@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/plugins/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","names":[],"sources":["../../../src/http/plugins/error-handler.ts"],"sourcesContent":["import type { FastifyReply, FastifyRequest } from 'fastify';\nimport { ActionInvocationError } from '@headless-lms/core/integrations';\nimport { isResponseSerializationError } from 'fastify-type-provider-zod';\nimport { classifyError } from '../errors.js';\n\nfunction routeOf(request: FastifyRequest): string {\n  return `${request.method} ${request.routeOptions.url ?? 'unmatched route'}`;\n}\n\nexport function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply) {\n  if (error instanceof ActionInvocationError) {\n    request.log.error(\n      { err: error, integrationId: error.integrationId, actionId: error.actionId },\n      `integration action failed in ${routeOf(request)}`,\n    );\n    return reply.status(502).send({\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    });\n  }\n  const refusal = classifyError(error);\n  if (refusal) {\n    request.log.info(\n      {\n        status: refusal.status,\n        error: refusal.error,\n        message: refusal.message,\n        ...(refusal.issues && { issues: refusal.issues }),\n        ...(refusal.error === 'bad_request' && { cause: (error as Error).message }),\n      },\n      `${routeOf(request)} refused`,\n    );\n    return reply.status(refusal.status).send({\n      error: refusal.error,\n      message: refusal.message,\n      ...(refusal.issues && { issues: refusal.issues }),\n    });\n  }\n  if (isResponseSerializationError(error)) {\n    request.log.error(\n      { err: error, issues: error.cause.issues },\n      `response of ${routeOf(request)} does not match its schema`,\n    );\n  } else {\n    request.log.error({ err: error }, `unhandled error in ${routeOf(request)}`);\n  }\n  return reply.status(500).send({\n    error: 'internal_error',\n    message: 'Something went wrong on our side. Quote the request id when reporting it.',\n    requestId: request.id,\n  });\n}\n\nexport function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {\n  request.log.info(\n    { status: 404, error: 'not_found' },\n    `${request.method} unmatched route refused`,\n  );\n  return reply\n    .status(404)\n    .send({ error: 'not_found', message: `No route for ${request.method} ${request.url}` });\n}\n"],"mappings":";;;;AAKA,SAAS,QAAQ,SAAiC;CAChD,OAAO,GAAG,QAAQ,OAAO,GAAG,QAAQ,aAAa,OAAO;AAC1D;AAEA,SAAgB,aAAa,OAAgB,SAAyB,OAAqB;CACzF,IAAI,iBAAiB,uBAAuB;EAC1C,QAAQ,IAAI,MACV;GAAE,KAAK;GAAO,eAAe,MAAM;GAAe,UAAU,MAAM;EAAS,GAC3E,gCAAgC,QAAQ,OAAO,GACjD;EACA,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;GAC5B,OAAO;GACP,SAAS;EACX,CAAC;CACH;CACA,MAAM,UAAU,cAAc,KAAK;CACnC,IAAI,SAAS;EACX,QAAQ,IAAI,KACV;GACE,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,UAAU,iBAAiB,EAAE,OAAQ,MAAgB,QAAQ;EAC3E,GACA,GAAG,QAAQ,OAAO,EAAE,SACtB;EACA,OAAO,MAAM,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK;GACvC,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;EACjD,CAAC;CACH;CACA,IAAI,6BAA6B,KAAK,GACpC,QAAQ,IAAI,MACV;EAAE,KAAK;EAAO,QAAQ,MAAM,MAAM;CAAO,GACzC,eAAe,QAAQ,OAAO,EAAE,2BAClC;MAEA,QAAQ,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,sBAAsB,QAAQ,OAAO,GAAG;CAE5E,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;EAC5B,OAAO;EACP,SAAS;EACT,WAAW,QAAQ;CACrB,CAAC;AACH;AAEA,SAAgB,gBAAgB,SAAyB,OAAqB;CAC5E,QAAQ,IAAI,KACV;EAAE,QAAQ;EAAK,OAAO;CAAY,GAClC,GAAG,QAAQ,OAAO,yBACpB;CACA,OAAO,MACJ,OAAO,GAAG,CAAC,CACX,KAAK;EAAE,OAAO;EAAa,SAAS,gBAAgB,QAAQ,OAAO,GAAG,QAAQ;CAAM,CAAC;AAC1F"}
+{"version":3,"file":"error-handler.js","names":[],"sources":["../../../src/http/plugins/error-handler.ts"],"sourcesContent":["import type { FastifyReply, FastifyRequest } from 'fastify';\nimport { ActionInvocationError } from '@headless-lms/core/integrations';\nimport { isResponseSerializationError } from 'fastify-type-provider-zod';\nimport { classifyError } from '../errors.js';\n\nfunction routeOf(request: FastifyRequest): string {\n  return `${request.method} ${request.routeOptions.url ?? 'unmatched route'}`;\n}\n\nexport function refusalSubject(error: unknown): { permission?: string; contentId?: string } {\n  const subject = error as { permission?: unknown; contentId?: unknown };\n  return {\n    ...(typeof subject?.permission === 'string' && { permission: subject.permission }),\n    ...(typeof subject?.contentId === 'string' && { contentId: subject.contentId }),\n  };\n}\n\nexport function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply) {\n  if (error instanceof ActionInvocationError) {\n    request.log.error(\n      { err: error, integrationId: error.integrationId, actionId: error.actionId },\n      `integration action failed in ${routeOf(request)}`,\n    );\n    return reply.status(502).send({\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    });\n  }\n  const refusal = classifyError(error);\n  if (refusal) {\n    request.log.info(\n      {\n        status: refusal.status,\n        error: refusal.error,\n        message: refusal.message,\n        ...(refusal.issues && { issues: refusal.issues }),\n        ...(refusal.details && { details: refusal.details }),\n        ...(refusal.error === 'bad_request' && { cause: (error as Error).message }),\n        ...refusalSubject(error),\n      },\n      `${routeOf(request)} refused`,\n    );\n    return reply.status(refusal.status).send({\n      error: refusal.error,\n      message: refusal.message,\n      ...(refusal.issues && { issues: refusal.issues }),\n      ...(refusal.details && { details: refusal.details }),\n    });\n  }\n  if (isResponseSerializationError(error)) {\n    request.log.error(\n      { err: error, issues: error.cause.issues },\n      `response of ${routeOf(request)} does not match its schema`,\n    );\n  } else {\n    request.log.error({ err: error }, `unhandled error in ${routeOf(request)}`);\n  }\n  return reply.status(500).send({\n    error: 'internal_error',\n    message: 'Something went wrong on our side. Quote the request id when reporting it.',\n    requestId: request.id,\n  });\n}\n\nexport function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {\n  request.log.info(\n    { status: 404, error: 'not_found' },\n    `${request.method} unmatched route refused`,\n  );\n  return reply\n    .status(404)\n    .send({ error: 'not_found', message: `No route for ${request.method} ${request.url}` });\n}\n"],"mappings":";;;;AAKA,SAAS,QAAQ,SAAiC;CAChD,OAAO,GAAG,QAAQ,OAAO,GAAG,QAAQ,aAAa,OAAO;AAC1D;AAEA,SAAgB,eAAe,OAA6D;CAC1F,MAAM,UAAU;CAChB,OAAO;EACL,GAAI,OAAO,SAAS,eAAe,YAAY,EAAE,YAAY,QAAQ,WAAW;EAChF,GAAI,OAAO,SAAS,cAAc,YAAY,EAAE,WAAW,QAAQ,UAAU;CAC/E;AACF;AAEA,SAAgB,aAAa,OAAgB,SAAyB,OAAqB;CACzF,IAAI,iBAAiB,uBAAuB;EAC1C,QAAQ,IAAI,MACV;GAAE,KAAK;GAAO,eAAe,MAAM;GAAe,UAAU,MAAM;EAAS,GAC3E,gCAAgC,QAAQ,OAAO,GACjD;EACA,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;GAC5B,OAAO;GACP,SAAS;EACX,CAAC;CACH;CACA,MAAM,UAAU,cAAc,KAAK;CACnC,IAAI,SAAS;EACX,QAAQ,IAAI,KACV;GACE,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;GAClD,GAAI,QAAQ,UAAU,iBAAiB,EAAE,OAAQ,MAAgB,QAAQ;GACzE,GAAG,eAAe,KAAK;EACzB,GACA,GAAG,QAAQ,OAAO,EAAE,SACtB;EACA,OAAO,MAAM,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK;GACvC,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;EACpD,CAAC;CACH;CACA,IAAI,6BAA6B,KAAK,GACpC,QAAQ,IAAI,MACV;EAAE,KAAK;EAAO,QAAQ,MAAM,MAAM;CAAO,GACzC,eAAe,QAAQ,OAAO,EAAE,2BAClC;MAEA,QAAQ,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,sBAAsB,QAAQ,OAAO,GAAG;CAE5E,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;EAC5B,OAAO;EACP,SAAS;EACT,WAAW,QAAQ;CACrB,CAAC;AACH;AAEA,SAAgB,gBAAgB,SAAyB,OAAqB;CAC5E,QAAQ,IAAI,KACV;EAAE,QAAQ;EAAK,OAAO;CAAY,GAClC,GAAG,QAAQ,OAAO,yBACpB;CACA,OAAO,MACJ,OAAO,GAAG,CAAC,CACX,KAAK;EAAE,OAAO;EAAa,SAAS,gBAAgB,QAAQ,OAAO,GAAG,QAAQ;CAAM,CAAC;AAC1F"}

package/dist/http/plugins/openapi.js

@@ -22,7 +22,7 @@ function registerOpenApi(app, config) {
 			info: {
 				title: "Headless LMS API",
 				version,
-				description: "API documentation for the Headless LMS platform",
+				description: "API documentation for the Headless LMS platform. Every route under /api takes a signed-in session or an API key, sent in the `x-api-key` header or as `Authorization: Bearer <key>`. The platform routes take the platform key as `Authorization: Bearer <platform key>`.",
 				license: {
 					name: "MIT",
 					url: "https://opensource.org/licenses/MIT"
@@ -38,6 +38,10 @@ function registerOpenApi(app, config) {
 					name: "Content",
 					description: "Authored content: courses and downloads, their structure and delivery"
 				},
+				{
+					name: "Events",
+					description: "Live sessions at a set time: their details, location, recording and files"
+				},
 				{
 					name: "Entitlements",
 					description: "Access grants to content"
@@ -90,9 +94,21 @@ function registerOpenApi(app, config) {
 					name: "Reporting",
 					description: "Reporting and analytics"
 				},
+				{
+					name: "People",
+					description: "The organization's people, invites and the roles they hold"
+				},
+				{
+					name: "Roles",
+					description: "The organization's roles and their permissions"
+				},
 				{
 					name: "Access",
-					description: "Access scopes, connected apps and API keys"
+					description: "Your permissions, connected apps and API keys"
+				},
+				{
+					name: "Platform",
+					description: "Organizations and their API keys, created with the platform key"
 				}
 			]
 		},

package/dist/http/plugins/openapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.js","names":["pkg.version"],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform, jsonSchemaTransformObject } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\nimport { ErrorBody, ValidationErrorBody } from '../schemas/shared.js';\nimport pkg from '../../../package.json' with { type: 'json' };\n\nconst PUBLIC_ROUTES = new Set(['GET /api/organizations/invites/:token']);\n\ntype RouteSchema = {\n  body?: unknown;\n  querystring?: unknown;\n  params?: unknown;\n  response?: Record<string, unknown>;\n};\n\nfunction withDefaultResponses(\n  schema: RouteSchema | undefined,\n  method: string,\n  url: string,\n): RouteSchema | undefined {\n  if (!schema || !url.startsWith('/api/') || url.startsWith('/api/auth/')) {\n    return schema;\n  }\n  const response: Record<string, unknown> = { ...(schema.response ?? {}) };\n  if ((schema.body || schema.querystring || schema.params) && !response['400']) {\n    response['400'] = ValidationErrorBody;\n  }\n  if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response['401']) {\n    response['401'] = ErrorBody;\n  }\n  if (!response['500']) {\n    response['500'] = ErrorBody;\n  }\n  return { ...schema, response };\n}\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: {\n        title: 'Headless LMS API',\n        version: pkg.version,\n        description: 'API documentation for the Headless LMS platform',\n        license: {\n          name: 'MIT',\n          url: 'https://opensource.org/licenses/MIT',\n        },\n      },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        {\n          name: 'Organizations',\n          description: 'The tenant: its members, roles, invites and students',\n        },\n        {\n          name: 'Content',\n          description: 'Authored content: courses and downloads, their structure and delivery',\n        },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        {\n          name: 'Progress',\n          description: 'Per-student progress and completion through course content',\n        },\n        { name: 'Discussion', description: 'Learner comments, replies, reactions and moderation' },\n        {\n          name: 'Communities',\n          description: 'Communities, their spaces, topics, and direct-message settings',\n        },\n        { name: 'Posts', description: 'Posts in a space, reactions, and the moderation queue' },\n        { name: 'Chats', description: 'Direct and group chats inside one community' },\n        { name: 'Profile', description: 'The signed-in member profile' },\n        {\n          name: 'Notifications',\n          description: 'What happened to the signed-in member, and how they want to be told',\n        },\n        { name: 'Assets', description: 'The org media library: uploads, serving and lifecycle' },\n        {\n          name: 'Files',\n          description: 'Stable file URLs that check access and redirect to a signed storage URL',\n        },\n        { name: 'Automations', description: 'Workflows and webhooks that react to system events' },\n        { name: 'Integrations', description: 'Connections to external services' },\n        { name: 'Reporting', description: 'Reporting and analytics' },\n        { name: 'Access', description: 'Access scopes, connected apps and API keys' },\n      ],\n    },\n    transform: (input) => {\n      const method = String(\n        Array.isArray(input.route.method) ? input.route.method[0] : input.route.method,\n      );\n      return jsonSchemaTransform({\n        ...input,\n        schema: withDefaultResponses(input.schema as RouteSchema | undefined, method, input.url),\n      } as typeof input);\n    },\n    transformObject: jsonSchemaTransformObject,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;;;AAYA,MAAM,gCAAgB,IAAI,IAAI,CAAC,uCAAuC,CAAC;AASvE,SAAS,qBACP,QACA,QACA,KACyB;CACzB,IAAI,CAAC,UAAU,CAAC,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,YAAY,GACpE,OAAO;CAET,MAAM,WAAoC,EAAE,GAAI,OAAO,YAAY,CAAC,EAAG;CACvE,KAAK,OAAO,QAAQ,OAAO,eAAe,OAAO,WAAW,CAAC,SAAS,QACpE,SAAS,SAAS;CAEpB,IAAI,CAAC,cAAc,IAAI,GAAG,OAAO,GAAG,KAAK,KAAK,CAAC,SAAS,QACtD,SAAS,SAAS;CAEpB,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;CAEpB,OAAO;EAAE,GAAG;EAAQ;CAAS;AAC/B;AAEA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IACJ,OAAO;IACEA;IACT,aAAa;IACb,SAAS;KACP,MAAM;KACN,KAAK;IACP;GACF;GACA,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAc,aAAa;IAAsD;IACzF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAwD;IACtF;KAAE,MAAM;KAAS,aAAa;IAA8C;IAC5E;KAAE,MAAM;KAAW,aAAa;IAA+B;IAC/D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAU,aAAa;IAAwD;IACvF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAe,aAAa;IAAqD;IACzF;KAAE,MAAM;KAAgB,aAAa;IAAmC;IACxE;KAAE,MAAM;KAAa,aAAa;IAA0B;IAC5D;KAAE,MAAM;KAAU,aAAa;IAA6C;GAC9E;EACF;EACA,YAAY,UAAU;GACpB,MAAM,SAAS,OACb,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,MAC1E;GACA,OAAO,oBAAoB;IACzB,GAAG;IACH,QAAQ,qBAAqB,MAAM,QAAmC,QAAQ,MAAM,GAAG;GACzF,CAAiB;EACnB;EACA,iBAAiB;CACnB,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}
+{"version":3,"file":"openapi.js","names":["pkg.version"],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform, jsonSchemaTransformObject } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\nimport { ErrorBody, ValidationErrorBody } from '../schemas/shared.js';\nimport pkg from '../../../package.json' with { type: 'json' };\n\nconst PUBLIC_ROUTES = new Set(['GET /api/organizations/invites/:token']);\n\ntype RouteSchema = {\n  body?: unknown;\n  querystring?: unknown;\n  params?: unknown;\n  response?: Record<string, unknown>;\n};\n\nfunction withDefaultResponses(\n  schema: RouteSchema | undefined,\n  method: string,\n  url: string,\n): RouteSchema | undefined {\n  if (!schema || !url.startsWith('/api/') || url.startsWith('/api/auth/')) {\n    return schema;\n  }\n  const response: Record<string, unknown> = { ...(schema.response ?? {}) };\n  if ((schema.body || schema.querystring || schema.params) && !response['400']) {\n    response['400'] = ValidationErrorBody;\n  }\n  if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response['401']) {\n    response['401'] = ErrorBody;\n  }\n  if (!response['500']) {\n    response['500'] = ErrorBody;\n  }\n  return { ...schema, response };\n}\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: {\n        title: 'Headless LMS API',\n        version: pkg.version,\n        description:\n          'API documentation for the Headless LMS platform. Every route under /api takes a signed-in session or an API key, sent in the `x-api-key` header or as `Authorization: Bearer <key>`. The platform routes take the platform key as `Authorization: Bearer <platform key>`.',\n        license: {\n          name: 'MIT',\n          url: 'https://opensource.org/licenses/MIT',\n        },\n      },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        {\n          name: 'Organizations',\n          description: 'The tenant: its members, roles, invites and students',\n        },\n        {\n          name: 'Content',\n          description: 'Authored content: courses and downloads, their structure and delivery',\n        },\n        {\n          name: 'Events',\n          description: 'Live sessions at a set time: their details, location, recording and files',\n        },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        {\n          name: 'Progress',\n          description: 'Per-student progress and completion through course content',\n        },\n        { name: 'Discussion', description: 'Learner comments, replies, reactions and moderation' },\n        {\n          name: 'Communities',\n          description: 'Communities, their spaces, topics, and direct-message settings',\n        },\n        { name: 'Posts', description: 'Posts in a space, reactions, and the moderation queue' },\n        { name: 'Chats', description: 'Direct and group chats inside one community' },\n        { name: 'Profile', description: 'The signed-in member profile' },\n        {\n          name: 'Notifications',\n          description: 'What happened to the signed-in member, and how they want to be told',\n        },\n        { name: 'Assets', description: 'The org media library: uploads, serving and lifecycle' },\n        {\n          name: 'Files',\n          description: 'Stable file URLs that check access and redirect to a signed storage URL',\n        },\n        { name: 'Automations', description: 'Workflows and webhooks that react to system events' },\n        { name: 'Integrations', description: 'Connections to external services' },\n        { name: 'Reporting', description: 'Reporting and analytics' },\n        {\n          name: 'People',\n          description: \"The organization's people, invites and the roles they hold\",\n        },\n        { name: 'Roles', description: \"The organization's roles and their permissions\" },\n        { name: 'Access', description: 'Your permissions, connected apps and API keys' },\n        {\n          name: 'Platform',\n          description: 'Organizations and their API keys, created with the platform key',\n        },\n      ],\n    },\n    transform: (input) => {\n      const method = String(\n        Array.isArray(input.route.method) ? input.route.method[0] : input.route.method,\n      );\n      return jsonSchemaTransform({\n        ...input,\n        schema: withDefaultResponses(input.schema as RouteSchema | undefined, method, input.url),\n      } as typeof input);\n    },\n    transformObject: jsonSchemaTransformObject,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;;;AAYA,MAAM,gCAAgB,IAAI,IAAI,CAAC,uCAAuC,CAAC;AASvE,SAAS,qBACP,QACA,QACA,KACyB;CACzB,IAAI,CAAC,UAAU,CAAC,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,YAAY,GACpE,OAAO;CAET,MAAM,WAAoC,EAAE,GAAI,OAAO,YAAY,CAAC,EAAG;CACvE,KAAK,OAAO,QAAQ,OAAO,eAAe,OAAO,WAAW,CAAC,SAAS,QACpE,SAAS,SAAS;CAEpB,IAAI,CAAC,cAAc,IAAI,GAAG,OAAO,GAAG,KAAK,KAAK,CAAC,SAAS,QACtD,SAAS,SAAS;CAEpB,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;CAEpB,OAAO;EAAE,GAAG;EAAQ;CAAS;AAC/B;AAEA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IACJ,OAAO;IACEA;IACT,aACE;IACF,SAAS;KACP,MAAM;KACN,KAAK;IACP;GACF;GACA,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAc,aAAa;IAAsD;IACzF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAwD;IACtF;KAAE,MAAM;KAAS,aAAa;IAA8C;IAC5E;KAAE,MAAM;KAAW,aAAa;IAA+B;IAC/D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAU,aAAa;IAAwD;IACvF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAe,aAAa;IAAqD;IACzF;KAAE,MAAM;KAAgB,aAAa;IAAmC;IACxE;KAAE,MAAM;KAAa,aAAa;IAA0B;IAC5D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAiD;IAC/E;KAAE,MAAM;KAAU,aAAa;IAAgD;IAC/E;KACE,MAAM;KACN,aAAa;IACf;GACF;EACF;EACA,YAAY,UAAU;GACpB,MAAM,SAAS,OACb,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,MAC1E;GACA,OAAO,oBAAoB;IACzB,GAAG;IACH,QAAQ,qBAAqB,MAAM,QAAmC,QAAQ,MAAM,GAAG;GACzF,CAAiB;EACnB;EACA,iBAAiB;CACnB,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}

package/dist/http/plugins/platform.d.ts

@@ -0,0 +1,7 @@
+import { PlatformKeyCheck } from "../../app/platform.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/plugins/platform.d.ts
+declare function registerPlatformAuth(app: FastifyInstance, platform: PlatformKeyCheck): void;
+//#endregion
+export { registerPlatformAuth };
+//# sourceMappingURL=platform.d.ts.map

package/dist/http/plugins/platform.js

@@ -0,0 +1,13 @@
+import { UnauthorizedError } from "./auth.js";
+//#region src/http/plugins/platform.ts
+const BEARER = /^Bearer\s+(\S+)$/i;
+function registerPlatformAuth(app, platform) {
+	app.decorate("requirePlatform", async (request) => {
+		const match = BEARER.exec(request.headers.authorization ?? "");
+		if (!match || !platform.matches(match[1])) throw new UnauthorizedError("The platform key is not valid");
+	});
+}
+//#endregion
+export { registerPlatformAuth };
+
+//# sourceMappingURL=platform.js.map

package/dist/http/plugins/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","names":[],"sources":["../../../src/http/plugins/platform.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { PlatformKeyCheck } from '../../app/platform.js';\nimport { UnauthorizedError } from './auth.js';\n\nconst BEARER = /^Bearer\\s+(\\S+)$/i;\n\nexport function registerPlatformAuth(app: FastifyInstance, platform: PlatformKeyCheck): void {\n  app.decorate('requirePlatform', async (request: FastifyRequest) => {\n    const match = BEARER.exec(request.headers.authorization ?? '');\n    if (!match || !platform.matches(match[1]!)) {\n      throw new UnauthorizedError('The platform key is not valid');\n    }\n  });\n}\n"],"mappings":";;AAIA,MAAM,SAAS;AAEf,SAAgB,qBAAqB,KAAsB,UAAkC;CAC3F,IAAI,SAAS,mBAAmB,OAAO,YAA4B;EACjE,MAAM,QAAQ,OAAO,KAAK,QAAQ,QAAQ,iBAAiB,EAAE;EAC7D,IAAI,CAAC,SAAS,CAAC,SAAS,QAAQ,MAAM,EAAG,GACvC,MAAM,IAAI,kBAAkB,+BAA+B;CAE/D,CAAC;AACH"}

package/dist/http/routes/access.js

@@ -1,31 +1,48 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
-import { ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOptionList } from "../schemas/access.js";
+import { resolveActor } from "../scope.js";
+import { ApiKeyIdParam, ApiKeyList, ApiKeyRoleList, ClientIdParam, ConnectedAppList, CreateApiKey, CreatedApiKey, PermissionDefinitionList, ViewerPermissions } from "../schemas/access.js";
 import "../schemas/index.js";
-import { assertRoleHoldsScopes, scopeOptions } from "@headless-lms/core/organizations";
 import { z } from "zod";
 //#region src/http/routes/access.ts
 async function accessRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Access"];
+	const organizations = container.organizations;
 	r.route({
 		method: "GET",
-		url: "/api/access/scopes",
+		url: "/api/access/permissions/list",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "listAccessScopes",
+			operationId: "listPermissions",
 			tags,
-			summary: "Every access scope and whether your role can grant it",
-			description: "Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.",
+			summary: "Every permission, with its label, description and level",
+			description: `Any active member of the organization. For role screens, the key-creation screen and the consent screen.`,
 			response: {
-				200: ScopeOptionList,
+				200: PermissionDefinitionList,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			return scopeOptions((await resolveScope(container, req)).role);
+			await resolveActor(container, req);
+			return organizations.permissionList();
 		}
 	});
+	r.route({
+		method: "GET",
+		url: "/api/access/permissions",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMyPermissions",
+			tags,
+			summary: "Your effective permissions in this organization",
+			description: `Any active member of the organization. Your org role, whether you own the organization, the permissions you hold on the organization, and the ones you hold on each content item.`,
+			response: {
+				200: ViewerPermissions,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => organizations.viewerPermissions(await resolveActor(container, req))
+	});
 	r.route({
 		method: "GET",
 		url: "/api/access/apps",
@@ -34,16 +51,13 @@ async function accessRoutes(app, container) {
 			operationId: "listConnectedApps",
 			tags,
 			summary: "Apps connected to this organization as you",
-			description: "Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.",
+			description: `Any active member of the organization. The apps you connected to this organization, each with the scopes you granted and when.`,
 			response: {
 				200: ConnectedAppList,
 				...refusals(403)
 			}
 		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.auth.listConnectedApps(req.headers, scope.authOrgId);
-		}
+		handler: async (req) => organizations.listConnectedApps(await resolveActor(container, req))
 	});
 	r.route({
 		method: "DELETE",
@@ -53,7 +67,7 @@ async function accessRoutes(app, container) {
 			operationId: "revokeConnectedApp",
 			tags,
 			summary: "Disconnect an app",
-			description: "Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.",
+			description: `Any active member of the organization. Revokes your consent and tokens for the app in this organization; its next call is refused.`,
 			params: ClientIdParam,
 			response: {
 				204: z.void(),
@@ -61,8 +75,7 @@ async function accessRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);
+			await organizations.revokeConnectedApp(req.params.clientId, await resolveActor(container, req));
 			return reply.code(204).send();
 		}
 	});
@@ -74,16 +87,29 @@ async function accessRoutes(app, container) {
 			operationId: "listApiKeys",
 			tags,
 			summary: "Your API keys for this organization",
-			description: "Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.",
+			description: `Requires \`api_keys:read\`. Your keys for this organization with their role and expiry. The key itself is never returned again after it is created.`,
 			response: {
 				200: ApiKeyList,
 				...refusals(403)
 			}
 		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.auth.listApiKeys(req.headers, scope.authOrgId);
-		}
+		handler: async (req) => organizations.listApiKeys(await resolveActor(container, req))
+	});
+	r.route({
+		method: "GET",
+		url: "/api/access/api-keys/roles",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listApiKeyRoles",
+			tags,
+			summary: "The roles you can put on an API key",
+			description: `Requires \`api_keys:write\`. The organization's roles whose every permission you hold somewhere.`,
+			response: {
+				200: ApiKeyRoleList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => organizations.listApiKeyRoles(await resolveActor(container, req))
 	});
 	r.route({
 		method: "POST",
@@ -93,22 +119,15 @@ async function accessRoutes(app, container) {
 			operationId: "createApiKey",
 			tags,
 			summary: "Create an API key",
-			description: "Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.",
+			description: `Requires \`api_keys:write\`. The key acts as you in this organization with the permissions of the role given, never beyond what you hold at the time of each request. Send it in the \`x-api-key\` header or as \`Authorization: Bearer <key>\`; every route under /api and /mcp accepts it. 403 when the role holds a permission you hold nowhere; 404 when the organization has no such role. The key is returned once.`,
 			body: CreateApiKey,
 			response: {
 				201: CreatedApiKey,
-				...refusals(400, 403)
+				...refusals(400, 403, 404)
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			assertRoleHoldsScopes(scope.role, req.body.scopes);
-			const created = await container.auth.createApiKey({
-				authUserId: req.authUser.id,
-				orgId: scope.authOrgId,
-				name: req.body.name,
-				scopes: req.body.scopes
-			});
+			const created = await organizations.createApiKey(req.body, await resolveActor(container, req));
 			return reply.code(201).send(created);
 		}
 	});
@@ -119,8 +138,8 @@ async function accessRoutes(app, container) {
 		schema: {
 			operationId: "deleteApiKey",
 			tags,
-			summary: "Delete an API key",
-			description: "Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.",
+			summary: "Revoke an API key",
+			description: `Requires \`api_keys:delete\`. 404 when the key is not one of yours in this organization.`,
 			params: ApiKeyIdParam,
 			response: {
 				204: z.void(),
@@ -128,8 +147,7 @@ async function accessRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);
+			await organizations.deleteApiKey(req.params.id, await resolveActor(container, req));
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/routes/access.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport { assertRoleHoldsScopes, scopeOptions } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport {\n  ApiKeyIdParam,\n  ApiKeyList,\n  ClientIdParam,\n  ConnectedAppList,\n  CreateApiKey,\n  CreatedApiKey,\n  refusals,\n  ScopeOptionList,\n} from '../schemas/index.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function accessRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Access'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/scopes',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listAccessScopes',\n      tags,\n      summary: 'Every access scope and whether your role can grant it',\n      description:\n        'Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.',\n      response: { 200: ScopeOptionList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return scopeOptions(scope.role);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/apps',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnectedApps',\n      tags,\n      summary: 'Apps connected to this organization as you',\n      description:\n        'Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.',\n      response: { 200: ConnectedAppList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listConnectedApps(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/apps/:clientId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeConnectedApp',\n      tags,\n      summary: 'Disconnect an app',\n      description:\n        'Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.',\n      params: ClientIdParam,\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeys',\n      tags,\n      summary: 'Your API keys for this organization',\n      description:\n        'Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.',\n      response: { 200: ApiKeyList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listApiKeys(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createApiKey',\n      tags,\n      summary: 'Create an API key',\n      description:\n        'Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.',\n      body: CreateApiKey,\n      response: { 201: CreatedApiKey, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      assertRoleHoldsScopes(scope.role, req.body.scopes);\n      const created = await container.auth.createApiKey({\n        authUserId: req.authUser.id,\n        orgId: scope.authOrgId,\n        name: req.body.name,\n        scopes: req.body.scopes,\n      });\n      return reply.code(201).send(created);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/api-keys/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteApiKey',\n      tags,\n      summary: 'Delete an API key',\n      description:\n        'Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.',\n      params: ApiKeyIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAiBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,QAAQ;CAEtB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GAEtB,OAAO,cAAa,MADA,aAAa,WAAW,GAAG,EAAA,CACrB,IAAI;EAChC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,kBAAkB,IAAI,SAAS,MAAM,SAAS;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,mBAAmB,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,QAAQ;GACzF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,YAAY,IAAI,SAAS,MAAM,SAAS;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,sBAAsB,MAAM,MAAM,IAAI,KAAK,MAAM;GACjD,MAAM,UAAU,MAAM,UAAU,KAAK,aAAa;IAChD,YAAY,IAAI,SAAS;IACzB,OAAO,MAAM;IACb,MAAM,IAAI,KAAK;IACf,QAAQ,IAAI,KAAK;GACnB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,aAAa,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,EAAE;GAC7E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/routes/access.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport {\n  ApiKeyIdParam,\n  ApiKeyList,\n  ApiKeyRoleList,\n  ClientIdParam,\n  ConnectedAppList,\n  CreateApiKey,\n  CreatedApiKey,\n  PermissionDefinitionList,\n  ViewerPermissions,\n  refusals,\n} from '../schemas/index.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function accessRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Access'];\n  const organizations = container.organizations;\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/permissions/list',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listPermissions',\n      tags,\n      summary: 'Every permission, with its label, description and level',\n      description: `Any active member of the organization. For role screens, the key-creation screen and the consent screen.`,\n      response: { 200: PermissionDefinitionList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveActor(container, req);\n      return organizations.permissionList();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/permissions',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMyPermissions',\n      tags,\n      summary: 'Your effective permissions in this organization',\n      description: `Any active member of the organization. Your org role, whether you own the organization, the permissions you hold on the organization, and the ones you hold on each content item.`,\n      response: { 200: ViewerPermissions, ...refusals(403) },\n    },\n    handler: async (req) => organizations.viewerPermissions(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/apps',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnectedApps',\n      tags,\n      summary: 'Apps connected to this organization as you',\n      description: `Any active member of the organization. The apps you connected to this organization, each with the scopes you granted and when.`,\n      response: { 200: ConnectedAppList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listConnectedApps(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/apps/:clientId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeConnectedApp',\n      tags,\n      summary: 'Disconnect an app',\n      description: `Any active member of the organization. Revokes your consent and tokens for the app in this organization; its next call is refused.`,\n      params: ClientIdParam,\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      await organizations.revokeConnectedApp(\n        req.params.clientId,\n        await resolveActor(container, req),\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeys',\n      tags,\n      summary: 'Your API keys for this organization',\n      description: `Requires \\`api_keys:read\\`. Your keys for this organization with their role and expiry. The key itself is never returned again after it is created.`,\n      response: { 200: ApiKeyList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listApiKeys(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys/roles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeyRoles',\n      tags,\n      summary: 'The roles you can put on an API key',\n      description: `Requires \\`api_keys:write\\`. The organization's roles whose every permission you hold somewhere.`,\n      response: { 200: ApiKeyRoleList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listApiKeyRoles(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createApiKey',\n      tags,\n      summary: 'Create an API key',\n      description: `Requires \\`api_keys:write\\`. The key acts as you in this organization with the permissions of the role given, never beyond what you hold at the time of each request. Send it in the \\`x-api-key\\` header or as \\`Authorization: Bearer <key>\\`; every route under /api and /mcp accepts it. 403 when the role holds a permission you hold nowhere; 404 when the organization has no such role. The key is returned once.`,\n      body: CreateApiKey,\n      response: { 201: CreatedApiKey, ...refusals(400, 403, 404) },\n    },\n    handler: async (req, reply) => {\n      const created = await organizations.createApiKey(\n        req.body,\n        await resolveActor(container, req),\n      );\n      return reply.code(201).send(created);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/api-keys/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteApiKey',\n      tags,\n      summary: 'Revoke an API key',\n      description: `Requires \\`api_keys:delete\\`. 404 when the key is not one of yours in this organization.`,\n      params: ApiKeyIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await organizations.deleteApiKey(req.params.id, await resolveActor(container, req));\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAkBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,QAAQ;CACtB,MAAM,gBAAgB,UAAU;CAEhC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,aAAa,WAAW,GAAG;GACjC,OAAO,cAAc,eAAe;EACtC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ,cAAc,kBAAkB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC5F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ,cAAc,kBAAkB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC5F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,cAAc,mBAClB,IAAI,OAAO,UACX,MAAM,aAAa,WAAW,GAAG,CACnC;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ,cAAc,YAAY,MAAM,aAAa,WAAW,GAAG,CAAC;CACtF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ,cAAc,gBAAgB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC1F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,cAAc,aAClC,IAAI,MACJ,MAAM,aAAa,WAAW,GAAG,CACnC;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,cAAc,aAAa,IAAI,OAAO,IAAI,MAAM,aAAa,WAAW,GAAG,CAAC;GAClF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/activities.js

@@ -1,5 +1,5 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { ActivityAssetList, ActivityList, ActivityPathParam, CourseIdPathParam, CreateModule, ModuleList, ModulePathParam, ReorderInput, SaveActivity, UpdateModule } from "../schemas/activities.js";
 import "../schemas/index.js";
 //#region src/http/routes/activities.ts
@@ -14,8 +14,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listModules",
 			tags,
-			summary: "List a course's modules (staff)",
-			description: "Staff only (owner, admin, instructor). Modules in order, each with its activities.",
+			summary: "List a course's modules",
+			description: `Requires \`courses:read\`. Modules in order, each with its activities.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ModuleList,
@@ -23,8 +23,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseModules(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseModules(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -34,8 +34,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listActivities",
 			tags,
-			summary: "List a course's activities (staff)",
-			description: "Staff only (owner, admin, instructor). Every activity, published or not.",
+			summary: "List a course's activities",
+			description: `Requires \`courses:read\`. Every activity, published or not.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ActivityList,
@@ -43,8 +43,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseActivityViews(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseActivityViews(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -54,8 +54,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listActivityAssets",
 			tags,
-			summary: "List the library files each activity of a course uses (staff)",
-			description: "Staff only (owner, admin, instructor). One row per activity and file, as recorded when the activity was saved.",
+			summary: "List the library files each activity of a course uses",
+			description: `Requires \`courses:read\`. One row per activity and file, as recorded when the activity was saved.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ActivityAssetList,
@@ -63,8 +63,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseActivityAssets(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseActivityAssets(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -74,8 +74,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createModule",
 			tags,
-			summary: "Add a module (staff)",
-			description: "Staff only (owner, admin, instructor). Added last. Returns the course's modules.",
+			summary: "Add a module",
+			description: `Requires \`courses:write\`. Added last. Returns the course's modules.`,
 			params: CourseIdPathParam,
 			body: CreateModule,
 			response: {
@@ -84,8 +84,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.createModule(scope.orgId, req.params.courseId, req.body.title);
+			const actor = await resolveActor(container, req);
+			return content.createModule(req.params.courseId, req.body.title, actor);
 		}
 	});
 	r.route({
@@ -95,8 +95,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderModules",
 			tags,
-			summary: "Reorder a course's modules (staff)",
-			description: "Staff only (owner, admin, instructor). Ids that are not modules of the course are ignored. Returns the course's modules.",
+			summary: "Reorder a course's modules",
+			description: `Requires \`courses:write\`. Ids that are not modules of the course are ignored. Returns the course's modules.`,
 			params: CourseIdPathParam,
 			body: ReorderInput,
 			response: {
@@ -105,8 +105,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.reorderModules(scope.orgId, req.params.courseId, req.body.orderedIds);
+			const actor = await resolveActor(container, req);
+			return content.reorderModules(req.params.courseId, req.body.orderedIds, actor);
 		}
 	});
 	r.route({
@@ -116,8 +116,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateModule",
 			tags,
-			summary: "Rename a module (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Rename a module",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ModulePathParam,
 			body: UpdateModule,
 			response: {
@@ -126,8 +126,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.updateModule(scope.orgId, req.params.courseId, req.params.moduleId, req.body.title);
+			const actor = await resolveActor(container, req);
+			return content.updateModule(req.params.courseId, req.params.moduleId, req.body.title, actor);
 		}
 	});
 	r.route({
@@ -137,8 +137,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteModule",
 			tags,
-			summary: "Delete a module (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Delete a module",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ModulePathParam,
 			response: {
 				200: ModuleList,
@@ -146,8 +146,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.deleteModule(scope.orgId, req.params.courseId, req.params.moduleId);
+			const actor = await resolveActor(container, req);
+			return content.deleteModule(req.params.courseId, req.params.moduleId, actor);
 		}
 	});
 	r.route({
@@ -157,8 +157,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderActivities",
 			tags,
-			summary: "Reorder the activities in a module (staff)",
-			description: "Staff only (owner, admin, instructor). Send every activity id of the module once (409 otherwise). Returns the course's modules.",
+			summary: "Reorder the activities in a module",
+			description: `Requires \`courses:write\`. Send every activity id of the module once (409 otherwise). Returns the course's modules.`,
 			params: ModulePathParam,
 			body: ReorderInput,
 			response: {
@@ -167,8 +167,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.reorderActivities(scope.orgId, req.params.courseId, req.params.moduleId, req.body.orderedIds);
+			const actor = await resolveActor(container, req);
+			return content.reorderActivities(req.params.courseId, req.params.moduleId, req.body.orderedIds, actor);
 		}
 	});
 	r.route({
@@ -178,8 +178,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createActivity",
 			tags,
-			summary: "Add an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Records the library files the activity uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
+			summary: "Add an activity",
+			description: `Requires \`courses:write\`. Records the library files the activity uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \`media:read\` (403 otherwise). Returns the course's modules.`,
 			params: ModulePathParam,
 			body: SaveActivity,
 			response: {
@@ -188,8 +188,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body);
+			const actor = await resolveActor(container, req);
+			return content.saveActivity(req.params.courseId, req.params.moduleId, req.body, null, actor);
 		}
 	});
 	r.route({
@@ -199,8 +199,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateActivity",
 			tags,
-			summary: "Update an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
+			summary: "Update an activity",
+			description: `Requires \`courses:write\`. Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \`media:read\` (403 otherwise). Returns the course's modules.`,
 			params: ActivityPathParam,
 			body: SaveActivity,
 			response: {
@@ -209,8 +209,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body, req.params.activityId);
+			const actor = await resolveActor(container, req);
+			return content.saveActivity(req.params.courseId, req.params.moduleId, req.body, req.params.activityId, actor);
 		}
 	});
 	r.route({
@@ -220,8 +220,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteActivity",
 			tags,
-			summary: "Delete an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Delete an activity",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ActivityPathParam,
 			response: {
 				200: ModuleList,
@@ -229,8 +229,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.deleteActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.params.activityId);
+			const actor = await resolveActor(container, req);
+			return content.deleteActivity(req.params.courseId, req.params.moduleId, req.params.activityId, actor);
 		}
 	});
 }