@headless-lms/server 0.4.0 → 0.5.0

package/dist/http/routes/member/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../../../src/http/routes/member/events.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  AddEventAsset,\n  AddEventAttendee,\n  CreateEvent,\n  Event,\n  EventAssetParams,\n  EventAttendeeParams,\n  EventAttendeesPage,\n  EventFile,\n  EventIdParam,\n  MemberEvent,\n  MemberEventsPage,\n  MemberEventsQuery,\n  PageQuery,\n  RenameEventAsset,\n  ReorderEventAssets,\n  UpdateEvent,\n  refusals,\n} from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberEventsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const content = container.content;\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEvents',\n      tags: ['Events'],\n      summary: 'List the events you can see',\n      description:\n        'For a member of the organization. The published `public` events, and the published and canceled events you attend; with `events:read`, every published and canceled event it covers. Each as the event read returns it.',\n      querystring: MemberEventsQuery,\n      response: { 200: MemberEventsPage, ...refusals(400, 403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.listEvents(req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberEvent',\n      tags: ['Events'],\n      summary: 'Get an event, with what you can do with it',\n      description:\n        'With `events:read` on the event or the org: the event in any status. As an attendee, directly or through a bundle: the published or canceled event, with the recording after the end when replay is on. Otherwise a published `public` event without its location, files and recording. 404 for anything else.',\n      params: EventIdParam,\n      response: { 200: MemberEvent, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.getEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/calendar',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEventCalendar',\n      tags: ['Events'],\n      summary: 'Download an event as a calendar file',\n      description:\n        'An iCalendar file with the title, the times and the event page. The location and the meeting link are included when the event read returns them. 404 when the event read does.',\n      params: EventIdParam,\n      response: {\n        200: z.string().describe('`text/calendar`, one VEVENT'),\n        ...refusals(403, 404),\n      },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const body = await member.eventCalendar(req.params.eventId, actor);\n      return reply\n        .header('content-type', 'text/calendar; charset=utf-8')\n        .header('content-disposition', `attachment; filename=\"${req.params.eventId}.ics\"`)\n        .send(body);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEventAttendees',\n      tags: ['Events'],\n      summary: 'List the attendees of an event you run',\n      description: `Requires \\`events:read\\`. On the event or the org. The people attending, directly or through a bundle, by grant date. \\`source\\` is \\`bundle\\` for someone who attends only through a bundle.`,\n      params: EventIdParam,\n      querystring: PageQuery,\n      response: { 200: EventAttendeesPage, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return member.eventAttendees(req.params.eventId, req.query, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createMemberEvent',\n      tags: ['Events'],\n      summary: 'Create an event from the member app',\n      description: `Requires \\`events:write\\`. The event starts as a draft. 400 when it ends before it starts.`,\n      body: CreateEvent,\n      response: { 201: Event, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const event = await content.createEvent(req.body, actor);\n      return reply.code(201).send(event);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateMemberEvent',\n      tags: ['Events'],\n      summary: 'Update an event you run',\n      description: `Requires \\`events:write\\`. Changes only the fields sent; \\`status\\` publishes or unpublishes it. \\`thumbnailAssetId\\` must be a ready library image (409 \\`conflict\\` otherwise); null clears it. A file it does not already use must be uploaded for it, or the caller needs \\`media:read\\` (403 otherwise). 409 \\`canceled\\` when the event is canceled.`,\n      params: EventIdParam,\n      body: UpdateEvent,\n      response: { 200: Event, ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateEvent(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/cancel',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'cancelMemberEvent',\n      tags: ['Events'],\n      summary: 'Cancel an event you run',\n      description: `Requires \\`events:write\\`. Canceling is final. 409 \\`canceled\\` when it is already canceled.`,\n      params: EventIdParam,\n      response: { 200: Event, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.cancelEvent(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteMemberEvent',\n      tags: ['Events'],\n      summary: 'Delete an event you can delete',\n      description: `Requires \\`events:delete\\`. Its attendees lose it; its library files survive.`,\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await content.deleteEvent(req.params.eventId, actor);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberEventAssets',\n      tags: ['Events'],\n      summary: 'List the files of an event you run, in order',\n      description: 'Requires `events:read`.',\n      params: EventIdParam,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listEventAssets(req.params.eventId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addMemberEventAsset',\n      tags: ['Events'],\n      summary: 'Attach a file to an event you run',\n      description: `Requires \\`events:write\\`. Added last. 409 when the file is not a ready library file or is already attached. A file not uploaded for the event needs \\`media:read\\` (403 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: AddEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.addEventAsset(req.params.eventId, req.body, actor);\n    },\n  });\n\n  r.route({\n    method: 'PUT',\n    url: '/api/member/events/:eventId/assets/order',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderMemberEventAssets',\n      tags: ['Events'],\n      summary: 'Reorder the files of an event you run',\n      description: `Requires \\`events:write\\`. Send every attached file id exactly once (409 otherwise). Returns the event's files.`,\n      params: EventIdParam,\n      body: ReorderEventAssets,\n      response: { 200: z.array(EventFile), ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderEventAssets(req.params.eventId, req.body.assetIds, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'renameMemberEventAsset',\n      tags: ['Events'],\n      summary: \"Set a file's display name within an event you run\",\n      description: `Requires \\`events:write\\`. Null falls back to the filename. Returns the event's files.`,\n      params: EventAssetParams,\n      body: RenameEventAsset,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.renameEventAsset(\n        req.params.eventId,\n        req.params.assetId,\n        req.body.displayName,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberEventAsset',\n      tags: ['Events'],\n      summary: 'Remove a file from an event you run',\n      description: `Requires \\`events:write\\`. The library file itself survives. Returns the event's files.`,\n      params: EventAssetParams,\n      response: { 200: z.array(EventFile), ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.removeEventAsset(req.params.eventId, req.params.assetId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/register',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'registerForEvent',\n      tags: ['Events'],\n      summary: 'Register for an event',\n      description:\n        'Any active member of the organization registers themselves for a published `public` event that has not started, with source `self`. 403 when the event is `private`; 404 when it does not exist or is not published; 409 `already_registered`, `started` or `full`.',\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.grant(\n        {\n          orgUserId: actor.id,\n          contentId: req.params.eventId,\n          contentType: 'event',\n          expiresAt: null,\n        },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/unregister',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'cancelEventRegistration',\n      tags: ['Events'],\n      summary: 'Cancel your registration for an event',\n      description:\n        'Any active member of the organization revokes their own direct grant to the event, which frees the place. 404 when the caller has no direct active grant.',\n      params: EventIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.revoke(\n        { orgUserId: actor.id, contentId: req.params.eventId, contentType: 'event' },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/events/:eventId/attendees',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'addMemberEventAttendee',\n      tags: ['Events'],\n      summary: 'Add an attendee to an event you run',\n      description:\n        'Requires `access:write`, or `events:write` on the event or the org. Grants the event to the person, with source `manual`. Adding someone who already attends changes nothing. 404 when the event or the person does not exist; 409 `not_published`, `ended` or `full`.',\n      params: EventIdParam,\n      body: AddEventAttendee,\n      response: { 204: z.void(), ...refusals(400, 403, 404, 409) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.grant(\n        {\n          orgUserId: req.body.orgUserId,\n          contentId: req.params.eventId,\n          contentType: 'event',\n          expiresAt: null,\n        },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/member/events/:eventId/attendees/:orgUserId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'removeMemberEventAttendee',\n      tags: ['Events'],\n      summary: 'Remove an attendee from an event you run',\n      description:\n        \"Requires `access:write`, or `events:write` on the event or the org. Revokes the person's direct grant to the event. 404 when they have no direct active grant; someone who attends only through a bundle has none.\",\n      params: EventAttendeeParams,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      await container.entitlements.revoke(\n        { orgUserId: req.params.orgUserId, contentId: req.params.eventId, contentType: 'event' },\n        actor,\n      );\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAyBA,eAAsB,mBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAC3C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAa,GAAG,SAAS,KAAK,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK;EAClD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IACR,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,6BAA6B;IACtD,GAAG,SAAS,KAAK,GAAG;GACtB;EACF;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,OAAO,MAAM,OAAO,cAAc,IAAI,OAAO,SAAS,KAAK;GACjE,OAAO,MACJ,OAAO,gBAAgB,8BAA8B,CAAC,CACtD,OAAO,uBAAuB,yBAAyB,IAAI,OAAO,QAAQ,MAAM,CAAC,CACjF,KAAK,IAAI;EACd;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,aAAa;GACb,UAAU;IAAE,KAAK;IAAoB,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,OAAO,eAAe,IAAI,OAAO,SAAS,IAAI,OAAO,KAAK;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,MAAM,QAAQ,YAAY,IAAI,MAAM,KAAK;GACvD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK;EACnC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAO,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,QAAQ,YAAY,IAAI,OAAO,SAAS,KAAK;GACnD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,gBAAgB,IAAI,OAAO,SAAS,KAAK;EAC1D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI,MAAM,KAAK;EAClE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAClE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,mBAAmB,IAAI,OAAO,SAAS,IAAI,KAAK,UAAU,KAAK;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBACb,IAAI,OAAO,SACX,IAAI,OAAO,SACX,IAAI,KAAK,aACT,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,MAAM,SAAS;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,iBAAiB,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,MAC3B;IACE,WAAW,MAAM;IACjB,WAAW,IAAI,OAAO;IACtB,aAAa;IACb,WAAW;GACb,GACA,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,OAC3B;IAAE,WAAW,MAAM;IAAI,WAAW,IAAI,OAAO;IAAS,aAAa;GAAQ,GAC3E,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,MAC3B;IACE,WAAW,IAAI,KAAK;IACpB,WAAW,IAAI,OAAO;IACtB,aAAa;IACb,WAAW;GACb,GACA,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,QAAQ;GACf,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,aAAa,OAC3B;IAAE,WAAW,IAAI,OAAO;IAAW,WAAW,IAAI,OAAO;IAAS,aAAa;GAAQ,GACvF,KACF;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/files.js

@@ -1,29 +1,20 @@
 import { refusals } from "../../schemas/shared.js";
-import { ActivityFileParams, CommunityThumbnailParams, CourseThumbnailParams, DownloadFileParams, DownloadThumbnailParams, MessageAttachmentParams, PersonImageParams, PostCoverParams, UploadFileParams } from "../../schemas/files.js";
+import { resolveActor } from "../../scope.js";
+import { ActivityFileParams, CommunityThumbnailParams, CourseThumbnailParams, DownloadFileParams, DownloadThumbnailParams, EventFileParams, EventThumbnailParams, MessageAttachmentParams, PostAssetParams, PostCoverParams, UploadFileParams } from "../../schemas/files.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/files.ts
 const tags = ["Files"];
 const responses = {
 	302: z.void(),
 	...refusals(403, 404)
 };
-function redirect(reply, url, what, id) {
-	if (!url) throw new NotFoundError(what, id);
+function redirect(reply, url) {
 	return reply.header("cache-control", "no-store").header("referrer-policy", "no-referrer").redirect(url, 302);
 }
 async function memberFileRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const member = container.reporting.member;
-	async function actorOf$1(orgId, userId) {
-		const orgUser = await actorOf(container, orgId, userId);
-		return {
-			id: orgUser.id,
-			role: orgUser.role
-		};
-	}
 	r.route({
 		method: "GET",
 		url: "/api/member/courses/:courseId/thumbnail",
@@ -32,13 +23,47 @@ async function memberFileRoutes(app, container) {
 			operationId: "getCourseThumbnail",
 			tags,
 			summary: "Redirect to a course's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published course; staff may fetch any. 404 when the course has no thumbnail.",
+			description: "For an unpublished course, which only a holder of `courses:read` on it may fetch: a published course carries a public `thumbnailUrl` instead. 404 when the course has no thumbnail.",
 			params: CourseThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "course", req.params.courseId), "Course thumbnail", req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("course", req.params.courseId, actor));
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/thumbnail",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventThumbnail",
+			tags,
+			summary: "Redirect to an event's cover",
+			description: "For a draft event, which only a holder of `events:read` on it may fetch: a published or canceled event carries a public `thumbnailUrl` instead. 404 when the event read returns 404 or the event has no cover.",
+			params: EventThumbnailParams,
+			response: responses
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("event", req.params.eventId, actor));
+		}
+	});
+	r.route({
+		method: "GET",
+		url: "/api/member/events/:eventId/assets/:assetId",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getEventFile",
+			tags,
+			summary: "Redirect to a file attached to an event",
+			description: "For a holder of `events:read` on the event or the org, or an attendee of the published or canceled event. Saved under its display name. 404 otherwise, or when the file is not attached to the event.",
+			params: EventFileParams,
+			response: responses
+		},
+		handler: async (req, reply) => {
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.eventFile(req.params.eventId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -49,13 +74,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getDownloadThumbnail",
 			tags,
 			summary: "Redirect to a download's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published download; staff may fetch any. 404 when the download has no thumbnail.",
+			description: "For an unpublished download, which only a holder of `downloads:read` on it may fetch: a published download carries a public `thumbnailUrl` instead. 404 when the download has no thumbnail.",
 			params: DownloadThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "download", req.params.downloadId), "Download thumbnail", req.params.downloadId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("download", req.params.downloadId, actor));
 		}
 	});
 	r.route({
@@ -66,13 +91,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getCommunityThumbnail",
 			tags,
 			summary: "Redirect to a community's thumbnail",
-			description: "Any org user may fetch the thumbnail of a published community; staff may fetch any. 404 when the community has no thumbnail.",
+			description: "For an unpublished community, which only a holder of `communities:read` on it may fetch: a published community carries a public `thumbnailUrl` instead. 404 when the community has no thumbnail.",
 			params: CommunityThumbnailParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.thumbnailFile(req.orgId, actor, "community", req.params.communityId), "Community thumbnail", req.params.communityId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.thumbnailFile("community", req.params.communityId, actor));
 		}
 	});
 	r.route({
@@ -83,13 +108,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getActivityFile",
 			tags,
 			summary: "Redirect to a file used in a lesson",
-			description: "Served when the student can open the course, the course and the lesson are published, and the lesson lists the file. Staff may fetch any file a lesson lists. Use the URL as an img, video or audio src.",
+			description: "Served when the person can open the course, the course and the lesson are published, and the lesson lists the file. A holder of `courses:read` on the course may fetch any file a lesson lists. Use the URL as an img, video or audio src.",
 			params: ActivityFileParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.activityFile(req.orgId, actor, req.params.activityId, req.params.assetId), "Lesson file", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.activityFile(req.params.activityId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -100,13 +125,13 @@ async function memberFileRoutes(app, container) {
 			operationId: "getDownloadFile",
 			tags,
 			summary: "Redirect to a file in a download, saved under its display name",
-			description: "Served when the student can open the download, it is published, and it lists the file. Staff may fetch any file a download lists. The storage link lives DELIVERY_URL_EXPIRY seconds.",
+			description: "Served when the person can open the download, it is published, and it lists the file. A holder of `downloads:read` on the download may fetch it unpublished. The storage link lives DELIVERY_URL_EXPIRY seconds.",
 			params: DownloadFileParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.downloadFile(req.orgId, actor, req.params.downloadId, req.params.assetId), "Download file", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await member.downloadFile(req.params.downloadId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -117,47 +142,47 @@ async function memberFileRoutes(app, container) {
 			operationId: "getPostCover",
 			tags,
 			summary: "Redirect to a post's cover image",
-			description: "Served to whoever can read the post. 404 when the post has no cover.",
+			description: "For a post that is not published, served to whoever can read it: a published post carries a public `coverUrl` instead. 404 when the post has no cover.",
 			params: PostCoverParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.posts.coverFile(req.orgId, actor, req.params.postId), "Post cover", req.params.postId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.posts.coverFile(req.params.postId, actor));
 		}
 	});
 	r.route({
 		method: "GET",
-		url: "/api/member/chats/:chatId/messages/:messageId/attachments/:assetId",
+		url: "/api/member/posts/:postId/assets/:assetId",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "getMessageAttachment",
+			operationId: "getPostAsset",
 			tags,
-			summary: "Redirect to an image attached to a chat message",
-			description: "Served to the chat's participants while the message stands (staff also after it is deleted), and to moderators while the message is flagged.",
-			params: MessageAttachmentParams,
+			summary: "Redirect to a file in a post's body",
+			description: "Served to whoever can read the post while its body shows the file. Images, video, audio and PDFs open in place; any other file downloads under its name.",
+			params: PostAssetParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.chats.attachmentFile(req.orgId, actor, req.params.chatId, req.params.messageId, req.params.assetId), "Message attachment", req.params.assetId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.posts.assetFile(req.params.postId, req.params.assetId, actor));
 		}
 	});
 	r.route({
 		method: "GET",
-		url: "/api/member/people/:orgUserId/image",
+		url: "/api/member/chats/:chatId/messages/:messageId/attachments/:assetId",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "getPersonImage",
+			operationId: "getMessageAttachment",
 			tags,
-			summary: "Redirect to an org user's profile photo",
-			description: "Served to org users of the same organization when the photo belongs to it. 404 when the person has no photo here.",
-			params: PersonImageParams,
+			summary: "Redirect to an image attached to a chat message",
+			description: "Served to the chat's participants while the message stands, to holders of `communities:moderate` on the community also after it is deleted, and to them while the message is flagged.",
+			params: MessageAttachmentParams,
 			response: responses
 		},
 		handler: async (req, reply) => {
-			await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await member.personImage(req.orgId, req.params.orgUserId), "Profile photo", req.params.orgUserId);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.chats.attachmentFile(req.params.chatId, req.params.messageId, req.params.assetId, actor));
 		}
 	});
 	r.route({
@@ -173,8 +198,8 @@ async function memberFileRoutes(app, container) {
 			response: responses
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf$1(req.orgId, req.userId);
-			return redirect(reply, await container.assets.ownUploadFile(req.orgId, req.params.id, actor.id), "Upload", req.params.id);
+			const actor = await resolveActor(container, req);
+			return redirect(reply, await container.assets.ownUploadFile(req.params.id, actor));
 		}
 	});
 }

package/dist/http/routes/member/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","names":["actorOf","memberOf"],"sources":["../../../../src/http/routes/member/files.ts"],"sourcesContent":["// Member file proxies. Each route checks access with the context that owns the\n// file, then redirects to a short-lived signed storage URL. Every refusal is a\n// 404, so a response never confirms that a file exists. A 403 only means the\n// caller is not a member of the organization.\nimport type { FastifyInstance, FastifyReply } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport {\n  ActivityFileParams,\n  CommunityThumbnailParams,\n  CourseThumbnailParams,\n  DownloadFileParams,\n  DownloadThumbnailParams,\n  MessageAttachmentParams,\n  PersonImageParams,\n  PostCoverParams,\n  UploadFileParams,\n  refusals,\n} from '../../schemas/index.js';\nimport { actorOf as memberOf } from './actor.js';\nimport type { Container } from '../../../app/container.js';\n\nconst tags = ['Files'];\nconst responses = { 302: z.void(), ...refusals(403, 404) };\n\nfunction redirect(reply: FastifyReply, url: string | null, what: string, id: string) {\n  if (!url) {\n    throw new NotFoundError(what, id);\n  }\n  return reply\n    .header('cache-control', 'no-store')\n    .header('referrer-policy', 'no-referrer')\n    .redirect(url, 302);\n}\n\nexport async function memberFileRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  async function actorOf(orgId: string, userId: string) {\n    const orgUser = await memberOf(container, orgId, userId);\n    return { id: orgUser.id, role: orgUser.role };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseThumbnail',\n      tags,\n      summary: \"Redirect to a course's thumbnail\",\n      description:\n        'Any org user may fetch the thumbnail of a published course; staff may fetch any. 404 when the course has no thumbnail.',\n      params: CourseThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await member.thumbnailFile(req.orgId, actor, 'course', req.params.courseId);\n      return redirect(reply, url, 'Course thumbnail', req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownloadThumbnail',\n      tags,\n      summary: \"Redirect to a download's thumbnail\",\n      description:\n        'Any org user may fetch the thumbnail of a published download; staff may fetch any. 404 when the download has no thumbnail.',\n      params: DownloadThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await member.thumbnailFile(req.orgId, actor, 'download', req.params.downloadId);\n      return redirect(reply, url, 'Download thumbnail', req.params.downloadId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCommunityThumbnail',\n      tags,\n      summary: \"Redirect to a community's thumbnail\",\n      description:\n        'Any org user may fetch the thumbnail of a published community; staff may fetch any. 404 when the community has no thumbnail.',\n      params: CommunityThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await member.thumbnailFile(req.orgId, actor, 'community', req.params.communityId);\n      return redirect(reply, url, 'Community thumbnail', req.params.communityId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/activities/:activityId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getActivityFile',\n      tags,\n      summary: 'Redirect to a file used in a lesson',\n      description:\n        'Served when the student can open the course, the course and the lesson are published, and the lesson lists the file. Staff may fetch any file a lesson lists. Use the URL as an img, video or audio src.',\n      params: ActivityFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await member.activityFile(\n        req.orgId,\n        actor,\n        req.params.activityId,\n        req.params.assetId,\n      );\n      return redirect(reply, url, 'Lesson file', req.params.assetId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownloadFile',\n      tags,\n      summary: 'Redirect to a file in a download, saved under its display name',\n      description:\n        'Served when the student can open the download, it is published, and it lists the file. Staff may fetch any file a download lists. The storage link lives DELIVERY_URL_EXPIRY seconds.',\n      params: DownloadFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await member.downloadFile(\n        req.orgId,\n        actor,\n        req.params.downloadId,\n        req.params.assetId,\n      );\n      return redirect(reply, url, 'Download file', req.params.assetId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/posts/:postId/cover',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getPostCover',\n      tags,\n      summary: \"Redirect to a post's cover image\",\n      description: 'Served to whoever can read the post. 404 when the post has no cover.',\n      params: PostCoverParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await container.posts.coverFile(req.orgId, actor, req.params.postId);\n      return redirect(reply, url, 'Post cover', req.params.postId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/chats/:chatId/messages/:messageId/attachments/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMessageAttachment',\n      tags,\n      summary: 'Redirect to an image attached to a chat message',\n      description:\n        \"Served to the chat's participants while the message stands (staff also after it is deleted), and to moderators while the message is flagged.\",\n      params: MessageAttachmentParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await container.chats.attachmentFile(\n        req.orgId,\n        actor,\n        req.params.chatId,\n        req.params.messageId,\n        req.params.assetId,\n      );\n      return redirect(reply, url, 'Message attachment', req.params.assetId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/people/:orgUserId/image',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getPersonImage',\n      tags,\n      summary: \"Redirect to an org user's profile photo\",\n      description:\n        'Served to org users of the same organization when the photo belongs to it. 404 when the person has no photo here.',\n      params: PersonImageParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      await actorOf(req.orgId, req.userId);\n      const url = await member.personImage(req.orgId, req.params.orgUserId);\n      return redirect(reply, url, 'Profile photo', req.params.orgUserId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/uploads/:id/file',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberUploadFile',\n      tags,\n      summary: 'Redirect to an image you uploaded',\n      description: 'Served only to the person who uploaded it, once it is finalized.',\n      params: UploadFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(req.orgId, req.userId);\n      const url = await container.assets.ownUploadFile(req.orgId, req.params.id, actor.id);\n      return redirect(reply, url, 'Upload', req.params.id);\n    },\n  });\n}\n"],"mappings":";;;;;;;AAuBA,MAAM,OAAO,CAAC,OAAO;AACrB,MAAM,YAAY;CAAE,KAAK,EAAE,KAAK;CAAG,GAAG,SAAS,KAAK,GAAG;AAAE;AAEzD,SAAS,SAAS,OAAqB,KAAoB,MAAc,IAAY;CACnF,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,MAAM,EAAE;CAElC,OAAO,MACJ,OAAO,iBAAiB,UAAU,CAAC,CACnC,OAAO,mBAAmB,aAAa,CAAC,CACxC,SAAS,KAAK,GAAG;AACtB;AAEA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,eAAeA,UAAQ,OAAe,QAAgB;EACpD,MAAM,UAAU,MAAMC,QAAS,WAAW,OAAO,MAAM;EACvD,OAAO;GAAE,IAAI,QAAQ;GAAI,MAAM,QAAQ;EAAK;CAC9C;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMD,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEjD,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,IAAI,OAAO,OAAO,UAAU,IAAI,OAAO,QAAQ,GAC1D,oBAAoB,IAAI,OAAO,QAAQ;EACrE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEjD,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,IAAI,OAAO,OAAO,YAAY,IAAI,OAAO,UAAU,GAC9D,sBAAsB,IAAI,OAAO,UAAU;EACzE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEjD,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,IAAI,OAAO,OAAO,aAAa,IAAI,OAAO,WAAW,GAChE,uBAAuB,IAAI,OAAO,WAAW;EAC3E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAOjD,OAAO,SAAS,OAAO,MANL,OAAO,aACvB,IAAI,OACJ,OACA,IAAI,OAAO,YACX,IAAI,OAAO,OACb,GAC4B,eAAe,IAAI,OAAO,OAAO;EAC/D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAOjD,OAAO,SAAS,OAAO,MANL,OAAO,aACvB,IAAI,OACJ,OACA,IAAI,OAAO,YACX,IAAI,OAAO,OACb,GAC4B,iBAAiB,IAAI,OAAO,OAAO;EACjE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEjD,OAAO,SAAS,OAAO,MADL,UAAU,MAAM,UAAU,IAAI,OAAO,OAAO,IAAI,OAAO,MAAM,GACnD,cAAc,IAAI,OAAO,MAAM;EAC7D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAQjD,OAAO,SAAS,OAAO,MAPL,UAAU,MAAM,eAChC,IAAI,OACJ,OACA,IAAI,OAAO,QACX,IAAI,OAAO,WACX,IAAI,OAAO,OACb,GAC4B,sBAAsB,IAAI,OAAO,OAAO;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEnC,OAAO,SAAS,OAAO,MADL,OAAO,YAAY,IAAI,OAAO,IAAI,OAAO,SAAS,GACxC,iBAAiB,IAAI,OAAO,SAAS;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAMA,UAAQ,IAAI,OAAO,IAAI,MAAM;GAEjD,OAAO,SAAS,OAAO,MADL,UAAU,OAAO,cAAc,IAAI,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,GACvD,UAAU,IAAI,OAAO,EAAE;EACrD;CACF,CAAC;AACH"}
+{"version":3,"file":"files.js","names":[],"sources":["../../../../src/http/routes/member/files.ts"],"sourcesContent":["// Member file proxies. Each route asks the context that owns the file, then\n// redirects to a short-lived signed storage URL. Every refusal is a 404, so a\n// response never confirms that a file exists. A 403 only means the caller is\n// not an active member of the organization.\nimport type { FastifyInstance, FastifyReply } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport {\n  ActivityFileParams,\n  CommunityThumbnailParams,\n  CourseThumbnailParams,\n  DownloadFileParams,\n  DownloadThumbnailParams,\n  EventFileParams,\n  EventThumbnailParams,\n  MessageAttachmentParams,\n  PostCoverParams,\n  PostAssetParams,\n  UploadFileParams,\n  refusals,\n} from '../../schemas/index.js';\nimport { resolveActor } from '../../scope.js';\nimport type { Container } from '../../../app/container.js';\n\nconst tags = ['Files'];\nconst responses = { 302: z.void(), ...refusals(403, 404) };\n\nfunction redirect(reply: FastifyReply, url: string) {\n  return reply\n    .header('cache-control', 'no-store')\n    .header('referrer-policy', 'no-referrer')\n    .redirect(url, 302);\n}\n\nexport async function memberFileRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const member = container.reporting.member;\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/courses/:courseId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCourseThumbnail',\n      tags,\n      summary: \"Redirect to a course's thumbnail\",\n      description:\n        'For an unpublished course, which only a holder of `courses:read` on it may fetch: a published course carries a public `thumbnailUrl` instead. 404 when the course has no thumbnail.',\n      params: CourseThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.thumbnailFile('course', req.params.courseId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEventThumbnail',\n      tags,\n      summary: \"Redirect to an event's cover\",\n      description:\n        'For a draft event, which only a holder of `events:read` on it may fetch: a published or canceled event carries a public `thumbnailUrl` instead. 404 when the event read returns 404 or the event has no cover.',\n      params: EventThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.thumbnailFile('event', req.params.eventId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/events/:eventId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getEventFile',\n      tags,\n      summary: 'Redirect to a file attached to an event',\n      description:\n        'For a holder of `events:read` on the event or the org, or an attendee of the published or canceled event. Saved under its display name. 404 otherwise, or when the file is not attached to the event.',\n      params: EventFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.eventFile(req.params.eventId, req.params.assetId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownloadThumbnail',\n      tags,\n      summary: \"Redirect to a download's thumbnail\",\n      description:\n        'For an unpublished download, which only a holder of `downloads:read` on it may fetch: a published download carries a public `thumbnailUrl` instead. 404 when the download has no thumbnail.',\n      params: DownloadThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.thumbnailFile('download', req.params.downloadId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/thumbnail',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getCommunityThumbnail',\n      tags,\n      summary: \"Redirect to a community's thumbnail\",\n      description:\n        'For an unpublished community, which only a holder of `communities:read` on it may fetch: a published community carries a public `thumbnailUrl` instead. 404 when the community has no thumbnail.',\n      params: CommunityThumbnailParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.thumbnailFile('community', req.params.communityId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/activities/:activityId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getActivityFile',\n      tags,\n      summary: 'Redirect to a file used in a lesson',\n      description:\n        'Served when the person can open the course, the course and the lesson are published, and the lesson lists the file. A holder of `courses:read` on the course may fetch any file a lesson lists. Use the URL as an img, video or audio src.',\n      params: ActivityFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.activityFile(req.params.activityId, req.params.assetId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/downloads/:downloadId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getDownloadFile',\n      tags,\n      summary: 'Redirect to a file in a download, saved under its display name',\n      description:\n        'Served when the person can open the download, it is published, and it lists the file. A holder of `downloads:read` on the download may fetch it unpublished. The storage link lives DELIVERY_URL_EXPIRY seconds.',\n      params: DownloadFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await member.downloadFile(req.params.downloadId, req.params.assetId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/posts/:postId/cover',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getPostCover',\n      tags,\n      summary: \"Redirect to a post's cover image\",\n      description:\n        'For a post that is not published, served to whoever can read it: a published post carries a public `coverUrl` instead. 404 when the post has no cover.',\n      params: PostCoverParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await container.posts.coverFile(req.params.postId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/posts/:postId/assets/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getPostAsset',\n      tags,\n      summary: \"Redirect to a file in a post's body\",\n      description:\n        'Served to whoever can read the post while its body shows the file. Images, video, audio and PDFs open in place; any other file downloads under its name.',\n      params: PostAssetParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await container.posts.assetFile(req.params.postId, req.params.assetId, actor);\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/chats/:chatId/messages/:messageId/attachments/:assetId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMessageAttachment',\n      tags,\n      summary: 'Redirect to an image attached to a chat message',\n      description:\n        \"Served to the chat's participants while the message stands, to holders of `communities:moderate` on the community also after it is deleted, and to them while the message is flagged.\",\n      params: MessageAttachmentParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await container.chats.attachmentFile(\n        req.params.chatId,\n        req.params.messageId,\n        req.params.assetId,\n        actor,\n      );\n      return redirect(reply, url);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/uploads/:id/file',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberUploadFile',\n      tags,\n      summary: 'Redirect to an image you uploaded',\n      description: 'Served only to the person who uploaded it, once it is finalized.',\n      params: UploadFileParams,\n      response: responses,\n    },\n    handler: async (req, reply) => {\n      const actor = await resolveActor(container, req);\n      const url = await container.assets.ownUploadFile(req.params.id, actor);\n      return redirect(reply, url);\n    },\n  });\n}\n"],"mappings":";;;;;;AAwBA,MAAM,OAAO,CAAC,OAAO;AACrB,MAAM,YAAY;CAAE,KAAK,EAAE,KAAK;CAAG,GAAG,SAAS,KAAK,GAAG;AAAE;AAEzD,SAAS,SAAS,OAAqB,KAAa;CAClD,OAAO,MACJ,OAAO,iBAAiB,UAAU,CAAC,CACnC,OAAO,mBAAmB,aAAa,CAAC,CACxC,SAAS,KAAK,GAAG;AACtB;AAEA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,SAAS,UAAU,UAAU;CAEnC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,UAAU,IAAI,OAAO,UAAU,KAAK,CACjD;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,SAAS,IAAI,OAAO,SAAS,KAAK,CAC/C;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,UAAU,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,KAAK,CACtD;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,YAAY,IAAI,OAAO,YAAY,KAAK,CACrD;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,cAAc,aAAa,IAAI,OAAO,aAAa,KAAK,CACvD;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,aAAa,IAAI,OAAO,YAAY,IAAI,OAAO,SAAS,KAAK,CAC5D;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,OAAO,aAAa,IAAI,OAAO,YAAY,IAAI,OAAO,SAAS,KAAK,CAC5D;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,UAAU,MAAM,UAAU,IAAI,OAAO,QAAQ,KAAK,CAC1C;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,UAAU,MAAM,UAAU,IAAI,OAAO,QAAQ,IAAI,OAAO,SAAS,KAAK,CAC9D;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAO/C,OAAO,SAAS,OAAO,MANL,UAAU,MAAM,eAChC,IAAI,OAAO,QACX,IAAI,OAAO,WACX,IAAI,OAAO,SACX,KACF,CAC0B;EAC5B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;EACZ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,OAAO,SAAS,OAAO,MADL,UAAU,OAAO,cAAc,IAAI,OAAO,IAAI,KAAK,CAC3C;EAC5B;CACF,CAAC;AACH"}

package/dist/http/routes/member/index.js

@@ -4,6 +4,7 @@ import { memberCommentsRoutes } from "./comments.js";
 import { memberCommunityRoutes } from "./community.js";
 import { memberCoursesRoutes } from "./courses.js";
 import { memberDownloadsRoutes } from "./downloads.js";
+import { memberEventsRoutes } from "./events.js";
 import { memberFileRoutes } from "./files.js";
 import { memberNotificationRoutes } from "./notifications.js";
 import { memberNotificationSettingsRoutes } from "./notification-settings.js";
@@ -24,6 +25,7 @@ async function memberRoutes(app, container) {
 	await memberCommentsRoutes(app, container);
 	await memberAssetsRoutes(app, container);
 	await memberDownloadsRoutes(app, container);
+	await memberEventsRoutes(app, container);
 	await memberFileRoutes(app, container);
 	await memberNotificationRoutes(app, container);
 	await memberNotificationSettingsRoutes(app, container);

package/dist/http/routes/member/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/http/routes/member/index.ts"],"sourcesContent":["// Student HTTP API under `/api/member`. Session-guarded like every\n// back-office route, but scoped by the session's `org_users` row —\n// the reads gate on the person's enrollments, not on staff role. One file per\n// resource; everything under `/api/member` lives in this directory and nowhere\n// else. The course, download, and progress reads call reporting/member.\nimport type { FastifyInstance } from 'fastify';\nimport type { Container } from '../../../app/container.js';\nimport { memberAssetsRoutes } from './assets.js';\nimport { memberChatRoutes } from './chats.js';\nimport { memberCommentsRoutes } from './comments.js';\nimport { memberCommunityRoutes } from './community.js';\nimport { memberCoursesRoutes } from './courses.js';\nimport { memberDownloadsRoutes } from './downloads.js';\nimport { memberFileRoutes } from './files.js';\nimport { memberNotificationRoutes } from './notifications.js';\nimport { memberNotificationSettingsRoutes } from './notification-settings.js';\nimport { memberDeviceRoutes } from './devices.js';\nimport { memberOrgRoutes } from './org.js';\nimport { memberPostRoutes } from './posts.js';\nimport { memberProfileRoutes } from './profile.js';\nimport { memberProgressRoutes } from './progress.js';\n\nexport async function memberRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  await memberOrgRoutes(app, container);\n  await memberProfileRoutes(app, container);\n  await memberCommunityRoutes(app, container);\n  await memberPostRoutes(app, container);\n  await memberChatRoutes(app, container);\n  await memberCoursesRoutes(app, container);\n  await memberProgressRoutes(app, container);\n  await memberCommentsRoutes(app, container);\n  await memberAssetsRoutes(app, container);\n  await memberDownloadsRoutes(app, container);\n  await memberFileRoutes(app, container);\n  await memberNotificationRoutes(app, container);\n  await memberNotificationSettingsRoutes(app, container);\n  await memberDeviceRoutes(app, container);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,gBAAgB,KAAK,SAAS;CACpC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,sBAAsB,KAAK,SAAS;CAC1C,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,qBAAqB,KAAK,SAAS;CACzC,MAAM,qBAAqB,KAAK,SAAS;CACzC,MAAM,mBAAmB,KAAK,SAAS;CACvC,MAAM,sBAAsB,KAAK,SAAS;CAC1C,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,yBAAyB,KAAK,SAAS;CAC7C,MAAM,iCAAiC,KAAK,SAAS;CACrD,MAAM,mBAAmB,KAAK,SAAS;AACzC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/http/routes/member/index.ts"],"sourcesContent":["// Member HTTP API under `/api/member`. Every route resolves the caller's actor,\n// so only an active org user reaches it; the reads gate on the person's grants\n// and permissions. One file per resource; everything under `/api/member` lives\n// in this directory and nowhere else. The course, download, and progress reads\n// call reporting/member.\nimport type { FastifyInstance } from 'fastify';\nimport type { Container } from '../../../app/container.js';\nimport { memberAssetsRoutes } from './assets.js';\nimport { memberChatRoutes } from './chats.js';\nimport { memberCommentsRoutes } from './comments.js';\nimport { memberCommunityRoutes } from './community.js';\nimport { memberCoursesRoutes } from './courses.js';\nimport { memberDownloadsRoutes } from './downloads.js';\nimport { memberEventsRoutes } from './events.js';\nimport { memberFileRoutes } from './files.js';\nimport { memberNotificationRoutes } from './notifications.js';\nimport { memberNotificationSettingsRoutes } from './notification-settings.js';\nimport { memberDeviceRoutes } from './devices.js';\nimport { memberOrgRoutes } from './org.js';\nimport { memberPostRoutes } from './posts.js';\nimport { memberProfileRoutes } from './profile.js';\nimport { memberProgressRoutes } from './progress.js';\n\nexport async function memberRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  await memberOrgRoutes(app, container);\n  await memberProfileRoutes(app, container);\n  await memberCommunityRoutes(app, container);\n  await memberPostRoutes(app, container);\n  await memberChatRoutes(app, container);\n  await memberCoursesRoutes(app, container);\n  await memberProgressRoutes(app, container);\n  await memberCommentsRoutes(app, container);\n  await memberAssetsRoutes(app, container);\n  await memberDownloadsRoutes(app, container);\n  await memberEventsRoutes(app, container);\n  await memberFileRoutes(app, container);\n  await memberNotificationRoutes(app, container);\n  await memberNotificationSettingsRoutes(app, container);\n  await memberDeviceRoutes(app, container);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAuBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,gBAAgB,KAAK,SAAS;CACpC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,sBAAsB,KAAK,SAAS;CAC1C,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,oBAAoB,KAAK,SAAS;CACxC,MAAM,qBAAqB,KAAK,SAAS;CACzC,MAAM,qBAAqB,KAAK,SAAS;CACzC,MAAM,mBAAmB,KAAK,SAAS;CACvC,MAAM,sBAAsB,KAAK,SAAS;CAC1C,MAAM,mBAAmB,KAAK,SAAS;CACvC,MAAM,iBAAiB,KAAK,SAAS;CACrC,MAAM,yBAAyB,KAAK,SAAS;CAC7C,MAAM,iCAAiC,KAAK,SAAS;CACrD,MAAM,mBAAmB,KAAK,SAAS;AACzC"}

package/dist/http/routes/member/notification-settings.js

@@ -1,14 +1,20 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveCaller } from "../../scope.js";
 import { CommunityParam } from "../../schemas/chats.js";
 import { CommunityNotificationSettings, OrgNotificationSettings, PatchNotificationSettings } from "../../schemas/notifications.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/notification-settings.ts
 async function memberNotificationSettingsRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Notifications"];
+	async function memberOf(req) {
+		const caller = await resolveCaller(container, req);
+		return {
+			...caller.actor,
+			userId: caller.userId
+		};
+	}
 	r.route({
 		method: "GET",
 		url: "/api/member/communities/:communityId/settings/notifications",
@@ -17,7 +23,7 @@ async function memberNotificationSettingsRoutes(app, container) {
 			operationId: "getMemberCommunityNotificationSettings",
 			tags,
 			summary: "Read how you are told about each notification category in a community",
-			description: "For anyone who can open the community, staff included. One entry per category of the list in use, each with the channels it offers on this deployment, whether each is on for you and why (`locked`, `space`, `community`, `spaceDefault` or `default`), and `default`, what the channel would be without your own setting at that level. A per-space category also lists every space you can open, with its name. `digest` is the digest schedule of the community, null when it sends none. 404 when you cannot open the community.",
+			description: "For anyone who can open the community. One entry per category of the list in use that can apply to you, each with the channels it offers on this deployment, whether each is on for you and why (`locked`, `space`, `community`, `spaceDefault` or `default`), and `default`, what the channel would be without your own setting at that level. A per-space category also lists every space you can open, with its name. `digest` is the digest schedule of the community, null when it sends none. 404 when you cannot open the community.",
 			params: CommunityParam,
 			response: {
 				200: CommunityNotificationSettings,
@@ -25,10 +31,7 @@ async function memberNotificationSettingsRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const view = await container.reporting.member.communityNotificationSettings(req.orgId, actor, req.userId, req.params.communityId);
-			if (!view) throw new NotFoundError("Community", req.params.communityId);
-			return view;
+			return container.reporting.member.communityNotificationSettings(req.params.communityId, await memberOf(req));
 		}
 	});
 	r.route({
@@ -39,7 +42,7 @@ async function memberNotificationSettingsRoutes(app, container) {
 			operationId: "setMemberCommunityNotificationSettings",
 			tags,
 			summary: "Switch notification categories on or off per channel in a community",
-			description: "For anyone who can open the community, staff included. Each setting switches one category on one channel, for all spaces or, for a per-space category, for one space; `enabled: null` removes your choice so the default applies again. Settings left out keep their values. 404 when you cannot open the community; 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given for a category that is not per space.",
+			description: "For anyone who can open the community. Each setting switches one category on one channel, for all spaces or, for a per-space category, for one space; `enabled: null` removes your choice so the default applies again. Settings left out keep their values. 404 when you cannot open the community; 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given for a category that is not per space.",
 			params: CommunityParam,
 			body: PatchNotificationSettings,
 			response: {
@@ -48,12 +51,7 @@ async function memberNotificationSettingsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await container.notificationSettings.set(req.orgId, {
-				id: actor.id,
-				role: actor.role,
-				userId: req.userId
-			}, { communityId: req.params.communityId }, req.body.settings);
+			await container.notificationSettings.set({ communityId: req.params.communityId }, req.body.settings, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});
@@ -65,15 +63,14 @@ async function memberNotificationSettingsRoutes(app, container) {
 			operationId: "getMemberNotificationSettings",
 			tags,
 			summary: "Read how you are told about notifications outside any community",
-			description: "For anyone signed in to the organization. The organization's categories, such as access and course content, each with the channels it offers, whether each is on for you, and `default`, what it would be without your own setting.",
+			description: "For anyone signed in to the organization. The organization's categories that can apply to you, such as access and course content, each with the channels it offers, whether each is on for you, and `default`, what it would be without your own setting.",
 			response: {
 				200: OrgNotificationSettings,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			await actorOf(container, req.orgId, req.userId);
-			return container.reporting.member.orgNotificationSettings(req.orgId, req.userId);
+			return container.reporting.member.orgNotificationSettings(await memberOf(req));
 		}
 	});
 	r.route({
@@ -92,12 +89,7 @@ async function memberNotificationSettingsRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await container.notificationSettings.set(req.orgId, {
-				id: actor.id,
-				role: actor.role,
-				userId: req.userId
-			}, "org", req.body.settings);
+			await container.notificationSettings.set("org", req.body.settings, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/member/notification-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-settings.js","names":[],"sources":["../../../../src/http/routes/member/notification-settings.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport { actorOf } from './actor.js';\nimport {\n  CommunityParam,\n  CommunityNotificationSettings,\n  OrgNotificationSettings,\n  PatchNotificationSettings,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberNotificationSettingsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityNotificationSettings',\n      tags,\n      summary: 'Read how you are told about each notification category in a community',\n      description:\n        'For anyone who can open the community, staff included. One entry per category of the list in use, each with the channels it offers on this deployment, whether each is on for you and why (`locked`, `space`, `community`, `spaceDefault` or `default`), and `default`, what the channel would be without your own setting at that level. A per-space category also lists every space you can open, with its name. `digest` is the digest schedule of the community, null when it sends none. 404 when you cannot open the community.',\n      params: CommunityParam,\n      response: { 200: CommunityNotificationSettings, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const view = await container.reporting.member.communityNotificationSettings(\n        req.orgId,\n        actor,\n        req.userId,\n        req.params.communityId,\n      );\n      if (!view) {\n        throw new NotFoundError('Community', req.params.communityId);\n      }\n      return view;\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/communities/:communityId/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setMemberCommunityNotificationSettings',\n      tags,\n      summary: 'Switch notification categories on or off per channel in a community',\n      description:\n        'For anyone who can open the community, staff included. Each setting switches one category on one channel, for all spaces or, for a per-space category, for one space; `enabled: null` removes your choice so the default applies again. Settings left out keep their values. 404 when you cannot open the community; 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given for a category that is not per space.',\n      params: CommunityParam,\n      body: PatchNotificationSettings,\n      response: { 204: z.void(), ...refusals(400, 403, 404, 422) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await container.notificationSettings.set(\n        req.orgId,\n        { id: actor.id, role: actor.role, userId: req.userId },\n        { communityId: req.params.communityId },\n        req.body.settings,\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotificationSettings',\n      tags,\n      summary: 'Read how you are told about notifications outside any community',\n      description:\n        \"For anyone signed in to the organization. The organization's categories, such as access and course content, each with the channels it offers, whether each is on for you, and `default`, what it would be without your own setting.\",\n      response: { 200: OrgNotificationSettings, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await actorOf(container, req.orgId, req.userId);\n      return container.reporting.member.orgNotificationSettings(req.orgId, req.userId);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setMemberNotificationSettings',\n      tags,\n      summary: 'Switch notification categories outside any community on or off per channel',\n      description:\n        \"For anyone signed in to the organization. Works like the community settings, against the organization's categories; `enabled: null` removes your choice. 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given.\",\n      body: PatchNotificationSettings,\n      response: { 204: z.void(), ...refusals(400, 403, 422) },\n    },\n    handler: async (req, reply) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      await container.notificationSettings.set(\n        req.orgId,\n        { id: actor.id, role: actor.role, userId: req.userId },\n        'org',\n        req.body.settings,\n      );\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;;AAcA,eAAsB,iCACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAA+B,GAAG,SAAS,KAAK,GAAG;GAAE;EACxE;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,UAAU,UAAU,OAAO,8BAC5C,IAAI,OACJ,OACA,IAAI,QACJ,IAAI,OAAO,WACb;GACA,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,aAAa,IAAI,OAAO,WAAW;GAE7D,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,UAAU,qBAAqB,IACnC,IAAI,OACJ;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM;IAAM,QAAQ,IAAI;GAAO,GACrD,EAAE,aAAa,IAAI,OAAO,YAAY,GACtC,IAAI,KAAK,QACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAyB,GAAG,SAAS,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9C,OAAO,UAAU,UAAU,OAAO,wBAAwB,IAAI,OAAO,IAAI,MAAM;EACjF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,UAAU,qBAAqB,IACnC,IAAI,OACJ;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM;IAAM,QAAQ,IAAI;GAAO,GACrD,OACA,IAAI,KAAK,QACX;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"notification-settings.js","names":[],"sources":["../../../../src/http/routes/member/notification-settings.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { resolveCaller } from '../../scope.js';\nimport {\n  CommunityParam,\n  CommunityNotificationSettings,\n  OrgNotificationSettings,\n  PatchNotificationSettings,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberNotificationSettingsRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  async function memberOf(req: FastifyRequest) {\n    const caller = await resolveCaller(container, req);\n    return { ...caller.actor, userId: caller.userId };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/communities/:communityId/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberCommunityNotificationSettings',\n      tags,\n      summary: 'Read how you are told about each notification category in a community',\n      description:\n        'For anyone who can open the community. One entry per category of the list in use that can apply to you, each with the channels it offers on this deployment, whether each is on for you and why (`locked`, `space`, `community`, `spaceDefault` or `default`), and `default`, what the channel would be without your own setting at that level. A per-space category also lists every space you can open, with its name. `digest` is the digest schedule of the community, null when it sends none. 404 when you cannot open the community.',\n      params: CommunityParam,\n      response: { 200: CommunityNotificationSettings, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      return container.reporting.member.communityNotificationSettings(\n        req.params.communityId,\n        await memberOf(req),\n      );\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/communities/:communityId/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setMemberCommunityNotificationSettings',\n      tags,\n      summary: 'Switch notification categories on or off per channel in a community',\n      description:\n        'For anyone who can open the community. Each setting switches one category on one channel, for all spaces or, for a per-space category, for one space; `enabled: null` removes your choice so the default applies again. Settings left out keep their values. 404 when you cannot open the community; 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given for a category that is not per space.',\n      params: CommunityParam,\n      body: PatchNotificationSettings,\n      response: { 204: z.void(), ...refusals(400, 403, 404, 422) },\n    },\n    handler: async (req, reply) => {\n      await container.notificationSettings.set(\n        { communityId: req.params.communityId },\n        req.body.settings,\n        await memberOf(req),\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotificationSettings',\n      tags,\n      summary: 'Read how you are told about notifications outside any community',\n      description:\n        \"For anyone signed in to the organization. The organization's categories that can apply to you, such as access and course content, each with the channels it offers, whether each is on for you, and `default`, what it would be without your own setting.\",\n      response: { 200: OrgNotificationSettings, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return container.reporting.member.orgNotificationSettings(await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/member/settings/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'setMemberNotificationSettings',\n      tags,\n      summary: 'Switch notification categories outside any community on or off per channel',\n      description:\n        \"For anyone signed in to the organization. Works like the community settings, against the organization's categories; `enabled: null` removes your choice. 422 when a category does not exist, does not offer the channel, the channel is locked, or `spaceId` is given.\",\n      body: PatchNotificationSettings,\n      response: { 204: z.void(), ...refusals(400, 403, 422) },\n    },\n    handler: async (req, reply) => {\n      await container.notificationSettings.set('org', req.body.settings, await memberOf(req));\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,iCACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,eAAe,SAAS,KAAqB;EAC3C,MAAM,SAAS,MAAM,cAAc,WAAW,GAAG;EACjD,OAAO;GAAE,GAAG,OAAO;GAAO,QAAQ,OAAO;EAAO;CAClD;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAA+B,GAAG,SAAS,KAAK,GAAG;GAAE;EACxE;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,UAAU,OAAO,8BAChC,IAAI,OAAO,aACX,MAAM,SAAS,GAAG,CACpB;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,qBAAqB,IACnC,EAAE,aAAa,IAAI,OAAO,YAAY,GACtC,IAAI,KAAK,UACT,MAAM,SAAS,GAAG,CACpB;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAyB,GAAG,SAAS,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,UAAU,OAAO,wBAAwB,MAAM,SAAS,GAAG,CAAC;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,qBAAqB,IAAI,OAAO,IAAI,KAAK,UAAU,MAAM,SAAS,GAAG,CAAC;GACtF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/notifications.js

@@ -1,13 +1,20 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveCaller } from "../../scope.js";
 import { NotificationFilterQuery, NotificationIdParam, NotificationListQuery, NotificationUnreadCounts, NotificationView, NotificationsPage } from "../../schemas/notifications.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
+import { InvalidInputError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
-import { InvalidInputError, NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/notifications.ts
 async function memberNotificationRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Notifications"];
+	async function memberOf(req) {
+		const caller = await resolveCaller(container, req);
+		return {
+			...caller.actor,
+			userId: caller.userId
+		};
+	}
 	r.route({
 		method: "GET",
 		url: "/api/member/notifications",
@@ -24,12 +31,11 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
 			const { page, pageSize, ...filter } = req.query;
-			return container.reporting.member.notifications(req.orgId, actor, req.userId, filter, {
+			return container.reporting.member.notifications(filter, {
 				page,
 				pageSize
-			});
+			}, await memberOf(req));
 		}
 	});
 	r.route({
@@ -40,15 +46,14 @@ async function memberNotificationRoutes(app, container) {
 			operationId: "getMemberNotificationUnreadCounts",
 			tags,
 			summary: "Count your unread notifications in the org list and in each community",
-			description: "For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open, staff included.",
+			description: "For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open.",
 			response: {
 				200: NotificationUnreadCounts,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.reporting.member.notificationUnreadCounts(req.orgId, actor, req.userId);
+			return container.reporting.member.notificationUnreadCounts(await memberOf(req));
 		}
 	});
 	r.route({
@@ -67,10 +72,7 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const view = await container.reporting.member.notification(req.orgId, actor, req.userId, req.params.notificationId);
-			if (!view) throw new NotFoundError("Notification", req.params.notificationId);
-			return view;
+			return container.reporting.member.notification(req.params.notificationId, await memberOf(req));
 		}
 	});
 	r.route({
@@ -89,8 +91,7 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			await actorOf(container, req.orgId, req.userId);
-			await container.notificationList.markRead(req.orgId, req.userId, req.params.notificationId);
+			await container.notificationList.markRead(req.params.notificationId, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});
@@ -113,8 +114,7 @@ async function memberNotificationRoutes(app, container) {
 			if (req.body !== void 0) throw new InvalidInputError("Mark-read takes its filters in the query string, not in a body");
 		},
 		handler: async (req, reply) => {
-			await actorOf(container, req.orgId, req.userId);
-			await container.notificationList.markAllRead(req.orgId, req.userId, req.query);
+			await container.notificationList.markAllRead(req.query, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});