@headless-lms/server 0.4.0 → 0.6.0

package/dist/http/routes/member/notifications.js

@@ -1,13 +1,20 @@
 import { refusals } from "../../schemas/shared.js";
+import { resolveCaller } from "../../scope.js";
 import { NotificationFilterQuery, NotificationIdParam, NotificationListQuery, NotificationUnreadCounts, NotificationView, NotificationsPage } from "../../schemas/notifications.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
+import { InvalidInputError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
-import { InvalidInputError, NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/member/notifications.ts
 async function memberNotificationRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Notifications"];
+	async function memberOf(req) {
+		const caller = await resolveCaller(container, req);
+		return {
+			...caller.actor,
+			userId: caller.userId
+		};
+	}
 	r.route({
 		method: "GET",
 		url: "/api/member/notifications",
@@ -24,12 +31,11 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
 			const { page, pageSize, ...filter } = req.query;
-			return container.reporting.member.notifications(req.orgId, actor, req.userId, filter, {
+			return container.reporting.member.notifications(filter, {
 				page,
 				pageSize
-			});
+			}, await memberOf(req));
 		}
 	});
 	r.route({
@@ -40,15 +46,14 @@ async function memberNotificationRoutes(app, container) {
 			operationId: "getMemberNotificationUnreadCounts",
 			tags,
 			summary: "Count your unread notifications in the org list and in each community",
-			description: "For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open, staff included.",
+			description: "For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open.",
 			response: {
 				200: NotificationUnreadCounts,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.reporting.member.notificationUnreadCounts(req.orgId, actor, req.userId);
+			return container.reporting.member.notificationUnreadCounts(await memberOf(req));
 		}
 	});
 	r.route({
@@ -67,10 +72,7 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const view = await container.reporting.member.notification(req.orgId, actor, req.userId, req.params.notificationId);
-			if (!view) throw new NotFoundError("Notification", req.params.notificationId);
-			return view;
+			return container.reporting.member.notification(req.params.notificationId, await memberOf(req));
 		}
 	});
 	r.route({
@@ -89,8 +91,7 @@ async function memberNotificationRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			await actorOf(container, req.orgId, req.userId);
-			await container.notificationList.markRead(req.orgId, req.userId, req.params.notificationId);
+			await container.notificationList.markRead(req.params.notificationId, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});
@@ -113,8 +114,7 @@ async function memberNotificationRoutes(app, container) {
 			if (req.body !== void 0) throw new InvalidInputError("Mark-read takes its filters in the query string, not in a body");
 		},
 		handler: async (req, reply) => {
-			await actorOf(container, req.orgId, req.userId);
-			await container.notificationList.markAllRead(req.orgId, req.userId, req.query);
+			await container.notificationList.markAllRead(req.query, await memberOf(req));
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/member/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","names":[],"sources":["../../../../src/http/routes/member/notifications.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { InvalidInputError, NotFoundError } from '@headless-lms/core/shared/errors';\nimport { actorOf } from './actor.js';\nimport {\n  NotificationFilterQuery,\n  NotificationIdParam,\n  NotificationListQuery,\n  NotificationUnreadCounts,\n  NotificationView,\n  NotificationsPage,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberNotificationRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberNotifications',\n      tags,\n      summary: 'List your notifications, newest first, with the unread count of the same filters',\n      description:\n        'For any member of the organization. Filters combine with AND; the values of one filter combine with OR, and `includeOrg=true` with `communityId` adds the org list, so one query reads a community with the course and account notifications. 400 for `includeOrg` without `communityId` or with `scope`. Each notification carries the current titles, names and excerpts of what it refers to; a subject or parent you can no longer open, or that was deleted, is null. `display` is the text stored when it was sent.',\n      querystring: NotificationListQuery,\n      response: { 200: NotificationsPage, ...refusals(400, 403) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const { page, pageSize, ...filter } = req.query;\n      return container.reporting.member.notifications(req.orgId, actor, req.userId, filter, {\n        page,\n        pageSize,\n      });\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications/unread-counts',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotificationUnreadCounts',\n      tags,\n      summary: 'Count your unread notifications in the org list and in each community',\n      description:\n        'For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open, staff included.',\n      response: { 200: NotificationUnreadCounts, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      return container.reporting.member.notificationUnreadCounts(req.orgId, actor, req.userId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications/:notificationId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotification',\n      tags,\n      summary: 'Read one of your notifications',\n      description:\n        'For any member of the organization. The notification as the list shows it, with current titles, names and excerpts; reading it does not mark it read. 404 when it is not yours or was not shown in the app.',\n      params: NotificationIdParam,\n      response: { 200: NotificationView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await actorOf(container, req.orgId, req.userId);\n      const view = await container.reporting.member.notification(\n        req.orgId,\n        actor,\n        req.userId,\n        req.params.notificationId,\n      );\n      if (!view) {\n        throw new NotFoundError('Notification', req.params.notificationId);\n      }\n      return view;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/notifications/:notificationId/read',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'markMemberNotificationRead',\n      tags,\n      summary: 'Mark one of your notifications read',\n      description:\n        'For any member of the organization. Marking a read notification keeps its first read time. 404 when it is not yours.',\n      params: NotificationIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await actorOf(container, req.orgId, req.userId);\n      await container.notificationList.markRead(req.orgId, req.userId, req.params.notificationId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/notifications/read',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'markAllMemberNotificationsRead',\n      tags,\n      summary: 'Mark your notifications matching the filters read',\n      description:\n        'For any member of the organization. Takes the filters of the list in the query string, `includeOrg` included; with none, marks every notification read. 400 when the request has a body.',\n      querystring: NotificationFilterQuery,\n      response: { 204: z.void(), ...refusals(400, 403) },\n    },\n    preValidation: async (req) => {\n      if (req.body !== undefined) {\n        throw new InvalidInputError('Mark-read takes its filters in the query string, not in a body');\n      }\n    },\n    handler: async (req, reply) => {\n      await actorOf(container, req.orgId, req.userId);\n      await container.notificationList.markAllRead(req.orgId, req.userId, req.query);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,eAAsB,yBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC5D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,EAAE,MAAM,UAAU,GAAG,WAAW,IAAI;GAC1C,OAAO,UAAU,UAAU,OAAO,cAAc,IAAI,OAAO,OAAO,IAAI,QAAQ,QAAQ;IACpF;IACA;GACF,CAAC;EACH;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,OAAO,UAAU,UAAU,OAAO,yBAAyB,IAAI,OAAO,OAAO,IAAI,MAAM;EACzF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC5D,MAAM,OAAO,MAAM,UAAU,UAAU,OAAO,aAC5C,IAAI,OACJ,OACA,IAAI,QACJ,IAAI,OAAO,cACb;GACA,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,gBAAgB,IAAI,OAAO,cAAc;GAEnE,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9C,MAAM,UAAU,iBAAiB,SAAS,IAAI,OAAO,IAAI,QAAQ,IAAI,OAAO,cAAc;GAC1F,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,eAAe,OAAO,QAAQ;GAC5B,IAAI,IAAI,SAAS,KAAA,GACf,MAAM,IAAI,kBAAkB,gEAAgE;EAEhG;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9C,MAAM,UAAU,iBAAiB,YAAY,IAAI,OAAO,IAAI,QAAQ,IAAI,KAAK;GAC7E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"notifications.js","names":[],"sources":["../../../../src/http/routes/member/notifications.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../../app/container.js';\nimport { InvalidInputError } from '@headless-lms/core/shared/errors';\nimport { resolveCaller } from '../../scope.js';\nimport {\n  NotificationFilterQuery,\n  NotificationIdParam,\n  NotificationListQuery,\n  NotificationUnreadCounts,\n  NotificationView,\n  NotificationsPage,\n  refusals,\n} from '../../schemas/index.js';\n\nexport async function memberNotificationRoutes(\n  app: FastifyInstance,\n  container: Container,\n): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Notifications'];\n\n  async function memberOf(req: FastifyRequest) {\n    const caller = await resolveCaller(container, req);\n    return { ...caller.actor, userId: caller.userId };\n  }\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listMemberNotifications',\n      tags,\n      summary: 'List your notifications, newest first, with the unread count of the same filters',\n      description:\n        'For any member of the organization. Filters combine with AND; the values of one filter combine with OR, and `includeOrg=true` with `communityId` adds the org list, so one query reads a community with the course and account notifications. 400 for `includeOrg` without `communityId` or with `scope`. Each notification carries the current titles, names and excerpts of what it refers to; a subject or parent you can no longer open, or that was deleted, is null. `display` is the text stored when it was sent.',\n      querystring: NotificationListQuery,\n      response: { 200: NotificationsPage, ...refusals(400, 403) },\n    },\n    handler: async (req) => {\n      const { page, pageSize, ...filter } = req.query;\n      return container.reporting.member.notifications(\n        filter,\n        { page, pageSize },\n        await memberOf(req),\n      );\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications/unread-counts',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotificationUnreadCounts',\n      tags,\n      summary: 'Count your unread notifications in the org list and in each community',\n      description:\n        'For any member of the organization. `org` counts the org list; `communities` has one entry per community you can open.',\n      response: { 200: NotificationUnreadCounts, ...refusals(403) },\n    },\n    handler: async (req) => {\n      return container.reporting.member.notificationUnreadCounts(await memberOf(req));\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/notifications/:notificationId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberNotification',\n      tags,\n      summary: 'Read one of your notifications',\n      description:\n        'For any member of the organization. The notification as the list shows it, with current titles, names and excerpts; reading it does not mark it read. 404 when it is not yours or was not shown in the app.',\n      params: NotificationIdParam,\n      response: { 200: NotificationView, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      return container.reporting.member.notification(\n        req.params.notificationId,\n        await memberOf(req),\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/notifications/:notificationId/read',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'markMemberNotificationRead',\n      tags,\n      summary: 'Mark one of your notifications read',\n      description:\n        'For any member of the organization. Marking a read notification keeps its first read time. 404 when it is not yours.',\n      params: NotificationIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await container.notificationList.markRead(req.params.notificationId, await memberOf(req));\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/member/notifications/read',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'markAllMemberNotificationsRead',\n      tags,\n      summary: 'Mark your notifications matching the filters read',\n      description:\n        'For any member of the organization. Takes the filters of the list in the query string, `includeOrg` included; with none, marks every notification read. 400 when the request has a body.',\n      querystring: NotificationFilterQuery,\n      response: { 204: z.void(), ...refusals(400, 403) },\n    },\n    preValidation: async (req) => {\n      if (req.body !== undefined) {\n        throw new InvalidInputError(\n          'Mark-read takes its filters in the query string, not in a body',\n        );\n      }\n    },\n    handler: async (req, reply) => {\n      await container.notificationList.markAllRead(req.query, await memberOf(req));\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,eAAsB,yBACpB,KACA,WACe;CACf,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,eAAe;CAE7B,eAAe,SAAS,KAAqB;EAC3C,MAAM,SAAS,MAAM,cAAc,WAAW,GAAG;EACjD,OAAO;GAAE,GAAG,OAAO;GAAO,QAAQ,OAAO;EAAO;CAClD;CAEA,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC5D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,EAAE,MAAM,UAAU,GAAG,WAAW,IAAI;GAC1C,OAAO,UAAU,UAAU,OAAO,cAChC,QACA;IAAE;IAAM;GAAS,GACjB,MAAM,SAAS,GAAG,CACpB;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,UAAU,OAAO,yBAAyB,MAAM,SAAS,GAAG,CAAC;EAChF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,KAAK,GAAG;GAAE;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,UAAU,OAAO,aAChC,IAAI,OAAO,gBACX,MAAM,SAAS,GAAG,CACpB;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,iBAAiB,SAAS,IAAI,OAAO,gBAAgB,MAAM,SAAS,GAAG,CAAC;GACxF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,aAAa;GACb,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,eAAe,OAAO,QAAQ;GAC5B,IAAI,IAAI,SAAS,KAAA,GACf,MAAM,IAAI,kBACR,gEACF;EAEJ;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,iBAAiB,YAAY,IAAI,OAAO,MAAM,SAAS,GAAG,CAAC;GAC3E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/member/org.js

@@ -1,8 +1,7 @@
 import { refusals } from "../../schemas/shared.js";
-import { UnauthorizedError } from "../../plugins/auth.js";
+import { resolveActor } from "../../scope.js";
 import { MemberOrg, MemberViewer } from "../../schemas/member.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 //#region src/http/routes/member/org.ts
 async function memberOrgRoutes(app, container) {
 	const r = app.withTypeProvider();
@@ -18,13 +17,7 @@ async function memberOrgRoutes(app, container) {
 			response: { 200: MemberOrg }
 		},
 		handler: async (req) => {
-			const org = await container.organizations.getById(req.orgId);
-			if (!org) throw new UnauthorizedError("Your session points to an organization that no longer exists");
-			return {
-				id: org.id,
-				name: org.name,
-				slug: org.slug
-			};
+			return container.organizations.portalIdentity(req.orgId);
 		}
 	});
 	r.route({
@@ -35,18 +28,15 @@ async function memberOrgRoutes(app, container) {
 			operationId: "getMemberViewer",
 			tags: ["Organizations"],
 			summary: "Get the caller's identity within the session's org",
-			description: "For a member of the organization: your org user id, which the member API keys on, and your role here.",
+			description: "For a member of the organization: your org user id, which the member API keys on, your org role, the permissions you hold anywhere, and those you hold on the org.",
 			response: {
 				200: MemberViewer,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			const orgUser = await actorOf(container, req.orgId, req.userId);
-			return {
-				orgUserId: orgUser.id,
-				role: orgUser.role
-			};
+			const actor = await resolveActor(container, req);
+			return container.reporting.member.viewer(actor);
 		}
 	});
 }

package/dist/http/routes/member/org.js.map

@@ -1 +1 @@
-{"version":3,"file":"org.js","names":[],"sources":["../../../../src/http/routes/member/org.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { MemberOrg, MemberViewer, refusals } from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { UnauthorizedError } from '../../plugins/auth.js';\nimport { actorOf } from './actor.js';\n\nexport async function memberOrgRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/org',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberOrg',\n      tags: ['Organizations'],\n      summary: \"Get the portal org's public identity (branding)\",\n      description:\n        'For any signed-in person whose session has this organization active. Name and slug only.',\n      response: { 200: MemberOrg },\n    },\n    handler: async (req) => {\n      // The session's org (from `activeOrganizationId`) — surface its display\n      // identity for the portal brand.\n      const org = await container.organizations.getById(req.orgId);\n      if (!org) {\n        throw new UnauthorizedError('Your session points to an organization that no longer exists');\n      }\n      return { id: org.id, name: org.name, slug: org.slug };\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/viewer',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberViewer',\n      tags: ['Organizations'],\n      summary: \"Get the caller's identity within the session's org\",\n      description:\n        'For a member of the organization: your org user id, which the member API keys on, and your role here.',\n      response: { 200: MemberViewer, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const orgUser = await actorOf(container, req.orgId, req.userId);\n      return { orgUserId: orgUser.id, role: orgUser.role };\n    },\n  });\n}\n"],"mappings":";;;;;;AAOA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,UAAU,EAAE,KAAK,UAAU;EAC7B;EACA,SAAS,OAAO,QAAQ;GAGtB,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,IAAI,KAAK;GAC3D,IAAI,CAAC,KACH,MAAM,IAAI,kBAAkB,8DAA8D;GAE5F,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;GAAK;EACtD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,OAAO,IAAI,MAAM;GAC9D,OAAO;IAAE,WAAW,QAAQ;IAAI,MAAM,QAAQ;GAAK;EACrD;CACF,CAAC;AACH"}
+{"version":3,"file":"org.js","names":[],"sources":["../../../../src/http/routes/member/org.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { MemberOrg, MemberViewer, refusals } from '../../schemas/index.js';\nimport type { Container } from '../../../app/container.js';\nimport { resolveActor } from '../../scope.js';\n\nexport async function memberOrgRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/org',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberOrg',\n      tags: ['Organizations'],\n      summary: \"Get the portal org's public identity (branding)\",\n      description:\n        'For any signed-in person whose session has this organization active. Name and slug only.',\n      response: { 200: MemberOrg },\n    },\n    handler: async (req) => {\n      return container.organizations.portalIdentity(req.orgId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/member/viewer',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMemberViewer',\n      tags: ['Organizations'],\n      summary: \"Get the caller's identity within the session's org\",\n      description:\n        'For a member of the organization: your org user id, which the member API keys on, your org role, the permissions you hold anywhere, and those you hold on the org.',\n      response: { 200: MemberViewer, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return container.reporting.member.viewer(actor);\n    },\n  });\n}\n"],"mappings":";;;;;AAMA,eAAsB,gBAAgB,KAAsB,WAAqC;CAC/F,MAAM,IAAI,IAAI,iBAAkC;CAEhD,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,UAAU,EAAE,KAAK,UAAU;EAC7B;EACA,SAAS,OAAO,QAAQ;GACtB,OAAO,UAAU,cAAc,eAAe,IAAI,KAAK;EACzD;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb,MAAM,CAAC,eAAe;GACtB,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,UAAU,OAAO,OAAO,KAAK;EAChD;CACF,CAAC;AACH"}

package/dist/http/routes/member/posts.js

@@ -1,10 +1,10 @@
 import { PageQuery, refusals } from "../../schemas/shared.js";
+import { resolveActor } from "../../scope.js";
 import { CommentView, PostComment, Reactions, SetPostSubscription, SetReaction } from "../../schemas/discussion.js";
 import { CommunitySpaceParam } from "../../schemas/community.js";
 import { CreatePost, FeedQuery, FlagReason, PostCommentsPage, PostFeedPage, PostFlag, PostIdParam, PostView, ResolvePostFlags, SchedulePost, SetPostReactions, SpaceQueue, UpdatePost } from "../../schemas/posts.js";
 import { CommunityParam } from "../../schemas/chats.js";
 import "../../schemas/index.js";
-import { actorOf } from "./actor.js";
 import { z } from "zod";
 //#region src/http/routes/member/posts.ts
 async function memberPostRoutes(app, container) {
@@ -28,8 +28,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.memberFeed(req.orgId, actor, req.params.communityId, req.query);
+			const actor = await resolveActor(container, req);
+			return posts.memberFeed(req.params.communityId, req.query, actor);
 		}
 	});
 	r.route({
@@ -49,8 +49,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.listOwn(req.orgId, actor, req.params.communityId, req.query);
+			const actor = await resolveActor(container, req);
+			return posts.listOwn(req.params.communityId, req.query, actor);
 		}
 	});
 	r.route({
@@ -70,8 +70,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.listBookmarked(req.orgId, actor, req.params.communityId, req.query);
+			const actor = await resolveActor(container, req);
+			return posts.listBookmarked(req.params.communityId, req.query, actor);
 		}
 	});
 	r.route({
@@ -91,8 +91,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.spaceFeed(req.orgId, actor, req.params.communityId, req.params.spaceId, req.query);
+			const actor = await resolveActor(container, req);
+			return posts.spaceFeed(req.params.communityId, req.params.spaceId, req.query, actor);
 		}
 	});
 	r.route({
@@ -111,8 +111,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.moderationQueue(req.orgId, actor, req.params.communityId, req.params.spaceId);
+			const actor = await resolveActor(container, req);
+			return posts.moderationQueue(req.params.communityId, req.params.spaceId, actor);
 		}
 	});
 	r.route({
@@ -123,7 +123,7 @@ async function memberPostRoutes(app, container) {
 			operationId: "createPost",
 			tags,
 			summary: "Create a post",
-			description: "For anyone who can open the space. `mode` decides the status: `draft`, `scheduled`, or on `submit` `published`, or `pending` when the space requires review and you are not staff. 409 when the space has topics and none is given. 400 when a schedule is missing or in the past. 503 when a scheduled post could not be timed; the post is then kept as a draft, and `details.postId` names it, so open that draft instead of creating the post again.",
+			description: "For anyone who can open the space. `mode` decides the status: `draft`, `scheduled`, or on `submit` `published`, or `pending` when the space requires review and you do not hold `communities:moderate` on the community. 409 when the space has topics and none is given. 400 when a schedule is missing or in the past. 503 when a scheduled post could not be timed; the post is then kept as a draft, and `details.postId` names it, so open that draft instead of creating the post again.",
 			params: CommunitySpaceParam,
 			body: CreatePost,
 			response: {
@@ -132,12 +132,12 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const post = await posts.create(req.orgId, actor, {
+			const actor = await resolveActor(container, req);
+			const post = await posts.create({
 				...req.body,
 				communityId: req.params.communityId,
 				spaceId: req.params.spaceId
-			});
+			}, actor);
 			req.log.info({
 				postId: post.id,
 				status: post.status
@@ -161,8 +161,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.getPost(req.orgId, actor, req.params.postId);
+			const actor = await resolveActor(container, req);
+			return posts.getPost(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -182,19 +182,19 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.update(req.orgId, req.params.postId, actor, req.body);
+			const actor = await resolveActor(container, req);
+			return posts.update(req.params.postId, req.body, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/posts/:postId/submission",
+		url: "/api/member/posts/:postId/submit",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "submitPost",
 			tags,
 			summary: "Submit your draft or scheduled post",
-			description: "Author only. Publishes it now, or holds it for review when the space requires review and you are not staff. A scheduled post is no longer published at its time. 409 when the post is not a draft or scheduled.",
+			description: "Author only. Publishes it now, or holds it for review when the space requires review and you do not hold `communities:moderate` on the community. A scheduled post is no longer published at its time. 409 when the post is not a draft or scheduled.",
 			params: PostIdParam,
 			response: {
 				200: PostView,
@@ -202,8 +202,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.submit(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.submit(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -223,8 +223,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.schedule(req.orgId, req.params.postId, actor, req.body.scheduledAt);
+			const actor = await resolveActor(container, req);
+			return posts.schedule(req.params.postId, req.body.scheduledAt, actor);
 		}
 	});
 	r.route({
@@ -243,13 +243,13 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.unschedule(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.unschedule(req.params.postId, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/posts/:postId/approval",
+		url: "/api/member/posts/:postId/approve",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "approvePost",
@@ -263,19 +263,19 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.approve(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.approve(req.params.postId, null, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/posts/:postId/removal",
+		url: "/api/member/posts/:postId/remove",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "removePost",
 			tags,
 			summary: "Remove your post, or one in a space you moderate",
-			description: "For the author or a moderator. Takes a published or pending post down; a moderator removing someone else's post resolves its open flags as `removed`. 409 when it is already removed or was never submitted.",
+			description: "The author can remove their own post; anyone else needs `communities:moderate` on the community. Takes a published or pending post down; removing someone else's post resolves its open flags as `removed`. 409 when it is already removed or was never submitted.",
 			params: PostIdParam,
 			response: {
 				200: PostView,
@@ -283,13 +283,13 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.remove(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.remove(req.params.postId, null, actor);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/posts/:postId/restoration",
+		url: "/api/member/posts/:postId/restore",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "restorePost",
@@ -303,8 +303,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.restore(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.restore(req.params.postId, null, actor);
 		}
 	});
 	r.route({
@@ -323,8 +323,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.pin(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.pin(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -343,8 +343,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.unpin(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.unpin(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -363,8 +363,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.closeComments(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.closeComments(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -383,8 +383,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.openComments(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			return posts.openComments(req.params.postId, actor);
 		}
 	});
 	r.route({
@@ -404,8 +404,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.setReactions(req.orgId, req.params.postId, actor, req.body.enabled);
+			const actor = await resolveActor(container, req);
+			return posts.setReactions(req.params.postId, req.body.enabled, actor);
 		}
 	});
 	r.route({
@@ -425,8 +425,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.setReaction(req.orgId, req.params.postId, actor, req.body.emoji);
+			const actor = await resolveActor(container, req);
+			return posts.setReaction(req.params.postId, req.body.emoji, actor);
 		}
 	});
 	r.route({
@@ -445,8 +445,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return posts.setReaction(req.orgId, req.params.postId, actor, null);
+			const actor = await resolveActor(container, req);
+			return posts.setReaction(req.params.postId, null, actor);
 		}
 	});
 	r.route({
@@ -466,8 +466,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await container.subscriptions.setPost(req.orgId, actor, req.params.postId, req.body);
+			const actor = await resolveActor(container, req);
+			await container.subscriptions.setPost(req.params.postId, req.body, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -487,8 +487,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await posts.bookmark(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			await posts.bookmark(req.params.postId, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -508,8 +508,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await posts.unbookmark(req.orgId, req.params.postId, actor);
+			const actor = await resolveActor(container, req);
+			await posts.unbookmark(req.params.postId, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -530,14 +530,14 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const flag = await posts.flag(req.orgId, req.params.postId, actor, req.body.reason);
+			const actor = await resolveActor(container, req);
+			const flag = await posts.flag(req.params.postId, req.body.reason, actor);
 			return reply.code(201).send(flag);
 		}
 	});
 	r.route({
 		method: "POST",
-		url: "/api/member/posts/:postId/flags/resolution",
+		url: "/api/member/posts/:postId/flags/resolve",
 		preHandler: app.requireOrgSession,
 		schema: {
 			operationId: "resolvePostFlags",
@@ -552,8 +552,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			await posts.resolveFlags(req.orgId, req.params.postId, actor, req.body.resolution);
+			const actor = await resolveActor(container, req);
+			await posts.resolveFlags(req.params.postId, req.body.resolution, null, actor);
 			return reply.code(204).send();
 		}
 	});
@@ -574,8 +574,8 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			return container.discussion.postComments(req.orgId, req.params.postId, actor, req.query);
+			const actor = await resolveActor(container, req);
+			return container.discussion.postComments(req.params.postId, req.query, actor);
 		}
 	});
 	r.route({
@@ -595,13 +595,12 @@ async function memberPostRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const actor = await actorOf(container, req.orgId, req.userId);
-			const comment = await container.discussion.postComment(req.orgId, {
-				actor,
+			const actor = await resolveActor(container, req);
+			const comment = await container.discussion.postComment({
 				postId: req.params.postId,
 				parentId: req.body.parentId,
 				body: req.body.body
-			});
+			}, actor);
 			return reply.code(201).send(comment);
 		}
 	});