@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/routes/discussion.js.map

@@ -1 +1 @@
-{"version":3,"file":"discussion.js","names":[],"sources":["../../../src/http/routes/discussion.ts"],"sourcesContent":["// Moderator-facing discussion routes. The learner surface (everything under\n// `/api/member`) lives in routes/member/comments.ts.\nimport type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  Comment,\n  CommentIdParam,\n  CommentsPage,\n  CommentsQuery,\n  CommentView,\n  PatchComment,\n  ReplyToComment,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function discussionRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const discussion = container.discussion;\n  const staff = async (req: FastifyRequest) => {\n    await resolveScope(container, req);\n  };\n\n  r.route({\n    method: 'GET',\n    url: '/api/comments',\n    preHandler: staff,\n    schema: {\n      operationId: 'listComments',\n      tags: ['Discussion'],\n      summary: 'List course comments for moderation (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Comments on course activities, filtered by course, activity, author, status or open reports; each row carries the author's email and the open reports.\",\n      querystring: CommentsQuery,\n      response: { 200: CommentsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return discussion.listComments(req.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/comments/:commentId',\n    preHandler: staff,\n    schema: {\n      operationId: 'moderateRemoveComment',\n      tags: ['Discussion'],\n      summary: 'Remove a course comment (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Hides the comment and resolves its open reports as `removed`. Removing a removed comment returns it unchanged.',\n      params: CommentIdParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      return discussion.remove(req.orgId, req.params.commentId, orgUser!, null);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/comments/:commentId',\n    preHandler: staff,\n    schema: {\n      operationId: 'publishComment',\n      tags: ['Discussion'],\n      summary: 'Publish a course comment (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Approves a pending comment or restores a removed one; a published comment is returned unchanged.',\n      params: CommentIdParam,\n      body: PatchComment,\n      response: { 200: Comment, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', req.userId);\n      }\n      return discussion.publish(req.orgId, req.params.commentId, orgUser, null);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/comments/:commentId/reports',\n    preHandler: staff,\n    schema: {\n      operationId: 'dismissCommentReports',\n      tags: ['Discussion'],\n      summary: 'Dismiss every open report on a course comment (staff)',\n      description: 'Staff only (owner, admin, instructor). The comment stays up.',\n      params: CommentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', req.userId);\n      }\n      await discussion.resolveReports(req.orgId, req.params.commentId, orgUser, null);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/comments/:commentId/replies',\n    preHandler: staff,\n    schema: {\n      operationId: 'replyToComment',\n      tags: ['Discussion'],\n      summary: 'Reply to a course comment from the moderation queue (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Replies nest one level: answering a reply attaches to its root comment.',\n      params: CommentIdParam,\n      body: ReplyToComment,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', req.userId);\n      }\n      const parent = await discussion.getComment(req.orgId, req.params.commentId);\n      if (!parent || parent.activityId === null) {\n        throw new NotFoundError('Comment', req.params.commentId);\n      }\n      // Replies nest one level: answering a reply attaches to its root.\n      return discussion.postComment(req.orgId, {\n        actor: orgUser,\n        activityId: parent.activityId,\n        parentId: parent.parentId ?? parent.id,\n        body: req.body.body,\n      });\n    },\n  });\n}\n"],"mappings":";;;;;;;AAmBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,aAAa,UAAU;CAC7B,MAAM,QAAQ,OAAO,QAAwB;EAC3C,MAAM,aAAa,WAAW,GAAG;CACnC;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,WAAW,aAAa,IAAI,OAAO,IAAI,KAAK;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,OAAO,WAAW,OAAO,IAAI,OAAO,IAAI,OAAO,WAAW,SAAU,IAAI;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,MAAM;GAE/C,OAAO,WAAW,QAAQ,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,MAAM;GAE/C,MAAM,WAAW,eAAe,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI;GAC9E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,MAAM;GAE/C,MAAM,SAAS,MAAM,WAAW,WAAW,IAAI,OAAO,IAAI,OAAO,SAAS;GAC1E,IAAI,CAAC,UAAU,OAAO,eAAe,MACnC,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,SAAS;GAGzD,OAAO,WAAW,YAAY,IAAI,OAAO;IACvC,OAAO;IACP,YAAY,OAAO;IACnB,UAAU,OAAO,YAAY,OAAO;IACpC,MAAM,IAAI,KAAK;GACjB,CAAC;EACH;CACF,CAAC;AACH"}
+{"version":3,"file":"discussion.js","names":[],"sources":["../../../src/http/routes/discussion.ts"],"sourcesContent":["// Moderator-facing discussion routes. The learner surface (everything under\n// `/api/member`) lives in routes/member/comments.ts.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  Comment,\n  CommentIdParam,\n  CommentsPage,\n  CommentsQuery,\n  CommentView,\n  PatchComment,\n  ReplyToComment,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function discussionRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const discussion = container.discussion;\n\n  r.route({\n    method: 'GET',\n    url: '/api/comments',\n    schema: {\n      operationId: 'listComments',\n      tags: ['Discussion'],\n      summary: 'List course comments for moderation',\n      description: `Requires \\`courses:moderate\\`. Comments on the activities of the courses you moderate, filtered by course, activity, author, status or open reports; each row carries the author's email and the open reports.`,\n      querystring: CommentsQuery,\n      response: { 200: CommentsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.listComments(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/comments/:commentId',\n    schema: {\n      operationId: 'moderateRemoveComment',\n      tags: ['Discussion'],\n      summary: 'Remove a course comment',\n      description:\n        'Needs `courses:moderate` on the course, unless it is your own comment. Hides the comment and resolves its open reports as `removed`. Removing a removed comment returns it unchanged.',\n      params: CommentIdParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.remove(req.params.commentId, 'lesson', actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/comments/:commentId',\n    schema: {\n      operationId: 'publishComment',\n      tags: ['Discussion'],\n      summary: 'Publish a course comment',\n      description:\n        'Needs `courses:moderate` on the course. Approves a pending comment or restores a removed one; a published comment is returned unchanged.',\n      params: CommentIdParam,\n      body: PatchComment,\n      response: { 200: Comment, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.publish(req.params.commentId, 'lesson', actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/comments/:commentId/reports',\n    schema: {\n      operationId: 'dismissCommentReports',\n      tags: ['Discussion'],\n      summary: 'Dismiss every open report on a course comment',\n      description: 'Needs `courses:moderate` on the course. The comment stays up.',\n      params: CommentIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await discussion.resolveReports(req.params.commentId, 'lesson', actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/comments/:commentId/replies',\n    schema: {\n      operationId: 'replyToComment',\n      tags: ['Discussion'],\n      summary: 'Reply to a course comment from the moderation queue',\n      description: `Requires \\`courses:moderate\\`. Needed on the comment's course. Replies nest one level: answering a reply attaches to its root comment.`,\n      params: CommentIdParam,\n      body: ReplyToComment,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.replyToComment(req.params.commentId, req.body.body, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAkBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,aAAa,UAAU;CAE7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,aAAa,IAAI,OAAO,KAAK;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,UAAU,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,UAAU,KAAK;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,WAAW,eAAe,IAAI,OAAO,WAAW,UAAU,KAAK;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,YAAY;GACnB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,eAAe,IAAI,OAAO,WAAW,IAAI,KAAK,MAAM,KAAK;EAC7E;CACF,CAAC;AACH"}

package/dist/http/routes/downloads.js

@@ -1,9 +1,8 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { AddDownloadAsset, CreateDownload, Download, DownloadAssetParams, DownloadFile, DownloadIdParam, DownloadsPage, DownloadsQuery, RenameDownloadAsset, ReorderDownloadAssets, UpdateDownload } from "../schemas/downloads.js";
 import "../schemas/index.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/downloads.ts
 async function downloadsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -15,8 +14,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "listDownloads",
 			tags: ["Content"],
-			summary: "List downloads (staff)",
-			description: "Staff only (owner, admin, instructor). Every download, drafts included, filtered by status and category and searched by title.",
+			summary: "List downloads",
+			description: `Requires \`downloads:read\`. Every download, drafts included, filtered by status and category and searched by title.`,
 			querystring: DownloadsQuery,
 			response: {
 				200: DownloadsPage,
@@ -24,8 +23,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listDownloads(scope.orgId, req.query);
+			const actor = await resolveActor(container, req);
+			return content.listDownloads(req.query, actor);
 		}
 	});
 	r.route({
@@ -35,8 +34,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "getDownload",
 			tags: ["Content"],
-			summary: "Get a download (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Get a download",
+			description: "Requires `downloads:read`.",
 			params: DownloadIdParam,
 			response: {
 				200: Download,
@@ -44,10 +43,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const download = await content.getDownload(scope.orgId, req.params.downloadId);
-			if (!download) throw new NotFoundError("Download", req.params.downloadId);
-			return download;
+			const actor = await resolveActor(container, req);
+			return content.getDownload(req.params.downloadId, actor);
 		}
 	});
 	r.route({
@@ -57,8 +54,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "createDownload",
 			tags: ["Content"],
-			summary: "Create a download (staff)",
-			description: "Staff only (owner, admin, instructor). The download starts as a draft. 409 when its slug is taken.",
+			summary: "Create a download",
+			description: `Requires \`downloads:write\`. The download starts as a draft. 409 when its slug is taken.`,
 			body: CreateDownload,
 			response: {
 				201: Download,
@@ -66,8 +63,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			const download = await content.createDownload(scope.orgId, req.body);
+			const actor = await resolveActor(container, req);
+			const download = await content.createDownload(req.body, actor);
 			return reply.code(201).send(download);
 		}
 	});
@@ -78,8 +75,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "updateDownload",
 			tags: ["Content"],
-			summary: "Update a download (staff)",
-			description: "Staff only (owner, admin, instructor). Changes only the fields sent. `thumbnailAssetId` must be a ready library image (409 otherwise); null clears it.",
+			summary: "Update a download",
+			description: `Requires \`downloads:write\`. Changes only the fields sent. \`thumbnailAssetId\` must be a ready library image (409 otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \`media:read\` (403 otherwise).`,
 			params: DownloadIdParam,
 			body: UpdateDownload,
 			response: {
@@ -88,8 +85,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.updateDownload(scope.orgId, req.params.downloadId, req.body);
+			const actor = await resolveActor(container, req);
+			return content.updateDownload(req.params.downloadId, req.body, actor);
 		}
 	});
 	r.route({
@@ -99,8 +96,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "deleteDownload",
 			tags: ["Content"],
-			summary: "Delete a download (staff)",
-			description: "Staff only (owner, admin, instructor). Its library files survive.",
+			summary: "Delete a download",
+			description: `Requires \`downloads:delete\`. Its library files survive.`,
 			params: DownloadIdParam,
 			response: {
 				204: z.void(),
@@ -108,11 +105,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await content.removeDownload(scope.orgId, req.params.downloadId, {
-				id: scope.orgUserId,
-				role: scope.role
-			});
+			const actor = await resolveActor(container, req);
+			await content.removeDownload(req.params.downloadId, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -123,8 +117,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "listDownloadAssets",
 			tags: ["Content"],
-			summary: "List a download's files in order (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "List a download's files in order",
+			description: "Requires `downloads:read`.",
 			params: DownloadIdParam,
 			response: {
 				200: z.array(DownloadFile),
@@ -132,8 +126,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listDownloadAssets(scope.orgId, req.params.downloadId);
+			const actor = await resolveActor(container, req);
+			return content.listDownloadAssets(req.params.downloadId, actor);
 		}
 	});
 	r.route({
@@ -143,8 +137,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "addDownloadAsset",
 			tags: ["Content"],
-			summary: "Add a library file to a download (staff)",
-			description: "Staff only (owner, admin, instructor). Added last. 409 when the file is not a ready library file or is already in the download. Returns the download's files.",
+			summary: "Add a library file to a download",
+			description: `Requires \`downloads:write\`. Added last. 409 when the file is not a ready library file or is already in the download. A file not uploaded for the download needs \`media:read\` (403 otherwise). Returns the download's files.`,
 			params: DownloadIdParam,
 			body: AddDownloadAsset,
 			response: {
@@ -153,8 +147,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.addDownloadAsset(scope.orgId, req.params.downloadId, req.body);
+			const actor = await resolveActor(container, req);
+			return content.addDownloadAsset(req.params.downloadId, req.body, actor);
 		}
 	});
 	r.route({
@@ -164,8 +158,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "reorderDownloadAssets",
 			tags: ["Content"],
-			summary: "Reorder a download's files (staff)",
-			description: "Staff only (owner, admin, instructor). Send every file id of the download exactly once (409 otherwise). Returns the download's files.",
+			summary: "Reorder a download's files",
+			description: `Requires \`downloads:write\`. Send every file id of the download exactly once (409 otherwise). Returns the download's files.`,
 			params: DownloadIdParam,
 			body: ReorderDownloadAssets,
 			response: {
@@ -174,8 +168,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.reorderDownloadAssets(scope.orgId, req.params.downloadId, req.body.assetIds);
+			const actor = await resolveActor(container, req);
+			return content.reorderDownloadAssets(req.params.downloadId, req.body.assetIds, actor);
 		}
 	});
 	r.route({
@@ -185,8 +179,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "renameDownloadAsset",
 			tags: ["Content"],
-			summary: "Set a file's display name within a download (staff)",
-			description: "Staff only (owner, admin, instructor). Null falls back to the filename. Returns the download's files.",
+			summary: "Set a file's display name within a download",
+			description: `Requires \`downloads:write\`. Null falls back to the filename. Returns the download's files.`,
 			params: DownloadAssetParams,
 			body: RenameDownloadAsset,
 			response: {
@@ -195,8 +189,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.renameDownloadAsset(scope.orgId, req.params.downloadId, req.params.assetId, req.body.displayName);
+			const actor = await resolveActor(container, req);
+			return content.renameDownloadAsset(req.params.downloadId, req.params.assetId, req.body.displayName, actor);
 		}
 	});
 	r.route({
@@ -206,8 +200,8 @@ async function downloadsRoutes(app, container) {
 		schema: {
 			operationId: "removeDownloadAsset",
 			tags: ["Content"],
-			summary: "Remove a file from a download (staff)",
-			description: "Staff only (owner, admin, instructor). The library file itself survives. Returns the download's files.",
+			summary: "Remove a file from a download",
+			description: `Requires \`downloads:write\`. The library file itself survives. Returns the download's files.`,
 			params: DownloadAssetParams,
 			response: {
 				200: z.array(DownloadFile),
@@ -215,8 +209,8 @@ async function downloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.removeDownloadAsset(scope.orgId, req.params.downloadId, req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return content.removeDownloadAsset(req.params.downloadId, req.params.assetId, actor);
 		}
 	});
 }

package/dist/http/routes/downloads.js.map

@@ -1 +1 @@
-{"version":3,"file":"downloads.js","names":[],"sources":["../../../src/http/routes/downloads.ts"],"sourcesContent":["// HTTP routes for the download content type. Request + response are validated\n// against the shared contract schemas by the Zod type provider, and\n// @fastify/swagger reads the same schemas to build the OpenAPI spec.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AddDownloadAsset,\n  Download,\n  DownloadFile,\n  DownloadAssetParams,\n  DownloadIdParam,\n  DownloadsPage,\n  DownloadsQuery,\n  CreateDownload,\n  RenameDownloadAsset,\n  ReorderDownloadAssets,\n  UpdateDownload,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { resolveScope } from '../scope.js';\n\nexport async function downloadsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listDownloads',\n      tags: ['Content'],\n      summary: 'List downloads (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Every download, drafts included, filtered by status and category and searched by title.',\n      querystring: DownloadsQuery,\n      response: { 200: DownloadsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listDownloads(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownload',\n      tags: ['Content'],\n      summary: 'Get a download (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: DownloadIdParam,\n      response: { 200: Download, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const download = await content.getDownload(scope.orgId, req.params.downloadId);\n      if (!download) {\n        throw new NotFoundError('Download', req.params.downloadId);\n      }\n      return download;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createDownload',\n      tags: ['Content'],\n      summary: 'Create a download (staff)',\n      description:\n        'Staff only (owner, admin, instructor). The download starts as a draft. 409 when its slug is taken.',\n      body: CreateDownload,\n      response: { 201: Download, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const download = await content.createDownload(scope.orgId, req.body);\n      return reply.code(201).send(download);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateDownload',\n      tags: ['Content'],\n      summary: 'Update a download (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Changes only the fields sent. `thumbnailAssetId` must be a ready library image (409 otherwise); null clears it.',\n      params: DownloadIdParam,\n      body: UpdateDownload,\n      response: { 200: Download, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.updateDownload(scope.orgId, req.params.downloadId, req.body);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteDownload',\n      tags: ['Content'],\n      summary: 'Delete a download (staff)',\n      description: 'Staff only (owner, admin, instructor). Its library files survive.',\n      params: DownloadIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await content.removeDownload(scope.orgId, req.params.downloadId, {\n        id: scope.orgUserId,\n        role: scope.role,\n      });\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads/:downloadId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listDownloadAssets',\n      tags: ['Content'],\n      summary: \"List a download's files in order (staff)\",\n      description: 'Staff only (owner, admin, instructor).',\n      params: DownloadIdParam,\n      response: { 200: z.array(DownloadFile), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listDownloadAssets(scope.orgId, req.params.downloadId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/downloads/:downloadId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addDownloadAsset',\n      tags: ['Content'],\n      summary: 'Add a library file to a download (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Added last. 409 when the file is not a ready library file or is already in the download. Returns the download's files.\",\n      params: DownloadIdParam,\n      body: AddDownloadAsset,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.addDownloadAsset(scope.orgId, req.params.downloadId, req.body);\n    },\n  });\n\n  // Static segment before the parameterised sibling. Fastify's radix router\n  // prefers static either way; the ordering documents the intent.\n  r.route({\n    method: 'PUT',\n    url: '/api/downloads/:downloadId/assets/order',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderDownloadAssets',\n      tags: ['Content'],\n      summary: \"Reorder a download's files (staff)\",\n      description:\n        \"Staff only (owner, admin, instructor). Send every file id of the download exactly once (409 otherwise). Returns the download's files.\",\n      params: DownloadIdParam,\n      body: ReorderDownloadAssets,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderDownloadAssets(scope.orgId, req.params.downloadId, req.body.assetIds);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'renameDownloadAsset',\n      tags: ['Content'],\n      summary: \"Set a file's display name within a download (staff)\",\n      description:\n        \"Staff only (owner, admin, instructor). Null falls back to the filename. Returns the download's files.\",\n      params: DownloadAssetParams,\n      body: RenameDownloadAsset,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.renameDownloadAsset(\n        scope.orgId,\n        req.params.downloadId,\n        req.params.assetId,\n        req.body.displayName,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeDownloadAsset',\n      tags: ['Content'],\n      summary: 'Remove a file from a download (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). The library file itself survives. Returns the download's files.\",\n      params: DownloadAssetParams,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.removeDownloadAsset(scope.orgId, req.params.downloadId, req.params.assetId);\n    },\n  });\n}\n"],"mappings":";;;;;;;AAwBA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,MAAM,OAAO,IAAI,KAAK;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,WAAW,MAAM,QAAQ,YAAY,MAAM,OAAO,IAAI,OAAO,UAAU;GAC7E,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,YAAY,IAAI,OAAO,UAAU;GAE3D,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,WAAW,MAAM,QAAQ,eAAe,MAAM,OAAO,IAAI,IAAI;GACnE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,QAAQ;EACtC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,MAAM,OAAO,IAAI,OAAO,YAAY,IAAI,IAAI;EAC5E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,eAAe,MAAM,OAAO,IAAI,OAAO,YAAY;IAC/D,IAAI,MAAM;IACV,MAAM,MAAM;GACd,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,mBAAmB,MAAM,OAAO,IAAI,OAAO,UAAU;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,MAAM,OAAO,IAAI,OAAO,YAAY,IAAI,IAAI;EAC9E;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,sBAAsB,MAAM,OAAO,IAAI,OAAO,YAAY,IAAI,KAAK,QAAQ;EAC5F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,oBACb,MAAM,OACN,IAAI,OAAO,YACX,IAAI,OAAO,SACX,IAAI,KAAK,WACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,oBAAoB,MAAM,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,OAAO;EAC3F;CACF,CAAC;AACH"}
+{"version":3,"file":"downloads.js","names":[],"sources":["../../../src/http/routes/downloads.ts"],"sourcesContent":["// HTTP routes for the download content type. Request + response are validated\n// against the shared contract schemas by the Zod type provider, and\n// @fastify/swagger reads the same schemas to build the OpenAPI spec.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AddDownloadAsset,\n  Download,\n  DownloadFile,\n  DownloadAssetParams,\n  DownloadIdParam,\n  DownloadsPage,\n  DownloadsQuery,\n  CreateDownload,\n  RenameDownloadAsset,\n  ReorderDownloadAssets,\n  UpdateDownload,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function downloadsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listDownloads',\n      tags: ['Content'],\n      summary: 'List downloads',\n      description: `Requires \\`downloads:read\\`. Every download, drafts included, filtered by status and category and searched by title.`,\n      querystring: DownloadsQuery,\n      response: { 200: DownloadsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listDownloads(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownload',\n      tags: ['Content'],\n      summary: 'Get a download',\n      description: 'Requires `downloads:read`.',\n      params: DownloadIdParam,\n      response: { 200: Download, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.getDownload(req.params.downloadId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createDownload',\n      tags: ['Content'],\n      summary: 'Create a download',\n      description: `Requires \\`downloads:write\\`. The download starts as a draft. 409 when its slug is taken.`,\n      body: CreateDownload,\n      response: { 201: Download, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const download = await content.createDownload(req.body, actor);\n      return reply.code(201).send(download);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateDownload',\n      tags: ['Content'],\n      summary: 'Update a download',\n      description: `Requires \\`downloads:write\\`. Changes only the fields sent. \\`thumbnailAssetId\\` must be a ready library image (409 otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \\`media:read\\` (403 otherwise).`,\n      params: DownloadIdParam,\n      body: UpdateDownload,\n      response: { 200: Download, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateDownload(req.params.downloadId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteDownload',\n      tags: ['Content'],\n      summary: 'Delete a download',\n      description: `Requires \\`downloads:delete\\`. Its library files survive.`,\n      params: DownloadIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await content.removeDownload(req.params.downloadId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/downloads/:downloadId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listDownloadAssets',\n      tags: ['Content'],\n      summary: \"List a download's files in order\",\n      description: 'Requires `downloads:read`.',\n      params: DownloadIdParam,\n      response: { 200: z.array(DownloadFile), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listDownloadAssets(req.params.downloadId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/downloads/:downloadId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addDownloadAsset',\n      tags: ['Content'],\n      summary: 'Add a library file to a download',\n      description: `Requires \\`downloads:write\\`. Added last. 409 when the file is not a ready library file or is already in the download. A file not uploaded for the download needs \\`media:read\\` (403 otherwise). Returns the download's files.`,\n      params: DownloadIdParam,\n      body: AddDownloadAsset,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.addDownloadAsset(req.params.downloadId, req.body, actor);\n    },\n  });\n\n  // Static segment before the parameterised sibling. Fastify's radix router\n  // prefers static either way; the ordering documents the intent.\n  r.route({\n    method: 'PUT',\n    url: '/api/downloads/:downloadId/assets/order',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderDownloadAssets',\n      tags: ['Content'],\n      summary: \"Reorder a download's files\",\n      description: `Requires \\`downloads:write\\`. Send every file id of the download exactly once (409 otherwise). Returns the download's files.`,\n      params: DownloadIdParam,\n      body: ReorderDownloadAssets,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderDownloadAssets(req.params.downloadId, req.body.assetIds, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'renameDownloadAsset',\n      tags: ['Content'],\n      summary: \"Set a file's display name within a download\",\n      description: `Requires \\`downloads:write\\`. Null falls back to the filename. Returns the download's files.`,\n      params: DownloadAssetParams,\n      body: RenameDownloadAsset,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.renameDownloadAsset(\n        req.params.downloadId,\n        req.params.assetId,\n        req.body.displayName,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeDownloadAsset',\n      tags: ['Content'],\n      summary: 'Remove a file from a download',\n      description: `Requires \\`downloads:write\\`. The library file itself survives. Returns the download's files.`,\n      params: DownloadAssetParams,\n      response: { 200: z.array(DownloadFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.removeDownloadAsset(req.params.downloadId, req.params.assetId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAuBA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,IAAI,OAAO,KAAK;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,YAAY,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,WAAW,MAAM,QAAQ,eAAe,IAAI,MAAM,KAAK;GAC7D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,QAAQ;EACtC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,IAAI,OAAO,YAAY,IAAI,MAAM,KAAK;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,eAAe,IAAI,OAAO,YAAY,KAAK;GACzD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,mBAAmB,IAAI,OAAO,YAAY,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,IAAI,OAAO,YAAY,IAAI,MAAM,KAAK;EACxE;CACF,CAAC;CAID,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,sBAAsB,IAAI,OAAO,YAAY,IAAI,KAAK,UAAU,KAAK;EACtF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,oBACb,IAAI,OAAO,YACX,IAAI,OAAO,SACX,IAAI,KAAK,aACT,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,YAAY;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAChE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,oBAAoB,IAAI,OAAO,YAAY,IAAI,OAAO,SAAS,KAAK;EACrF;CACF,CAAC;AACH"}

package/dist/http/routes/entitlements.js

@@ -1,8 +1,7 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
-import { Entitlement, EntitlementIdParam, EntitlementsPage, EntitlementsQuery, GrantEntitlement, SetEntitlementStatus } from "../schemas/entitlements.js";
+import { resolveActor } from "../scope.js";
+import { Entitlement, EntitlementsPage, EntitlementsQuery, GrantEntitlement, RevokeEntitlement } from "../schemas/entitlements.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/entitlements.ts
 async function entitlementsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -14,8 +13,8 @@ async function entitlementsRoutes(app, container) {
 		schema: {
 			operationId: "listEntitlements",
 			tags: ["Entitlements"],
-			summary: "List entitlements (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "List entitlements",
+			description: `Requires one of \`access:read\`, \`progress:read\`. \`access:read\` lists every grant; \`progress:read\` on a course lists that course's grants when \`contentId\` names it.`,
 			querystring: EntitlementsQuery,
 			response: {
 				200: EntitlementsPage,
@@ -23,8 +22,8 @@ async function entitlementsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return entitlements.list(scope.orgId, req.query);
+			const actor = await resolveActor(container, req);
+			return entitlements.list(req.query, actor);
 		}
 	});
 	r.route({
@@ -34,41 +33,38 @@ async function entitlementsRoutes(app, container) {
 		schema: {
 			operationId: "grantEntitlement",
 			tags: ["Entitlements"],
-			summary: "Grant a person access to content or a bundle (staff)",
-			description: "Staff only (owner, admin, instructor). Name exactly one of `contentId` and `bundleId`. A bundle grant covers whatever the bundle holds, now and later.",
+			summary: "Grant a person access to content or a bundle",
+			description: `Requires \`access:write\`; to grant an event, \`events:write\` on it is enough. Name exactly one of \`contentId\` and \`bundleId\`. A bundle grant covers whatever the bundle holds, now and later. Granting again makes a revoked or expired grant active with the new expiry. A grant to an event needs it published and not ended, with a place left when it has a capacity: 409 \`not_published\`, \`ended\` or \`full\` otherwise; granting it to someone who already holds it changes nothing. 404 when the content or the person does not exist.`,
 			body: GrantEntitlement,
 			response: {
 				201: Entitlement,
-				...refusals(403, 409)
+				...refusals(403, 404, 409)
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			const entitlement = await entitlements.grant(scope.orgId, req.body);
+			const actor = await resolveActor(container, req);
+			const entitlement = await entitlements.grant(req.body, actor);
 			return reply.code(201).send(entitlement);
 		}
 	});
 	r.route({
-		method: "PATCH",
-		url: "/api/entitlements/:id",
+		method: "POST",
+		url: "/api/entitlements/revoke",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "setEntitlementStatus",
+			operationId: "revokeEntitlement",
 			tags: ["Entitlements"],
-			summary: "Revoke or reinstate an entitlement (staff)",
-			description: "Staff only (owner, admin, instructor). Access follows the status at once.",
-			params: EntitlementIdParam,
-			body: SetEntitlementStatus,
+			summary: "Revoke a person's grant to content or a bundle",
+			description: `Requires \`access:write\`; to revoke an event, \`events:write\` on it is enough, and a person may revoke their own. Name exactly one of \`contentId\` and \`bundleId\`. Revokes the person's direct grant; access through a bundle stays. Granting again makes it active. 404 when they have no direct active grant.`,
+			body: RevokeEntitlement,
 			response: {
 				200: Entitlement,
 				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const entitlement = await entitlements.setStatus(scope.orgId, req.params.id, req.body.status);
-			if (!entitlement) throw new NotFoundError("Entitlement", req.params.id);
-			return entitlement;
+			const actor = await resolveActor(container, req);
+			return entitlements.revoke(req.body, actor);
 		}
 	});
 }

package/dist/http/routes/entitlements.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlements.js","names":[],"sources":["../../../src/http/routes/entitlements.ts"],"sourcesContent":["// HTTP routes for the entitlements context (a student's access grant to a piece of content).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Entitlement,\n  EntitlementIdParam,\n  EntitlementsPage,\n  EntitlementsQuery,\n  GrantEntitlement,\n  SetEntitlementStatus,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function entitlementsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const entitlements = container.entitlements;\n\n  r.route({\n    method: 'GET',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEntitlements',\n      tags: ['Entitlements'],\n      summary: 'List entitlements (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: EntitlementsQuery,\n      response: { 200: EntitlementsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return entitlements.list(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'grantEntitlement',\n      tags: ['Entitlements'],\n      summary: 'Grant a person access to content or a bundle (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Name exactly one of `contentId` and `bundleId`. A bundle grant covers whatever the bundle holds, now and later.',\n      body: GrantEntitlement,\n      response: { 201: Entitlement, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.grant(scope.orgId, req.body);\n      return reply.code(201).send(entitlement);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/entitlements/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setEntitlementStatus',\n      tags: ['Entitlements'],\n      summary: 'Revoke or reinstate an entitlement (staff)',\n      description: 'Staff only (owner, admin, instructor). Access follows the status at once.',\n      params: EntitlementIdParam,\n      body: SetEntitlementStatus,\n      response: { 200: Entitlement, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const entitlement = await entitlements.setStatus(scope.orgId, req.params.id, req.body.status);\n      if (!entitlement) {\n        throw new NotFoundError('Entitlement', req.params.id);\n      }\n      return entitlement;\n    },\n  });\n}\n"],"mappings":";;;;;;AAgBA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAE/B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,KAAK,MAAM,OAAO,IAAI,KAAK;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,MAAM,MAAM,OAAO,IAAI,IAAI;GAClE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,WAAW;EACzC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,UAAU,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,MAAM;GAC5F,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,eAAe,IAAI,OAAO,EAAE;GAEtD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"entitlements.js","names":[],"sources":["../../../src/http/routes/entitlements.ts"],"sourcesContent":["// HTTP routes for the entitlements context (a student's access grant to a piece of content).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Entitlement,\n  EntitlementsPage,\n  EntitlementsQuery,\n  GrantEntitlement,\n  RevokeEntitlement,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function entitlementsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const entitlements = container.entitlements;\n\n  r.route({\n    method: 'GET',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEntitlements',\n      tags: ['Entitlements'],\n      summary: 'List entitlements',\n      description: `Requires one of \\`access:read\\`, \\`progress:read\\`. \\`access:read\\` lists every grant; \\`progress:read\\` on a course lists that course's grants when \\`contentId\\` names it.`,\n      querystring: EntitlementsQuery,\n      response: { 200: EntitlementsPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return entitlements.list(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/entitlements',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'grantEntitlement',\n      tags: ['Entitlements'],\n      summary: 'Grant a person access to content or a bundle',\n      description: `Requires \\`access:write\\`; to grant an event, \\`events:write\\` on it is enough. Name exactly one of \\`contentId\\` and \\`bundleId\\`. A bundle grant covers whatever the bundle holds, now and later. Granting again makes a revoked or expired grant active with the new expiry. A grant to an event needs it published and not ended, with a place left when it has a capacity: 409 \\`not_published\\`, \\`ended\\` or \\`full\\` otherwise; granting it to someone who already holds it changes nothing. 404 when the content or the person does not exist.`,\n      body: GrantEntitlement,\n      response: { 201: Entitlement, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const entitlement = await entitlements.grant(req.body, actor);\n      return reply.code(201).send(entitlement);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/entitlements/revoke',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeEntitlement',\n      tags: ['Entitlements'],\n      summary: \"Revoke a person's grant to content or a bundle\",\n      description: `Requires \\`access:write\\`; to revoke an event, \\`events:write\\` on it is enough, and a person may revoke their own. Name exactly one of \\`contentId\\` and \\`bundleId\\`. Revokes the person's direct grant; access through a bundle stays. Granting again makes it active. 404 when they have no direct active grant.`,\n      body: RevokeEntitlement,\n      response: { 200: Entitlement, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return entitlements.revoke(req.body, actor);\n    },\n  });\n}\n"],"mappings":";;;;;AAcA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAE/B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,KAAK,IAAI,OAAO,KAAK;EAC3C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,cAAc,MAAM,aAAa,MAAM,IAAI,MAAM,KAAK;GAC5D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,WAAW;EACzC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,cAAc;GACrB,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,OAAO,IAAI,MAAM,KAAK;EAC5C;CACF,CAAC;AACH"}

package/dist/http/routes/events.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/events.d.ts
+declare function eventsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { eventsRoutes };
+//# sourceMappingURL=events.d.ts.map