@headless-lms/server 0.4.0 → 0.6.0

package/dist/http/routes/access.js

@@ -1,31 +1,48 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
-import { ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOptionList } from "../schemas/access.js";
+import { resolveActor } from "../scope.js";
+import { ApiKeyIdParam, ApiKeyList, ApiKeyRoleList, ClientIdParam, ConnectedAppList, CreateApiKey, CreatedApiKey, PermissionDefinitionList, ViewerPermissions } from "../schemas/access.js";
 import "../schemas/index.js";
-import { assertRoleHoldsScopes, scopeOptions } from "@headless-lms/core/organizations";
 import { z } from "zod";
 //#region src/http/routes/access.ts
 async function accessRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const tags = ["Access"];
+	const organizations = container.organizations;
 	r.route({
 		method: "GET",
-		url: "/api/access/scopes",
+		url: "/api/access/permissions/list",
 		preHandler: app.requireOrgSession,
 		schema: {
-			operationId: "listAccessScopes",
+			operationId: "listPermissions",
 			tags,
-			summary: "Every access scope and whether your role can grant it",
-			description: "Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.",
+			summary: "Every permission, with its label, description and level",
+			description: `Any active member of the organization. For role screens, the key-creation screen and the consent screen.`,
 			response: {
-				200: ScopeOptionList,
+				200: PermissionDefinitionList,
 				...refusals(403)
 			}
 		},
 		handler: async (req) => {
-			return scopeOptions((await resolveScope(container, req)).role);
+			await resolveActor(container, req);
+			return organizations.permissionList();
 		}
 	});
+	r.route({
+		method: "GET",
+		url: "/api/access/permissions",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "getMyPermissions",
+			tags,
+			summary: "Your effective permissions in this organization",
+			description: `Any active member of the organization. Your org role, whether you own the organization, the permissions you hold on the organization, and the ones you hold on each content item.`,
+			response: {
+				200: ViewerPermissions,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => organizations.viewerPermissions(await resolveActor(container, req))
+	});
 	r.route({
 		method: "GET",
 		url: "/api/access/apps",
@@ -34,16 +51,13 @@ async function accessRoutes(app, container) {
 			operationId: "listConnectedApps",
 			tags,
 			summary: "Apps connected to this organization as you",
-			description: "Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.",
+			description: `Any active member of the organization. The apps you connected to this organization, each with the scopes you granted and when.`,
 			response: {
 				200: ConnectedAppList,
 				...refusals(403)
 			}
 		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.auth.listConnectedApps(req.headers, scope.authOrgId);
-		}
+		handler: async (req) => organizations.listConnectedApps(await resolveActor(container, req))
 	});
 	r.route({
 		method: "DELETE",
@@ -53,7 +67,7 @@ async function accessRoutes(app, container) {
 			operationId: "revokeConnectedApp",
 			tags,
 			summary: "Disconnect an app",
-			description: "Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.",
+			description: `Any active member of the organization. Revokes your consent and tokens for the app in this organization; its next call is refused.`,
 			params: ClientIdParam,
 			response: {
 				204: z.void(),
@@ -61,8 +75,7 @@ async function accessRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);
+			await organizations.revokeConnectedApp(req.params.clientId, await resolveActor(container, req));
 			return reply.code(204).send();
 		}
 	});
@@ -74,16 +87,29 @@ async function accessRoutes(app, container) {
 			operationId: "listApiKeys",
 			tags,
 			summary: "Your API keys for this organization",
-			description: "Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.",
+			description: `Requires \`api_keys:read\`. Your keys for this organization with their role and expiry. The key itself is never returned again after it is created.`,
 			response: {
 				200: ApiKeyList,
 				...refusals(403)
 			}
 		},
-		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return container.auth.listApiKeys(req.headers, scope.authOrgId);
-		}
+		handler: async (req) => organizations.listApiKeys(await resolveActor(container, req))
+	});
+	r.route({
+		method: "GET",
+		url: "/api/access/api-keys/roles",
+		preHandler: app.requireOrgSession,
+		schema: {
+			operationId: "listApiKeyRoles",
+			tags,
+			summary: "The roles you can put on an API key",
+			description: `Requires \`api_keys:write\`. The organization's roles whose every permission you hold somewhere.`,
+			response: {
+				200: ApiKeyRoleList,
+				...refusals(403)
+			}
+		},
+		handler: async (req) => organizations.listApiKeyRoles(await resolveActor(container, req))
 	});
 	r.route({
 		method: "POST",
@@ -93,22 +119,15 @@ async function accessRoutes(app, container) {
 			operationId: "createApiKey",
 			tags,
 			summary: "Create an API key",
-			description: "Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.",
+			description: `Requires \`api_keys:write\` and a signed-in person: a request made with an API key or an app token gets 403. The key acts as you in this organization with the permissions of the role given, never beyond what you hold at the time of each request. Send it in the \`x-api-key\` header or as \`Authorization: Bearer <key>\`; every route under /api and /mcp accepts it. 403 when the role holds a permission you hold nowhere; 404 when the organization has no such role. The key is returned once.`,
 			body: CreateApiKey,
 			response: {
 				201: CreatedApiKey,
-				...refusals(400, 403)
+				...refusals(400, 403, 404)
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			assertRoleHoldsScopes(scope.role, req.body.scopes);
-			const created = await container.auth.createApiKey({
-				authUserId: req.authUser.id,
-				orgId: scope.authOrgId,
-				name: req.body.name,
-				scopes: req.body.scopes
-			});
+			const created = await organizations.createApiKey(req.body, await resolveActor(container, req));
 			return reply.code(201).send(created);
 		}
 	});
@@ -119,8 +138,8 @@ async function accessRoutes(app, container) {
 		schema: {
 			operationId: "deleteApiKey",
 			tags,
-			summary: "Delete an API key",
-			description: "Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.",
+			summary: "Revoke an API key",
+			description: `Requires \`api_keys:delete\`. 404 when the key is not one of yours in this organization.`,
 			params: ApiKeyIdParam,
 			response: {
 				204: z.void(),
@@ -128,8 +147,7 @@ async function accessRoutes(app, container) {
 			}
 		},
 		handler: async (req, reply) => {
-			const scope = await resolveScope(container, req);
-			await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);
+			await organizations.deleteApiKey(req.params.id, await resolveActor(container, req));
 			return reply.code(204).send();
 		}
 	});

package/dist/http/routes/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/routes/access.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport { assertRoleHoldsScopes, scopeOptions } from '@headless-lms/core/organizations';\nimport type { Container } from '../../app/container.js';\nimport {\n  ApiKeyIdParam,\n  ApiKeyList,\n  ClientIdParam,\n  ConnectedAppList,\n  CreateApiKey,\n  CreatedApiKey,\n  refusals,\n  ScopeOptionList,\n} from '../schemas/index.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function accessRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Access'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/scopes',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listAccessScopes',\n      tags,\n      summary: 'Every access scope and whether your role can grant it',\n      description:\n        'Staff only (owner, admin, instructor). Each scope an app connection or API key can carry, marked with whether your role holds it. Only allowed scopes can be granted.',\n      response: { 200: ScopeOptionList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return scopeOptions(scope.role);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/apps',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnectedApps',\n      tags,\n      summary: 'Apps connected to this organization as you',\n      description:\n        'Staff only (owner, admin, instructor). The apps you connected to this organization, each with the scopes you granted and when.',\n      response: { 200: ConnectedAppList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listConnectedApps(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/apps/:clientId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeConnectedApp',\n      tags,\n      summary: 'Disconnect an app',\n      description:\n        'Staff only (owner, admin, instructor). Revokes your consent and refresh tokens for the app in this organization; its next call is refused.',\n      params: ClientIdParam,\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.revokeConnectedApp(req.headers, scope.authOrgId, req.params.clientId);\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeys',\n      tags,\n      summary: 'Your API keys for this organization',\n      description:\n        'Staff only (owner, admin, instructor). Your keys for this organization with their scopes. The key itself is never returned again after it is created.',\n      response: { 200: ApiKeyList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return container.auth.listApiKeys(req.headers, scope.authOrgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createApiKey',\n      tags,\n      summary: 'Create an API key',\n      description:\n        'Staff only (owner, admin, instructor). The key acts as you in this organization with the scopes given. 403 when your role cannot hold one of them. The key is returned once.',\n      body: CreateApiKey,\n      response: { 201: CreatedApiKey, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      assertRoleHoldsScopes(scope.role, req.body.scopes);\n      const created = await container.auth.createApiKey({\n        authUserId: req.authUser.id,\n        orgId: scope.authOrgId,\n        name: req.body.name,\n        scopes: req.body.scopes,\n      });\n      return reply.code(201).send(created);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/api-keys/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteApiKey',\n      tags,\n      summary: 'Delete an API key',\n      description:\n        'Staff only (owner, admin, instructor). 404 when the key is not one of yours in this organization.',\n      params: ApiKeyIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      await container.auth.deleteApiKey(req.headers, scope.authOrgId, req.params.id);\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;;AAiBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,QAAQ;CAEtB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAiB,GAAG,SAAS,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GAEtB,OAAO,cAAa,MADA,aAAa,WAAW,GAAG,EAAA,CACrB,IAAI;EAChC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,kBAAkB,IAAI,SAAS,MAAM,SAAS;EACtE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,mBAAmB,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,QAAQ;GACzF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,UAAU,KAAK,YAAY,IAAI,SAAS,MAAM,SAAS;EAChE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,sBAAsB,MAAM,MAAM,IAAI,KAAK,MAAM;GACjD,MAAM,UAAU,MAAM,UAAU,KAAK,aAAa;IAChD,YAAY,IAAI,SAAS;IACzB,OAAO,MAAM;IACb,MAAM,IAAI,KAAK;IACf,QAAQ,IAAI,KAAK;GACnB,CAAC;GACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,KAAK,aAAa,IAAI,SAAS,MAAM,WAAW,IAAI,OAAO,EAAE;GAC7E,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}
+{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/routes/access.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport { z } from 'zod';\nimport type { Container } from '../../app/container.js';\nimport {\n  ApiKeyIdParam,\n  ApiKeyList,\n  ApiKeyRoleList,\n  ClientIdParam,\n  ConnectedAppList,\n  CreateApiKey,\n  CreatedApiKey,\n  PermissionDefinitionList,\n  ViewerPermissions,\n  refusals,\n} from '../schemas/index.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function accessRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const tags = ['Access'];\n  const organizations = container.organizations;\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/permissions/list',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listPermissions',\n      tags,\n      summary: 'Every permission, with its label, description and level',\n      description: `Any active member of the organization. For role screens, the key-creation screen and the consent screen.`,\n      response: { 200: PermissionDefinitionList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      await resolveActor(container, req);\n      return organizations.permissionList();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/permissions',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getMyPermissions',\n      tags,\n      summary: 'Your effective permissions in this organization',\n      description: `Any active member of the organization. Your org role, whether you own the organization, the permissions you hold on the organization, and the ones you hold on each content item.`,\n      response: { 200: ViewerPermissions, ...refusals(403) },\n    },\n    handler: async (req) => organizations.viewerPermissions(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/apps',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listConnectedApps',\n      tags,\n      summary: 'Apps connected to this organization as you',\n      description: `Any active member of the organization. The apps you connected to this organization, each with the scopes you granted and when.`,\n      response: { 200: ConnectedAppList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listConnectedApps(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/apps/:clientId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'revokeConnectedApp',\n      tags,\n      summary: 'Disconnect an app',\n      description: `Any active member of the organization. Revokes your consent and tokens for the app in this organization; its next call is refused.`,\n      params: ClientIdParam,\n      response: { 204: z.void(), ...refusals(403) },\n    },\n    handler: async (req, reply) => {\n      await organizations.revokeConnectedApp(\n        req.params.clientId,\n        await resolveActor(container, req),\n      );\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeys',\n      tags,\n      summary: 'Your API keys for this organization',\n      description: `Requires \\`api_keys:read\\`. Your keys for this organization with their role and expiry. The key itself is never returned again after it is created.`,\n      response: { 200: ApiKeyList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listApiKeys(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/access/api-keys/roles',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listApiKeyRoles',\n      tags,\n      summary: 'The roles you can put on an API key',\n      description: `Requires \\`api_keys:write\\`. The organization's roles whose every permission you hold somewhere.`,\n      response: { 200: ApiKeyRoleList, ...refusals(403) },\n    },\n    handler: async (req) => organizations.listApiKeyRoles(await resolveActor(container, req)),\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/access/api-keys',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createApiKey',\n      tags,\n      summary: 'Create an API key',\n      description: `Requires \\`api_keys:write\\` and a signed-in person: a request made with an API key or an app token gets 403. The key acts as you in this organization with the permissions of the role given, never beyond what you hold at the time of each request. Send it in the \\`x-api-key\\` header or as \\`Authorization: Bearer <key>\\`; every route under /api and /mcp accepts it. 403 when the role holds a permission you hold nowhere; 404 when the organization has no such role. The key is returned once.`,\n      body: CreateApiKey,\n      response: { 201: CreatedApiKey, ...refusals(400, 403, 404) },\n    },\n    handler: async (req, reply) => {\n      const created = await organizations.createApiKey(\n        req.body,\n        await resolveActor(container, req),\n      );\n      return reply.code(201).send(created);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/access/api-keys/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteApiKey',\n      tags,\n      summary: 'Revoke an API key',\n      description: `Requires \\`api_keys:delete\\`. 404 when the key is not one of yours in this organization.`,\n      params: ApiKeyIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      await organizations.deleteApiKey(req.params.id, await resolveActor(container, req));\n      return reply.code(204).send();\n    },\n  });\n}\n"],"mappings":";;;;;;AAkBA,eAAsB,aAAa,KAAsB,WAAqC;CAC5F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,OAAO,CAAC,QAAQ;CACtB,MAAM,gBAAgB,UAAU;CAEhC,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAA0B,GAAG,SAAS,GAAG;GAAE;EAC9D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,aAAa,WAAW,GAAG;GACjC,OAAO,cAAc,eAAe;EACtC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ,cAAc,kBAAkB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC5F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAkB,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ,cAAc,kBAAkB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC5F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,GAAG;GAAE;EAC9C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,cAAc,mBAClB,IAAI,OAAO,UACX,MAAM,aAAa,WAAW,GAAG,CACnC;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ,cAAc,YAAY,MAAM,aAAa,WAAW,GAAG,CAAC;CACtF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,GAAG;GAAE;EACpD;EACA,SAAS,OAAO,QAAQ,cAAc,gBAAgB,MAAM,aAAa,WAAW,GAAG,CAAC;CAC1F,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC7D;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,UAAU,MAAM,cAAc,aAClC,IAAI,MACJ,MAAM,aAAa,WAAW,GAAG,CACnC;GACA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,cAAc,aAAa,IAAI,OAAO,IAAI,MAAM,aAAa,WAAW,GAAG,CAAC;GAClF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/http/routes/activities.js

@@ -1,5 +1,5 @@
 import { refusals } from "../schemas/shared.js";
-import { resolveScope } from "../scope.js";
+import { resolveActor } from "../scope.js";
 import { ActivityAssetList, ActivityList, ActivityPathParam, CourseIdPathParam, CreateModule, ModuleList, ModulePathParam, ReorderInput, SaveActivity, UpdateModule } from "../schemas/activities.js";
 import "../schemas/index.js";
 //#region src/http/routes/activities.ts
@@ -14,8 +14,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listModules",
 			tags,
-			summary: "List a course's modules (staff)",
-			description: "Staff only (owner, admin, instructor). Modules in order, each with its activities.",
+			summary: "List a course's modules",
+			description: `Requires \`courses:read\`. Modules in order, each with its activities.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ModuleList,
@@ -23,8 +23,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseModules(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseModules(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -34,8 +34,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listActivities",
 			tags,
-			summary: "List a course's activities (staff)",
-			description: "Staff only (owner, admin, instructor). Every activity, published or not.",
+			summary: "List a course's activities",
+			description: `Requires \`courses:read\`. Every activity, published or not.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ActivityList,
@@ -43,8 +43,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseActivityViews(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseActivityViews(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -54,8 +54,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "listActivityAssets",
 			tags,
-			summary: "List the library files each activity of a course uses (staff)",
-			description: "Staff only (owner, admin, instructor). One row per activity and file, as recorded when the activity was saved.",
+			summary: "List the library files each activity of a course uses",
+			description: `Requires \`courses:read\`. One row per activity and file, as recorded when the activity was saved.`,
 			params: CourseIdPathParam,
 			response: {
 				200: ActivityAssetList,
@@ -63,8 +63,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.listCourseActivityAssets(scope.orgId, req.params.courseId);
+			const actor = await resolveActor(container, req);
+			return content.listCourseActivityAssets(req.params.courseId, actor);
 		}
 	});
 	r.route({
@@ -74,8 +74,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createModule",
 			tags,
-			summary: "Add a module (staff)",
-			description: "Staff only (owner, admin, instructor). Added last. Returns the course's modules.",
+			summary: "Add a module",
+			description: `Requires \`courses:write\`. Added last. Returns the course's modules.`,
 			params: CourseIdPathParam,
 			body: CreateModule,
 			response: {
@@ -84,8 +84,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.createModule(scope.orgId, req.params.courseId, req.body.title);
+			const actor = await resolveActor(container, req);
+			return content.createModule(req.params.courseId, req.body.title, actor);
 		}
 	});
 	r.route({
@@ -95,8 +95,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderModules",
 			tags,
-			summary: "Reorder a course's modules (staff)",
-			description: "Staff only (owner, admin, instructor). Ids that are not modules of the course are ignored. Returns the course's modules.",
+			summary: "Reorder a course's modules",
+			description: `Requires \`courses:write\`. Ids that are not modules of the course are ignored. Returns the course's modules.`,
 			params: CourseIdPathParam,
 			body: ReorderInput,
 			response: {
@@ -105,8 +105,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.reorderModules(scope.orgId, req.params.courseId, req.body.orderedIds);
+			const actor = await resolveActor(container, req);
+			return content.reorderModules(req.params.courseId, req.body.orderedIds, actor);
 		}
 	});
 	r.route({
@@ -116,8 +116,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateModule",
 			tags,
-			summary: "Rename a module (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Rename a module",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ModulePathParam,
 			body: UpdateModule,
 			response: {
@@ -126,8 +126,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.updateModule(scope.orgId, req.params.courseId, req.params.moduleId, req.body.title);
+			const actor = await resolveActor(container, req);
+			return content.updateModule(req.params.courseId, req.params.moduleId, req.body.title, actor);
 		}
 	});
 	r.route({
@@ -137,8 +137,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteModule",
 			tags,
-			summary: "Delete a module (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Delete a module",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ModulePathParam,
 			response: {
 				200: ModuleList,
@@ -146,8 +146,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.deleteModule(scope.orgId, req.params.courseId, req.params.moduleId);
+			const actor = await resolveActor(container, req);
+			return content.deleteModule(req.params.courseId, req.params.moduleId, actor);
 		}
 	});
 	r.route({
@@ -157,8 +157,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "reorderActivities",
 			tags,
-			summary: "Reorder the activities in a module (staff)",
-			description: "Staff only (owner, admin, instructor). Send every activity id of the module once (409 otherwise). Returns the course's modules.",
+			summary: "Reorder the activities in a module",
+			description: `Requires \`courses:write\`. Send every activity id of the module once (409 otherwise). Returns the course's modules.`,
 			params: ModulePathParam,
 			body: ReorderInput,
 			response: {
@@ -167,8 +167,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.reorderActivities(scope.orgId, req.params.courseId, req.params.moduleId, req.body.orderedIds);
+			const actor = await resolveActor(container, req);
+			return content.reorderActivities(req.params.courseId, req.params.moduleId, req.body.orderedIds, actor);
 		}
 	});
 	r.route({
@@ -178,8 +178,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "createActivity",
 			tags,
-			summary: "Add an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Records the library files the activity uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
+			summary: "Add an activity",
+			description: `Requires \`courses:write\`. Records the library files the activity uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \`media:read\` (403 otherwise). Returns the course's modules.`,
 			params: ModulePathParam,
 			body: SaveActivity,
 			response: {
@@ -188,8 +188,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body);
+			const actor = await resolveActor(container, req);
+			return content.saveActivity(req.params.courseId, req.params.moduleId, req.body, null, actor);
 		}
 	});
 	r.route({
@@ -199,8 +199,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "updateActivity",
 			tags,
-			summary: "Update an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). Returns the course's modules.",
+			summary: "Update an activity",
+			description: `Requires \`courses:write\`. Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \`media:read\` (403 otherwise). Returns the course's modules.`,
 			params: ActivityPathParam,
 			body: SaveActivity,
 			response: {
@@ -209,8 +209,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body, req.params.activityId);
+			const actor = await resolveActor(container, req);
+			return content.saveActivity(req.params.courseId, req.params.moduleId, req.body, req.params.activityId, actor);
 		}
 	});
 	r.route({
@@ -220,8 +220,8 @@ async function activitiesRoutes(app, container) {
 		schema: {
 			operationId: "deleteActivity",
 			tags,
-			summary: "Delete an activity (staff)",
-			description: "Staff only (owner, admin, instructor). Returns the course's modules.",
+			summary: "Delete an activity",
+			description: `Requires \`courses:write\`. Returns the course's modules.`,
 			params: ActivityPathParam,
 			response: {
 				200: ModuleList,
@@ -229,8 +229,8 @@ async function activitiesRoutes(app, container) {
 			}
 		},
 		handler: async (req) => {
-			const scope = await resolveScope(container, req);
-			return content.deleteActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.params.activityId);
+			const actor = await resolveActor(container, req);
+			return content.deleteActivity(req.params.courseId, req.params.moduleId, req.params.activityId, actor);
 		}
 	});
 }

package/dist/http/routes/activities.js.map

@@ -1 +1 @@
-{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/routes/activities.ts"],"sourcesContent":["// HTTP routes for course modules + activities. Write operations return the\n// course's full, reordered module list (how the editor re-renders). Nested under\n// courses. All require a session with an active organization; handlers resolve\n// the session's active org to the domain org id and scope every call by it.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityAssetList,\n  ActivityList,\n  ActivityPathParam,\n  CourseIdPathParam,\n  CreateModule,\n  ModuleList,\n  ModulePathParam,\n  ReorderInput,\n  SaveActivity,\n  UpdateModule,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nexport async function activitiesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  // Modules/activities are part of the content aggregate; grouped under the Courses tag.\n  const content = container.content;\n  const tags = ['Content'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listModules',\n      tags,\n      summary: \"List a course's modules (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Modules in order, each with its activities.',\n      params: CourseIdPathParam,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseModules(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivities',\n      tags,\n      summary: \"List a course's activities (staff)\",\n      description: 'Staff only (owner, admin, instructor). Every activity, published or not.',\n      params: CourseIdPathParam,\n      response: { 200: ActivityList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseActivityViews(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activity-assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivityAssets',\n      tags,\n      summary: 'List the library files each activity of a course uses (staff)',\n      description:\n        'Staff only (owner, admin, instructor). One row per activity and file, as recorded when the activity was saved.',\n      params: CourseIdPathParam,\n      response: { 200: ActivityAssetList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.listCourseActivityAssets(scope.orgId, req.params.courseId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createModule',\n      tags,\n      summary: 'Add a module (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Added last. Returns the course's modules.\",\n      params: CourseIdPathParam,\n      body: CreateModule,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.createModule(scope.orgId, req.params.courseId, req.body.title);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderModules',\n      tags,\n      summary: \"Reorder a course's modules (staff)\",\n      description:\n        \"Staff only (owner, admin, instructor). Ids that are not modules of the course are ignored. Returns the course's modules.\",\n      params: CourseIdPathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderModules(scope.orgId, req.params.courseId, req.body.orderedIds);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateModule',\n      tags,\n      summary: 'Rename a module (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: UpdateModule,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.updateModule(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.title,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteModule',\n      tags,\n      summary: 'Delete a module (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ModulePathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteModule(scope.orgId, req.params.courseId, req.params.moduleId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderActivities',\n      tags,\n      summary: 'Reorder the activities in a module (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Send every activity id of the module once (409 otherwise). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.reorderActivities(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.orderedIds,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createActivity',\n      tags,\n      summary: 'Add an activity (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Records the library files the activity uses; each must be a ready library file (409 otherwise). Returns the course's modules.\",\n      params: ModulePathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(scope.orgId, req.params.courseId, req.params.moduleId, req.body);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateActivity',\n      tags,\n      summary: 'Update an activity (staff)',\n      description:\n        \"Staff only (owner, admin, instructor). Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). Returns the course's modules.\",\n      params: ActivityPathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.saveActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.body,\n        req.params.activityId,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteActivity',\n      tags,\n      summary: 'Delete an activity (staff)',\n      description: \"Staff only (owner, admin, instructor). Returns the course's modules.\",\n      params: ActivityPathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return content.deleteActivity(\n        scope.orgId,\n        req.params.courseId,\n        req.params.moduleId,\n        req.params.activityId,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;AAsBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAEhD,MAAM,UAAU,UAAU;CAC1B,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBAAkB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,wBAAwB,MAAM,OAAO,IAAI,OAAO,QAAQ;EACzE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,yBAAyB,MAAM,OAAO,IAAI,OAAO,QAAQ;EAC1E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,KAAK;EAC9E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,KAAK,UAAU;EACrF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,KACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,QAAQ;EACnF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,UACX;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,MAAM,OAAO,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,IAAI,IAAI;EAC7F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,MACJ,IAAI,OAAO,UACb;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eACb,MAAM,OACN,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,OAAO,UACb;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/routes/activities.ts"],"sourcesContent":["// HTTP routes for course modules + activities. Write operations return the\n// course's full, reordered module list (how the editor re-renders). Nested under\n// courses. All require a session with an active organization.\nimport type { FastifyInstance } from 'fastify';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  ActivityAssetList,\n  ActivityList,\n  ActivityPathParam,\n  CourseIdPathParam,\n  CreateModule,\n  ModuleList,\n  ModulePathParam,\n  ReorderInput,\n  SaveActivity,\n  UpdateModule,\n  refusals,\n} from '../schemas/index.js';\nimport type { Container } from '../../app/container.js';\nimport { resolveActor } from '../scope.js';\n\nexport async function activitiesRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  // Modules/activities are part of the content aggregate; grouped under the Courses tag.\n  const content = container.content;\n  const tags = ['Content'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listModules',\n      tags,\n      summary: \"List a course's modules\",\n      description: `Requires \\`courses:read\\`. Modules in order, each with its activities.`,\n      params: CourseIdPathParam,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listCourseModules(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivities',\n      tags,\n      summary: \"List a course's activities\",\n      description: `Requires \\`courses:read\\`. Every activity, published or not.`,\n      params: CourseIdPathParam,\n      response: { 200: ActivityList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listCourseActivityViews(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/courses/:courseId/activity-assets',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listActivityAssets',\n      tags,\n      summary: 'List the library files each activity of a course uses',\n      description: `Requires \\`courses:read\\`. One row per activity and file, as recorded when the activity was saved.`,\n      params: CourseIdPathParam,\n      response: { 200: ActivityAssetList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.listCourseActivityAssets(req.params.courseId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createModule',\n      tags,\n      summary: 'Add a module',\n      description: `Requires \\`courses:write\\`. Added last. Returns the course's modules.`,\n      params: CourseIdPathParam,\n      body: CreateModule,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.createModule(req.params.courseId, req.body.title, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderModules',\n      tags,\n      summary: \"Reorder a course's modules\",\n      description: `Requires \\`courses:write\\`. Ids that are not modules of the course are ignored. Returns the course's modules.`,\n      params: CourseIdPathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderModules(req.params.courseId, req.body.orderedIds, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateModule',\n      tags,\n      summary: 'Rename a module',\n      description: `Requires \\`courses:write\\`. Returns the course's modules.`,\n      params: ModulePathParam,\n      body: UpdateModule,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.updateModule(req.params.courseId, req.params.moduleId, req.body.title, actor);\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteModule',\n      tags,\n      summary: 'Delete a module',\n      description: `Requires \\`courses:write\\`. Returns the course's modules.`,\n      params: ModulePathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.deleteModule(req.params.courseId, req.params.moduleId, actor);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/reorder',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'reorderActivities',\n      tags,\n      summary: 'Reorder the activities in a module',\n      description: `Requires \\`courses:write\\`. Send every activity id of the module once (409 otherwise). Returns the course's modules.`,\n      params: ModulePathParam,\n      body: ReorderInput,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.reorderActivities(\n        req.params.courseId,\n        req.params.moduleId,\n        req.body.orderedIds,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/courses/:courseId/modules/:moduleId/activities',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createActivity',\n      tags,\n      summary: 'Add an activity',\n      description: `Requires \\`courses:write\\`. Records the library files the activity uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \\`media:read\\` (403 otherwise). Returns the course's modules.`,\n      params: ModulePathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.saveActivity(req.params.courseId, req.params.moduleId, req.body, null, actor);\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateActivity',\n      tags,\n      summary: 'Update an activity',\n      description: `Requires \\`courses:write\\`. Replaces its content and records the library files it uses; each must be a ready library file (409 otherwise). A file the course does not already use must be uploaded for the course, or the caller needs \\`media:read\\` (403 otherwise). Returns the course's modules.`,\n      params: ActivityPathParam,\n      body: SaveActivity,\n      response: { 200: ModuleList, ...refusals(403, 404, 409) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.saveActivity(\n        req.params.courseId,\n        req.params.moduleId,\n        req.body,\n        req.params.activityId,\n        actor,\n      );\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/courses/:courseId/modules/:moduleId/activities/:activityId',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteActivity',\n      tags,\n      summary: 'Delete an activity',\n      description: `Requires \\`courses:write\\`. Returns the course's modules.`,\n      params: ActivityPathParam,\n      response: { 200: ModuleList, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const actor = await resolveActor(container, req);\n      return content.deleteActivity(\n        req.params.courseId,\n        req.params.moduleId,\n        req.params.activityId,\n        actor,\n      );\n    },\n  });\n}\n"],"mappings":";;;;;AAqBA,eAAsB,iBAAiB,KAAsB,WAAqC;CAChG,MAAM,IAAI,IAAI,iBAAkC;CAEhD,MAAM,UAAU,UAAU;CAC1B,MAAM,OAAO,CAAC,SAAS;CAEvB,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBAAkB,IAAI,OAAO,UAAU,KAAK;EAC7D;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAc,GAAG,SAAS,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,wBAAwB,IAAI,OAAO,UAAU,KAAK;EACnE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAmB,GAAG,SAAS,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,yBAAyB,IAAI,OAAO,UAAU,KAAK;EACpE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK;EACxE;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,GAAG;GAAE;EAChD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eAAe,IAAI,OAAO,UAAU,IAAI,KAAK,YAAY,KAAK;EAC/E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK;EAC7F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK;EAC7E;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,kBACb,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,KAAK,YACT,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aAAa,IAAI,OAAO,UAAU,IAAI,OAAO,UAAU,IAAI,MAAM,MAAM,KAAK;EAC7F;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EAC1D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,aACb,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,MACJ,IAAI,OAAO,YACX,KACF;EACF;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAY,GAAG,SAAS,KAAK,GAAG;GAAE;EACrD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,QAAQ,eACb,IAAI,OAAO,UACX,IAAI,OAAO,UACX,IAAI,OAAO,YACX,KACF;EACF;CACF,CAAC;AACH"}