: 'Delete a bundle',\n      description: `Requires \\`bundles:delete\\`. Its content survives; access granted through the bundle ends.`,\n      params: BundleIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await content.deleteBundle(req.params.bundleId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/bundles/:bundleId/items',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listBundleItems',\n      tags: ['Content'],\n      summary: \"List a bundle's content\",\n      description: 'Requires `bundles:read`.',\n      params: BundleIdParam,\n      response: { 200: z.array(BundleItem), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listBundleItems(req.params.bundleId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/bundles/:bundleId/items',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addBundleItem',\n      tags: ['Content'],\n      summary: 'Add content to a bundle',\n      description: `Requires \\`bundles:write\\`. Everyone who holds the bundle can open the content from then on. Returns the bundle's content.`,\n      params: BundleIdParam,\n      body: AddBundleItem,\n      response: { 200: z.array(BundleItem), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.addBundleItem(req.params.bundleId, req.body.contentId, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/bundles/:bundleId/items/:contentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeBundleItem',\n      tags: ['Content'],\n      summary: 'Remove content from a bundle',\n      description: `Requires \\`bundles:write\\`. The content survives; access to it through the bundle ends. Returns the bundle's content.`,\n      params: BundleItemParams,\n      response: { 200: z.array(BundleItem), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.removeBundleItem(req.params.bundleId, req.params.contentId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,cAAc,KAAsB,WAAqC;CAC7F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,UAAU,IAAI,OAAO,UAAU,KAAK;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,aAAa,IAAI,MAAM,KAAK;GACzD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,UAAU,IAAI,MAAM,KAAK;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,aAAa,IAAI,OAAO,UAAU,KAAK;GACrD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,gBAAgB,IAAI,OAAO,UAAU,KAAK;EAC3D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,IAAI,OAAO,UAAU,IAAI,KAAK,WAAW,KAAK;EAC7E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,UAAU;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,IAAI,OAAO,UAAU,IAAI,OAAO,WAAW,KAAK;EAClF;CACF,CAAC;AACH"}