@kywi-software/core 0.5.0 → 0.6.0

package/dist/api/site-context.js

@@ -1,5 +1,6 @@
 import { resolveSiteFromRequest } from '../multisite/resolve.js';
 import { resolveSiteId as resolveSiteIdFromDb } from '../db/site-queries.js';
+import { forbidden } from './response.js';
 /**
  * Resolve the active siteId from a request.
  * Priority: explicit ?siteId param (if valid) > domain match > first configured site.
@@ -57,4 +58,44 @@ export async function toSiteUuid(db, idOrSlug, fallbackOrConfig) {
         return raw;
     return (await resolveSiteIdFromDb(db, raw)) ?? raw;
 }
+/**
+ * Per-site API authorization (#73).
+ *
+ * API roles are global — a `siteAdmin` is siteAdmin everywhere — so without a
+ * per-site check a siteAdmin of Site B could operate on Site A simply by
+ * addressing it (`?siteId=…`). This gates an already-authenticated,
+ * site-scoped operation to the sites the user actually belongs to.
+ *
+ * Back-compat is deliberate (see {@link UserContext.siteMemberships}):
+ *   - `superAdmin` always passes.
+ *   - `undefined` memberships (old token, or an unresolved path) → pass. Old
+ *     tokens must never be denied; they get a DB fallback in `resolveAuth`.
+ *   - `[]` (zero membership rows) → pass. Existing single-site installs never
+ *     seeded memberships, so a zero-row user is unrestricted.
+ *   - a non-empty list → the user is confined to exactly those site UUIDs.
+ *
+ * `siteId` MUST be a resolved DB UUID (post `toSiteUuid`/`resolveSiteId`), since
+ * that is the form stored in `kywi_site_memberships` and embedded in the claim.
+ */
+export function hasSiteAccess(user, siteId) {
+    if (user.role === 'superAdmin')
+        return true;
+    const memberships = user.siteMemberships;
+    if (memberships === undefined || memberships.length === 0)
+        return true;
+    return memberships.includes(siteId);
+}
+/**
+ * Guard form of {@link hasSiteAccess} for route handlers: returns a ready-to-
+ * return 403 `Response` when the user may not act on `siteId`, or `null` when
+ * access is allowed. Route usage:
+ *
+ *   const denied = assertSiteAccess(auth.user, siteId)
+ *   if (denied) return denied
+ */
+export function assertSiteAccess(user, siteId) {
+    return hasSiteAccess(user, siteId)
+        ? null
+        : forbidden('You do not have access to this site');
+}
 //# sourceMappingURL=site-context.js.map

package/dist/api/site-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-context.js","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAI5E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,MAAkB,EAAE,SAAkC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAEtE,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAA;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAExC,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,QAAmC,EACnC,gBAAqC;IAErC,MAAM,QAAQ,GACZ,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,OAAO,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACpD,CAAC"}
+{"version":3,"file":"site-context.js","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAIzC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,MAAkB,EAAE,SAAkC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAEtE,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAA;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAExC,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,QAAmC,EACnC,gBAAqC;IAErC,MAAM,QAAQ,GACZ,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,OAAO,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,MAAc;IAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAA;IACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,MAAc;IAChE,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;QAChC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAA;AACtD,CAAC"}

package/dist/api/tag-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tag-routes.d.ts","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAoBpD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAeD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CA0H5E"}
+{"version":3,"file":"tag-routes.d.ts","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAoBpD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAeD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CAgI5E"}

package/dist/api/tag-routes.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { resolveAuth } from './auth.js';
-import { toSiteUuid } from './site-context.js';
+import { toSiteUuid, assertSiteAccess } from './site-context.js';
 import { hasMinRole, canAccessContent } from '../auth/roles.js';
 import { listTags, getTagById, createTag, updateTag, deleteTag, } from '../db/tag-queries.js';
 import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError, } from './response.js';
@@ -61,6 +61,9 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, parsed.data.siteId, config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const createData = {
             siteId,
             slug: parsed.data.slug,
@@ -93,6 +96,9 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const updateData = {};
         if (parsed.data.slug !== undefined)
             updateData.slug = parsed.data.slug;
@@ -116,6 +122,9 @@ export function registerTagRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const deleted = await deleteTag(db, params.id, siteId);
         if (!deleted)
             return notFound('Tag not found');

package/dist/api/tag-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"tag-routes.js","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,QAAQ,EACR,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAA;AAQtB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAoB;IACpE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAExE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,EAAE,EACF,MAAM,EACN,SAAS,EACT,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAA;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,UAAU,GAKZ;YACF,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,UAAU,GAAuE,EAAE,CAAA;QACzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"tag-routes.js","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,QAAQ,EACR,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAA;AAQtB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAoB;IACpE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAExE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,EAAE,EACF,MAAM,EACN,SAAS,EACT,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAA;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAKZ;YACF,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,UAAU,GAAuE,EAAE,CAAA;QACzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/translation-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"translation-routes.d.ts","sourceRoot":"","sources":["../../src/api/translation-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAc,MAAM,oBAAoB,CAAA;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAYvD;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACvD,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;CAC9D;AAqBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,GAAG,IAAI,CAiH5F"}
+{"version":3,"file":"translation-routes.d.ts","sourceRoot":"","sources":["../../src/api/translation-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAc,MAAM,oBAAoB,CAAA;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAYvD;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACvD,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;CAC9D;AAqBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,GAAG,IAAI,CA2H5F"}

package/dist/api/translation-routes.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { resolveAuth } from './auth.js';
 import { hasMinRole } from '../auth/roles.js';
-import { resolveSiteId } from './site-context.js';
+import { resolveSiteId, assertSiteAccess } from './site-context.js';
 import { jsonOk, jsonError, notFound, unauthorized } from './response.js';
 import { getTranslationCoverage, getLocaleVariants, buildTranslationData, } from '../db/locale-queries.js';
 import { getContentById, createContent } from '../db/content-queries.js';
@@ -36,7 +36,10 @@ export function registerTranslationRoutes(router, ctx) {
         const user = await requireEditor(req, authSecret, db);
         if (!user)
             return unauthorized();
-        const { site } = resolveSite(req);
+        const { site, siteUuid } = resolveSite(req);
+        const siteDenied = assertSiteAccess(user, siteUuid);
+        if (siteDenied)
+            return siteDenied;
         return jsonOk({
             defaultLocale: site.defaultLocale,
             locales: configuredLocales(site),
@@ -50,6 +53,9 @@ export function registerTranslationRoutes(router, ctx) {
         if (!user)
             return unauthorized();
         const { site, siteUuid } = resolveSite(req);
+        const siteDenied = assertSiteAccess(user, siteUuid);
+        if (siteDenied)
+            return siteDenied;
         const locales = configuredLocales(site);
         const coverage = await getTranslationCoverage(db, siteUuid, site.defaultLocale, locales);
         return jsonOk({ defaultLocale: site.defaultLocale, locales: coverage });
@@ -59,7 +65,10 @@ export function registerTranslationRoutes(router, ctx) {
         const user = await requireEditor(req, authSecret, db);
         if (!user)
             return unauthorized();
-        const { site } = resolveSite(req);
+        const { site, siteUuid } = resolveSite(req);
+        const siteDenied = assertSiteAccess(user, siteUuid);
+        if (siteDenied)
+            return siteDenied;
         const bundles = {};
         if (ctx.resourceBundles) {
             for (const [locale, entries] of ctx.resourceBundles) {
@@ -81,7 +90,10 @@ export function registerTranslationRoutes(router, ctx) {
         const user = await requireEditor(req, authSecret, db);
         if (!user)
             return unauthorized();
-        const { site } = resolveSite(req);
+        const { site, siteUuid } = resolveSite(req);
+        const siteDenied = assertSiteAccess(user, siteUuid);
+        if (siteDenied)
+            return siteDenied;
         const variants = await getLocaleVariants(db, params.id);
         const present = new Set(variants.map((v) => v.locale));
         const missingLocales = configuredLocales(site).filter((l) => !present.has(l));
@@ -105,6 +117,9 @@ export function registerTranslationRoutes(router, ctx) {
         }
         const { sourceId, locale } = parsed.data;
         const { site, siteUuid } = resolveSite(req);
+        const siteDenied = assertSiteAccess(user, siteUuid);
+        if (siteDenied)
+            return siteDenied;
         if (!configuredLocales(site).includes(locale)) {
             return jsonError('VALIDATION_ERROR', `Locale '${locale}' is not configured for this site`, 400);
         }

package/dist/api/translation-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"translation-routes.js","sourceRoot":"","sources":["../../src/api/translation-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACzE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAqBxE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAA;AAEF,uDAAuD;AACvD,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,UAAkB,EAAE,EAAU;IACvE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,IAAI,CAAC,IAAI,CAAA;AAClB,CAAC;AAED,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,GAA4B;IACpF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAEjD,gFAAgF;IAChF,SAAS,WAAW,CAAC,GAAY;QAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACtD,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QACjC,OAAO,MAAM,CAAC;YACZ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAChC,qDAAqD;YACrD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACxF,OAAO,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,OAAO,GAA2C,EAAE,CAAA;QAC1D,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;gBACpD,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;YACZ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAChC,OAAO;YACP,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAEnG,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAExC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,kBAAkB,EAAE,WAAW,MAAM,mCAAmC,EAAE,GAAG,CAAC,CAAA;QACjG,CAAC;QAED,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAA;QAEtD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAyB,CAAA;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAChE,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,yBAAyB,eAAe,GAAG,EAAE,GAAG,CAAC,CAAA;QACnG,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAA;QAExE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAA;QAExD,wDAAwD;QACxD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,UAAU,EAAE,MAAM,MAAM,+CAA+C,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAiC,EAAE,MAAM,CAAC,CAAA;QAC5E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAE1F,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"translation-routes.js","sourceRoot":"","sources":["../../src/api/translation-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACzE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAqBxE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAA;AAEF,uDAAuD;AACvD,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,UAAkB,EAAE,EAAU;IACvE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,IAAI,CAAC,IAAI,CAAA;AAClB,CAAC;AAED,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,GAA4B;IACpF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAEjD,gFAAgF;IAChF,SAAS,WAAW,CAAC,GAAY;QAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACtD,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAA;QACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,OAAO,MAAM,CAAC;YACZ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAChC,qDAAqD;YACrD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACxF,OAAO,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,OAAO,GAA2C,EAAE,CAAA;QAC1D,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;gBACpD,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;YACZ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAChC,OAAO;YACP,yEAAyE;YACzE,wEAAwE;YACxE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,OAAO,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAEnG,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAExC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,kBAAkB,EAAE,WAAW,MAAM,mCAAmC,EAAE,GAAG,CAAC,CAAA;QACjG,CAAC;QAED,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAA;QAEtD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAyB,CAAA;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAChE,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,yBAAyB,eAAe,GAAG,EAAE,GAAG,CAAC,CAAA;QACnG,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAA;QAExE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAA;QAExD,wDAAwD;QACxD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,UAAU,EAAE,MAAM,MAAM,+CAA+C,EAAE,GAAG,CAAC,CAAA;QAChG,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAiC,EAAE,MAAM,CAAC,CAAA;QAC5E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAE1F,OAAO,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/user-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-routes.d.ts","sourceRoot":"","sources":["../../src/api/user-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,oBAAoB,CAAA;AAoBjE,UAAU,gBAAgB;IACxB,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAwBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAkM9E"}
+{"version":3,"file":"user-routes.d.ts","sourceRoot":"","sources":["../../src/api/user-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,oBAAoB,CAAA;AAqBjE,UAAU,gBAAgB;IACxB,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAwBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CA0M9E"}

package/dist/api/user-routes.js

@@ -5,6 +5,7 @@ import { resolveAuth } from './auth.js';
 import { hasMinRole } from '../auth/roles.js';
 import { resolveSiteId } from '../db/site-queries.js';
 import { getUserSiteMemberships, addUserToSite, removeUserFromSite, } from '../db/site-membership-queries.js';
+import { assertSiteAccess } from './site-context.js';
 function stripPasswordHash(user) {
     const { passwordHash, ...rest } = user;
     return rest;
@@ -52,6 +53,9 @@ export function registerUserRoutes(router, ctx) {
         // site-membership rows store the site's DB UUID. Resolve so seeded users
         // (who are joined to a site by membership) are actually returned.
         const siteId = (await resolveSiteId(db, requestedSiteId)) ?? requestedSiteId;
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const users = await listUsers(db, siteId);
         return jsonOk(users.map(u => stripPasswordHash(u)));
     });
@@ -92,6 +96,9 @@ export function registerUserRoutes(router, ctx) {
         // Resolve slug → UUID so the created membership matches how memberships are
         // stored (and so the new user shows up in the site-scoped GET /users list).
         const resolvedSiteId = (await resolveSiteId(db, requestedSiteId)) ?? requestedSiteId;
+        const siteDenied = assertSiteAccess(auth.user, resolvedSiteId);
+        if (siteDenied)
+            return siteDenied;
         const user = await createUser(db, {
             email,
             password,
@@ -184,6 +191,9 @@ export function registerUserRoutes(router, ctx) {
         if (!user)
             return notFound('User not found');
         const resolvedSiteId = (await resolveSiteId(db, params.siteId)) ?? params.siteId;
+        const siteDenied = assertSiteAccess(auth.user, resolvedSiteId);
+        if (siteDenied)
+            return siteDenied;
         await addUserToSite(db, params.id, resolvedSiteId);
         return jsonOk({ added: true });
     });
@@ -195,6 +205,9 @@ export function registerUserRoutes(router, ctx) {
         if (!hasMinRole(auth.user.role, 'siteAdmin'))
             return forbidden();
         const resolvedSiteId = (await resolveSiteId(db, params.siteId)) ?? params.siteId;
+        const siteDenied = assertSiteAccess(auth.user, resolvedSiteId);
+        if (siteDenied)
+            return siteDenied;
         await removeUserFromSite(db, params.id, resolvedSiteId);
         return jsonOk({ removed: true });
     });

package/dist/api/user-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-routes.js","sourceRoot":"","sources":["../../src/api/user-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EACL,WAAW,EAGX,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAQzC,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,GAAqB;IACtE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,gBAAgB;IAChB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,kCAAkC;IAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe,CAAA;QAC5E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAEzC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAuC,CAAC,CAAC,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,8CAA8C;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1E,MAAM,eAAe,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QACrD,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe,CAAA;QAEpF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;YAChC,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,IAAI,EAAE,IAAI,IAAI,QAAQ;YACtB,MAAM,EAAE,cAAc;SACvB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAA;QACvB,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC,wCAAwC,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzB,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE/C,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAA6C,CAAC,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,mDAAmD;QACnD,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC,oCAAoC,CAAC,CAAA;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE/C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,IAAI,MAAM,CAAC,MAAO,CAAA;QAClF,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,cAAc,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,IAAI,MAAM,CAAC,MAAO,CAAA;QAClF,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,cAAc,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"user-routes.js","sourceRoot":"","sources":["../../src/api/user-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EACL,WAAW,EAGX,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAQpD,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,GAAqB;IACtE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,gBAAgB;IAChB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,kCAAkC;IAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe,CAAA;QAC5E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAEzC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAuC,CAAC,CAAC,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,8CAA8C;IAC9C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1E,MAAM,eAAe,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QACrD,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe,CAAA;QACpF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;YAChC,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,IAAI,EAAE,IAAI,IAAI,QAAQ;YACtB,MAAM,EAAE,cAAc;SACvB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAA0C,CAAC,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAA;QACvB,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC,wCAAwC,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzB,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE/C,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAA6C,CAAC,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,mDAAmD;QACnD,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC,oCAAoC,CAAC,CAAA;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE/C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,EAAE,CAAA;QAE3C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,sEAAsE;IACtE,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAE5C,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,IAAI,MAAM,CAAC,MAAO,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,cAAc,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,cAAc,GAAG,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAC,IAAI,MAAM,CAAC,MAAO,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,cAAc,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/version-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-routes.d.ts","sourceRoot":"","sources":["../../src/api/version-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAU7D,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA8FpF"}
+{"version":3,"file":"version-routes.d.ts","sourceRoot":"","sources":["../../src/api/version-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAU7D,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA+FpF"}

package/dist/api/version-routes.js

@@ -66,6 +66,7 @@ export function registerVersionRoutes(router, ctx) {
             userId: auth.user.id,
             userEmail,
             customTable,
+            customFieldNames: contentType.fields.map(f => f.name),
         });
         if (!result.success) {
             return notFound(result.error);

package/dist/api/version-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-routes.js","sourceRoot":"","sources":["../../src/api/version-routes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAA;AACjF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAW7C,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAwB;IAC5E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9D,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAExC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,aAAa,EAAE,mDAAmD,EAAE,GAAG,CAAC,CAAA;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAExB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC,aAAa,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,EAAG;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAE1E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAE7D,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAE5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC5H,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAA;QAEtC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAChE,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE;YAC7C,SAAS,EAAE,MAAM,CAAC,EAAG;YACrB,SAAS,EAAE,MAAM,CAAC,SAAU;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS;YACT,WAAW;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAM,CAAC,CAAA;QAChC,CAAC;QACD,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAA8C,CAAA;QACtE,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAC3B,QAAQ,EAAE,MAA4B,EACrC,QAAQ,EAAE,EAAyB,IAAI,MAAM,CAAC,EAAG,EAClD,QAAQ,EAAE,IAA0B,CACrC,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,qEAAqE;QACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAC7E,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAClD,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"version-routes.js","sourceRoot":"","sources":["../../src/api/version-routes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAA;AACjF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAW7C,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAwB;IAC5E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,GAAG,CAAA;IAE9D,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAExC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,aAAa,EAAE,mDAAmD,EAAE,GAAG,CAAC,CAAA;QAC3F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAExB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC,aAAa,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,EAAG;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAE1E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAE7D,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAE5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC5H,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAA;QAEtC,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAChE,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE;YAC7C,SAAS,EAAE,MAAM,CAAC,EAAG;YACrB,SAAS,EAAE,MAAM,CAAC,SAAU;YAC5B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACpB,SAAS;YACT,WAAW;YACX,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtD,CAAC,CAAA;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAM,CAAC,CAAA;QAChC,CAAC;QACD,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAA8C,CAAA;QACtE,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAC3B,QAAQ,EAAE,MAA4B,EACrC,QAAQ,EAAE,EAAyB,IAAI,MAAM,CAAC,EAAG,EAClD,QAAQ,EAAE,IAA0B,CACrC,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,MAAM,CAAC,MAAM,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,qEAAqE;QACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAC7E,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QAClD,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/webhook-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-routes.d.ts","sourceRoot":"","sources":["../../src/api/webhook-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAapD,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AA4BD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAsGpF"}
+{"version":3,"file":"webhook-routes.d.ts","sourceRoot":"","sources":["../../src/api/webhook-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAcpD,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AA4BD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA8HpF"}

package/dist/api/webhook-routes.js

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import { resolveAuth } from './auth.js';
-import { toSiteUuid } from './site-context.js';
+import { toSiteUuid, assertSiteAccess } from './site-context.js';
 import { hasMinRole } from '../auth/roles.js';
 import { jsonOk, jsonError, unauthorized, forbidden, notFound, validationError } from './response.js';
-import { createEndpoint, updateEndpoint, deleteEndpoint, listEndpoints, listDeliveries, } from '../db/webhook-queries.js';
+import { createEndpoint, updateEndpoint, deleteEndpoint, listEndpoints, listDeliveries, getEndpointById, } from '../db/webhook-queries.js';
 /**
  * Strip the signing `secret` from an endpoint before it leaves a read/list/
  * update response. #57: unlike an OAuth client secret (verify-only, so it can be
@@ -38,6 +38,9 @@ export function registerWebhookRoutes(router, ctx) {
             return forbidden();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const endpoints = await listEndpoints(db, siteId);
         // #57: never disclose signing secrets on list/read.
         return jsonOk(endpoints.map(redactSecret));
@@ -61,6 +64,9 @@ export function registerWebhookRoutes(router, ctx) {
             return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
         }
         const siteId = await toSiteUuid(db, null, config);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const endpoint = await createEndpoint(db, {
             siteId,
             url: parsed.data.url,
@@ -90,6 +96,15 @@ export function registerWebhookRoutes(router, ctx) {
         if (!parsed.success) {
             return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
         }
+        // #73: id-keyed mutation — authorize against the endpoint's own site before
+        // updating (updateEndpoint is keyed by id alone, so a foreign siteAdmin could
+        // otherwise edit another site's endpoint).
+        const existing = await getEndpointById(db, params.id);
+        if (!existing)
+            return notFound('Webhook endpoint not found');
+        const siteDenied = assertSiteAccess(auth.user, existing.siteId);
+        if (siteDenied)
+            return siteDenied;
         const updated = await updateEndpoint(db, params.id, parsed.data);
         if (!updated)
             return notFound('Webhook endpoint not found');
@@ -103,6 +118,13 @@ export function registerWebhookRoutes(router, ctx) {
             return unauthorized();
         if (!hasMinRole(auth.user.role, 'siteAdmin'))
             return forbidden();
+        // #73: id-keyed mutation — authorize against the endpoint's own site first.
+        const existing = await getEndpointById(db, params.id);
+        if (!existing)
+            return notFound('Webhook endpoint not found');
+        const siteDenied = assertSiteAccess(auth.user, existing.siteId);
+        if (siteDenied)
+            return siteDenied;
         const deleted = await deleteEndpoint(db, params.id);
         if (!deleted)
             return notFound('Webhook endpoint not found');
@@ -115,6 +137,13 @@ export function registerWebhookRoutes(router, ctx) {
             return unauthorized();
         if (!hasMinRole(auth.user.role, 'siteAdmin'))
             return forbidden();
+        // #73: id-keyed read of a delivery log — authorize against the endpoint's site.
+        const existing = await getEndpointById(db, params.id);
+        if (!existing)
+            return notFound('Webhook endpoint not found');
+        const siteDenied = assertSiteAccess(auth.user, existing.siteId);
+        if (siteDenied)
+            return siteDenied;
         const url = new URL(req.url);
         const limit = parseInt(url.searchParams.get('limit') ?? '50', 10);
         const deliveries = await listDeliveries(db, params.id, limit);

package/dist/api/webhook-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-routes.js","sourceRoot":"","sources":["../../src/api/webhook-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,0BAA0B,CAAA;AAQjC;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAuC,QAAW;IACrE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAA;IACpC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAwB;IAC5E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAE3E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACjD,oDAAoD;QACpD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE;YACxC,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACxB,CAAC,CAAA;QAEF,6EAA6E;QAC7E,qEAAqE;QACrE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,sCAAsC;IACtC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAE3D,+DAA+D;QAC/D,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAE3D,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QAEjE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"webhook-routes.js","sourceRoot":"","sources":["../../src/api/webhook-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAA;AAQjC;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAuC,QAAW;IACrE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAA;IACpC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAwB;IAC5E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACjD,oDAAoD;QACpD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE;YACxC,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;YACpB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACxB,CAAC,CAAA;QAEF,6EAA6E;QAC7E,qEAAqE;QACrE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,sCAAsC;IACtC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,4EAA4E;QAC5E,8EAA8E;QAC9E,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAE3D,+DAA+D;QAC/D,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAE3D,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,gFAAgF;QAChF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QAEjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QAEjE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/workflow-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-routes.d.ts","sourceRoot":"","sources":["../../src/api/workflow-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AA4B7D,UAAU,oBAAoB;IAC5B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,IAAI,CAwWtF"}
+{"version":3,"file":"workflow-routes.d.ts","sourceRoot":"","sources":["../../src/api/workflow-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AA4B7D,UAAU,oBAAoB;IAC5B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACnF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,IAAI,CA0YtF"}

package/dist/api/workflow-routes.js

@@ -1,6 +1,6 @@
 import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError } from './response.js';
 import { resolveAuth } from './auth.js';
-import { toSiteUuid } from './site-context.js';
+import { toSiteUuid, assertSiteAccess } from './site-context.js';
 import { hasMinRole } from '../auth/roles.js';
 import { transitionContentStatus } from '../db/workflow-queries.js';
 import { getContentById, updateContent } from '../db/content-queries.js';
@@ -64,6 +64,11 @@ export function registerWorkflowRoutes(router, ctx) {
         const existing = await getContentById(db, customTable, params.id);
         if (!existing)
             return notFound('Content not found');
+        // #73: this route is keyed by content id (no request-derived site), so
+        // authorize against the loaded row's own site before any transition/revision.
+        const siteDenied = assertSiteAccess(auth.user, existing.siteId);
+        if (siteDenied)
+            return siteDenied;
         const currentStatus = existing.status;
         // Validate the submitted edits once, up front (used by both branches). An
         // absent `fields` is a bare submit (no edits captured).
@@ -133,6 +138,13 @@ export function registerWorkflowRoutes(router, ctx) {
         const [userRow] = await db.select({ email: kywiUsers.email }).from(kywiUsers).where(eq(kywiUsers.id, auth.user.id)).limit(1);
         const userEmail = userRow?.email ?? '';
         const customTable = customTableMap.get(contentType.name) ?? null;
+        // #73: id-keyed route — authorize against the target row's own site first.
+        const target = await getContentById(db, customTable, params.id);
+        if (!target)
+            return notFound('Content not found');
+        const siteDenied = assertSiteAccess(auth.user, target.siteId);
+        if (siteDenied)
+            return siteDenied;
         const result = await transitionContentStatus(db, {
             contentId: params.id,
             toStatus: publish ? 'published' : 'approved',
@@ -166,6 +178,13 @@ export function registerWorkflowRoutes(router, ctx) {
         const [userRow] = await db.select({ email: kywiUsers.email }).from(kywiUsers).where(eq(kywiUsers.id, auth.user.id)).limit(1);
         const userEmail = userRow?.email ?? '';
         const customTable = customTableMap.get(contentType.name) ?? null;
+        // #73: id-keyed route — authorize against the target row's own site first.
+        const target = await getContentById(db, customTable, params.id);
+        if (!target)
+            return notFound('Content not found');
+        const siteDenied = assertSiteAccess(auth.user, target.siteId);
+        if (siteDenied)
+            return siteDenied;
         const changeNote = reason !== undefined ? `Rejected: ${reason}` : 'Rejected';
         const result = await transitionContentStatus(db, {
             contentId: params.id,
@@ -201,6 +220,9 @@ export function registerWorkflowRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), ctx.config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const revisions = await listPendingRevisions(db, siteId);
         const out = [];
         for (const rev of revisions) {
@@ -236,6 +258,14 @@ export function registerWorkflowRoutes(router, ctx) {
         const [userRow] = await db.select({ email: kywiUsers.email }).from(kywiUsers).where(eq(kywiUsers.id, auth.user.id)).limit(1);
         const userEmail = userRow?.email ?? '';
         const customTable = customTableMap.get(contentType.name) ?? null;
+        // #73: revision is keyed by content id — authorize against the content's own
+        // site before applying the queued revision.
+        const target = await getContentById(db, customTable, params.id);
+        if (!target)
+            return notFound('Content not found');
+        const siteDenied = assertSiteAccess(auth.user, target.siteId);
+        if (siteDenied)
+            return siteDenied;
         const result = await approvePendingRevision(db, {
             contentId: params.id,
             versionId: params.versionId,
@@ -271,6 +301,14 @@ export function registerWorkflowRoutes(router, ctx) {
         const [userRow] = await db.select({ email: kywiUsers.email }).from(kywiUsers).where(eq(kywiUsers.id, auth.user.id)).limit(1);
         const userEmail = userRow?.email ?? '';
         const customTable = customTableMap.get(contentType.name) ?? null;
+        // #73: revision is keyed by content id — authorize against the content's own
+        // site before discarding the queued revision.
+        const target = await getContentById(db, customTable, params.id);
+        if (!target)
+            return notFound('Content not found');
+        const siteDenied = assertSiteAccess(auth.user, target.siteId);
+        if (siteDenied)
+            return siteDenied;
         const result = await rejectPendingRevision(db, {
             contentId: params.id,
             versionId: params.versionId,
@@ -294,6 +332,9 @@ export function registerWorkflowRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), ctx.config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const rows = await db
             .select()
             .from(kywiContent)
@@ -312,6 +353,9 @@ export function registerWorkflowRoutes(router, ctx) {
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), ctx.config);
         if (!siteId)
             return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const siteDenied = assertSiteAccess(auth.user, siteId);
+        if (siteDenied)
+            return siteDenied;
         const rows = await db
             .select()
             .from(kywiContent)