@headless-lms/server 0.4.0 → 0.5.0

package/dist/http/routes/member/courses.js

@@ -1,10 +1,9 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
 import { Course } from "../../schemas/content.js";
 import { ActivityList } from "../../schemas/activities.js";
 import { MemberCourseIdParam, MemberCourses, MemberModules } from "../../schemas/member.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/courses.ts
 async function memberCoursesRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -24,8 +23,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return member.listCourses(req.orgId, orgUser.id);
+			const actor = await resolveActor(container, req);
+			return member.listCourses(actor);
 		}
 	});
 	r.route({
@@ -36,7 +35,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "getMemberCourse",
 			tags: ["Content"],
 			summary: "Get one course you can open",
-			description: "For a member of the organization. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it (which also opens it unpublished). 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: Course,
@@ -44,10 +43,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const course = await member.getCourse(req.orgId, orgUser.id, req.params.courseId);
-			if (!course) throw new NotFoundError("Course", req.params.courseId);
-			return course;
+			const actor = await resolveActor(container, req);
+			return member.getCourse(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -58,7 +55,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "listMemberModules",
 			tags: ["Content"],
 			summary: "List the modules and activities of a course you can open",
-			description: "For a member of the organization. Published activities only. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it. Published activities only. 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: MemberModules,
@@ -66,10 +63,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const modules = await member.listModules(req.orgId, orgUser.id, req.params.courseId);
-			if (!modules) throw new NotFoundError("Course", req.params.courseId);
-			return modules;
+			const actor = await resolveActor(container, req);
+			return member.listModules(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -80,7 +75,7 @@ async function memberCoursesRoutes(app, container) {
 			operationId: "listMemberActivities",
 			tags: ["Content"],
 			summary: "List the published activities of a course you can open",
-			description: "For a member of the organization. 404 when the course is not published or you do not hold it.",
+			description: "For a member of the organization who holds the course, or holds `courses:read` on it. 404 otherwise.",
 			params: MemberCourseIdParam,
 			response: {
 				200: ActivityList,
@@ -88,10 +83,8 @@ async function memberCoursesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const activities = await member.listActivities(req.orgId, orgUser.id, req.params.courseId);
-			if (!activities) throw new NotFoundError("Course", req.params.courseId);
-			return activities;
+			const actor = await resolveActor(container, req);
+			return member.listActivities(req.params.courseId, actor);
 		}
 	});
 }

package/dist/http/routes/member/courses.js.map

@@ -1 +1 @@
-{"version":3,"file":"courses.js","names":[],"sources":["../../../../src/http/routes/member/courses.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityList,\n  Course,\n  MemberCourseIdParam,\n  MemberCourses,\n  MemberModules,\n  refusals,\n} from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberCoursesRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberCourses',\n      tags: ['Content'],\n      summary: 'List the courses you can open',\n      description:\n        'For a member of the organization. Published courses you hold, directly or through a bundle.',\n      response: { 200: MemberCourses, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return member.listCourses(req.orgId, orgUser.id);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourse',\n      tags: ['Content'],\n      summary: 'Get one course you can open',\n      description:\n        'For a member of the organization. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const course = await member.getCourse(req.orgId, orgUser.id, req.params.courseId);\n      if (!course) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return course;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberModules',\n      tags: ['Content'],\n      summary: 'List the modules and activities of a course you can open',\n      description:\n        'For a member of the organization. Published activities only. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: MemberModules, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const modules = await member.listModules(req.orgId, orgUser.id, req.params.courseId);\n      if (!modules) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return modules;\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberActivities',\n      tags: ['Content'],\n      summary: 'List the published activities of a course you can open',\n      description:\n        'For a member of the organization. 404 when the course is not published or you do not hold it.',\n      params: MemberCourseIdParam,\n      response: { 200: ActivityList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const activities = await member.listActivities(req.orgId, orgUser.id, req.params.courseId);\n      if (!activities) {\n        throw new NotFoundError('Course', req.params.courseId);\n      }\n      return activities;\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,OAAO,YAAY,IAAI,OAAO,QAAQ,EAAE;EACjD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,UAAU,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GAChF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,UAAU,MAAM,OAAO,YAAY,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACnF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,aAAa,MAAM,OAAO,eAAe,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,QAAQ;GACzF,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,UAAU,IAAI,OAAO,QAAQ;GAEvD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"courses.js","names":[],"sources":["../../../../src/http/routes/member/courses.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityList,\n  Course,\n  MemberCourseIdParam,\n  MemberCourses,\n  MemberModules,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberCoursesRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberCourses',\n      tags: ['Content'],\n      summary: 'List the courses you can open',\n      description:\n        'For a member of the organization. Published courses you hold, directly or through a bundle.',\n      response: { 200: MemberCourses, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listCourses(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCourse',\n      tags: ['Content'],\n      summary: 'Get one course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it (which also opens it unpublished). 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: Course, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getCourse(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberModules',\n      tags: ['Content'],\n      summary: 'List the modules and activities of a course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it. Published activities only. 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: MemberModules, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listModules(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberActivities',\n      tags: ['Content'],\n      summary: 'List the published activities of a course you can open',\n      description:\n        'For a member of the organization who holds the course, or holds `courses:read` on it. 404 otherwise.',\n      params: MemberCourseIdParam,\n      response: { 200: ActivityList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listActivities(req.params.courseId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,oBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,KAAK;EACjC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,GAAG;GAAE;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK;EACpD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,IAAI,OAAO,UAAU,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,eAAe,IAAI,OAAO,UAAU,KAAK;EACzD;CACF,CAAC;AACH"}

package/dist/http/routes/member/devices.js

@@ -1,18 +1,17 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveActor, resolveCaller } from "../../scope.js";
 import { Device, DeviceIdParam, DeviceList, PushConfigView, RegisterDevice } from "../../schemas/notifications.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
 //#region src/http/routes/member/devices.ts
 async function memberDeviceRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Notifications"];
-	async function memberOf(orgId, userId) {
-		const orgUser = await actorOf(container, orgId, userId);
+	async function memberOf(req) {
+		const caller = await resolveCaller(container, req);
 		return {
-			id: orgUser.id,
-			role: orgUser.role,
-			userId
+			...caller.actor,
+			userId: caller.userId
 		};
 	}
 	r.route({
@@ -30,7 +29,7 @@ async function memberDeviceRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			return container.devices.list(req.orgId, await memberOf(req.orgId, req.userId));
+			return container.devices.list(await memberOf(req));
 		}
 	});
 	r.route({
@@ -49,7 +48,7 @@ async function memberDeviceRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			return container.devices.register(req.orgId, await memberOf(req.orgId, req.userId), req.body);
+			return container.devices.register(req.body, await memberOf(req));
 		}
 	});
 	r.route({
@@ -68,7 +67,7 @@ async function memberDeviceRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			await container.devices.remove(req.orgId, await memberOf(req.orgId, req.userId), req.params.deviceId);
+			await container.devices.remove(req.params.deviceId, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});
@@ -87,7 +86,7 @@ async function memberDeviceRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			await actorOf(container, req.orgId, req.userId);
+			await resolveActor(container, req);
 			return container.devices.pushConfig();
 		}
 	});

package/dist/http/routes/member/devices.js.map

@@ -1 +1 @@
-{"version":3,"file":"devices.js","names":[],"sources":["../../../../src/http/routes/member/devices.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\nimport {\n  Device,\n  DeviceIdParam,\n  DeviceList,\n  PushConfigView,\n  RegisterDevice,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberDeviceRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  async function memberOf(orgId: string, userId: string) {\n    const orgUser = await actorOf(container, orgId, userId);\n    return { id: orgUser.id, role: orgUser.role, userId };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDevices',\n      tags,\n      summary: 'List the devices you registered for push notifications',\n      description:\n        'For anyone signed in to the organization. Each app install or browser that registered, most recently seen first. A device not seen for 30 days receives no push until it registers again.',\n      response: { 200: DeviceList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return container.devices.list(req.orgId, await memberOf(req.orgId, req.userId));\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'registerMemberDevice',\n      tags,\n      summary: 'Register this device for push notifications, or refresh it',\n      description:\n        'For anyone signed in to the organization. Call it after sign-in and on every launch. A new token adds a device, a known token is refreshed, and a token another person registered moves to you. A browser sends its push subscription endpoint as `token` with its `keys`; an iOS app sends its bundle id as `appId` and its APNs `environment`. 422 when the provider is not configured, an `apns` `appId` is not one of the configured bundle ids, a `webpush` device has no `keys`, or `keys` or `environment` come with a provider they do not apply to.',\n      body: RegisterDevice,\n      response: { 200: Device, ...refusals(400, 403, 422) },\n    },\n    handler: async (req) => {\n      return container.devices.register(req.orgId, await memberOf(req.orgId, req.userId), req.body);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/devices/:deviceId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberDevice',\n      tags,\n      summary: 'Remove one of your devices',\n      description:\n        'For the person who registered the device. Call it before signing out, so the next person on the device receives none of your pushes. 404 when the device is not yours.',\n      params: DeviceIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await container.devices.remove(\n        req.orgId,\n        await memberOf(req.orgId, req.userId),\n        req.params.deviceId,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/push-config',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberPushConfig',\n      tags,\n      summary: 'Read what a browser needs to subscribe to push notifications',\n      description:\n        'For anyone signed in to the organization. `vapidPublicKey` is the `applicationServerKey` for `pushManager.subscribe`, or null when Web Push is not configured.',\n      response: { 200: PushConfigView, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await actorOf(container, req.orgId, req.userId);\n      return container.devices.pushConfig();\n    },\n  });\n}\n"],"mappings":";;;;;;AAcA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,eAAe,SAAS,OAAe,QAAgB;EACrD,MAAM,UAAU,MAAM,QAAQ,WAAW,OAAO,MAAM;EACtD,OAAO;GAAE,IAAI,QAAQ;GAAI,MAAM,QAAQ;GAAM;EAAO;CACtD;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,KAAK,IAAI,OAAO,MAAM,SAAS,IAAI,OAAO,IAAI,MAAM,CAAC;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,SAAS,IAAI,OAAO,MAAM,SAAS,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,IAAI;EAC9F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,QAAQ,OACtB,IAAI,OACJ,MAAM,SAAS,IAAI,OAAO,IAAI,MAAM,GACpC,IAAI,OAAO,QACb;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9C,OAAO,UAAU,QAAQ,WAAW;EACtC;CACF,CAAC;AACH"}
+{"version":3,"file":"devices.js","names":[],"sources":["../../../../src/http/routes/member/devices.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport type { FastifyRequest } from 'fastify';\nimport { resolveActor, resolveCaller } from '../../scope.js';\nimport {\n  Device,\n  DeviceIdParam,\n  DeviceList,\n  PushConfigView,\n  RegisterDevice,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberDeviceRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  async function memberOf(req: FastifyRequest) {\n    const caller = await resolveCaller(container, req);\n    return { ...caller.actor, userId: caller.userId };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDevices',\n      tags,\n      summary: 'List the devices you registered for push notifications',\n      description:\n        'For anyone signed in to the organization. Each app install or browser that registered, most recently seen first. A device not seen for 30 days receives no push until it registers again.',\n      response: { 200: DeviceList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return container.devices.list(await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/devices',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'registerMemberDevice',\n      tags,\n      summary: 'Register this device for push notifications, or refresh it',\n      description:\n        'For anyone signed in to the organization. Call it after sign-in and on every launch. A new token adds a device, a known token is refreshed, and a token another person registered moves to you. A browser sends its push subscription endpoint as `token` with its `keys`; an iOS app sends its bundle id as `appId` and its APNs `environment`. 422 when the provider is not configured, an `apns` `appId` is not one of the configured bundle ids, a `webpush` device has no `keys`, or `keys` or `environment` come with a provider they do not apply to.',\n      body: RegisterDevice,\n      response: { 200: Device, ...refusals(400, 403, 422) },\n    },\n    handler: async (req) => {\n      return container.devices.register(req.body, await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/devices/:deviceId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberDevice',\n      tags,\n      summary: 'Remove one of your devices',\n      description:\n        'For the person who registered the device. Call it before signing out, so the next person on the device receives none of your pushes. 404 when the device is not yours.',\n      params: DeviceIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await container.devices.remove(req.params.deviceId, await memberOf(req));\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/push-config',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberPushConfig',\n      tags,\n      summary: 'Read what a browser needs to subscribe to push notifications',\n      description:\n        'For anyone signed in to the organization. `vapidPublicKey` is the `applicationServerKey` for `pushManager.subscribe`, or null when Web Push is not configured.',\n      response: { 200: PushConfigView, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveActor(container, req);\n      return container.devices.pushConfig();\n    },\n  });\n}\n"],"mappings":";;;;;;AAeA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,eAAe,SAAS,KAAqB;EAC3C,MAAM,SAAS,MAAM,cAAc,WAAW,GAAG;EACjD,OAAO;GAAE,GAAG,OAAO;GAAO,QAAQ,OAAO;EAAO;CAClD;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,KAAK,MAAM,SAAS,GAAG,CAAC;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAQ,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,QAAQ,SAAS,IAAI,MAAM,MAAM,SAAS,GAAG,CAAC;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,QAAQ,OAAO,IAAI,OAAO,UAAU,MAAM,SAAS,GAAG,CAAC;GACvE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,aAAa,WAAW,GAAG;GACjC,OAAO,UAAU,QAAQ,WAAW;EACtC;CACF,CAAC;AACH"}

package/dist/http/routes/member/downloads.js

@@ -1,9 +1,8 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
 import { DownloadIdParam } from "../../schemas/downloads.js";
 import { MemberDownload, MemberDownloads } from "../../schemas/member.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/downloads.ts
 async function memberDownloadsRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -23,8 +22,8 @@ async function memberDownloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return member.listDownloads(req.orgId, orgUser.id);
+			const actor = await resolveActor(container, req);
+			return member.listDownloads(actor);
 		}
 	});
 	r.route({
@@ -35,7 +34,7 @@ async function memberDownloadsRoutes(app, container) {
 			operationId: "getMemberDownload",
 			tags: ["Content"],
 			summary: "One download you can open, with its files in order",
-			description: "For a member of the organization. 404 when the download is not published or you do not hold it.",
+			description: "For a member of the organization who holds the download, or holds `downloads:read` on it (which also opens it unpublished). 404 otherwise.",
 			params: DownloadIdParam,
 			response: {
 				200: MemberDownload,
@@ -43,10 +42,8 @@ async function memberDownloadsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			const result = await member.getDownload(req.orgId, orgUser.id, req.params.downloadId);
-			if (!result) throw new NotFoundError("Download", req.params.downloadId);
-			return result;
+			const actor = await resolveActor(container, req);
+			return member.getDownload(req.params.downloadId, actor);
 		}
 	});
 }

package/dist/http/routes/member/downloads.js.map

@@ -1 +1 @@
-{"version":3,"file":"downloads.js","names":[],"sources":["../../../../src/http/routes/member/downloads.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { DownloadIdParam, MemberDownload, MemberDownloads, refusals } from '../../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../../app/container.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberDownloadsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDownloads',\n      tags: ['Content'],\n      summary: 'List the downloads you can open',\n      description:\n        'For a member of the organization. Published downloads you hold, directly or through a bundle.',\n      response: { 200: MemberDownloads, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return member.listDownloads(req.orgId, orgUser.id);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberDownload',\n      tags: ['Content'],\n      summary: 'One download you can open, with its files in order',\n      description:\n        'For a member of the organization. 404 when the download is not published or you do not hold it.',\n      params: DownloadIdParam,\n      response: { 200: MemberDownload, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      const result = await member.getDownload(req.orgId, orgUser.id, req.params.downloadId);\n      if (!result) {\n        throw new NotFoundError('Download', req.params.downloadId);\n      }\n      return result;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO,OAAO,cAAc,IAAI,OAAO,QAAQ,EAAE;EACnD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,MAAM,SAAS,MAAM,OAAO,YAAY,IAAI,OAAO,QAAQ,IAAI,IAAI,OAAO,UAAU;GACpF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,YAAY,IAAI,OAAO,UAAU;GAE3D,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"downloads.js","names":[],"sources":["../../../../src/http/routes/member/downloads.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { DownloadIdParam, MemberDownload, MemberDownloads, refusals } from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberDownloadsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberDownloads',\n      tags: ['Content'],\n      summary: 'List the downloads you can open',\n      description:\n        'For a member of the organization. Published downloads you hold, directly or through a bundle.',\n      response: { 200: MemberDownloads, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listDownloads(actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberDownload',\n      tags: ['Content'],\n      summary: 'One download you can open, with its files in order',\n      description:\n        'For a member of the organization who holds the download, or holds `downloads:read` on it (which also opens it unpublished). 404 otherwise.',\n      params: DownloadIdParam,\n      response: { 200: MemberDownload, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getDownload(req.params.downloadId, actor);\n    },\n  });\n}\n"],"mappings":";;;;;;AAMA,eAAsB,sBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,cAAc,KAAK;EACnC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,SAAS;GAChB,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,YAAY,IAAI,OAAO,YAAY,KAAK;EACxD;CACF,CAAC;AACH"}

package/dist/http/routes/member/events.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../../../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/routes/member/events.d.ts
+declare function memberEventsRoutes(app: FastifyInstance, container: Container): Promise<void>;
+//#endregion
+export { memberEventsRoutes };
+//# sourceMappingURL=events.d.ts.map

package/dist/http/routes/member/events.js

@@ -0,0 +1,386 @@
+import { PageQuery, refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
+import { AddEventAsset, AddEventAttendee, CreateEvent, Event, EventAssetParams, EventAttendeeParams, EventAttendeesPage, EventFile, EventIdParam, MemberEvent, MemberEventsPage, MemberEventsQuery, RenameEventAsset, ReorderEventAssets, UpdateEvent } from "../../schemas/events.js";
+import "../../schemas/index.js";
+import { z } from "zod";
+//#region src/http/routes/member/events.ts
+async function memberEventsRoutes(app, container) {
+	const r = app.withTypeProvider();
+	const content = container.content;
+	const member = container.reporting.member;
+	r.route({
+		method: "GET",
+		url: "/api/member/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEvents",
+			tags: ["Events"],
+			summary: "List the events you can see",
+			description: "For a member of the organization. The published `public` events, and the published and canceled events you attend; with `events:read`, every published and canceled event it covers. Each as the event read returns it.",
+			querystring: MemberEventsQuery,
+			response: {
+				200: MemberEventsPage,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.listEvents(req.query, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMemberEvent",
+			tags: ["Events"],
+			summary: "Get an event, with what you can do with it",
+			description: "With `events:read` on the event or the org: the event in any status. As an attendee, directly or through a bundle: the published or canceled event, with the recording after the end when replay is on. Otherwise a published `public` event without its location, files and recording. 404 for anything else.",
+			params: EventIdParam,
+			response: {
+				200: MemberEvent,
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.getEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/calendar",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventCalendar",
+			tags: ["Events"],
+			summary: "Download an event as a calendar file",
+			description: "An iCalendar file with the title, the times and the event page. The location and the meeting link are included when the event read returns them. 404 when the event read does.",
+			params: EventIdParam,
+			response: {
+				200: z.string().describe("`text/calendar`, one VEVENT"),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			const body = await member.eventCalendar(req.params.eventId, actor);
+			return reply.header("content-type", "text/calendar; charset=utf-8").header("content-disposition", `attachment; filename="${req.params.eventId}.ics"`).send(body);
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEventAttendees",
+			tags: ["Events"],
+			summary: "List the attendees of an event you run",
+			description: `Requires \`events:read\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \`source\` is \`bundle\` for someone who attends only through a bundle.`,
+			params: EventIdParam,
+			querystring: PageQuery,
+			response: {
+				200: EventAttendeesPage,
+				...refusals(400, 403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return member.eventAttendees(req.params.eventId, req.query, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "createMemberEvent",
+			tags: ["Events"],
+			summary: "Create an event from the member app",
+			description: `Requires \`events:write\`. The event starts as a draft. 400 when it ends before it starts.`,
+			body: CreateEvent,
+			response: {
+				201: Event,
+				...refusals(400, 403)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			const event = await content.createEvent(req.body, actor);
+			return reply.code(201).send(event);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "updateMemberEvent",
+			tags: ["Events"],
+			summary: "Update an event you run",
+			description: `Requires \`events:write\`. Changes only the fields sent; \`status\` publishes or unpublishes it. \`thumbnailAssetId\` must be a ready library image (409 \`conflict\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \`media:read\` (403 otherwise). 409 \`canceled\` when the event is canceled.`,
+			params: EventIdParam,
+			body: UpdateEvent,
+			response: {
+				200: Event,
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.updateEvent(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/cancel",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "cancelMemberEvent",
+			tags: ["Events"],
+			summary: "Cancel an event you run",
+			description: `Requires \`events:write\`. Canceling is final. 409 \`canceled\` when it is already canceled.`,
+			params: EventIdParam,
+			response: {
+				200: Event,
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.cancelEvent(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "deleteMemberEvent",
+			tags: ["Events"],
+			summary: "Delete an event you can delete",
+			description: `Requires \`events:delete\`. Its attendees lose it; its library files survive.`,
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await content.deleteEvent(req.params.eventId, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listMemberEventAssets",
+			tags: ["Events"],
+			summary: "List the files of an event you run, in order",
+			description: "Requires `events:read`.",
+			params: EventIdParam,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.listEventAssets(req.params.eventId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/assets",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addMemberEventAsset",
+			tags: ["Events"],
+			summary: "Attach a file to an event you run",
+			description: `Requires \`events:write\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \`media:read\` (403 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: AddEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.addEventAsset(req.params.eventId, req.body, actor);
+		}
+	});
+	r.route({
+		method: "PUT",
+		url: "/api/member/events/:eventId/assets/order",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "reorderMemberEventAssets",
+			tags: ["Events"],
+			summary: "Reorder the files of an event you run",
+			description: `Requires \`events:write\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,
+			params: EventIdParam,
+			body: ReorderEventAssets,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);
+		}
+	});
+	r.route({
+		method: "PATCH",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "renameMemberEventAsset",
+			tags: ["Events"],
+			summary: "Set a file's display name within an event you run",
+			description: `Requires \`events:write\`. Null falls back to the filename. Returns the event's files.`,
+			params: EventAssetParams,
+			body: RenameEventAsset,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.renameEventAsset(req.params.eventId, req.params.assetId, req.body.displayName, actor);
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMemberEventAsset",
+			tags: ["Events"],
+			summary: "Remove a file from an event you run",
+			description: `Requires \`events:write\`. The library file itself survives. Returns the event's files.`,
+			params: EventAssetParams,
+			response: {
+				200: z.array(EventFile),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req) => {
+			const actor = await resolveActor(container, req);
+			return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/register",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "registerForEvent",
+			tags: ["Events"],
+			summary: "Register for an event",
+			description: "Any active member of the organization registers themselves for a published `public` event that has not started, with source `self`. 403 when the event is `private`; 404 when it does not exist or is not published; 409 `already_registered`, `started` or `full`.",
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.grant({
+				orgUserId: actor.id,
+				contentId: req.params.eventId,
+				contentType: "event",
+				expiresAt: null
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/unregister",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "cancelEventRegistration",
+			tags: ["Events"],
+			summary: "Cancel your registration for an event",
+			description: "Any active member of the organization revokes their own direct grant to the event, which frees the place. 404 when the caller has no direct active grant.",
+			params: EventIdParam,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.revoke({
+				orgUserId: actor.id,
+				contentId: req.params.eventId,
+				contentType: "event"
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "POST",
+		url: "/api/member/events/:eventId/attendees",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "addMemberEventAttendee",
+			tags: ["Events"],
+			summary: "Add an attendee to an event you run",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.",
+			params: EventIdParam,
+			body: AddEventAttendee,
+			response: {
+				204: z.void(),
+				...refusals(400, 403, 404, 409)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.grant({
+				orgUserId: req.body.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event",
+				expiresAt: null
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+	r.route({
+		method: "DELETE",
+		url: "/api/member/events/:eventId/attendees/:orgUserId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "removeMemberEventAttendee",
+			tags: ["Events"],
+			summary: "Remove an attendee from an event you run",
+			description: "Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.",
+			params: EventAttendeeParams,
+			response: {
+				204: z.void(),
+				...refusals(403, 404)
+			}
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			await container.entitlements.revoke({
+				orgUserId: req.params.orgUserId,
+				contentId: req.params.eventId,
+				contentType: "event"
+			}, actor);
+			return reply.code(204).send();
+		}
+	});
+}
+//#endregion
+export { memberEventsRoutes };
+
+//# sourceMappingURL=events.js.map