@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/routes/member/comments.js

@@ -1,7 +1,7 @@
 import { refusals } from "../../schemas/shared.js";
-import { ActivityComments, CommentIdParam, CommentReport, CommentView, DiscussionActivityParam, EditComment, PostComment, Reactions, ReportComment, ResolveCommentFlags, SetReaction } from "../../schemas/discussion.js";
+import { resolveActor } from "../../scope.js";
+import { ActivityComments, Comment, CommentIdParam, CommentReport, CommentView, DiscussionActivityParam, EditComment, PostComment, Reactions, ReportComment, ResolveCommentFlags, SetReaction } from "../../schemas/discussion.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
 //#region src/http/routes/member/comments.ts
 async function memberCommentsRoutes(app, container) {
@@ -16,7 +16,7 @@ async function memberCommentsRoutes(app, container) {
 			operationId: "listActivityComments",
 			tags,
 			summary: "Read an activity's comments",
-			description: "For a student who can open the course, and staff. Returns the activity's resolved comment settings with the comments; removed comments keep their place without their body.",
+			description: "For anyone who can open the course: through a grant, or with `courses:read` on it. Returns the activity's resolved comment settings with the comments; removed comments keep their place without their body.",
 			params: DiscussionActivityParam,
 			response: {
 				200: ActivityComments,
@@ -24,8 +24,8 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.activityComments(req.orgId, req.params.activityId, orgUser);
+			const actor = await resolveActor(container, req);
+			return discussion.activityComments(req.params.activityId, actor);
 		}
 	});
 	r.route({
@@ -36,7 +36,7 @@ async function memberCommentsRoutes(app, container) {
 			operationId: "postComment",
 			tags,
 			summary: "Post a comment or reply on an activity",
-			description: "For a student who can open the course, and staff, while discussion is on for the activity (403 otherwise). Lands pending when the course requires review and you are not staff. Replies nest one level and need threading on.",
+			description: "For anyone who can open the course, while discussion is on for the activity (403 otherwise). Lands pending when the course requires review and you do not hold `courses:moderate` on it. Replies nest one level and need threading on.",
 			params: DiscussionActivityParam,
 			body: PostComment,
 			response: {
@@ -45,13 +45,12 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const comment = await discussion.postComment(req.orgId, {
-				actor: orgUser,
+			const actor = await resolveActor(container, req);
+			const comment = await discussion.postComment({
 				activityId: req.params.activityId,
 				parentId: req.body.parentId,
 				body: req.body.body
-			});
+			}, actor);
 			return reply.code(201).send(comment);
 		}
 	});
@@ -63,7 +62,7 @@ async function memberCommentsRoutes(app, container) {
 			operationId: "editComment",
 			tags,
 			summary: "Revise your own comment",
-			description: "Author only; not even staff may revise it. Discussion must be open where the comment is, and a removed comment cannot be revised.",
+			description: "Author only; not even a moderator may revise it. Discussion must be open where the comment is, and a removed comment cannot be revised.",
 			params: CommentIdParam,
 			body: EditComment,
 			response: {
@@ -72,8 +71,8 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.edit(req.orgId, req.params.commentId, orgUser, req.body.body);
+			const actor = await resolveActor(container, req);
+			return discussion.edit(req.params.commentId, req.body.body, actor);
 		}
 	});
 	r.route({
@@ -84,7 +83,7 @@ async function memberCommentsRoutes(app, container) {
 			operationId: "deleteComment",
 			tags,
 			summary: "Delete your comment, or one you moderate",
-			description: "For the author, staff on an activity comment, or a moderator on a post comment. The comment is marked removed and keeps its place in the thread. Deleting a removed comment returns it unchanged.",
+			description: "The author can delete their own comment; anyone else needs `communities:moderate` on the community for a post comment, or `courses:moderate` on the course for a lesson comment. The comment is marked removed and keeps its place in the thread. Deleting a removed comment returns it unchanged.",
 			params: CommentIdParam,
 			response: {
 				200: CommentView,
@@ -92,8 +91,8 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.remove(req.orgId, req.params.commentId, orgUser);
+			const actor = await resolveActor(container, req);
+			return discussion.remove(req.params.commentId, "any", actor);
 		}
 	});
 	r.route({
@@ -113,8 +112,8 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.setReaction(req.orgId, req.params.commentId, orgUser, req.body.emoji);
+			const actor = await resolveActor(container, req);
+			return discussion.setReaction(req.params.commentId, req.body.emoji, actor);
 		}
 	});
 	r.route({
@@ -133,8 +132,8 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.setReaction(req.orgId, req.params.commentId, orgUser, null);
+			const actor = await resolveActor(container, req);
+			return discussion.setReaction(req.params.commentId, null, actor);
 		}
 	});
 	r.route({
@@ -154,19 +153,19 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return discussion.reportComment(req.orgId, req.params.commentId, orgUser, req.body.reason);
+			const actor = await resolveActor(container, req);
+			return discussion.reportComment(req.params.commentId, req.body.reason, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/comments/:commentId/flags/resolution",
+		url: "/api/member/comments/:commentId/flags/resolve",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "resolveCommentFlags",
 			tags,
 			summary: "Dismiss the open flags on a comment in a space you moderate",
-			description: "For a moderator of a post comment, or staff for an activity comment. Closes every open flag and leaves the comment up.",
+			description: "Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. Closes every open flag and leaves the comment up.",
 			params: CommentIdParam,
 			body: ResolveCommentFlags,
 			response: {
@@ -175,11 +174,51 @@ async function memberCommentsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			await discussion.resolveReports(req.orgId, req.params.commentId, orgUser);
+			const actor = await resolveActor(container, req);
+			await discussion.resolveReports(req.params.commentId, "any", actor);
 			return reply.code(204).send();
 		}
 	});
+	r.route({
+		method: "POST",
+		url: "/api/member/comments/:commentId/restore",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "restoreMemberComment",
+			tags,
+			summary: "Restore a removed comment where you moderate",
+			description: "Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. Publishes the comment again; a comment that is not removed is returned unchanged.",
+			params: CommentIdParam,
+			response: {
+				200: CommentView,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return discussion.restore(req.params.commentId, "any", actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/comments/:commentId/approve",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "approveMemberComment",
+			tags,
+			summary: "Publish a comment awaiting review where you moderate",
+			description: "Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. 403 when the comment is not awaiting review.",
+			params: CommentIdParam,
+			response: {
+				200: Comment,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return discussion.approve(req.params.commentId, actor);
+		}
+	});
 }
 //#endregion
 export { memberCommentsRoutes };

package/dist/http/routes/member/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","names":[],"sources":["../../../../src/http/routes/member/comments.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActivityComments,\n  CommentIdParam,\n  CommentReport,\n  CommentView,\n  DiscussionActivityParam,\n  EditComment,\n  PostComment,\n  Reactions,\n  ReportComment,\n  ResolveCommentFlags,\n  SetReaction,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberCommentsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const discussion = container.discussion;\n  const tags = ['Discussion'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/activities/:activityId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivityComments',\n      tags,\n      summary: \"Read an activity's comments\",\n      description:\n        \"For a student who can open the course, and staff. Returns the activity's resolved comment settings with the comments; removed comments keep their place without their body.\",\n      params: DiscussionActivityParam,\n      response: { 200: ActivityComments, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.activityComments(req.orgId, req.params.activityId, orgUser);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/activities/:activityId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'postComment',\n      tags,\n      summary: 'Post a comment or reply on an activity',\n      description:\n        'For a student who can open the course, and staff, while discussion is on for the activity (403 otherwise). Lands pending when the course requires review and you are not staff. Replies nest one level and need threading on.',\n      params: DiscussionActivityParam,\n      body: PostComment,\n      response: { 201: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const comment = await discussion.postComment(req.orgId, {\n        actor: orgUser,\n        activityId: req.params.activityId,\n        parentId: req.body.parentId,\n        body: req.body.body,\n      });\n      return reply.code(201).send(comment);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/comments/:commentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'editComment',\n      tags,\n      summary: 'Revise your own comment',\n      description:\n        'Author only; not even staff may revise it. Discussion must be open where the comment is, and a removed comment cannot be revised.',\n      params: CommentIdParam,\n      body: EditComment,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.edit(req.orgId, req.params.commentId, orgUser, req.body.body);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/comments/:commentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteComment',\n      tags,\n      summary: 'Delete your comment, or one you moderate',\n      description:\n        'For the author, staff on an activity comment, or a moderator on a post comment. The comment is marked removed and keeps its place in the thread. Deleting a removed comment returns it unchanged.',\n      params: CommentIdParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.remove(req.orgId, req.params.commentId, orgUser);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/comments/:commentId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setCommentReaction',\n      tags,\n      summary: 'Set your reaction on a comment',\n      description:\n        'For anyone who can read the comment, while reactions are on where it is (403 otherwise). Replaces any reaction you already had and returns the new counts.',\n      params: CommentIdParam,\n      body: SetReaction,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.setReaction(req.orgId, req.params.commentId, orgUser, req.body.emoji);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/comments/:commentId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'clearCommentReaction',\n      tags,\n      summary: 'Withdraw your reaction from a comment',\n      description: 'For anyone who can read the comment. Returns the new counts.',\n      params: CommentIdParam,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.setReaction(req.orgId, req.params.commentId, orgUser, null);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/reports',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reportComment',\n      tags,\n      summary: 'Flag a comment for the moderators',\n      description:\n        'For anyone who can read the comment. Flagging it again while your flag is open returns that flag.',\n      params: CommentIdParam,\n      body: ReportComment,\n      response: { 200: CommentReport, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return discussion.reportComment(req.orgId, req.params.commentId, orgUser, req.body.reason);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/flags/resolution',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resolveCommentFlags',\n      tags,\n      summary: 'Dismiss the open flags on a comment in a space you moderate',\n      description:\n        'For a moderator of a post comment, or staff for an activity comment. Closes every open flag and leaves the comment up.',\n      params: CommentIdParam,\n      body: ResolveCommentFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      await discussion.resolveReports(req.orgId, req.params.commentId, orgUser);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAoBA,eAAsB,qBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,aAAa,UAAU;CAC7B,MAAM,OAAO,CAAC,YAAY;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,iBAAiB,IAAI,OAAO,IAAI,OAAO,YAAY,OAAO;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,UAAU,MAAM,WAAW,YAAY,IAAI,OAAO;IACtD,OAAO;IACP,YAAY,IAAI,OAAO;IACvB,UAAU,IAAI,KAAK;IACnB,MAAM,IAAI,KAAK;GACjB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,KAAK,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI,KAAK,IAAI;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,OAAO,IAAI,OAAO,IAAI,OAAO,WAAW,OAAO;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,YAAY,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI,KAAK,KAAK;EACxF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,YAAY,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,WAAW,cAAc,IAAI,OAAO,IAAI,OAAO,WAAW,SAAS,IAAI,KAAK,MAAM;EAC3F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,WAAW,eAAe,IAAI,OAAO,IAAI,OAAO,WAAW,OAAO;GACxE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"comments.js","names":[],"sources":["../../../../src/http/routes/member/comments.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActivityComments,\n  Comment,\n  CommentIdParam,\n  CommentReport,\n  CommentView,\n  DiscussionActivityParam,\n  EditComment,\n  PostComment,\n  Reactions,\n  ReportComment,\n  ResolveCommentFlags,\n  SetReaction,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberCommentsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const discussion = container.discussion;\n  const tags = ['Discussion'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/activities/:activityId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivityComments',\n      tags,\n      summary: \"Read an activity's comments\",\n      description:\n        \"For anyone who can open the course: through a grant, or with `courses:read` on it. Returns the activity's resolved comment settings with the comments; removed comments keep their place without their body.\",\n      params: DiscussionActivityParam,\n      response: { 200: ActivityComments, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.activityComments(req.params.activityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/activities/:activityId/comments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'postComment',\n      tags,\n      summary: 'Post a comment or reply on an activity',\n      description:\n        'For anyone who can open the course, while discussion is on for the activity (403 otherwise). Lands pending when the course requires review and you do not hold `courses:moderate` on it. Replies nest one level and need threading on.',\n      params: DiscussionActivityParam,\n      body: PostComment,\n      response: { 201: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const comment = await discussion.postComment(\n        { activityId: req.params.activityId, parentId: req.body.parentId, body: req.body.body },\n        actor,\n      );\n      return reply.code(201).send(comment);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/comments/:commentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'editComment',\n      tags,\n      summary: 'Revise your own comment',\n      description:\n        'Author only; not even a moderator may revise it. Discussion must be open where the comment is, and a removed comment cannot be revised.',\n      params: CommentIdParam,\n      body: EditComment,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.edit(req.params.commentId, req.body.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/comments/:commentId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteComment',\n      tags,\n      summary: 'Delete your comment, or one you moderate',\n      description:\n        'The author can delete their own comment; anyone else needs `communities:moderate` on the community for a post comment, or `courses:moderate` on the course for a lesson comment. The comment is marked removed and keeps its place in the thread. Deleting a removed comment returns it unchanged.',\n      params: CommentIdParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.remove(req.params.commentId, 'any', actor);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/comments/:commentId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setCommentReaction',\n      tags,\n      summary: 'Set your reaction on a comment',\n      description:\n        'For anyone who can read the comment, while reactions are on where it is (403 otherwise). Replaces any reaction you already had and returns the new counts.',\n      params: CommentIdParam,\n      body: SetReaction,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.setReaction(req.params.commentId, req.body.emoji, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/comments/:commentId/reaction',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'clearCommentReaction',\n      tags,\n      summary: 'Withdraw your reaction from a comment',\n      description: 'For anyone who can read the comment. Returns the new counts.',\n      params: CommentIdParam,\n      response: { 200: Reactions, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.setReaction(req.params.commentId, null, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/reports',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reportComment',\n      tags,\n      summary: 'Flag a comment for the moderators',\n      description:\n        'For anyone who can read the comment. Flagging it again while your flag is open returns that flag.',\n      params: CommentIdParam,\n      body: ReportComment,\n      response: { 200: CommentReport, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.reportComment(req.params.commentId, req.body.reason, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/flags/resolve',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'resolveCommentFlags',\n      tags,\n      summary: 'Dismiss the open flags on a comment in a space you moderate',\n      description:\n        'Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. Closes every open flag and leaves the comment up.',\n      params: CommentIdParam,\n      body: ResolveCommentFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await discussion.resolveReports(req.params.commentId, 'any', actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/restore',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'restoreMemberComment',\n      tags,\n      summary: 'Restore a removed comment where you moderate',\n      description:\n        'Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. Publishes the comment again; a comment that is not removed is returned unchanged.',\n      params: CommentIdParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.restore(req.params.commentId, 'any', actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/comments/:commentId/approve',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'approveMemberComment',\n      tags,\n      summary: 'Publish a comment awaiting review where you moderate',\n      description:\n        'Needs `courses:moderate` on the course for an activity comment, or `communities:moderate` on the community for a post comment. 403 when the comment is not awaiting review.',\n      params: CommentIdParam,\n      response: { 200: Comment, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return discussion.approve(req.params.commentId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAqBA,eAAsB,qBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,aAAa,UAAU;CAC7B,MAAM,OAAO,CAAC,YAAY;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,iBAAiB,IAAI,OAAO,YAAY,KAAK;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,WAAW,YAC/B;IAAE,YAAY,IAAI,OAAO;IAAY,UAAU,IAAI,KAAK;IAAU,MAAM,IAAI,KAAK;GAAK,GACtF,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,KAAK,IAAI,OAAO,WAAW,IAAI,KAAK,MAAM,KAAK;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,OAAO,IAAI,OAAO,WAAW,OAAO,KAAK;EAC7D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,YAAY,IAAI,OAAO,WAAW,IAAI,KAAK,OAAO,KAAK;EAC3E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAW,GAAG,SAAS,KAAK,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,YAAY,IAAI,OAAO,WAAW,MAAM,KAAK;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,cAAc,IAAI,OAAO,WAAW,IAAI,KAAK,QAAQ,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,WAAW,eAAe,IAAI,OAAO,WAAW,OAAO,KAAK;GAClE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,OAAO,KAAK;EAC9D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,WAAW,QAAQ,IAAI,OAAO,WAAW,KAAK;EACvD;CACF,CAAC;AACH"}

package/dist/http/routes/member/community.js

@@ -1,9 +1,10 @@
 import { PageQuery, refusals } from "../../schemas/shared.js";
-import { CommunityHome, CommunityHomeSpace, CommunitySpaceParam, DirectoryPage, DirectoryQuery, SpaceMember, SpaceMemberParam, SpaceMembersPage } from "../../schemas/community.js";
+import { resolveActor } from "../../scope.js";
+import { SetMute } from "../../schemas/discussion.js";
+import { CommunityHome, CommunityHomeSpace, CommunitySpaceParam, DirectoryPage, DirectoryQuery, SpaceIdParam, SpaceMember, SpaceMemberParam, SpaceMembersPage } from "../../schemas/community.js";
 import { CommunityParam, OrgUserBody } from "../../schemas/chats.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
+import { z } from "zod";
 //#region src/http/routes/member/community.ts
 async function memberCommunityRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -16,7 +17,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "getMemberCommunityHome",
 			tags,
 			summary: "The spaces a member can see in a community",
-			description: "For a member of the community. Lists its spaces in order. Spaces the viewer can open come back in full; spaces they can see but not open come back locked, with only their name, count, rule and the viewer's standing. A by-invite space the viewer is not invited to or a member of is left out. 404 when the viewer is not a member.",
+			description: "For a member of the community, through a grant or `communities:read` on it. Lists its spaces in order. Spaces the viewer can open come back in full; spaces they can see but not open come back locked, with only their name, count, rule and the viewer's standing. A by-invite space the viewer is not invited to or a member of is left out, unless the viewer opens every space. `viewer` carries the viewer's permissions on the community, whether they open every space, and their team flag and role name. 404 when the viewer is not a member.",
 			params: CommunityParam,
 			response: {
 				200: CommunityHome,
@@ -24,10 +25,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const home = await container.reporting.member.communityHome(req.orgId, actor, req.params.communityId);
-			if (!home) throw new NotFoundError("Community", req.params.communityId);
-			return home;
+			const actor = await resolveActor(container, req);
+			return container.reporting.member.communityHome(req.params.communityId, actor);
 		}
 	});
 	r.route({
@@ -46,10 +45,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const space = await container.reporting.member.communitySpace(req.orgId, actor, req.params.communityId, req.params.spaceId);
-			if (!space) throw new NotFoundError("Space", req.params.spaceId);
-			return space;
+			const actor = await resolveActor(container, req);
+			return container.reporting.member.communitySpace(req.params.communityId, req.params.spaceId, actor);
 		}
 	});
 	r.route({
@@ -60,7 +57,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "getMemberCommunityDirectory",
 			tags,
 			summary: "People in a community",
-			description: "For a member of the community: everyone who holds it, with their public profile. 404 when the viewer is not a member.",
+			description: "For a member of the community: everyone who holds it or holds `communities:read` on it, with their public profile, whether they are team here and under which role name, and whether they open every space. 404 when the viewer is not a member.",
 			params: CommunityParam,
 			querystring: DirectoryQuery,
 			response: {
@@ -69,10 +66,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const page = await container.reporting.member.directory(req.orgId, actor, req.params.communityId, req.query);
-			if (!page) throw new NotFoundError("Community", req.params.communityId);
-			return page;
+			const actor = await resolveActor(container, req);
+			return container.reporting.member.directory(req.params.communityId, req.query, actor);
 		}
 	});
 	r.route({
@@ -83,7 +78,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "listSpaceMembers",
 			tags,
 			summary: "List the members of a space",
-			description: "For anyone who can open the space. Members see the active members; moderators also see open requests and invitations.",
+			description: "For anyone who can open the space. Members see the active members; holders of `communities:moderate` on the community also see open requests and invitations. Who opens every space holds no place, and is left out.",
 			params: CommunitySpaceParam,
 			querystring: PageQuery,
 			response: {
@@ -92,8 +87,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.listSpaceMembers(req.orgId, actor, req.params.communityId, req.params.spaceId, req.query);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.listSpaceMembers(req.params.communityId, req.params.spaceId, req.query, actor);
 		}
 	});
 	r.route({
@@ -104,7 +99,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "requestSpaceMembership",
 			tags,
 			summary: "Ask to join a space",
-			description: "For a member of the community who is not staff. Opens a request on a `by_request` space for a moderator to approve. 409 when the space is not `by_request` or you are already placed in it.",
+			description: "For a member of the community who does not open every space. Opens a request on a `by_request` space for a moderator to approve. 409 when the space is not `by_request` or you are already placed in it.",
 			params: CommunitySpaceParam,
 			response: {
 				201: SpaceMember,
@@ -112,8 +107,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const member = await container.entitlements.requestJoin(req.orgId, actor, req.params.communityId, req.params.spaceId);
+			const actor = await resolveActor(container, req);
+			const member = await container.entitlements.requestJoin(req.params.communityId, req.params.spaceId, actor);
 			return reply.code(201).send(member);
 		}
 	});
@@ -125,7 +120,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "inviteSpaceMember",
 			tags,
 			summary: "Invite a person into a space you moderate",
-			description: "For a moderator who is a member of the community. Invites another member into a `by_invite` space; they join when they accept. 403 when the person is staff or does not hold the community; 409 when the space is not invite-only or the person is already placed.",
+			description: `Requires \`communities:moderate\`. On the community, as its member. Invites another member into a \`by_invite\` space; they join when they accept. 403 when the person opens every space or is not a member of the community; 409 when the space is not invite-only or the person is already placed.`,
 			params: CommunitySpaceParam,
 			body: OrgUserBody,
 			response: {
@@ -134,8 +129,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const member = await container.entitlements.invite(req.orgId, actor, req.params.communityId, req.params.spaceId, req.body.orgUserId);
+			const actor = await resolveActor(container, req);
+			const member = await container.entitlements.invite(req.params.communityId, req.params.spaceId, req.body.orgUserId, actor);
 			return reply.code(201).send(member);
 		}
 	});
@@ -147,7 +142,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "addSpaceMember",
 			tags,
 			summary: "Add a person to a space you moderate",
-			description: "For a moderator who is a member of the community. Places another member straight into the space, with no request or invitation. 409 when the space is open to all members, the person is already placed, or the space is full.",
+			description: `Requires \`communities:moderate\`. On the community, as its member. Places another member straight into the space, with no request or invitation. 403 when the person opens every space; 409 when the space is open to all members, the person is already placed, or the space is full.`,
 			params: CommunitySpaceParam,
 			body: OrgUserBody,
 			response: {
@@ -156,20 +151,20 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const member = await container.entitlements.addSpaceMember(req.orgId, actor, req.params.communityId, req.params.spaceId, req.body.orgUserId);
+			const actor = await resolveActor(container, req);
+			const member = await container.entitlements.addSpaceMember(req.params.communityId, req.params.spaceId, req.body.orgUserId, actor);
 			return reply.code(201).send(member);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/communities/:communityId/spaces/:spaceId/acceptance",
+		url: "/api/member/communities/:communityId/spaces/:spaceId/accept",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "acceptSpaceInvite",
 			tags,
 			summary: "Accept your invitation to a space",
-			description: "For a member of the community who is not staff. Makes you an active member. 409 when you have no open invitation, are already a member, or the space is full.",
+			description: "For a member of the community who does not open every space. Makes you an active member. 409 when you have no open invitation, are already a member, or the space is full.",
 			params: CommunitySpaceParam,
 			response: {
 				200: SpaceMember,
@@ -177,19 +172,19 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.accept(req.orgId, actor, req.params.communityId, req.params.spaceId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.accept(req.params.communityId, req.params.spaceId, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/approval",
+		url: "/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/approve",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "approveSpaceRequest",
 			tags,
 			summary: "Approve a person's request to join a space you moderate",
-			description: "For a moderator who is a member of the community. Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.",
+			description: `Requires \`communities:moderate\`. On the community, as its member. Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.`,
 			params: SpaceMemberParam,
 			response: {
 				200: SpaceMember,
@@ -197,8 +192,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.approve(req.orgId, actor, req.params.communityId, req.params.spaceId, req.params.orgUserId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.approve(req.params.communityId, req.params.spaceId, req.params.orgUserId, actor);
 		}
 	});
 	r.route({
@@ -209,7 +204,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "declineSpaceRequest",
 			tags,
 			summary: "Decline a person's request to join a space you moderate",
-			description: "For a moderator who is a member of the community. Closes the open request. 404 when the person has no open request; 409 when they are already a member.",
+			description: `Requires \`communities:moderate\`. On the community, as its member. Closes the open request. 404 when the person has no open request; 409 when they are already a member.`,
 			params: SpaceMemberParam,
 			response: {
 				200: SpaceMember,
@@ -217,19 +212,19 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.decline(req.orgId, actor, req.params.communityId, req.params.spaceId, req.params.orgUserId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.decline(req.params.communityId, req.params.spaceId, req.params.orgUserId, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/communities/:communityId/spaces/:spaceId/refusal",
+		url: "/api/member/communities/:communityId/spaces/:spaceId/refuse",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "refuseSpaceInvite",
 			tags,
 			summary: "Refuse your invitation to a space",
-			description: "For a member of the community who is not staff. 409 when you have no open invitation or are already a member.",
+			description: "For a member of the community who does not open every space. 409 when you have no open invitation or are already a member.",
 			params: CommunitySpaceParam,
 			response: {
 				200: SpaceMember,
@@ -237,8 +232,8 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.refuse(req.orgId, actor, req.params.communityId, req.params.spaceId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.refuse(req.params.communityId, req.params.spaceId, actor);
 		}
 	});
 	r.route({
@@ -249,7 +244,7 @@ async function memberCommunityRoutes(app, container) {
 			operationId: "leaveSpace",
 			tags,
 			summary: "Leave a space",
-			description: "For a member of the community who is not staff. 409 when you are not a member of the space.",
+			description: "For a member of the community who does not open every space. 409 when you are not a member of the space.",
 			params: CommunitySpaceParam,
 			response: {
 				200: SpaceMember,
@@ -257,19 +252,19 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.leave(req.orgId, actor, req.params.communityId, req.params.spaceId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.leave(req.params.communityId, req.params.spaceId, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/removal",
+		url: "/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/remove",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "removeSpaceMember",
 			tags,
 			summary: "Remove a person from a space you moderate",
-			description: "For a moderator who is a member of the community. Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.",
+			description: `Requires \`communities:moderate\`. On the community, as its member. Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.`,
 			params: SpaceMemberParam,
 			response: {
 				200: SpaceMember,
@@ -277,8 +272,30 @@ async function memberCommunityRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.entitlements.remove(req.orgId, actor, req.params.communityId, req.params.spaceId, req.params.orgUserId);
+			const actor = await resolveActor(container, req);
+			return container.entitlements.remove(req.params.communityId, req.params.spaceId, req.params.orgUserId, actor);
+		}
+	});
+	r.route({
+		method: "PUT",
+		url: "/api/member/spaces/:spaceId/subscription",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "setSpaceSubscription",
+			tags,
+			summary: "Mute a space, or clear your mute",
+			description: "For anyone who can open the space. `muted` stops its activity notifying you, until `mutedUntil` when given; mentions, actions on you and moderation work still notify. `none` clears the mute.",
+			params: SpaceIdParam,
+			body: SetMute,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.subscriptions.setSpace(req.params.spaceId, req.body, actor);
+			return reply.code(204).send();
 		}
 	});
 }