@headless-lms/server 0.4.0 → 0.5.0

package/dist/http/routes/community-moderation.js.map

@@ -1 +1 @@
-{"version":3,"file":"community-moderation.js","names":[],"sources":["../../../src/http/routes/community-moderation.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { resolveScope } from '../scope.js';\nimport {\n  Chat,\n  CommentView,\n  CommunityChatParam,\n  CommunityCommentParam,\n  CommunityIdParam,\n  CommunityMembersPage,\n  CommunityMembersQuery,\n  CommunityMessageParam,\n  CommunityPostParam,\n  CommunitySpaceParam,\n  OrgUserBody,\n  PageQuery,\n  PostView,\n  ResolveCommentFlags,\n  ResolveMessageFlags,\n  ResolvePostFlags,\n  SpaceMember,\n  SpaceMemberParam,\n  SpaceMembersPage,\n  SpaceQueue,\n  refusals,\n} from '../schemas/index.js';\n\nexport async function communityModerationRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Communities'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/members',\n    schema: {\n      operationId: 'listCommunityMembers',\n      tags,\n      summary: 'List the people who hold a community (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Everyone with active access to the community, granted directly or through a bundle, paged and searched by name or email.',\n      params: CommunityIdParam,\n      querystring: CommunityMembersQuery,\n      response: { 200: CommunityMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const page = await container.reporting.admin.communityMembers(\n        scope.orgId,\n        req.params.communityId,\n        req.query,\n      );\n      if (!page) {\n        throw new NotFoundError('Community', req.params.communityId);\n      }\n      return page;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/spaces/:spaceId/members',\n    schema: {\n      operationId: 'listCommunitySpaceMembers',\n      tags,\n      summary: 'List the members, requests and invitations of a space (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). The space's members, its open requests to join and its open invitations.\",\n      params: CommunitySpaceParam,\n      querystring: PageQuery,\n      response: { 200: SpaceMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.entitlements.listSpaceMembers(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.query,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members',\n    schema: {\n      operationId: 'addCommunitySpaceMember',\n      tags,\n      summary: 'Add a person to a space (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Places a member of the community straight into the space, with no request or invitation. 409 when the space is open to all members, the person is already placed, or the space is full.',\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const member = await container.entitlements.addSpaceMember(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/invites',\n    schema: {\n      operationId: 'inviteCommunitySpaceMember',\n      tags,\n      summary: 'Invite a person into a space (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Invites a member of the community into a `by_invite` space; they join when they accept. 403 when the person is staff or does not hold the community; 409 when the space is not invite-only or the person is already placed.',\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const member = await container.entitlements.invite(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/approval',\n    schema: {\n      operationId: 'approveCommunitySpaceRequest',\n      tags,\n      summary: \"Approve a person's request to join a space (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.entitlements.approve(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/decline',\n    schema: {\n      operationId: 'declineCommunitySpaceRequest',\n      tags,\n      summary: \"Decline a person's request to join a space (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Closes the open request. 404 when the person has no open request; 409 when they are already a member.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.entitlements.decline(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/removal',\n    schema: {\n      operationId: 'removeCommunitySpaceMember',\n      tags,\n      summary: 'Remove a person from a space (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.',\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.entitlements.remove(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/spaces/:spaceId/queue',\n    schema: {\n      operationId: 'getCommunitySpaceQueue',\n      tags,\n      summary: 'The moderation queue of a space (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Posts awaiting review, and the open flags on posts and on comments in the space. Each list holds at most the 100 oldest entries: pending posts by creation, flags by when they were raised; working the queue brings in the next ones.',\n      params: CommunitySpaceParam,\n      response: { 200: SpaceQueue, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.posts.moderationQueue(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n        req.params.spaceId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/approval',\n    schema: {\n      operationId: 'approveCommunityPost',\n      tags,\n      summary: 'Publish a post that is awaiting review (staff)',\n      description:\n        'Staff only (owner, admin, instructor). 409 when the post is not awaiting review.',\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.posts.approve(\n        scope.orgId,\n        req.params.postId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/removal',\n    schema: {\n      operationId: 'removeCommunityPost',\n      tags,\n      summary: 'Remove a post (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Takes a published or pending post down and resolves its open flags as `removed`. 409 when it is already removed or was never submitted.',\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.posts.remove(\n        scope.orgId,\n        req.params.postId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/restoration',\n    schema: {\n      operationId: 'restoreCommunityPost',\n      tags,\n      summary: 'Restore a removed post (staff)',\n      description: 'Staff only (owner, admin, instructor). 409 when the post is not removed.',\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.posts.restore(\n        scope.orgId,\n        req.params.postId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/flags/resolution',\n    schema: {\n      operationId: 'resolveCommunityPostFlags',\n      tags,\n      summary: 'Dismiss the open flags on a post (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Closes every open flag on the post and leaves it up.',\n      params: CommunityPostParam,\n      body: ResolvePostFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.posts.resolveFlags(\n        scope.orgId,\n        req.params.postId,\n        { id: scope.orgUserId, role: scope.role },\n        req.body.resolution,\n        req.params.communityId,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/removal',\n    schema: {\n      operationId: 'removeCommunityComment',\n      tags,\n      summary: 'Remove a comment on a post (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Hides the comment and resolves its open flags as `removed`. Removing a removed comment returns it unchanged.',\n      params: CommunityCommentParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.discussion.remove(\n        scope.orgId,\n        req.params.commentId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/restoration',\n    schema: {\n      operationId: 'restoreCommunityComment',\n      tags,\n      summary: 'Restore a removed comment on a post (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Publishes the comment again. Restoring a comment that is not removed returns it unchanged.',\n      params: CommunityCommentParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.discussion.restore(\n        scope.orgId,\n        req.params.commentId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/flags/resolution',\n    schema: {\n      operationId: 'resolveCommunityCommentFlags',\n      tags,\n      summary: 'Dismiss the open flags on a comment (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Closes every open flag on the comment and leaves it up.',\n      params: CommunityCommentParam,\n      body: ResolveCommentFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.discussion.resolveReports(\n        scope.orgId,\n        req.params.commentId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.communityId,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/messages/:messageId/flags/resolution',\n    schema: {\n      operationId: 'resolveCommunityMessageFlags',\n      tags,\n      summary: 'Dismiss the open flags on a message (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Closes every open flag on the message and leaves it up.',\n      params: CommunityMessageParam,\n      body: ResolveMessageFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.chats.resolveMessageFlags(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.messageId,\n        req.body.resolution,\n        req.params.communityId,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/chats/:chatId/lock',\n    schema: {\n      operationId: 'lockCommunityChat',\n      tags,\n      summary: 'Lock a chat (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Nobody can send or edit messages until it is unlocked; its open message flags are resolved as `locked`. Locking a locked chat returns it unchanged.',\n      params: CommunityChatParam,\n      response: { 200: Chat, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.chats.lock(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.chatId,\n        req.params.communityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/chats/:chatId/unlock',\n    schema: {\n      operationId: 'unlockCommunityChat',\n      tags,\n      summary: 'Unlock a chat (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Lets participants send messages again. Unlocking an unlocked chat returns it unchanged.',\n      params: CommunityChatParam,\n      response: { 200: Chat, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.chats.unlock(\n        scope.orgId,\n        { id: scope.orgUserId, role: scope.role },\n        req.params.chatId,\n        req.params.communityId,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;AA8BA,eAAsB,0BACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAsB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,OAAO,MAAM,UAAU,UAAU,MAAM,iBAC3C,MAAM,OACN,IAAI,OAAO,aACX,IAAI,KACN;GACA,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,aAAa,IAAI,OAAO,WAAW;GAE7D,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,iBAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KACN;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,eAC1C,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,SACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,OAC1C,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,SACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,OAC5B,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,SACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,gBACrB,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,aACX,IAAI,OAAO,OACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,QACrB,MAAM,OACN,IAAI,OAAO,QACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,OACrB,MAAM,OACN,IAAI,OAAO,QACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,QACrB,MAAM,OACN,IAAI,OAAO,QACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,aACpB,MAAM,OACN,IAAI,OAAO,QACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,KAAK,YACT,IAAI,OAAO,WACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,WAAW,OAC1B,MAAM,OACN,IAAI,OAAO,WACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,WAAW,QAC1B,MAAM,OACN,IAAI,OAAO,WACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,WAAW,eACzB,MAAM,OACN,IAAI,OAAO,WACX;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,oBACpB,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,WACX,IAAI,KAAK,YACT,IAAI,OAAO,WACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAM,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,KACrB,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,QACX,IAAI,OAAO,WACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAM,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,OACrB,MAAM,OACN;IAAE,IAAI,MAAM;IAAW,MAAM,MAAM;GAAK,GACxC,IAAI,OAAO,QACX,IAAI,OAAO,WACb;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"community-moderation.js","names":[],"sources":["../../../src/http/routes/community-moderation.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\nimport {\n  Chat,\n  CommentView,\n  CommunityChatParam,\n  CommunityCommentParam,\n  CommunityIdParam,\n  CommunityMembersPage,\n  CommunityMembersQuery,\n  CommunityMessageParam,\n  CommunityPostParam,\n  CommunitySpaceParam,\n  OrgUserBody,\n  PageQuery,\n  PostView,\n  ResolveCommentFlags,\n  ResolveMessageFlags,\n  ResolvePostFlags,\n  SpaceMember,\n  SpaceMemberParam,\n  SpaceMembersPage,\n  SpaceQueue,\n  refusals,\n} from '../schemas/index.js';\n\nexport async function communityModerationRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Communities'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/members',\n    schema: {\n      operationId: 'listCommunityMembers',\n      tags,\n      summary: 'List the people who hold a community',\n      description: `Requires \\`access:read\\`. Everyone with active access to the community, granted directly or through a bundle, paged and searched by name or email.`,\n      params: CommunityIdParam,\n      querystring: CommunityMembersQuery,\n      response: { 200: CommunityMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.communityMembers(req.params.communityId, req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/spaces/:spaceId/members',\n    schema: {\n      operationId: 'listCommunitySpaceMembers',\n      tags,\n      summary: 'List the members, requests and invitations of a space',\n      description: `For a person who can open the space. Its members; a holder of \\`communities:moderate\\` on the community also sees its open requests to join and open invitations. People who open every space of the community through their role are not listed. 404 when you cannot open the space.`,\n      params: CommunitySpaceParam,\n      querystring: PageQuery,\n      response: { 200: SpaceMembersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.listSpaceMembers(\n        req.params.communityId,\n        req.params.spaceId,\n        req.query,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members',\n    schema: {\n      operationId: 'addCommunitySpaceMember',\n      tags,\n      summary: 'Add a person to a space',\n      description: `Requires \\`communities:moderate\\`. Places a member of the community straight into the space, with no request or invitation. 409 when the space is open to all members, the person is already placed, or the space is full.`,\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const member = await container.entitlements.addSpaceMember(\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n        actor,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/invites',\n    schema: {\n      operationId: 'inviteCommunitySpaceMember',\n      tags,\n      summary: 'Invite a person into a space',\n      description: `Requires \\`communities:moderate\\`. Invites a member of the community into a \\`by_invite\\` space; they join when they accept. 403 when the person opens every space or is not a member of the community; 409 when the space is not invite-only or the person is already placed.`,\n      params: CommunitySpaceParam,\n      body: OrgUserBody,\n      response: { 201: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const member = await container.entitlements.invite(\n        req.params.communityId,\n        req.params.spaceId,\n        req.body.orgUserId,\n        actor,\n      );\n      return reply.code(201).send(member);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/approve',\n    schema: {\n      operationId: 'approveCommunitySpaceRequest',\n      tags,\n      summary: \"Approve a person's request to join a space\",\n      description: `Requires \\`communities:moderate\\`. Makes the requester an active member. 404 when the person has no open request; 409 when the space is full or they are already a member.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.approve(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/decline',\n    schema: {\n      operationId: 'declineCommunitySpaceRequest',\n      tags,\n      summary: \"Decline a person's request to join a space\",\n      description: `Requires \\`communities:moderate\\`. Closes the open request. 404 when the person has no open request; 409 when they are already a member.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.decline(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/spaces/:spaceId/members/:orgUserId/remove',\n    schema: {\n      operationId: 'removeCommunitySpaceMember',\n      tags,\n      summary: 'Remove a person from a space',\n      description: `Requires \\`communities:moderate\\`. Revokes the placement, whether it is a membership, a request or an invitation. 409 when the space is open to all members or the placement is already revoked.`,\n      params: SpaceMemberParam,\n      response: { 200: SpaceMember, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.entitlements.remove(\n        req.params.communityId,\n        req.params.spaceId,\n        req.params.orgUserId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/communities/:communityId/spaces/:spaceId/queue',\n    schema: {\n      operationId: 'getCommunitySpaceQueue',\n      tags,\n      summary: 'The moderation queue of a space',\n      description: `Requires \\`communities:moderate\\`. Posts awaiting review, and the open flags on posts and on comments in the space. Each list holds at most the 100 oldest entries: pending posts by creation, flags by when they were raised; working the queue brings in the next ones.`,\n      params: CommunitySpaceParam,\n      response: { 200: SpaceQueue, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.posts.moderationQueue(req.params.communityId, req.params.spaceId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/approve',\n    schema: {\n      operationId: 'approveCommunityPost',\n      tags,\n      summary: 'Publish a post that is awaiting review',\n      description: `Requires \\`communities:moderate\\`. 409 when the post is not awaiting review.`,\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.posts.approve(req.params.postId, req.params.communityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/remove',\n    schema: {\n      operationId: 'removeCommunityPost',\n      tags,\n      summary: 'Remove a post',\n      description: `The author can remove their own post; anyone else needs \\`communities:moderate\\` on the community. Takes a published or pending post down; removing someone else's post resolves its open flags as \\`removed\\`. 409 when it is already removed or was never submitted.`,\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.posts.remove(req.params.postId, req.params.communityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/restore',\n    schema: {\n      operationId: 'restoreCommunityPost',\n      tags,\n      summary: 'Restore a removed post',\n      description: `Requires \\`communities:moderate\\`. 409 when the post is not removed.`,\n      params: CommunityPostParam,\n      response: { 200: PostView, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.posts.restore(req.params.postId, req.params.communityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/posts/:postId/flags/resolve',\n    schema: {\n      operationId: 'resolveCommunityPostFlags',\n      tags,\n      summary: 'Dismiss the open flags on a post',\n      description: `Requires \\`communities:moderate\\`. Closes every open flag on the post and leaves it up.`,\n      params: CommunityPostParam,\n      body: ResolvePostFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.posts.resolveFlags(\n        req.params.postId,\n        req.body.resolution,\n        req.params.communityId,\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/remove',\n    schema: {\n      operationId: 'removeCommunityComment',\n      tags,\n      summary: 'Remove a comment on a post',\n      description: `The author can remove their own comment; anyone else needs \\`communities:moderate\\` on the community. Hides the comment; removing someone else's comment resolves its open flags as \\`removed\\`. Removing a removed comment returns it unchanged.`,\n      params: CommunityCommentParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.discussion.remove(\n        req.params.commentId,\n        { communityId: req.params.communityId },\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/restore',\n    schema: {\n      operationId: 'restoreCommunityComment',\n      tags,\n      summary: 'Restore a removed comment on a post',\n      description: `Requires one of \\`courses:moderate\\`, \\`communities:moderate\\`. Publishes the comment again. Restoring a comment that is not removed returns it unchanged.`,\n      params: CommunityCommentParam,\n      response: { 200: CommentView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.discussion.restore(\n        req.params.commentId,\n        { communityId: req.params.communityId },\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/comments/:commentId/flags/resolve',\n    schema: {\n      operationId: 'resolveCommunityCommentFlags',\n      tags,\n      summary: 'Dismiss the open flags on a comment',\n      description: `Requires one of \\`courses:moderate\\`, \\`communities:moderate\\`. Closes every open flag on the comment and leaves it up.`,\n      params: CommunityCommentParam,\n      body: ResolveCommentFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.discussion.resolveReports(\n        req.params.commentId,\n        { communityId: req.params.communityId },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/messages/:messageId/flags/resolve',\n    schema: {\n      operationId: 'resolveCommunityMessageFlags',\n      tags,\n      summary: 'Dismiss the open flags on a message',\n      description: `Requires \\`communities:moderate\\`. Closes every open flag on the message and leaves it up.`,\n      params: CommunityMessageParam,\n      body: ResolveMessageFlags,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.chats.resolveMessageFlags(\n        req.params.messageId,\n        req.body.resolution,\n        req.params.communityId,\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/chats/:chatId/lock',\n    schema: {\n      operationId: 'lockCommunityChat',\n      tags,\n      summary: 'Lock a chat',\n      description: `Requires \\`communities:moderate\\`. Nobody can send or edit messages until it is unlocked; its open message flags are resolved as \\`locked\\`. Locking a locked chat returns it unchanged.`,\n      params: CommunityChatParam,\n      response: { 200: Chat, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.chats.lock(req.params.chatId, req.params.communityId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/communities/:communityId/chats/:chatId/unlock',\n    schema: {\n      operationId: 'unlockCommunityChat',\n      tags,\n      summary: 'Unlock a chat',\n      description: `Requires \\`communities:moderate\\`. Lets participants send messages again. Unlocking an unlocked chat returns it unchanged.`,\n      params: CommunityChatParam,\n      response: { 200: Chat, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.chats.unlock(req.params.chatId, req.params.communityId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;;;;AA6BA,eAAsB,0BACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAsB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,iBAAiB,IAAI,OAAO,aAAa,IAAI,OAAO,KAAK;EAC5F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,iBAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OACJ,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,eAC1C,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,WACT,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,aAAa,OAC1C,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,KAAK,WACT,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,QAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,aAAa,OAC5B,IAAI,OAAO,aACX,IAAI,OAAO,SACX,IAAI,OAAO,WACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,gBAAgB,IAAI,OAAO,aAAa,IAAI,OAAO,SAAS,KAAK;EAC1F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,QAAQ,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,KAAK;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,KAAK;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAU,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,QAAQ,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,KAAK;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,aACpB,IAAI,OAAO,QACX,IAAI,KAAK,YACT,IAAI,OAAO,aACX,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,WAAW,OAC1B,IAAI,OAAO,WACX,EAAE,aAAa,IAAI,OAAO,YAAY,GACtC,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,WAAW,QAC1B,IAAI,OAAO,WACX,EAAE,aAAa,IAAI,OAAO,YAAY,GACtC,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,WAAW,eACzB,IAAI,OAAO,WACX,EAAE,aAAa,IAAI,OAAO,YAAY,GACtC,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,oBACpB,IAAI,OAAO,WACX,IAAI,KAAK,YACT,IAAI,OAAO,aACX,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAM,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,KAAK,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAM,GAAG,SAAS,KAAK,GAAG;GAAE;EAC/C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,MAAM,OAAO,IAAI,OAAO,QAAQ,IAAI,OAAO,aAAa,KAAK;EAChF;CACF,CAAC;AACH"}

package/dist/http/routes/course-analytics.js

@@ -1,10 +1,10 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { CourseIdParam } from "../schemas/content.js";
+import { CourseIdPathParam } from "../schemas/activities.js";
 import { EnrollmentSeries, EnrollmentSeriesQuery } from "../schemas/dashboard.js";
-import { CourseAnalytics } from "../schemas/course-analytics.js";
+import { CourseAnalytics, CourseLearnersPage, CourseLearnersQuery } from "../schemas/course-analytics.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/course-analytics.ts
 async function courseAnalyticsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -15,8 +15,8 @@ async function courseAnalyticsRoutes(app, container) {
 		schema: {
 			operationId: "getCourseAnalytics",
 			tags: ["Reporting"],
-			summary: "Completion and engagement stats for a course (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Completion and engagement stats for a course",
+			description: "Requires `progress:read`.",
 			params: CourseIdParam,
 			response: {
 				200: CourseAnalytics,
@@ -24,10 +24,8 @@ async function courseAnalyticsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const analytics = await container.reporting.admin.courseAnalytics(scope.orgId, req.params.id);
-			if (!analytics) throw new NotFoundError("Course", req.params.id);
-			return analytics;
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.courseAnalytics(req.params.id, actor);
 		}
 	});
 	r.route({
@@ -37,8 +35,8 @@ async function courseAnalyticsRoutes(app, container) {
 		schema: {
 			operationId: "getCourseEnrollmentSeries",
 			tags: ["Reporting"],
-			summary: "Enrollments granted per day for a course over a trailing window (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Enrollments granted per day for a course over a trailing window",
+			description: "Requires `progress:read`.",
 			params: CourseIdParam,
 			querystring: EnrollmentSeriesQuery,
 			response: {
@@ -47,10 +45,29 @@ async function courseAnalyticsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const series = await container.reporting.admin.courseEnrollments(scope.orgId, req.params.id, req.query.days);
-			if (!series) throw new NotFoundError("Course", req.params.id);
-			return series;
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.courseEnrollments(req.params.id, req.query.days, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/courses/:courseId/learners",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listCourseLearners",
+			tags: ["Reporting"],
+			summary: "List a course's learners with their access and progress",
+			description: `Requires \`progress:read\`. Everyone with a grant that opens the course, directly or through a bundle, active or not, each with that grant and their progress. Paged and searched by name or email.`,
+			params: CourseIdPathParam,
+			querystring: CourseLearnersQuery,
+			response: {
+				200: CourseLearnersPage,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.courseLearners(req.params.courseId, req.query, actor);
 		}
 	});
 }

package/dist/http/routes/course-analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"course-analytics.js","names":[],"sources":["../../../src/http/routes/course-analytics.ts"],"sourcesContent":["// HTTP routes for per-course analytics (reporting).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  CourseAnalytics,\n  CourseIdParam,\n  EnrollmentSeries,\n  EnrollmentSeriesQuery,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function courseAnalyticsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseAnalytics',\n      tags: ['Reporting'],\n      summary: 'Completion and engagement stats for a course (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: CourseIdParam,\n      response: { 200: CourseAnalytics, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const analytics = await container.reporting.admin.courseAnalytics(scope.orgId, req.params.id);\n      if (!analytics) {\n        throw new NotFoundError('Course', req.params.id);\n      }\n      return analytics;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id/analytics/enrollments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseEnrollmentSeries',\n      tags: ['Reporting'],\n      summary: 'Enrollments granted per day for a course over a trailing window (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: CourseIdParam,\n      querystring: EnrollmentSeriesQuery,\n      response: { 200: EnrollmentSeries, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const series = await container.reporting.admin.courseEnrollments(\n        scope.orgId,\n        req.params.id,\n        req.query.days,\n      );\n      if (!series) {\n        throw new NotFoundError('Course', req.params.id);\n      }\n      return series;\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,YAAY,MAAM,UAAU,UAAU,MAAM,gBAAgB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC5F,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,UAAU,UAAU,MAAM,kBAC7C,MAAM,OACN,IAAI,OAAO,IACX,IAAI,MAAM,IACZ;GACA,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"course-analytics.js","names":[],"sources":["../../../src/http/routes/course-analytics.ts"],"sourcesContent":["// HTTP routes for per-course analytics (reporting).\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  CourseAnalytics,\n  CourseIdParam,\n  CourseIdPathParam,\n  CourseLearnersPage,\n  CourseLearnersQuery,\n  EnrollmentSeries,\n  EnrollmentSeriesQuery,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function courseAnalyticsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseAnalytics',\n      tags: ['Reporting'],\n      summary: 'Completion and engagement stats for a course',\n      description: 'Requires `progress:read`.',\n      params: CourseIdParam,\n      response: { 200: CourseAnalytics, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.courseAnalytics(req.params.id, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id/analytics/enrollments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseEnrollmentSeries',\n      tags: ['Reporting'],\n      summary: 'Enrollments granted per day for a course over a trailing window',\n      description: 'Requires `progress:read`.',\n      params: CourseIdParam,\n      querystring: EnrollmentSeriesQuery,\n      response: { 200: EnrollmentSeries, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.courseEnrollments(req.params.id, req.query.days, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/learners',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listCourseLearners',\n      tags: ['Reporting'],\n      summary: \"List a course's learners with their access and progress\",\n      description: `Requires \\`progress:read\\`. Everyone with a grant that opens the course, directly or through a bundle, active or not, each with that grant and their progress. Paged and searched by name or email.`,\n      params: CourseIdPathParam,\n      querystring: CourseLearnersQuery,\n      response: { 200: CourseLearnersPage, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.courseLearners(req.params.courseId, req.query, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAgBA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,gBAAgB,IAAI,OAAO,IAAI,KAAK;EACvE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,kBAAkB,IAAI,OAAO,IAAI,IAAI,MAAM,MAAM,KAAK;EACzF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,eAAe,IAAI,OAAO,UAAU,IAAI,OAAO,KAAK;EACvF;CACF,CAAC;AACH"}

package/dist/http/routes/courses.js

@@ -1,9 +1,8 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { Course, CourseIdParam, CourseSettings, CoursesPage, CoursesQuery, CreateCourse, PatchCourseSettings, UpdateCourse } from "../schemas/content.js";
 import "../schemas/index.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/courses.ts
 async function coursesRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -15,8 +14,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "listCourses",
 			tags: ["Content"],
-			summary: "List courses (staff)",
-			description: "Staff only (owner, admin, instructor). Every course in the organization, drafts included, filtered by status and category and searched by title.",
+			summary: "List courses",
+			description: `Requires \`courses:read\`. Every course in the organization, drafts included, filtered by status and category and searched by title.`,
 			querystring: CoursesQuery,
 			response: {
 				200: CoursesPage,
@@ -24,8 +23,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return courses.listCourses(scope.orgId, req.query);
+			const actor = await resolveActor(container, req);
+			return courses.listCourses(req.query, actor);
 		}
 	});
 	r.route({
@@ -35,8 +34,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "getCourse",
 			tags: ["Content"],
-			summary: "Get a course (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Get a course",
+			description: "Requires `courses:read`.",
 			params: CourseIdParam,
 			response: {
 				200: Course,
@@ -44,10 +43,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			const course = await courses.getCourse(scope.orgId, req.params.id);
-			if (!course) throw new NotFoundError("Course", req.params.id);
-			return course;
+			const actor = await resolveActor(container, req);
+			return courses.getCourse(req.params.id, actor);
 		}
 	});
 	r.route({
@@ -57,8 +54,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "createCourse",
 			tags: ["Content"],
-			summary: "Create a course (staff)",
-			description: "Staff only (owner, admin, instructor). The course starts as a draft. 409 when its slug is taken.",
+			summary: "Create a course",
+			description: `Requires \`courses:write\`. The course starts as a draft. 409 when its slug is taken.`,
 			body: CreateCourse,
 			response: {
 				201: Course,
@@ -66,8 +63,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			const course = await courses.createCourse(scope.orgId, req.body);
+			const actor = await resolveActor(container, req);
+			const course = await courses.createCourse(req.body, actor);
 			return reply.code(201).send(course);
 		}
 	});
@@ -78,8 +75,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "updateCourse",
 			tags: ["Content"],
-			summary: "Update a course (staff)",
-			description: "Staff only (owner, admin, instructor). Changes only the fields sent. `thumbnailAssetId` must be a ready library image (409 otherwise); null clears it.",
+			summary: "Update a course",
+			description: `Requires \`courses:write\`. Changes only the fields sent. \`thumbnailAssetId\` must be a ready library image (409 otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \`media:read\` (403 otherwise).`,
 			params: CourseIdParam,
 			body: UpdateCourse,
 			response: {
@@ -88,8 +85,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return courses.updateCourse(scope.orgId, req.params.id, req.body);
+			const actor = await resolveActor(container, req);
+			return courses.updateCourse(req.params.id, req.body, actor);
 		}
 	});
 	r.route({
@@ -99,8 +96,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "updateCourseSettings",
 			tags: ["Content"],
-			summary: "Update a course's settings (staff)",
-			description: "Staff only (owner, admin, instructor). Merges the settings sent into the current ones.",
+			summary: "Update a course's settings",
+			description: `Requires \`courses:write\`. Merges the settings sent into the current ones.`,
 			params: CourseIdParam,
 			body: PatchCourseSettings,
 			response: {
@@ -109,9 +106,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			req.log.info({ body: req.body }, "update course settings");
-			return courses.patchCourseSettings(scope.orgId, req.params.id, req.body);
+			const actor = await resolveActor(container, req);
+			return courses.patchCourseSettings(req.params.id, req.body, actor);
 		}
 	});
 	r.route({
@@ -121,8 +117,8 @@ async function coursesRoutes(app, container) {
 		schema: {
 			operationId: "deleteCourse",
 			tags: ["Content"],
-			summary: "Delete a course (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Delete a course",
+			description: "Requires `courses:delete`.",
 			params: CourseIdParam,
 			response: {
 				204: z.void(),
@@ -130,11 +126,8 @@ async function coursesRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await courses.deleteCourse(scope.orgId, req.params.id, {
-				id: scope.orgUserId,
-				role: scope.role
-			});
+			const actor = await resolveActor(container, req);
+			await courses.deleteCourse(req.params.id, actor);
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/courses.js.map

@@ -1 +1 @@
-{"version":3,"file":"courses.js","names":[],"sources":["../../../src/http/routes/courses.ts"],"sourcesContent":["// HTTP routes for the courses context. Request + response are validated against\n// the shared contract schemas by the Zod type provider, and @fastify/swagger\n// reads the same schemas to build the OpenAPI spec the SDK is generated from.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Course,\n  CourseIdParam,\n  CourseSettings,\n  CoursesPage,\n  CoursesQuery,\n  CreateCourse,\n  PatchCourseSettings,\n  UpdateCourse,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { resolveScope } from '../scope.js';\n\nexport async function coursesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const courses = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listCourses',\n      tags: ['Content'],\n      summary: 'List courses (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Every course in the organization, drafts included, filtered by status and category and searched by title.',\n      querystring: CoursesQuery,\n      response: { 200: CoursesPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return courses.listCourses(scope.orgId, req.query);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourse',\n      tags: ['Content'],\n      summary: 'Get a course (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: CourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const course = await courses.getCourse(scope.orgId, req.params.id);\n      if (!course) {\n        throw new NotFoundError('Course', req.params.id);\n      }\n      return course;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createCourse',\n      tags: ['Content'],\n      summary: 'Create a course (staff)',\n      description:\n        'Staff only (owner, admin, instructor). The course starts as a draft. 409 when its slug is taken.',\n      body: CreateCourse,\n      response: { 201: Course, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const course = await courses.createCourse(scope.orgId, req.body);\n      return reply.code(201).send(course);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateCourse',\n      tags: ['Content'],\n      summary: 'Update a course (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Changes only the fields sent. `thumbnailAssetId` must be a ready library image (409 otherwise); null clears it.',\n      params: CourseIdParam,\n      body: UpdateCourse,\n      response: { 200: Course, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return courses.updateCourse(scope.orgId, req.params.id, req.body);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:id/settings',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateCourseSettings',\n      tags: ['Content'],\n      summary: \"Update a course's settings (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Merges the settings sent into the current ones.',\n      params: CourseIdParam,\n      body: PatchCourseSettings,\n      response: { 200: CourseSettings, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      req.log.info({ body: req.body }, 'update course settings');\n      return courses.patchCourseSettings(scope.orgId, req.params.id, req.body);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteCourse',\n      tags: ['Content'],\n      summary: 'Delete a course (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      params: CourseIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await courses.deleteCourse(scope.orgId, req.params.id, {\n        id: scope.orgUserId,\n        role: scope.role,\n      });\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAqBA,eAAsB,cAAc,KAAsB,WAAqC;CAC7F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,MAAM,OAAO,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,UAAU,MAAM,OAAO,IAAI,OAAO,EAAE;GACjE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,EAAE;GAEjD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,OAAO,IAAI,IAAI;GAC/D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,IAAI,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,GAAG,wBAAwB;GACzD,OAAO,QAAQ,oBAAoB,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;EACzE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,IAAI;IACrD,IAAI,MAAM;IACV,MAAM,MAAM;GACd,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"courses.js","names":[],"sources":["../../../src/http/routes/courses.ts"],"sourcesContent":["// HTTP routes for the courses context. Request + response are validated against\n// the shared contract schemas by the Zod type provider, and @fastify/swagger\n// reads the same schemas to build the OpenAPI spec the SDK is generated from.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  Course,\n  CourseIdParam,\n  CourseSettings,\n  CoursesPage,\n  CoursesQuery,\n  CreateCourse,\n  PatchCourseSettings,\n  UpdateCourse,\n  refusals,\n} from '../schemas/index.js';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function coursesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const courses = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listCourses',\n      tags: ['Content'],\n      summary: 'List courses',\n      description: `Requires \\`courses:read\\`. Every course in the organization, drafts included, filtered by status and category and searched by title.`,\n      querystring: CoursesQuery,\n      response: { 200: CoursesPage, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return courses.listCourses(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourse',\n      tags: ['Content'],\n      summary: 'Get a course',\n      description: 'Requires `courses:read`.',\n      params: CourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return courses.getCourse(req.params.id, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createCourse',\n      tags: ['Content'],\n      summary: 'Create a course',\n      description: `Requires \\`courses:write\\`. The course starts as a draft. 409 when its slug is taken.`,\n      body: CreateCourse,\n      response: { 201: Course, ...refusals(403, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const course = await courses.createCourse(req.body, actor);\n      return reply.code(201).send(course);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateCourse',\n      tags: ['Content'],\n      summary: 'Update a course',\n      description: `Requires \\`courses:write\\`. Changes only the fields sent. \\`thumbnailAssetId\\` must be a ready library image (409 otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \\`media:read\\` (403 otherwise).`,\n      params: CourseIdParam,\n      body: UpdateCourse,\n      response: { 200: Course, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return courses.updateCourse(req.params.id, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:id/settings',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateCourseSettings',\n      tags: ['Content'],\n      summary: \"Update a course's settings\",\n      description: `Requires \\`courses:write\\`. Merges the settings sent into the current ones.`,\n      params: CourseIdParam,\n      body: PatchCourseSettings,\n      response: { 200: CourseSettings, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return courses.patchCourseSettings(req.params.id, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteCourse',\n      tags: ['Content'],\n      summary: 'Delete a course',\n      description: 'Requires `courses:delete`.',\n      params: CourseIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await courses.deleteCourse(req.params.id, actor);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAoBA,eAAsB,cAAc,KAAsB,WAAqC;CAC7F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,UAAU,IAAI,OAAO,IAAI,KAAK;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,QAAQ,aAAa,IAAI,MAAM,KAAK;GACzD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;EACpC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,IAAI,IAAI,MAAM,KAAK;EAC5D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,oBAAoB,IAAI,OAAO,IAAI,IAAI,MAAM,KAAK;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,aAAa,IAAI,OAAO,IAAI,KAAK;GAC/C,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/dashboard.js

@@ -1,5 +1,5 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { EnrollmentSeries, EnrollmentSeriesQuery, OverviewStats } from "../schemas/dashboard.js";
 import "../schemas/index.js";
 //#region src/http/routes/dashboard.ts
@@ -12,16 +12,16 @@ async function dashboardRoutes(app, container) {
 		schema: {
 			operationId: "getOverview",
 			tags: ["Reporting"],
-			summary: "Back-office overview stats (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Back-office overview stats",
+			description: "Requires `analytics:read`.",
 			response: {
 				200: OverviewStats,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.reporting.admin.overview(scope.orgId);
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.overview(actor);
 		}
 	});
 	r.route({
@@ -31,8 +31,8 @@ async function dashboardRoutes(app, container) {
 		schema: {
 			operationId: "getEnrollmentSeries",
 			tags: ["Reporting"],
-			summary: "Enrollments granted per day over a trailing window (staff)",
-			description: "Staff only (owner, admin, instructor).",
+			summary: "Enrollments granted per day over a trailing window",
+			description: "Requires `analytics:read`.",
 			querystring: EnrollmentSeriesQuery,
 			response: {
 				200: EnrollmentSeries,
@@ -40,8 +40,8 @@ async function dashboardRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.reporting.admin.enrollments(scope.orgId, req.query.days);
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.enrollments(req.query.days, actor);
 		}
 	});
 }

package/dist/http/routes/dashboard.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard.js","names":[],"sources":["../../../src/http/routes/dashboard.ts"],"sourcesContent":["// HTTP routes for the dashboard (overview) context.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  EnrollmentSeries,\n  EnrollmentSeriesQuery,\n  OverviewStats,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function dashboardRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/overview',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getOverview',\n      tags: ['Reporting'],\n      summary: 'Back-office overview stats (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      response: { 200: OverviewStats, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.reporting.admin.overview(scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/overview/enrollments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEnrollmentSeries',\n      tags: ['Reporting'],\n      summary: 'Enrollments granted per day over a trailing window (staff)',\n      description: 'Staff only (owner, admin, instructor).',\n      querystring: EnrollmentSeriesQuery,\n      response: { 200: EnrollmentSeries, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.reporting.admin.enrollments(scope.orgId, req.query.days);\n    },\n  });\n}\n"],"mappings":";;;;;AAYA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,SAAS,MAAM,KAAK;EACvD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,YAAY,MAAM,OAAO,IAAI,MAAM,IAAI;EAC1E;CACF,CAAC;AACH"}
+{"version":3,"file":"dashboard.js","names":[],"sources":["../../../src/http/routes/dashboard.ts"],"sourcesContent":["// HTTP routes for the dashboard (overview) context.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  EnrollmentSeries,\n  EnrollmentSeriesQuery,\n  OverviewStats,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function dashboardRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/overview',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getOverview',\n      tags: ['Reporting'],\n      summary: 'Back-office overview stats',\n      description: 'Requires `analytics:read`.',\n      response: { 200: OverviewStats, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.overview(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/overview/enrollments',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEnrollmentSeries',\n      tags: ['Reporting'],\n      summary: 'Enrollments granted per day over a trailing window',\n      description: 'Requires `analytics:read`.',\n      querystring: EnrollmentSeriesQuery,\n      response: { 200: EnrollmentSeries, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.enrollments(req.query.days, actor);\n    },\n  });\n}\n"],"mappings":";;;;;AAYA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,SAAS,KAAK;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,WAAW;GAClB,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,YAAY,IAAI,MAAM,MAAM,KAAK;EACpE;CACF,CAAC;AACH"}

package/dist/http/routes/discussion.js

@@ -1,25 +1,20 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { Comment, CommentIdParam, CommentView, CommentsPage, CommentsQuery, PatchComment, ReplyToComment } from "../schemas/discussion.js";
 import "../schemas/index.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/discussion.ts
 async function discussionRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const discussion = container.discussion;
-	const staff = async (req) => {
-		await resolveScope(container, req);
-	};
 	r.route({
 		method: "GET",
 		url: "/api/comments",
-		preHandler: staff,
 		schema: {
 			operationId: "listComments",
 			tags: ["Discussion"],
-			summary: "List course comments for moderation (staff)",
-			description: "Staff only (owner, admin, instructor). Comments on course activities, filtered by course, activity, author, status or open reports; each row carries the author's email and the open reports.",
+			summary: "List course comments for moderation",
+			description: `Requires \`courses:moderate\`. Comments on the activities of the courses you moderate, filtered by course, activity, author, status or open reports; each row carries the author's email and the open reports.`,
 			querystring: CommentsQuery,
 			response: {
 				200: CommentsPage,
@@ -27,18 +22,18 @@ async function discussionRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			return discussion.listComments(req.orgId, req.query);
+			const actor = await resolveActor(container, req);
+			return discussion.listComments(req.query, actor);
 		}
 	});
 	r.route({
 		method: "DELETE",
 		url: "/api/comments/:commentId",
-		preHandler: staff,
 		schema: {
 			operationId: "moderateRemoveComment",
 			tags: ["Discussion"],
-			summary: "Remove a course comment (staff)",
-			description: "Staff only (owner, admin, instructor). Hides the comment and resolves its open reports as `removed`. Removing a removed comment returns it unchanged.",
+			summary: "Remove a course comment",
+			description: "Needs `courses:moderate` on the course, unless it is your own comment. Hides the comment and resolves its open reports as `removed`. Removing a removed comment returns it unchanged.",
 			params: CommentIdParam,
 			response: {
 				200: CommentView,
@@ -46,19 +41,18 @@ async function discussionRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
-			return discussion.remove(req.orgId, req.params.commentId, orgUser, null);
+			const actor = await resolveActor(container, req);
+			return discussion.remove(req.params.commentId, "lesson", actor);
 		}
 	});
 	r.route({
 		method: "PATCH",
 		url: "/api/comments/:commentId",
-		preHandler: staff,
 		schema: {
 			operationId: "publishComment",
 			tags: ["Discussion"],
-			summary: "Publish a course comment (staff)",
-			description: "Staff only (owner, admin, instructor). Approves a pending comment or restores a removed one; a published comment is returned unchanged.",
+			summary: "Publish a course comment",
+			description: "Needs `courses:moderate` on the course. Approves a pending comment or restores a removed one; a published comment is returned unchanged.",
 			params: CommentIdParam,
 			body: PatchComment,
 			response: {
@@ -67,20 +61,18 @@ async function discussionRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
-			if (!orgUser) throw new NotFoundError("OrgUser", req.userId);
-			return discussion.publish(req.orgId, req.params.commentId, orgUser, null);
+			const actor = await resolveActor(container, req);
+			return discussion.publish(req.params.commentId, "lesson", actor);
 		}
 	});
 	r.route({
 		method: "DELETE",
 		url: "/api/comments/:commentId/reports",
-		preHandler: staff,
 		schema: {
 			operationId: "dismissCommentReports",
 			tags: ["Discussion"],
-			summary: "Dismiss every open report on a course comment (staff)",
-			description: "Staff only (owner, admin, instructor). The comment stays up.",
+			summary: "Dismiss every open report on a course comment",
+			description: "Needs `courses:moderate` on the course. The comment stays up.",
 			params: CommentIdParam,
 			response: {
 				204: z.void(),
@@ -88,21 +80,19 @@ async function discussionRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
-			if (!orgUser) throw new NotFoundError("OrgUser", req.userId);
-			await discussion.resolveReports(req.orgId, req.params.commentId, orgUser, null);
+			const actor = await resolveActor(container, req);
+			await discussion.resolveReports(req.params.commentId, "lesson", actor);
 			return reply.code(204).send();
 		}
 	});
 	r.route({
 		method: "POST",
 		url: "/api/comments/:commentId/replies",
-		preHandler: staff,
 		schema: {
 			operationId: "replyToComment",
 			tags: ["Discussion"],
-			summary: "Reply to a course comment from the moderation queue (staff)",
-			description: "Staff only (owner, admin, instructor). Replies nest one level: answering a reply attaches to its root comment.",
+			summary: "Reply to a course comment from the moderation queue",
+			description: `Requires \`courses:moderate\`. Needed on the comment's course. Replies nest one level: answering a reply attaches to its root comment.`,
 			params: CommentIdParam,
 			body: ReplyToComment,
 			response: {
@@ -111,16 +101,8 @@ async function discussionRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await container.organizations.getOrgUser(req.orgId, req.userId);
-			if (!orgUser) throw new NotFoundError("OrgUser", req.userId);
-			const parent = await discussion.getComment(req.orgId, req.params.commentId);
-			if (!parent || parent.activityId === null) throw new NotFoundError("Comment", req.params.commentId);
-			return discussion.postComment(req.orgId, {
-				actor: orgUser,
-				activityId: parent.activityId,
-				parentId: parent.parentId ?? parent.id,
-				body: req.body.body
-			});
+			const actor = await resolveActor(container, req);
+			return discussion.replyToComment(req.params.commentId, req.body.body, actor);
 		}
 	});
 }