@headless-lms/server 0.4.0 → 0.5.0

package/dist/http/routes/events.js

@@ -0,0 +1,333 @@
+import { PageQuery, refusals } from "../schemas/shared.js";
+import { resolveActor } from "../scope.js";
+import { AddEventAsset, AddEventAttendee, CreateEvent, Event, EventAnalytics, EventAssetParams, EventAttendeeParams, EventAttendeesPage, EventFile, EventIdParam, EventsPage, EventsQuery, RenameEventAsset, ReorderEventAssets, UpdateEvent } from "../schemas/events.js";
+import "../schemas/index.js";
+import { z } from "zod";
+//#region src/http/routes/events.ts
+async function eventsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const content = container.content;
+	r.route({
+		method: "GET",
+		url: "/api/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listEvents",
+			tags: ["Events"],
+			summary: "List events",
+			description: `Requires \`events:read\`. Every event the caller holds \`events:read\` on, drafts and canceled included. \`from\` and \`to\` keep the events that overlap the range.`,
+			querystring: EventsQuery,
+			response: {
+				200: EventsPage,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.listEvents(req.query, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEvent",
+			tags: ["Events"],
+			summary: "Get an event",
+			description: "Requires `events:read`.",
+			params: EventIdParam,
+			response: {
+				200: Event,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.getEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "createEvent",
+			tags: ["Events"],
+			summary: "Create an event",
+			description: `Requires \`events:write\`. The event starts as a draft. 400 when it ends before it starts.`,
+			body: CreateEvent,
+			response: {
+				201: Event,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			const event = await content.createEvent(req.body, actor);
+			return reply.code(201).send(event);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateEvent",
+			tags: ["Events"],
+			summary: "Update an event",
+			description: `Requires \`events:write\`. Changes only the fields sent; \`status\` publishes or unpublishes it. \`thumbnailAssetId\` must be a ready library image (409 \`conflict\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \`media:read\` (403 otherwise). 409 \`canceled\` when the event is canceled.`,
+			params: EventIdParam,
+			body: UpdateEvent,
+			response: {
+				200: Event,
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.updateEvent(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/events/:eventId/cancel",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "cancelEvent",
+			tags: ["Events"],
+			summary: "Cancel an event",
+			description: `Requires \`events:write\`. Canceling is final. 409 \`canceled\` when it is already canceled.`,
+			params: EventIdParam,
+			response: {
+				200: Event,
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.cancelEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteEvent",
+			tags: ["Events"],
+			summary: "Delete an event",
+			description: `Requires \`events:delete\`. Its attendees lose it; its library files survive.`,
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await content.deleteEvent(req.params.eventId, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listEventAssets",
+			tags: ["Events"],
+			summary: "List an event's files in order",
+			description: "Requires `events:read`.",
+			params: EventIdParam,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.listEventAssets(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addEventAsset",
+			tags: ["Events"],
+			summary: "Attach a file to an event",
+			description: `Requires \`events:write\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \`media:read\` (403 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: AddEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.addEventAsset(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "PUT",
+		url: "/api/events/:eventId/assets/order",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reorderEventAssets",
+			tags: ["Events"],
+			summary: "Reorder an event's files",
+			description: `Requires \`events:write\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: ReorderEventAssets,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "renameEventAsset",
+			tags: ["Events"],
+			summary: "Set a file's display name within an event",
+			description: `Requires \`events:write\`. Null falls back to the filename. Returns the event's files.`,
+			params: EventAssetParams,
+			body: RenameEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.renameEventAsset(req.params.eventId, req.params.assetId, req.body.displayName, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeEventAsset",
+			tags: ["Events"],
+			summary: "Remove a file from an event",
+			description: `Requires \`events:write\`. The library file itself survives. Returns the event's files.`,
+			params: EventAssetParams,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addEventAttendee",
+			tags: ["Events"],
+			summary: "Add an attendee to an event",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.",
+			params: EventIdParam,
+			body: AddEventAttendee,
+			response: {
+				204: z.void(),
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.grant({
+				orgUserId: req.body.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event",
+				expiresAt: null
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/events/:eventId/attendees/:orgUserId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeEventAttendee",
+			tags: ["Events"],
+			summary: "Remove an attendee from an event",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.",
+			params: EventAttendeeParams,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.revoke({
+				orgUserId: req.params.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event"
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listEventAttendees",
+			tags: ["Events"],
+			summary: "List an event's attendees",
+			description: `Requires \`events:read\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \`source\` is \`bundle\` for someone who attends only through a bundle.`,
+			params: EventIdParam,
+			querystring: PageQuery,
+			response: {
+				200: EventAttendeesPage,
+				...refusals(400, 403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.eventAttendees(req.params.eventId, req.query, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/events/:eventId/analytics",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventAnalytics",
+			tags: ["Events"],
+			summary: "An event's attendance figures",
+			description: `Requires \`events:read\`. On the event or the org. The attendees now and by source, the capacity, the revoked direct grants, and the current direct grants by grant date before the start.`,
+			params: EventIdParam,
+			response: {
+				200: EventAnalytics,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return container.reporting.admin.eventAnalytics(req.params.eventId, actor);
+		}
+	});
+}
+//#endregion
+export { eventsRoutes };
+
+//# sourceMappingURL=events.js.map

package/dist/http/routes/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../../src/http/routes/events.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AddEventAsset,\n  AddEventAttendee,\n  CreateEvent,\n  Event,\n  EventAnalytics,\n  EventAttendeesPage,\n  EventAssetParams,\n  EventAttendeeParams,\n  EventFile,\n  EventIdParam,\n  EventsPage,\n  EventsQuery,\n  PageQuery,\n  RenameEventAsset,\n  ReorderEventAssets,\n  UpdateEvent,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function eventsRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n\n  r.route({\n    method: 'GET',\n    url: '/api/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEvents',\n      tags: ['Events'],\n      summary: 'List events',\n      description: `Requires \\`events:read\\`. Every event the caller holds \\`events:read\\` on, drafts and canceled included. \\`from\\` and \\`to\\` keep the events that overlap the range.`,\n      querystring: EventsQuery,\n      response: { 200: EventsPage, ...refusals(400, 403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listEvents(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEvent',\n      tags: ['Events'],\n      summary: 'Get an event',\n      description: 'Requires `events:read`.',\n      params: EventIdParam,\n      response: { 200: Event, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.getEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createEvent',\n      tags: ['Events'],\n      summary: 'Create an event',\n      description: `Requires \\`events:write\\`. The event starts as a draft. 400 when it ends before it starts.`,\n      body: CreateEvent,\n      response: { 201: Event, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const event = await content.createEvent(req.body, actor);\n      return reply.code(201).send(event);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateEvent',\n      tags: ['Events'],\n      summary: 'Update an event',\n      description: `Requires \\`events:write\\`. Changes only the fields sent; \\`status\\` publishes or unpublishes it. \\`thumbnailAssetId\\` must be a ready library image (409 \\`conflict\\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \\`media:read\\` (403 otherwise). 409 \\`canceled\\` when the event is canceled.`,\n      params: EventIdParam,\n      body: UpdateEvent,\n      response: { 200: Event, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateEvent(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/events/:eventId/cancel',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'cancelEvent',\n      tags: ['Events'],\n      summary: 'Cancel an event',\n      description: `Requires \\`events:write\\`. Canceling is final. 409 \\`canceled\\` when it is already canceled.`,\n      params: EventIdParam,\n      response: { 200: Event, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.cancelEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteEvent',\n      tags: ['Events'],\n      summary: 'Delete an event',\n      description: `Requires \\`events:delete\\`. Its attendees lose it; its library files survive.`,\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await content.deleteEvent(req.params.eventId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEventAssets',\n      tags: ['Events'],\n      summary: \"List an event's files in order\",\n      description: 'Requires `events:read`.',\n      params: EventIdParam,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listEventAssets(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addEventAsset',\n      tags: ['Events'],\n      summary: 'Attach a file to an event',\n      description: `Requires \\`events:write\\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \\`media:read\\` (403 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: AddEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.addEventAsset(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/events/:eventId/assets/order',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderEventAssets',\n      tags: ['Events'],\n      summary: \"Reorder an event's files\",\n      description: `Requires \\`events:write\\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: ReorderEventAssets,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'renameEventAsset',\n      tags: ['Events'],\n      summary: \"Set a file's display name within an event\",\n      description: `Requires \\`events:write\\`. Null falls back to the filename. Returns the event's files.`,\n      params: EventAssetParams,\n      body: RenameEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.renameEventAsset(\n        req.params.eventId,\n        req.params.assetId,\n        req.body.displayName,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeEventAsset',\n      tags: ['Events'],\n      summary: 'Remove a file from an event',\n      description: `Requires \\`events:write\\`. The library file itself survives. Returns the event's files.`,\n      params: EventAssetParams,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addEventAttendee',\n      tags: ['Events'],\n      summary: 'Add an attendee to an event',\n      description:\n        'Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.',\n      params: EventIdParam,\n      body: AddEventAttendee,\n      response: { 204: z.void(), ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.grant(\n        {\n          orgUserId: req.body.orgUserId,\n          contentId: req.params.eventId,\n          contentType: 'event',\n          expiresAt: null,\n        },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/events/:eventId/attendees/:orgUserId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeEventAttendee',\n      tags: ['Events'],\n      summary: 'Remove an attendee from an event',\n      description:\n        \"Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.\",\n      params: EventAttendeeParams,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.revoke(\n        { orgUserId: req.params.orgUserId, contentId: req.params.eventId, contentType: 'event' },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listEventAttendees',\n      tags: ['Events'],\n      summary: \"List an event's attendees\",\n      description: `Requires \\`events:read\\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \\`source\\` is \\`bundle\\` for someone who attends only through a bundle.`,\n      params: EventIdParam,\n      querystring: PageQuery,\n      response: { 200: EventAttendeesPage, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.eventAttendees(req.params.eventId, req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/events/:eventId/analytics',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEventAnalytics',\n      tags: ['Events'],\n      summary: \"An event's attendance figures\",\n      description: `Requires \\`events:read\\`. On the event or the org. The attendees now and by source, the capacity, the revoked direct grants, and the current direct grants by grant date before the start.`,\n      params: EventIdParam,\n      response: { 200: EventAnalytics, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.admin.eventAnalytics(req.params.eventId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAyBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAE1B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,aAAa;GACb,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,WAAW,IAAI,OAAO,KAAK;EAC5C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,SAAS,IAAI,OAAO,SAAS,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,MAAM,QAAQ,YAAY,IAAI,MAAM,KAAK;GACvD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK;EACnC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;GACnD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,gBAAgB,IAAI,OAAO,SAAS,KAAK;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,mBAAmB,IAAI,OAAO,SAAS,IAAI,KAAK,UAAU,KAAK;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBACb,IAAI,OAAO,SACX,IAAI,OAAO,SACX,IAAI,KAAK,aACT,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,MAC3B;IACE,WAAW,IAAI,KAAK;IACpB,WAAW,IAAI,OAAO;IACtB,aAAa;IACb,WAAW;GACb,GACA,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,OAC3B;IAAE,WAAW,IAAI,OAAO;IAAW,WAAW,IAAI,OAAO;IAAS,aAAa;GAAQ,GACvF,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,eAAe,IAAI,OAAO,SAAS,IAAI,OAAO,KAAK;EACtF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,MAAM,eAAe,IAAI,OAAO,SAAS,KAAK;EAC3E;CACF,CAAC;AACH"}

package/dist/http/routes/integrations.js

@@ -1,77 +1,61 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { ActionInvocationResult, AvailableIntegrationsList, ConfigureRequest, ConnectRequest, Connection, ConnectionActionParams, ConnectionIdParam, ConnectionsList, InvokeActionRequest, ReconnectRequest } from "../schemas/integrations.js";
 import "../schemas/index.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/integrations.ts
 function toApi(connection) {
 	const { credentialRef: _credentialRef, ...rest } = connection;
 	return rest;
 }
-/** Resolve the session's active org to the domain org id, or 400 and return null. */
-async function resolveOrgId(req, reply) {
-	if (!req.orgId) {
-		await reply.code(400).send({
-			error: "no_active_org",
-			message: "No active organization"
-		});
-		return null;
-	}
-	return req.orgId;
-}
 async function integrationsRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const integrations = container.integrations;
 	const tags = ["Integrations"];
-	const staff = async (req) => {
-		await resolveScope(container, req);
-	};
 	r.route({
 		method: "GET",
 		url: "/api/integrations/available",
-		preHandler: staff,
 		schema: {
 			operationId: "listAvailableIntegrations",
 			tags,
-			summary: "List the integrations this deployment supports (staff)",
-			description: "Staff only (owner, admin, instructor). Each with the JSON Schemas of its config, its secrets and its actions.",
+			summary: "List the integrations this deployment supports",
+			description: `Requires \`integrations:read\`. Each with the JSON Schemas of its config, its secrets and its actions.`,
 			response: {
 				200: AvailableIntegrationsList,
 				...refusals(403)
 			}
 		},
-		handler: async () => integrations.available()
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return integrations.available(actor);
+		}
 	});
 	r.route({
 		method: "GET",
 		url: "/api/integrations",
-		preHandler: staff,
 		schema: {
 			operationId: "listConnections",
 			tags,
-			summary: "List the organization's integration connections (staff)",
-			description: "Staff only (owner, admin, instructor). Secrets are never returned.",
+			summary: "List the organization's integration connections",
+			description: `Requires \`integrations:read\`. Secrets are never returned.`,
 			response: {
 				200: ConnectionsList,
 				...refusals(403)
 			}
 		},
-		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			return (await integrations.list(orgId)).map(toApi);
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return (await integrations.list(actor)).map(toApi);
 		}
 	});
 	r.route({
 		method: "POST",
 		url: "/api/integrations",
-		preHandler: staff,
 		schema: {
 			operationId: "connectIntegration",
 			tags,
-			summary: "Connect an integration (staff)",
-			description: "Staff only (owner, admin, instructor). Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.",
+			summary: "Connect an integration",
+			description: `Requires \`integrations:write\`. Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.`,
 			body: ConnectRequest,
 			response: {
 				201: Connection,
@@ -79,44 +63,38 @@ async function integrationsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			const connection = await integrations.connect(orgId, req.body);
+			const actor = await resolveActor(container, req);
+			const connection = await integrations.connect(req.body, actor);
 			return reply.code(201).send(toApi(connection));
 		}
 	});
 	r.route({
 		method: "GET",
 		url: "/api/integrations/:id",
-		preHandler: staff,
 		schema: {
 			operationId: "getConnection",
 			tags,
-			summary: "Get a connection (staff)",
-			description: "Staff only (owner, admin, instructor). Secrets are never returned.",
+			summary: "Get a connection",
+			description: `Requires \`integrations:read\`. Secrets are never returned.`,
 			params: ConnectionIdParam,
 			response: {
 				200: Connection,
 				...refusals(403, 404)
 			}
 		},
-		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			const connection = await integrations.get(orgId, req.params.id);
-			if (!connection) throw new NotFoundError("Connection", req.params.id);
-			return toApi(connection);
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return toApi(await integrations.get(req.params.id, actor));
 		}
 	});
 	r.route({
 		method: "PATCH",
 		url: "/api/integrations/:id",
-		preHandler: staff,
 		schema: {
 			operationId: "configureConnection",
 			tags,
-			summary: "Change a connection's configuration or active flag (staff)",
-			description: "Staff only (owner, admin, instructor). 400 when the config is invalid for the integration.",
+			summary: "Change a connection's configuration or active flag",
+			description: `Requires \`integrations:write\`. 400 when the config is invalid for the integration.`,
 			params: ConnectionIdParam,
 			body: ConfigureRequest,
 			response: {
@@ -124,23 +102,19 @@ async function integrationsRoutes(app, container) {
 				...refusals(400, 403, 404)
 			}
 		},
-		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			const connection = await integrations.configure(orgId, req.params.id, req.body);
-			if (!connection) throw new NotFoundError("Connection", req.params.id);
-			return toApi(connection);
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return toApi(await integrations.configure(req.params.id, req.body, actor));
 		}
 	});
 	r.route({
 		method: "POST",
 		url: "/api/integrations/:id/reconnect",
-		preHandler: staff,
 		schema: {
 			operationId: "reconnectIntegration",
 			tags,
-			summary: "Replace a connection's secrets (staff)",
-			description: "Staff only (owner, admin, instructor). The new secrets replace the stored ones.",
+			summary: "Replace a connection's secrets",
+			description: `Requires \`integrations:write\`. The new secrets replace the stored ones.`,
 			params: ConnectionIdParam,
 			body: ReconnectRequest,
 			response: {
@@ -148,23 +122,19 @@ async function integrationsRoutes(app, container) {
 				...refusals(403, 404)
 			}
 		},
-		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			const connection = await integrations.reconnect(orgId, req.params.id, req.body.secrets);
-			if (!connection) throw new NotFoundError("Connection", req.params.id);
-			return toApi(connection);
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return toApi(await integrations.reconnect(req.params.id, req.body.secrets, actor));
 		}
 	});
 	r.route({
 		method: "POST",
 		url: "/api/integrations/:id/actions/:actionId",
-		preHandler: staff,
 		schema: {
 			operationId: "invokeConnectionAction",
 			tags,
-			summary: "Invoke one of a connection's actions (staff)",
-			description: "Staff only (owner, admin, instructor). Runs the action, such as a listing that feeds a picker, with `input` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.",
+			summary: "Invoke one of a connection's actions",
+			description: `Requires \`integrations:write\`. Runs the action, such as a listing that feeds a picker, with \`input\` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.`,
 			params: ConnectionActionParams,
 			body: InvokeActionRequest,
 			response: {
@@ -172,21 +142,19 @@ async function integrationsRoutes(app, container) {
 				...refusals(400, 403, 404, 409)
 			}
 		},
-		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			return { output: await integrations.invoke(orgId, req.params.id, req.params.actionId, req.body.input ?? {}) };
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return { output: await integrations.invoke(req.params.id, req.params.actionId, req.body.input ?? {}, actor) };
 		}
 	});
 	r.route({
 		method: "DELETE",
 		url: "/api/integrations/:id",
-		preHandler: staff,
 		schema: {
 			operationId: "disconnectIntegration",
 			tags,
-			summary: "Disconnect an integration (staff)",
-			description: "Staff only (owner, admin, instructor). Destroys its stored secrets.",
+			summary: "Disconnect an integration",
+			description: `Requires \`integrations:delete\`. Destroys its stored secrets.`,
 			params: ConnectionIdParam,
 			response: {
 				204: z.void(),
@@ -194,9 +162,8 @@ async function integrationsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const orgId = await resolveOrgId(req, reply);
-			if (!orgId) return;
-			if (!await integrations.disconnect(orgId, req.params.id)) throw new NotFoundError("Connection", req.params.id);
+			const actor = await resolveActor(container, req);
+			await integrations.disconnect(req.params.id, actor);
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.js","names":[],"sources":["../../../src/http/routes/integrations.ts"],"sourcesContent":["// HTTP routes for integrations (an org's connections to external services).\n// All require a session with an active organization. Credentials are\n// write-only: accepted on connect/reconnect, never present in a response —\n// `toApi` strips the credentialRef so not even the reference leaks.\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActionInvocationResult,\n  AvailableIntegrationsList,\n  ConfigureRequest,\n  ConnectRequest,\n  Connection,\n  ConnectionActionParams,\n  ConnectionIdParam,\n  ConnectionsList,\n  InvokeActionRequest,\n  ReconnectRequest,\n  refusals,\n} from '../schemas/index.js';\nimport type { Connection as DomainConnection } from '@headless-lms/core/integrations';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nfunction toApi(connection: DomainConnection): Connection {\n  const { credentialRef: _credentialRef, ...rest } = connection;\n  return rest;\n}\n\n/** Resolve the session's active org to the domain org id, or 400 and return null. */\nasync function resolveOrgId(req: FastifyRequest, reply: FastifyReply): Promise<string | null> {\n  if (!req.orgId) {\n    await reply.code(400).send({ error: 'no_active_org', message: 'No active organization' });\n    return null;\n  }\n  return req.orgId;\n}\n\nexport async function integrationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const integrations = container.integrations;\n  const tags = ['Integrations'];\n  const staff = async (req: FastifyRequest) => {\n    await resolveScope(container, req);\n  };\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/available',\n    preHandler: staff,\n    schema: {\n      operationId: 'listAvailableIntegrations',\n      tags,\n      summary: 'List the integrations this deployment supports (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Each with the JSON Schemas of its config, its secrets and its actions.',\n      response: { 200: AvailableIntegrationsList, ...refusals(403) },\n    },\n    handler: async () => integrations.available(),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations',\n    preHandler: staff,\n    schema: {\n      operationId: 'listConnections',\n      tags,\n      summary: \"List the organization's integration connections (staff)\",\n      description: 'Staff only (owner, admin, instructor). Secrets are never returned.',\n      response: { 200: ConnectionsList, ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      return (await integrations.list(orgId)).map(toApi);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations',\n    preHandler: staff,\n    schema: {\n      operationId: 'connectIntegration',\n      tags,\n      summary: 'Connect an integration (staff)',\n      description:\n        'Staff only (owner, admin, instructor). Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.',\n      body: ConnectRequest,\n      response: { 201: Connection, ...refusals(400, 403, 409) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.connect(orgId, req.body);\n      return reply.code(201).send(toApi(connection));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'getConnection',\n      tags,\n      summary: 'Get a connection (staff)',\n      description: 'Staff only (owner, admin, instructor). Secrets are never returned.',\n      params: ConnectionIdParam,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.get(orgId, req.params.id);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'configureConnection',\n      tags,\n      summary: \"Change a connection's configuration or active flag (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). 400 when the config is invalid for the integration.',\n      params: ConnectionIdParam,\n      body: ConfigureRequest,\n      response: { 200: Connection, ...refusals(400, 403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.configure(orgId, req.params.id, req.body);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/reconnect',\n    preHandler: staff,\n    schema: {\n      operationId: 'reconnectIntegration',\n      tags,\n      summary: \"Replace a connection's secrets (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The new secrets replace the stored ones.',\n      params: ConnectionIdParam,\n      body: ReconnectRequest,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const connection = await integrations.reconnect(orgId, req.params.id, req.body.secrets);\n      if (!connection) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return toApi(connection);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/actions/:actionId',\n    preHandler: staff,\n    schema: {\n      operationId: 'invokeConnectionAction',\n      tags,\n      summary: \"Invoke one of a connection's actions (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Runs the action, such as a listing that feeds a picker, with `input` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.',\n      params: ConnectionActionParams,\n      body: InvokeActionRequest,\n      response: { 200: ActionInvocationResult, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const output = await integrations.invoke(\n        orgId,\n        req.params.id,\n        req.params.actionId,\n        req.body.input ?? {},\n      );\n      return { output: output as Record<string, unknown> };\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/integrations/:id',\n    preHandler: staff,\n    schema: {\n      operationId: 'disconnectIntegration',\n      tags,\n      summary: 'Disconnect an integration (staff)',\n      description: 'Staff only (owner, admin, instructor). Destroys its stored secrets.',\n      params: ConnectionIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const orgId = await resolveOrgId(req, reply);\n      if (!orgId) {\n        return;\n      }\n      const removed = await integrations.disconnect(orgId, req.params.id);\n      if (!removed) {\n        throw new NotFoundError('Connection', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAyBA,SAAS,MAAM,YAA0C;CACvD,MAAM,EAAE,eAAe,gBAAgB,GAAG,SAAS;CACnD,OAAO;AACT;;AAGA,eAAe,aAAa,KAAqB,OAA6C;CAC5F,IAAI,CAAC,IAAI,OAAO;EACd,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAiB,SAAS;EAAyB,CAAC;EACxF,OAAO;CACT;CACA,OAAO,IAAI;AACb;AAEA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAC/B,MAAM,OAAO,CAAC,cAAc;CAC5B,MAAM,QAAQ,OAAO,QAAwB;EAC3C,MAAM,aAAa,WAAW,GAAG;CACnC;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAA2B,GAAG,SAAS,GAAG;GAAE;EAC/D;EACA,SAAS,YAAY,aAAa,UAAU;CAC9C,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,QAAQ,MAAM,aAAa,KAAK,KAAK,EAAA,CAAG,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,QAAQ,OAAO,IAAI,IAAI;GAC7D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,UAAU,CAAC;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,IAAI,OAAO,IAAI,OAAO,EAAE;GAC9D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GAC9E,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAEF,MAAM,aAAa,MAAM,aAAa,UAAU,OAAO,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO;GACtF,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,UAAU;EACzB;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAwB,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC3E;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAQF,OAAO,EAAE,QAAQ,MANI,aAAa,OAChC,OACA,IAAI,OAAO,IACX,IAAI,OAAO,UACX,IAAI,KAAK,SAAS,CAAC,CACrB,EACmD;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY;EACZ,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK;GAC3C,IAAI,CAAC,OACH;GAGF,IAAI,CAAC,MADiB,aAAa,WAAW,OAAO,IAAI,OAAO,EAAE,GAEhE,MAAM,IAAI,cAAc,cAAc,IAAI,OAAO,EAAE;GAErD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"integrations.js","names":[],"sources":["../../../src/http/routes/integrations.ts"],"sourcesContent":["// HTTP routes for integrations (an org's connections to external services).\n// Credentials are write-only: accepted on connect/reconnect, never present in a\n// response — `toApi` strips the credentialRef so not even the reference leaks.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActionInvocationResult,\n  AvailableIntegrationsList,\n  ConfigureRequest,\n  ConnectRequest,\n  Connection,\n  ConnectionActionParams,\n  ConnectionIdParam,\n  ConnectionsList,\n  InvokeActionRequest,\n  ReconnectRequest,\n  refusals,\n} from '../schemas/index.js';\nimport type { Connection as DomainConnection } from '@headless-lms/core/integrations';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nfunction toApi(connection: DomainConnection): Connection {\n  const { credentialRef: _credentialRef, ...rest } = connection;\n  return rest;\n}\n\nexport async function integrationsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const integrations = container.integrations;\n  const tags = ['Integrations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/available',\n    schema: {\n      operationId: 'listAvailableIntegrations',\n      tags,\n      summary: 'List the integrations this deployment supports',\n      description: `Requires \\`integrations:read\\`. Each with the JSON Schemas of its config, its secrets and its actions.`,\n      response: { 200: AvailableIntegrationsList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return integrations.available(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations',\n    schema: {\n      operationId: 'listConnections',\n      tags,\n      summary: \"List the organization's integration connections\",\n      description: `Requires \\`integrations:read\\`. Secrets are never returned.`,\n      response: { 200: ConnectionsList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return (await integrations.list(actor)).map(toApi);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations',\n    schema: {\n      operationId: 'connectIntegration',\n      tags,\n      summary: 'Connect an integration',\n      description: `Requires \\`integrations:write\\`. Stores the secrets encrypted; they are never returned. 400 when the integration is unknown or the config is invalid; 409 when the organization already has a connection to it.`,\n      body: ConnectRequest,\n      response: { 201: Connection, ...refusals(400, 403, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const connection = await integrations.connect(req.body, actor);\n      return reply.code(201).send(toApi(connection));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/integrations/:id',\n    schema: {\n      operationId: 'getConnection',\n      tags,\n      summary: 'Get a connection',\n      description: `Requires \\`integrations:read\\`. Secrets are never returned.`,\n      params: ConnectionIdParam,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return toApi(await integrations.get(req.params.id, actor));\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/integrations/:id',\n    schema: {\n      operationId: 'configureConnection',\n      tags,\n      summary: \"Change a connection's configuration or active flag\",\n      description: `Requires \\`integrations:write\\`. 400 when the config is invalid for the integration.`,\n      params: ConnectionIdParam,\n      body: ConfigureRequest,\n      response: { 200: Connection, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return toApi(await integrations.configure(req.params.id, req.body, actor));\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/reconnect',\n    schema: {\n      operationId: 'reconnectIntegration',\n      tags,\n      summary: \"Replace a connection's secrets\",\n      description: `Requires \\`integrations:write\\`. The new secrets replace the stored ones.`,\n      params: ConnectionIdParam,\n      body: ReconnectRequest,\n      response: { 200: Connection, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return toApi(await integrations.reconnect(req.params.id, req.body.secrets, actor));\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/integrations/:id/actions/:actionId',\n    schema: {\n      operationId: 'invokeConnectionAction',\n      tags,\n      summary: \"Invoke one of a connection's actions\",\n      description: `Requires \\`integrations:write\\`. Runs the action, such as a listing that feeds a picker, with \\`input\\` checked against its input schema. 400 when the action fails or rejects the input; 404 when the connection or action does not exist; 409 when the connection is inactive.`,\n      params: ConnectionActionParams,\n      body: InvokeActionRequest,\n      response: { 200: ActionInvocationResult, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      const output = await integrations.invoke(\n        req.params.id,\n        req.params.actionId,\n        req.body.input ?? {},\n        actor,\n      );\n      return { output: output as Record<string, unknown> };\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/integrations/:id',\n    schema: {\n      operationId: 'disconnectIntegration',\n      tags,\n      summary: 'Disconnect an integration',\n      description: `Requires \\`integrations:delete\\`. Destroys its stored secrets.`,\n      params: ConnectionIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await integrations.disconnect(req.params.id, actor);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAuBA,SAAS,MAAM,YAA0C;CACvD,MAAM,EAAE,eAAe,gBAAgB,GAAG,SAAS;CACnD,OAAO;AACT;AAEA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,eAAe,UAAU;CAC/B,MAAM,OAAO,CAAC,cAAc;CAE5B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAA2B,GAAG,SAAS,GAAG;GAAE;EAC/D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,aAAa,UAAU,KAAK;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,QAAQ,MAAM,aAAa,KAAK,KAAK,EAAA,CAAG,IAAI,KAAK;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,aAAa,MAAM,aAAa,QAAQ,IAAI,MAAM,KAAK;GAC7D,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM,UAAU,CAAC;EAC/C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,MAAM,MAAM,aAAa,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC;EAC3D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,MAAM,MAAM,aAAa,UAAU,IAAI,OAAO,IAAI,IAAI,MAAM,KAAK,CAAC;EAC3E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,MAAM,MAAM,aAAa,UAAU,IAAI,OAAO,IAAI,IAAI,KAAK,SAAS,KAAK,CAAC;EACnF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAwB,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC3E;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAO/C,OAAO,EAAE,QAAQ,MANI,aAAa,OAChC,IAAI,OAAO,IACX,IAAI,OAAO,UACX,IAAI,KAAK,SAAS,CAAC,GACnB,KACF,EACmD;EACrD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,aAAa,WAAW,IAAI,OAAO,IAAI,KAAK;GAClD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}