@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/routes/member/events.js

@@ -0,0 +1,386 @@
+import { PageQuery, refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
+import { AddEventAsset, AddEventAttendee, CreateEvent, Event, EventAssetParams, EventAttendeeParams, EventAttendeesPage, EventFile, EventIdParam, MemberEvent, MemberEventsPage, MemberEventsQuery, RenameEventAsset, ReorderEventAssets, UpdateEvent } from "../../schemas/events.js";
+import "../../schemas/index.js";
+import { z } from "zod";
+//#region src/http/routes/member/events.ts
+async function memberEventsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const content = container.content;
+	const member = container.reporting.member;
+	r.route({
+		method: "GET",
+		url: "/api/member/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEvents",
+			tags: ["Events"],
+			summary: "List the events you can see",
+			description: "For a member of the organization. The published `public` events, and the published and canceled events you attend; with `events:read`, every published and canceled event it covers. Each as the event read returns it.",
+			querystring: MemberEventsQuery,
+			response: {
+				200: MemberEventsPage,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.listEvents(req.query, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberEvent",
+			tags: ["Events"],
+			summary: "Get an event, with what you can do with it",
+			description: "With `events:read` on the event or the org: the event in any status. As an attendee, directly or through a bundle: the published or canceled event, with the recording after the end when replay is on. Otherwise a published `public` event without its location, files and recording. 404 for anything else.",
+			params: EventIdParam,
+			response: {
+				200: MemberEvent,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.getEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/calendar",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventCalendar",
+			tags: ["Events"],
+			summary: "Download an event as a calendar file",
+			description: "An iCalendar file with the title, the times and the event page. The location and the meeting link are included when the event read returns them. 404 when the event read does.",
+			params: EventIdParam,
+			response: {
+				200: z.string().describe("`text/calendar`, one VEVENT"),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			const body = await member.eventCalendar(req.params.eventId, actor);
+			return reply.header("content-type", "text/calendar; charset=utf-8").header("content-disposition", `attachment; filename="${req.params.eventId}.ics"`).send(body);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEventAttendees",
+			tags: ["Events"],
+			summary: "List the attendees of an event you run",
+			description: `Requires \`events:read\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \`source\` is \`bundle\` for someone who attends only through a bundle.`,
+			params: EventIdParam,
+			querystring: PageQuery,
+			response: {
+				200: EventAttendeesPage,
+				...refusals(400, 403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.eventAttendees(req.params.eventId, req.query, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "createMemberEvent",
+			tags: ["Events"],
+			summary: "Create an event from the member app",
+			description: `Requires \`events:write\`. The event starts as a draft. 400 when it ends before it starts.`,
+			body: CreateEvent,
+			response: {
+				201: Event,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			const event = await content.createEvent(req.body, actor);
+			return reply.code(201).send(event);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateMemberEvent",
+			tags: ["Events"],
+			summary: "Update an event you run",
+			description: `Requires \`events:write\`. Changes only the fields sent; \`status\` publishes or unpublishes it. \`thumbnailAssetId\` must be a ready library image (409 \`conflict\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \`media:read\` (403 otherwise). 409 \`canceled\` when the event is canceled.`,
+			params: EventIdParam,
+			body: UpdateEvent,
+			response: {
+				200: Event,
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.updateEvent(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/cancel",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "cancelMemberEvent",
+			tags: ["Events"],
+			summary: "Cancel an event you run",
+			description: `Requires \`events:write\`. Canceling is final. 409 \`canceled\` when it is already canceled.`,
+			params: EventIdParam,
+			response: {
+				200: Event,
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.cancelEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteMemberEvent",
+			tags: ["Events"],
+			summary: "Delete an event you can delete",
+			description: `Requires \`events:delete\`. Its attendees lose it; its library files survive.`,
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await content.deleteEvent(req.params.eventId, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEventAssets",
+			tags: ["Events"],
+			summary: "List the files of an event you run, in order",
+			description: "Requires `events:read`.",
+			params: EventIdParam,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.listEventAssets(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addMemberEventAsset",
+			tags: ["Events"],
+			summary: "Attach a file to an event you run",
+			description: `Requires \`events:write\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \`media:read\` (403 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: AddEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.addEventAsset(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "PUT",
+		url: "/api/member/events/:eventId/assets/order",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reorderMemberEventAssets",
+			tags: ["Events"],
+			summary: "Reorder the files of an event you run",
+			description: `Requires \`events:write\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: ReorderEventAssets,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "renameMemberEventAsset",
+			tags: ["Events"],
+			summary: "Set a file's display name within an event you run",
+			description: `Requires \`events:write\`. Null falls back to the filename. Returns the event's files.`,
+			params: EventAssetParams,
+			body: RenameEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.renameEventAsset(req.params.eventId, req.params.assetId, req.body.displayName, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMemberEventAsset",
+			tags: ["Events"],
+			summary: "Remove a file from an event you run",
+			description: `Requires \`events:write\`. The library file itself survives. Returns the event's files.`,
+			params: EventAssetParams,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/register",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "registerForEvent",
+			tags: ["Events"],
+			summary: "Register for an event",
+			description: "Any active member of the organization registers themselves for a published `public` event that has not started, with source `self`. 403 when the event is `private`; 404 when it does not exist or is not published; 409 `already_registered`, `started` or `full`.",
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.grant({
+				orgUserId: actor.id,
+				contentId: req.params.eventId,
+				contentType: "event",
+				expiresAt: null
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/unregister",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "cancelEventRegistration",
+			tags: ["Events"],
+			summary: "Cancel your registration for an event",
+			description: "Any active member of the organization revokes their own direct grant to the event, which frees the place. 404 when the caller has no direct active grant.",
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.revoke({
+				orgUserId: actor.id,
+				contentId: req.params.eventId,
+				contentType: "event"
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addMemberEventAttendee",
+			tags: ["Events"],
+			summary: "Add an attendee to an event you run",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.",
+			params: EventIdParam,
+			body: AddEventAttendee,
+			response: {
+				204: z.void(),
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.grant({
+				orgUserId: req.body.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event",
+				expiresAt: null
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId/attendees/:orgUserId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMemberEventAttendee",
+			tags: ["Events"],
+			summary: "Remove an attendee from an event you run",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.",
+			params: EventAttendeeParams,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.revoke({
+				orgUserId: req.params.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event"
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+}
+//#endregion
+export { memberEventsRoutes };
+
+//# sourceMappingURL=events.js.map

package/dist/http/routes/member/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../../../src/http/routes/member/events.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AddEventAsset,\n  AddEventAttendee,\n  CreateEvent,\n  Event,\n  EventAssetParams,\n  EventAttendeeParams,\n  EventAttendeesPage,\n  EventFile,\n  EventIdParam,\n  MemberEvent,\n  MemberEventsPage,\n  MemberEventsQuery,\n  PageQuery,\n  RenameEventAsset,\n  ReorderEventAssets,\n  UpdateEvent,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberEventsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEvents',\n      tags: ['Events'],\n      summary: 'List the events you can see',\n      description:\n        'For a member of the organization. The published `public` events, and the published and canceled events you attend; with `events:read`, every published and canceled event it covers. Each as the event read returns it.',\n      querystring: MemberEventsQuery,\n      response: { 200: MemberEventsPage, ...refusals(400, 403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listEvents(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberEvent',\n      tags: ['Events'],\n      summary: 'Get an event, with what you can do with it',\n      description:\n        'With `events:read` on the event or the org: the event in any status. As an attendee, directly or through a bundle: the published or canceled event, with the recording after the end when replay is on. Otherwise a published `public` event without its location, files and recording. 404 for anything else.',\n      params: EventIdParam,\n      response: { 200: MemberEvent, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/calendar',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEventCalendar',\n      tags: ['Events'],\n      summary: 'Download an event as a calendar file',\n      description:\n        'An iCalendar file with the title, the times and the event page. The location and the meeting link are included when the event read returns them. 404 when the event read does.',\n      params: EventIdParam,\n      response: {\n        200: z.string().describe('`text/calendar`, one VEVENT'),\n        ...refusals(403, 404),\n      },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const body = await member.eventCalendar(req.params.eventId, actor);\n      return reply\n        .header('content-type', 'text/calendar; charset=utf-8')\n        .header('content-disposition', `attachment; filename=\"${req.params.eventId}.ics\"`)\n        .send(body);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEventAttendees',\n      tags: ['Events'],\n      summary: 'List the attendees of an event you run',\n      description: `Requires \\`events:read\\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \\`source\\` is \\`bundle\\` for someone who attends only through a bundle.`,\n      params: EventIdParam,\n      querystring: PageQuery,\n      response: { 200: EventAttendeesPage, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.eventAttendees(req.params.eventId, req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createMemberEvent',\n      tags: ['Events'],\n      summary: 'Create an event from the member app',\n      description: `Requires \\`events:write\\`. The event starts as a draft. 400 when it ends before it starts.`,\n      body: CreateEvent,\n      response: { 201: Event, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const event = await content.createEvent(req.body, actor);\n      return reply.code(201).send(event);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberEvent',\n      tags: ['Events'],\n      summary: 'Update an event you run',\n      description: `Requires \\`events:write\\`. Changes only the fields sent; \\`status\\` publishes or unpublishes it. \\`thumbnailAssetId\\` must be a ready library image (409 \\`conflict\\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \\`media:read\\` (403 otherwise). 409 \\`canceled\\` when the event is canceled.`,\n      params: EventIdParam,\n      body: UpdateEvent,\n      response: { 200: Event, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateEvent(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/cancel',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'cancelMemberEvent',\n      tags: ['Events'],\n      summary: 'Cancel an event you run',\n      description: `Requires \\`events:write\\`. Canceling is final. 409 \\`canceled\\` when it is already canceled.`,\n      params: EventIdParam,\n      response: { 200: Event, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.cancelEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteMemberEvent',\n      tags: ['Events'],\n      summary: 'Delete an event you can delete',\n      description: `Requires \\`events:delete\\`. Its attendees lose it; its library files survive.`,\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await content.deleteEvent(req.params.eventId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEventAssets',\n      tags: ['Events'],\n      summary: 'List the files of an event you run, in order',\n      description: 'Requires `events:read`.',\n      params: EventIdParam,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listEventAssets(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addMemberEventAsset',\n      tags: ['Events'],\n      summary: 'Attach a file to an event you run',\n      description: `Requires \\`events:write\\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \\`media:read\\` (403 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: AddEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.addEventAsset(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/events/:eventId/assets/order',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderMemberEventAssets',\n      tags: ['Events'],\n      summary: 'Reorder the files of an event you run',\n      description: `Requires \\`events:write\\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: ReorderEventAssets,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'renameMemberEventAsset',\n      tags: ['Events'],\n      summary: \"Set a file's display name within an event you run\",\n      description: `Requires \\`events:write\\`. Null falls back to the filename. Returns the event's files.`,\n      params: EventAssetParams,\n      body: RenameEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.renameEventAsset(\n        req.params.eventId,\n        req.params.assetId,\n        req.body.displayName,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberEventAsset',\n      tags: ['Events'],\n      summary: 'Remove a file from an event you run',\n      description: `Requires \\`events:write\\`. The library file itself survives. Returns the event's files.`,\n      params: EventAssetParams,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/register',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'registerForEvent',\n      tags: ['Events'],\n      summary: 'Register for an event',\n      description:\n        'Any active member of the organization registers themselves for a published `public` event that has not started, with source `self`. 403 when the event is `private`; 404 when it does not exist or is not published; 409 `already_registered`, `started` or `full`.',\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.grant(\n        {\n          orgUserId: actor.id,\n          contentId: req.params.eventId,\n          contentType: 'event',\n          expiresAt: null,\n        },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/unregister',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'cancelEventRegistration',\n      tags: ['Events'],\n      summary: 'Cancel your registration for an event',\n      description:\n        'Any active member of the organization revokes their own direct grant to the event, which frees the place. 404 when the caller has no direct active grant.',\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.revoke(\n        { orgUserId: actor.id, contentId: req.params.eventId, contentType: 'event' },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addMemberEventAttendee',\n      tags: ['Events'],\n      summary: 'Add an attendee to an event you run',\n      description:\n        'Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.',\n      params: EventIdParam,\n      body: AddEventAttendee,\n      response: { 204: z.void(), ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.grant(\n        {\n          orgUserId: req.body.orgUserId,\n          contentId: req.params.eventId,\n          contentType: 'event',\n          expiresAt: null,\n        },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId/attendees/:orgUserId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberEventAttendee',\n      tags: ['Events'],\n      summary: 'Remove an attendee from an event you run',\n      description:\n        \"Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.\",\n      params: EventAttendeeParams,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.revoke(\n        { orgUserId: req.params.orgUserId, contentId: req.params.eventId, contentType: 'event' },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAyBA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAC3C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK;EAClD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IACR,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,6BAA6B;IACtD,GAAG,SAAS,KAAK,GAAG;GACtB;EACF;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,OAAO,MAAM,OAAO,cAAc,IAAI,OAAO,SAAS,KAAK;GACjE,OAAO,MACJ,OAAO,gBAAgB,8BAA8B,CAAC,CACtD,OAAO,uBAAuB,yBAAyB,IAAI,OAAO,QAAQ,MAAM,CAAC,CACjF,KAAK,IAAI;EACd;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,eAAe,IAAI,OAAO,SAAS,IAAI,OAAO,KAAK;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,MAAM,QAAQ,YAAY,IAAI,MAAM,KAAK;GACvD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK;EACnC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;GACnD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,gBAAgB,IAAI,OAAO,SAAS,KAAK;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,mBAAmB,IAAI,OAAO,SAAS,IAAI,KAAK,UAAU,KAAK;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBACb,IAAI,OAAO,SACX,IAAI,OAAO,SACX,IAAI,KAAK,aACT,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,MAC3B;IACE,WAAW,MAAM;IACjB,WAAW,IAAI,OAAO;IACtB,aAAa;IACb,WAAW;GACb,GACA,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,OAC3B;IAAE,WAAW,MAAM;IAAI,WAAW,IAAI,OAAO;IAAS,aAAa;GAAQ,GAC3E,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,MAC3B;IACE,WAAW,IAAI,KAAK;IACpB,WAAW,IAAI,OAAO;IACtB,aAAa;IACb,WAAW;GACb,GACA,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,OAC3B;IAAE,WAAW,IAAI,OAAO;IAAW,WAAW,IAAI,OAAO;IAAS,aAAa;GAAQ,GACvF,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/files.js

@@ -1,29 +1,20 @@
 import { refusals } from "../../schemas/shared.js";
-import { ActivityFileParams, CommunityThumbnailParams, CourseThumbnailParams, DownloadFileParams, DownloadThumbnailParams, MessageAttachmentParams, PersonImageParams, PostCoverParams, UploadFileParams } from "../../schemas/files.js";
+import { resolveActor } from "../../scope.js";
+import { ActivityFileParams, CommunityThumbnailParams, CourseThumbnailParams, DownloadFileParams, DownloadThumbnailParams, EventFileParams, EventThumbnailParams, MessageAttachmentParams, PostAssetParams, PostCoverParams, UploadFileParams } from "../../schemas/files.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/files.ts
 const tags = ["Files"];
 const responses = {
 	302: z.void(),
 	...refusals(403, 404)
 };
-function redirect(reply, url, what, id) {
-	if (!url) throw new NotFoundError(what, id);
+function redirect(reply, url) {
 	return reply.header("cache-control", "no-store").header("referrer-policy", "no-referrer").redirect(url, 302);
 }
 async function memberFileRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const member = container.reporting.member;
-	async function actorOf$1(orgId, userId) {
-		const orgUser = await actorOf(container, orgId, userId);
-		return {
-			id: orgUser.id,
-			role: orgUser.role
-		};
-	}
 	r.route({
 		method: "GET",
 		url: "/api/member/courses/:courseId/thumbnail",
@@ -32,13 +23,47 @@ async function memberFileRoutes(app, container) {
 			operationId: "getCourseThumbnail",
 			tags,
 			summary: "Redirect to a course's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published course; staff may fetch any. 404 when the course has no thumbnail.",
+			description: "For an unpublished course, which only a holder of `courses:read` on it may fetch: a published course carries a public `thumbnailUrl` instead. 404 when the course has no thumbnail.",
 			params: CourseThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "course", req.params.courseId), "Course thumbnail", req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("course", req.params.courseId, actor));
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/thumbnail",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventThumbnail",
+			tags,
+			summary: "Redirect to an event's cover",
+			description: "For a draft event, which only a holder of `events:read` on it may fetch: a published or canceled event carries a public `thumbnailUrl` instead. 404 when the event read returns 404 or the event has no cover.",
+			params: EventThumbnailParams,
+			response: responses
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("event", req.params.eventId, actor));
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventFile",
+			tags,
+			summary: "Redirect to a file attached to an event",
+			description: "For a holder of `events:read` on the event or the org, or an attendee of the published or canceled event. Saved under its display name. 404 otherwise, or when the file is not attached to the event.",
+			params: EventFileParams,
+			response: responses
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.eventFile(req.params.eventId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -49,13 +74,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getDownloadThumbnail",
 			tags,
 			summary: "Redirect to a download's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published download; staff may fetch any. 404 when the download has no thumbnail.",
+			description: "For an unpublished download, which only a holder of `downloads:read` on it may fetch: a published download carries a public `thumbnailUrl` instead. 404 when the download has no thumbnail.",
 			params: DownloadThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "download", req.params.downloadId), "Download thumbnail", req.params.downloadId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("download", req.params.downloadId, actor));
 		}
 	});
 	r.route({
@@ -66,13 +91,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getCommunityThumbnail",
 			tags,
 			summary: "Redirect to a community's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published community; staff may fetch any. 404 when the community has no thumbnail.",
+			description: "For an unpublished community, which only a holder of `communities:read` on it may fetch: a published community carries a public `thumbnailUrl` instead. 404 when the community has no thumbnail.",
 			params: CommunityThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "community", req.params.communityId), "Community thumbnail", req.params.communityId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("community", req.params.communityId, actor));
 		}
 	});
 	r.route({
@@ -83,13 +108,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getActivityFile",
 			tags,
 			summary: "Redirect to a file used in a lesson",
-			description: "Served when the student can open the course, the course and the lesson are published, and the lesson lists the file. Staff may fetch any file a lesson lists. Use the URL as an img, video or audio src.",
+			description: "Served when the person can open the course, the course and the lesson are published, and the lesson lists the file. A holder of `courses:read` on the course may fetch any file a lesson lists. Use the URL as an img, video or audio src.",
 			params: ActivityFileParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.activityFile(req.orgId, actor, req.params.activityId, req.params.assetId), "Lesson file", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.activityFile(req.params.activityId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -100,13 +125,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getDownloadFile",
 			tags,
 			summary: "Redirect to a file in a download, saved under its display name",
-			description: "Served when the student can open the download, it is published, and it lists the file. Staff may fetch any file a download lists. The storage link lives DELIVERY_URL_EXPIRY seconds.",
+			description: "Served when the person can open the download, it is published, and it lists the file. A holder of `downloads:read` on the download may fetch it unpublished. The storage link lives DELIVERY_URL_EXPIRY seconds.",
 			params: DownloadFileParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.downloadFile(req.orgId, actor, req.params.downloadId, req.params.assetId), "Download file", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.downloadFile(req.params.downloadId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -117,47 +142,47 @@ async function memberFileRoutes(app, container) {
 			operationId: "getPostCover",
 			tags,
 			summary: "Redirect to a post's cover image",
-			description: "Served to whoever can read the post. 404 when the post has no cover.",
+			description: "For a post that is not published, served to whoever can read it: a published post carries a public `coverUrl` instead. 404 when the post has no cover.",
 			params: PostCoverParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.posts.coverFile(req.orgId, actor, req.params.postId), "Post cover", req.params.postId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.posts.coverFile(req.params.postId, actor));
 		}
 	});
 	r.route({
 		method: "GET",
-		url: "/api/member/chats/:chatId/messages/:messageId/attachments/:assetId",
+		url: "/api/member/posts/:postId/assets/:assetId",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "getMessageAttachment",
+			operationId: "getPostAsset",
 			tags,
-			summary: "Redirect to an image attached to a chat message",
-			description: "Served to the chat's participants while the message stands (staff also after it is deleted), and to moderators while the message is flagged.",
-			params: MessageAttachmentParams,
+			summary: "Redirect to a file in a post's body",
+			description: "Served to whoever can read the post while its body shows the file. Images, video, audio and PDFs open in place; any other file downloads under its name.",
+			params: PostAssetParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.chats.attachmentFile(req.orgId, actor, req.params.chatId, req.params.messageId, req.params.assetId), "Message attachment", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.posts.assetFile(req.params.postId, req.params.assetId, actor));
 		}
 	});
 	r.route({
 		method: "GET",
-		url: "/api/member/people/:orgUserId/image",
+		url: "/api/member/chats/:chatId/messages/:messageId/attachments/:assetId",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "getPersonImage",
+			operationId: "getMessageAttachment",
 			tags,
-			summary: "Redirect to an org user's profile photo",
-			description: "Served to org users of the same organization when the photo belongs to it. 404 when the person has no photo here.",
-			params: PersonImageParams,
+			summary: "Redirect to an image attached to a chat message",
+			description: "Served to the chat's participants while the message stands, to holders of `communities:moderate` on the community also after it is deleted, and to them while the message is flagged.",
+			params: MessageAttachmentParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.personImage(req.orgId, req.params.orgUserId), "Profile photo", req.params.orgUserId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.chats.attachmentFile(req.params.chatId, req.params.messageId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -173,8 +198,8 @@ async function memberFileRoutes(app, container) {
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.assets.ownUploadFile(req.orgId, req.params.id, actor.id), "Upload", req.params.id);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.assets.ownUploadFile(req.params.id, actor));
 		}
 	});
 }