@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/routes/member/community.js.map

@@ -1 +1 @@
-{"version":3,"file":"community.js","names":[],"sources":["../../../../src/http/routes/member/community.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport type { Container } from '../../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { actorOf } from './actor.js';\nimport {\n  CommunityHome,\n  CommunityHomeSpace,\n  CommunityParam,\n  CommunitySpaceParam,\n  DirectoryPage,\n  DirectoryQuery,\n  OrgUserBody,\n  PageQuery,\n  SpaceMember,\n  SpaceMemberParam,\n  SpaceMembersPage,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberCommunityRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Communities'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/home',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityHome',\n      tags,\n      summary: 'The spaces a member can see in a community',\n      description:\n        \"For a member of the community. Lists its spaces in order. Spaces the viewer can open come back in full; spaces they can see but not open come back locked, with only their name, count, rule and the viewer's standing. A by-invite space the viewer is not invited to or a member of is left out. 404 when the viewer is not a member.\",\n      params: CommunityParam,\n      response: { 200: CommunityHome, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const home = await container.reporting.member.communityHome(\n        req.orgId,\n        actor,\n        req.params.communityId,\n      );\n      if (!home) {\n        throw new NotFoundError('Community', req.params.communityId);\n      }\n      return home;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberSpace',\n      tags,\n      summary: 'One space as a member sees it',\n      description:\n        'For a member of the community: the space with its topics, links, settings and where the viewer stands. A space the viewer cannot open comes back locked, without its content. 404 when the viewer is not a member, the space is not in the community, or it is a by-invite space the viewer is not invited to or a member of.',\n      params: CommunitySpaceParam,\n      response: { 200: CommunityHomeSpace, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const space = await container.reporting.member.communitySpace(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n      );\n      if (!space) {\n        throw new NotFoundError('Space', req.params.spaceId);\n      }\n      return space;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/directory',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityDirectory',\n      tags,\n      summary: 'People in a community',\n      description:\n        'For a member of the community: everyone who holds it, with their public profile. 404 when the viewer is not a member.',\n      params: CommunityParam,\n      querystring: DirectoryQuery,\n      response: { 200: DirectoryPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const page = await container.reporting.member.directory(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.query,\n      );\n      if (!page) {\n        throw new NotFoundError('Community', req.params.communityId);\n      }\n      return page;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listSpaceMembers',\n      tags,\n      summary: 'List the members of a space',\n      description:\n        'For anyone who can open the space. Members see the active members; moderators also see open requests and invitations.',\n      params: CommunitySpaceParam,\n      querystring: PageQuery,\n      response: { 200: SpaceMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.listSpaceMembers(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.query,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/requests',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'requestSpaceMembership',\n      tags,\n      summary: 'Ask to join a space',\n      description:\n        'For a member of the community who is not staff. Opens a request on a `by_request` space for a moderator to approve. 409 when the space is not `by_request` or you are already placed in it.',\n      params: CommunitySpaceParam,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const member = await container.entitlements.requestJoin(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'inviteSpaceMember',\n      tags,\n      summary: 'Invite a person into a space you moderate',\n      description:\n        'For a moderator who is a member of the community. Invites another member into a `by_invite` space; they join when they accept. 403 when the person is staff or does not hold the community; 409 when the space is not invite-only or the person is already placed.',\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const member = await container.entitlements.invite(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addSpaceMember',\n      tags,\n      summary: 'Add a person to a space you moderate',\n      description:\n        'For a moderator who is a member of the community. Places another member straight into the space, with no request or invitation. 409 when the space is open to all members, the person is already placed, or the space is full.',\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const member = await container.entitlements.addSpaceMember(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/acceptance',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'acceptSpaceInvite',\n      tags,\n      summary: 'Accept your invitation to a space',\n      description:\n        'For a member of the community who is not staff. Makes you an active member. 409 when you have no open invitation, are already a member, or the space is full.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.accept(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/approval',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'approveSpaceRequest',\n      tags,\n      summary: \"Approve a person's request to join a space you moderate\",\n      description:\n        'For a moderator who is a member of the community. Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.approve(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/decline',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'declineSpaceRequest',\n      tags,\n      summary: \"Decline a person's request to join a space you moderate\",\n      description:\n        'For a moderator who is a member of the community. Closes the open request. 404 when the person has no open request; 409 when they are already a member.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.decline(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/refusal',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'refuseSpaceInvite',\n      tags,\n      summary: 'Refuse your invitation to a space',\n      description:\n        'For a member of the community who is not staff. 409 when you have no open invitation or are already a member.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.refuse(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/departure',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'leaveSpace',\n      tags,\n      summary: 'Leave a space',\n      description:\n        'For a member of the community who is not staff. 409 when you are not a member of the space.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.leave(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/removal',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeSpaceMember',\n      tags,\n      summary: 'Remove a person from a space you moderate',\n      description:\n        'For a moderator who is a member of the community. Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.entitlements.remove(\n        req.orgId,\n        actor,\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;AAoBA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,UAAU,UAAU,OAAO,cAC5C,IAAI,OACJ,OACA,IAAI,OAAO,WACb;GACA,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,aAAa,IAAI,OAAO,WAAW;GAE7D,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,QAAQ,MAAM,UAAU,UAAU,OAAO,eAC7C,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,OACb;GACA,IAAI,CAAC,OACH,MAAM,IAAI,cAAc,SAAS,IAAI,OAAO,OAAO;GAErD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,UAAU,UAAU,OAAO,UAC5C,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,KACN;GACA,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,aAAa,IAAI,OAAO,WAAW;GAE7D,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,iBAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KACN;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,SAAS,MAAM,UAAU,aAAa,YAC1C,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,OACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,SAAS,MAAM,UAAU,aAAa,OAC1C,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,SACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,SAAS,MAAM,UAAU,aAAa,eAC1C,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,SACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,OAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,OACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,QAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,QAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,OAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,OACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,MAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,OACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,aAAa,OAC5B,IAAI,OACJ,OACA,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"community.js","names":[],"sources":["../../../../src/http/routes/member/community.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\nimport {\n  CommunityHome,\n  CommunityHomeSpace,\n  CommunityParam,\n  CommunitySpaceParam,\n  DirectoryPage,\n  DirectoryQuery,\n  OrgUserBody,\n  PageQuery,\n  SetMute,\n  SpaceIdParam,\n  SpaceMember,\n  SpaceMemberParam,\n  SpaceMembersPage,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberCommunityRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Communities'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/home',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityHome',\n      tags,\n      summary: 'The spaces a member can see in a community',\n      description:\n        \"For a member of the community, through a grant or `communities:read` on it. Lists its spaces in order. Spaces the viewer can open come back in full; spaces they can see but not open come back locked, with only their name, count, rule and the viewer's standing. A by-invite space the viewer is not invited to or a member of is left out, unless the viewer opens every space. `viewer` carries the viewer's permissions on the community, whether they open every space, and their team flag and role name. 404 when the viewer is not a member.\",\n      params: CommunityParam,\n      response: { 200: CommunityHome, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.member.communityHome(req.params.communityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberSpace',\n      tags,\n      summary: 'One space as a member sees it',\n      description:\n        'For a member of the community: the space with its topics, links, settings and where the viewer stands. A space the viewer cannot open comes back locked, without its content. 404 when the viewer is not a member, the space is not in the community, or it is a by-invite space the viewer is not invited to or a member of.',\n      params: CommunitySpaceParam,\n      response: { 200: CommunityHomeSpace, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.member.communitySpace(\n        req.params.communityId,\n        req.params.spaceId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/directory',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityDirectory',\n      tags,\n      summary: 'People in a community',\n      description:\n        'For a member of the community: everyone who holds it or holds `communities:read` on it, with their public profile, whether they are team here and under which role name, and whether they open every space. 404 when the viewer is not a member.',\n      params: CommunityParam,\n      querystring: DirectoryQuery,\n      response: { 200: DirectoryPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.member.directory(req.params.communityId, req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listSpaceMembers',\n      tags,\n      summary: 'List the members of a space',\n      description:\n        'For anyone who can open the space. Members see the active members; holders of `communities:moderate` on the community also see open requests and invitations. Who opens every space holds no place, and is left out.',\n      params: CommunitySpaceParam,\n      querystring: PageQuery,\n      response: { 200: SpaceMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.listSpaceMembers(\n        req.params.communityId,\n        req.params.spaceId,\n        req.query,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/requests',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'requestSpaceMembership',\n      tags,\n      summary: 'Ask to join a space',\n      description:\n        'For a member of the community who does not open every space. Opens a request on a `by_request` space for a moderator to approve. 409 when the space is not `by_request` or you are already placed in it.',\n      params: CommunitySpaceParam,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const member = await container.entitlements.requestJoin(\n        req.params.communityId,\n        req.params.spaceId,\n        actor,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/invites',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'inviteSpaceMember',\n      tags,\n      summary: 'Invite a person into a space you moderate',\n      description: `Requires \\`communities:moderate\\`. On the community, as its member. Invites another member into a \\`by_invite\\` space; they join when they accept. 403 when the person opens every space or is not a member of the community; 409 when the space is not invite-only or the person is already placed.`,\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const member = await container.entitlements.invite(\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n        actor,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addSpaceMember',\n      tags,\n      summary: 'Add a person to a space you moderate',\n      description: `Requires \\`communities:moderate\\`. On the community, as its member. Places another member straight into the space, with no request or invitation. 403 when the person opens every space; 409 when the space is open to all members, the person is already placed, or the space is full.`,\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const member = await container.entitlements.addSpaceMember(\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n        actor,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/accept',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'acceptSpaceInvite',\n      tags,\n      summary: 'Accept your invitation to a space',\n      description:\n        'For a member of the community who does not open every space. Makes you an active member. 409 when you have no open invitation, are already a member, or the space is full.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.accept(req.params.communityId, req.params.spaceId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/approve',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'approveSpaceRequest',\n      tags,\n      summary: \"Approve a person's request to join a space you moderate\",\n      description: `Requires \\`communities:moderate\\`. On the community, as its member. Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.approve(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/decline',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'declineSpaceRequest',\n      tags,\n      summary: \"Decline a person's request to join a space you moderate\",\n      description: `Requires \\`communities:moderate\\`. On the community, as its member. Closes the open request. 404 when the person has no open request; 409 when they are already a member.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.decline(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/refuse',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'refuseSpaceInvite',\n      tags,\n      summary: 'Refuse your invitation to a space',\n      description:\n        'For a member of the community who does not open every space. 409 when you have no open invitation or are already a member.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.refuse(req.params.communityId, req.params.spaceId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/departure',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'leaveSpace',\n      tags,\n      summary: 'Leave a space',\n      description:\n        'For a member of the community who does not open every space. 409 when you are not a member of the space.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.leave(req.params.communityId, req.params.spaceId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/communities/:communityId/spaces/:spaceId/members/:orgUserId/remove',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeSpaceMember',\n      tags,\n      summary: 'Remove a person from a space you moderate',\n      description: `Requires \\`communities:moderate\\`. On the community, as its member. Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.remove(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/spaces/:spaceId/subscription',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setSpaceSubscription',\n      tags,\n      summary: 'Mute a space, or clear your mute',\n      description:\n        'For anyone who can open the space. `muted` stops its activity notifying you, until `mutedUntil` when given; mentions, actions on you and moderation work still notify. `none` clears the mute.',\n      params: SpaceIdParam,\n      body: SetMute,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.subscriptions.setSpace(req.params.spaceId, req.body, actor);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAsBA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,OAAO,cAAc,IAAI,OAAO,aAAa,KAAK;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,OAAO,eAChC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,OAAO,UAAU,IAAI,OAAO,aAAa,IAAI,OAAO,KAAK;EACtF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,iBAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OACJ,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,YAC1C,IAAI,OAAO,aACX,IAAI,OAAO,SACX,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,OAC1C,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,WACT,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,eAC1C,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,WACT,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,OAAO,IAAI,OAAO,aAAa,IAAI,OAAO,SAAS,KAAK;EACxF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,OAAO,IAAI,OAAO,aAAa,IAAI,OAAO,SAAS,KAAK;EACxF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,MAAM,IAAI,OAAO,aAAa,IAAI,OAAO,SAAS,KAAK;EACvF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,OAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,cAAc,SAAS,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;GAC1E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/courses.js

@@ -1,10 +1,9 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
 import { Course } from "../../schemas/content.js";
 import { ActivityList } from "../../schemas/activities.js";
 import { MemberCourseIdParam, MemberCourses, MemberModules } from "../../schemas/member.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/courses.ts
 async function memberCoursesRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -24,8 +23,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return member.listCourses(req.orgId, orgUser.id);
+			const actor = await resolveActor(container, req);
+			return member.listCourses(actor);
 		}
 	});
 	r.route({
@@ -36,7 +35,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "getMemberCourse",
 			tags: ["Content"],
 			summary: "Get one course you can open",
-			description: "For a member of the organization. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it (which also opens it unpublished). 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: Course,
@@ -44,10 +43,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const course = await member.getCourse(req.orgId, orgUser.id, req.params.courseId);
-			if (!course) throw new NotFoundError("Course", req.params.courseId);
-			return course;
+			const actor = await resolveActor(container, req);
+			return member.getCourse(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -58,7 +55,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "listMemberModules",
 			tags: ["Content"],
 			summary: "List the modules and activities of a course you can open",
-			description: "For a member of the organization. Published activities only. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it. Published activities only. 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: MemberModules,
@@ -66,10 +63,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const modules = await member.listModules(req.orgId, orgUser.id, req.params.courseId);
-			if (!modules) throw new NotFoundError("Course", req.params.courseId);
-			return modules;
+			const actor = await resolveActor(container, req);
+			return member.listModules(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -80,7 +75,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "listMemberActivities",
 			tags: ["Content"],
 			summary: "List the published activities of a course you can open",
-			description: "For a member of the organization. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it. 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: ActivityList,
@@ -88,10 +83,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const activities = await member.listActivities(req.orgId, orgUser.id, req.params.courseId);
-			if (!activities) throw new NotFoundError("Course", req.params.courseId);
-			return activities;
+			const actor = await resolveActor(container, req);
+			return member.listActivities(req.params.courseId, actor);
 		}
 	});
 }

package/dist/http/routes/member/courses.js.map

@@ -1 +1 @@
-{"version":3,"file":"courses.js","names":[],"sources":["../../../../src/http/routes/member/courses.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityList,\n  Course,\n  MemberCourseIdParam,\n  MemberCourses,\n  MemberModules,\n  refusals,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberCoursesRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberCourses',\n      tags: ['Content'],\n      summary: 'List the courses you can open',\n      description:\n        'For a member of the organization. Published courses you hold, directly or through a bundle.',\n      response: { 200: MemberCourses, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return member.listCourses(req.orgId, orgUser.id);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourse',\n      tags: ['Content'],\n      summary: 'Get one course you can open',\n      description:\n        'For a member of the organization. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const course = await member.getCourse(req.orgId, orgUser.id, req.params.courseId);\n      if (!course) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return course;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberModules',\n      tags: ['Content'],\n      summary: 'List the modules and activities of a course you can open',\n      description:\n        'For a member of the organization. Published activities only. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: MemberModules, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const modules = await member.listModules(req.orgId, orgUser.id, req.params.courseId);\n      if (!modules) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return modules;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberActivities',\n      tags: ['Content'],\n      summary: 'List the published activities of a course you can open',\n      description:\n        'For a member of the organization. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: ActivityList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const activities = await member.listActivities(req.orgId, orgUser.id, req.params.courseId);\n      if (!activities) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return activities;\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,OAAO,YAAY,IAAI,OAAO,QAAQ,EAAE;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,UAAU,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GAChF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,UAAU,MAAM,OAAO,YAAY,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACnF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,aAAa,MAAM,OAAO,eAAe,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACzF,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"courses.js","names":[],"sources":["../../../../src/http/routes/member/courses.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityList,\n  Course,\n  MemberCourseIdParam,\n  MemberCourses,\n  MemberModules,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberCoursesRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberCourses',\n      tags: ['Content'],\n      summary: 'List the courses you can open',\n      description:\n        'For a member of the organization. Published courses you hold, directly or through a bundle.',\n      response: { 200: MemberCourses, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listCourses(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourse',\n      tags: ['Content'],\n      summary: 'Get one course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it (which also opens it unpublished). 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getCourse(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberModules',\n      tags: ['Content'],\n      summary: 'List the modules and activities of a course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it. Published activities only. 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: MemberModules, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listModules(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberActivities',\n      tags: ['Content'],\n      summary: 'List the published activities of a course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it. 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: ActivityList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listActivities(req.params.courseId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,KAAK;EACjC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK;EACpD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,IAAI,OAAO,UAAU,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,eAAe,IAAI,OAAO,UAAU,KAAK;EACzD;CACF,CAAC;AACH"}

package/dist/http/routes/member/devices.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/devices.d.ts
+declare function memberDeviceRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberDeviceRoutes };
+//# sourceMappingURL=devices.d.ts.map

package/dist/http/routes/member/devices.js

@@ -0,0 +1,97 @@
+import { refusals } from "../../schemas/shared.js";
+import { resolveActor, resolveCaller } from "../../scope.js";
+import { Device, DeviceIdParam, DeviceList, PushConfigView, RegisterDevice } from "../../schemas/notifications.js";
+import "../../schemas/index.js";
+import { z } from "zod";
+//#region src/http/routes/member/devices.ts
+async function memberDeviceRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const tags = ["Notifications"];
+	async function memberOf(req) {
+		const caller = await resolveCaller(container, req);
+		return {
+			...caller.actor,
+			userId: caller.userId
+		};
+	}
+	r.route({
+		method: "GET",
+		url: "/api/member/devices",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberDevices",
+			tags,
+			summary: "List the devices you registered for push notifications",
+			description: "For anyone signed in to the organization. Each app install or browser that registered, most recently seen first. A device not seen for 30 days receives no push until it registers again.",
+			response: {
+				200: DeviceList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			return container.devices.list(await memberOf(req));
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/devices",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "registerMemberDevice",
+			tags,
+			summary: "Register this device for push notifications, or refresh it",
+			description: "For anyone signed in to the organization. Call it after sign-in and on every launch. A new token adds a device, a known token is refreshed, and a token another person registered moves to you. A browser sends its push subscription endpoint as `token` with its `keys`; an iOS app sends its bundle id as `appId` and its APNs `environment`. 422 when the provider is not configured, an `apns` `appId` is not one of the configured bundle ids, a `webpush` device has no `keys`, or `keys` or `environment` come with a provider they do not apply to.",
+			body: RegisterDevice,
+			response: {
+				200: Device,
+				...refusals(400, 403, 422)
+			}
+		},
+		handler: async (req) => {
+			return container.devices.register(req.body, await memberOf(req));
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/devices/:deviceId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMemberDevice",
+			tags,
+			summary: "Remove one of your devices",
+			description: "For the person who registered the device. Call it before signing out, so the next person on the device receives none of your pushes. 404 when the device is not yours.",
+			params: DeviceIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			await container.devices.remove(req.params.deviceId, await memberOf(req));
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/push-config",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberPushConfig",
+			tags,
+			summary: "Read what a browser needs to subscribe to push notifications",
+			description: "For anyone signed in to the organization. `vapidPublicKey` is the `applicationServerKey` for `pushManager.subscribe`, or null when Web Push is not configured.",
+			response: {
+				200: PushConfigView,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => {
+			await resolveActor(container, req);
+			return container.devices.pushConfig();
+		}
+	});
+}
+//#endregion
+export { memberDeviceRoutes };
+
+//# sourceMappingURL=devices.js.map

package/dist/http/routes/member/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","names":[],"sources":["../../../../src/http/routes/member/devices.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport type { FastifyRequest } from 'fastify';\nimport { resolveActor, resolveCaller } from '../../scope.js';\nimport {\n  Device,\n  DeviceIdParam,\n  DeviceList,\n  PushConfigView,\n  RegisterDevice,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberDeviceRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  async function memberOf(req: FastifyRequest) {\n    const caller = await resolveCaller(container, req);\n    return { ...caller.actor, userId: caller.userId };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDevices',\n      tags,\n      summary: 'List the devices you registered for push notifications',\n      description:\n        'For anyone signed in to the organization. Each app install or browser that registered, most recently seen first. A device not seen for 30 days receives no push until it registers again.',\n      response: { 200: DeviceList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return container.devices.list(await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'registerMemberDevice',\n      tags,\n      summary: 'Register this device for push notifications, or refresh it',\n      description:\n        'For anyone signed in to the organization. Call it after sign-in and on every launch. A new token adds a device, a known token is refreshed, and a token another person registered moves to you. A browser sends its push subscription endpoint as `token` with its `keys`; an iOS app sends its bundle id as `appId` and its APNs `environment`. 422 when the provider is not configured, an `apns` `appId` is not one of the configured bundle ids, a `webpush` device has no `keys`, or `keys` or `environment` come with a provider they do not apply to.',\n      body: RegisterDevice,\n      response: { 200: Device, ...refusals(400, 403, 422) },\n    },\n    handler: async (req) => {\n      return container.devices.register(req.body, await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/devices/:deviceId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberDevice',\n      tags,\n      summary: 'Remove one of your devices',\n      description:\n        'For the person who registered the device. Call it before signing out, so the next person on the device receives none of your pushes. 404 when the device is not yours.',\n      params: DeviceIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await container.devices.remove(req.params.deviceId, await memberOf(req));\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/push-config',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberPushConfig',\n      tags,\n      summary: 'Read what a browser needs to subscribe to push notifications',\n      description:\n        'For anyone signed in to the organization. `vapidPublicKey` is the `applicationServerKey` for `pushManager.subscribe`, or null when Web Push is not configured.',\n      response: { 200: PushConfigView, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveActor(container, req);\n      return container.devices.pushConfig();\n    },\n  });\n}\n"],"mappings":";;;;;;AAeA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,eAAe,SAAS,KAAqB;EAC3C,MAAM,SAAS,MAAM,cAAc,WAAW,GAAG;EACjD,OAAO;GAAE,GAAG,OAAO;GAAO,QAAQ,OAAO;EAAO;CAClD;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,KAAK,MAAM,SAAS,GAAG,CAAC;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,SAAS,IAAI,MAAM,MAAM,SAAS,GAAG,CAAC;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,QAAQ,OAAO,IAAI,OAAO,UAAU,MAAM,SAAS,GAAG,CAAC;GACvE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,aAAa,WAAW,GAAG;GACjC,OAAO,UAAU,QAAQ,WAAW;EACtC;CACF,CAAC;AACH"}

package/dist/http/routes/member/downloads.js

@@ -1,9 +1,8 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
 import { DownloadIdParam } from "../../schemas/downloads.js";
 import { MemberDownload, MemberDownloads } from "../../schemas/member.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/downloads.ts
 async function memberDownloadsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -23,8 +22,8 @@ async function memberDownloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return member.listDownloads(req.orgId, orgUser.id);
+			const actor = await resolveActor(container, req);
+			return member.listDownloads(actor);
 		}
 	});
 	r.route({
@@ -35,7 +34,7 @@ async function memberDownloadsRoutes(app, container) {
 			operationId: "getMemberDownload",
 			tags: ["Content"],
 			summary: "One download you can open, with its files in order",
-			description: "For a member of the organization. 404 when the download is not published or you do not hold it.",
+			description: "For a member of the organization who holds the download, or holds `downloads:read` on it (which also opens it unpublished). 404 otherwise.",
 			params: DownloadIdParam,
 			response: {
 				200: MemberDownload,
@@ -43,10 +42,8 @@ async function memberDownloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const result = await member.getDownload(req.orgId, orgUser.id, req.params.downloadId);
-			if (!result) throw new NotFoundError("Download", req.params.downloadId);
-			return result;
+			const actor = await resolveActor(container, req);
+			return member.getDownload(req.params.downloadId, actor);
 		}
 	});
 }

package/dist/http/routes/member/downloads.js.map

@@ -1 +1 @@
-{"version":3,"file":"downloads.js","names":[],"sources":["../../../../src/http/routes/member/downloads.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { DownloadIdParam, MemberDownload, MemberDownloads, refusals } from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberDownloadsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDownloads',\n      tags: ['Content'],\n      summary: 'List the downloads you can open',\n      description:\n        'For a member of the organization. Published downloads you hold, directly or through a bundle.',\n      response: { 200: MemberDownloads, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return member.listDownloads(req.orgId, orgUser.id);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberDownload',\n      tags: ['Content'],\n      summary: 'One download you can open, with its files in order',\n      description:\n        'For a member of the organization. 404 when the download is not published or you do not hold it.',\n      params: DownloadIdParam,\n      response: { 200: MemberDownload, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const result = await member.getDownload(req.orgId, orgUser.id, req.params.downloadId);\n      if (!result) {\n        throw new NotFoundError('Download', req.params.downloadId);\n      }\n      return result;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,OAAO,cAAc,IAAI,OAAO,QAAQ,EAAE;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,YAAY,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,UAAU;GACpF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,YAAY,IAAI,OAAO,UAAU;GAE3D,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"downloads.js","names":[],"sources":["../../../../src/http/routes/member/downloads.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { DownloadIdParam, MemberDownload, MemberDownloads, refusals } from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberDownloadsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDownloads',\n      tags: ['Content'],\n      summary: 'List the downloads you can open',\n      description:\n        'For a member of the organization. Published downloads you hold, directly or through a bundle.',\n      response: { 200: MemberDownloads, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listDownloads(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberDownload',\n      tags: ['Content'],\n      summary: 'One download you can open, with its files in order',\n      description:\n        'For a member of the organization who holds the download, or holds `downloads:read` on it (which also opens it unpublished). 404 otherwise.',\n      params: DownloadIdParam,\n      response: { 200: MemberDownload, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getDownload(req.params.downloadId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAMA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,cAAc,KAAK;EACnC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,IAAI,OAAO,YAAY,KAAK;EACxD;CACF,CAAC;AACH"}

package/dist/http/routes/member/events.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/events.d.ts
+declare function memberEventsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberEventsRoutes };
+//# sourceMappingURL=events.d.ts.map