@manablox/api-rpc 0.1.0 → 0.2.0

package/src/routers/workflow.ts

@@ -0,0 +1,253 @@
+import { WORKFLOW_CONDITION_OPERATORS, WORKFLOW_EVENTS, type WorkflowStep } from '@manablox/core';
+import { z } from 'zod';
+import { authed, scoped } from '../base.js';
+import { uuid } from '../schemas.js';
+
+const template = z.string().max(20_000);
+
+const eventTrigger = z.object({
+  kind: z.literal('event'),
+  events: z.array(z.enum(WORKFLOW_EVENTS)).max(10),
+  typeIds: z.array(z.string().max(120)).max(200).default([]),
+  locales: z.array(z.string().max(10)).max(50).default([]),
+});
+
+const selection = z.object({
+  typeIds: z.array(z.string().max(120)).max(200).default([]),
+  status: z.enum(['any', 'draft', 'published']).default('any'),
+  changedWithinHours: z
+    .number()
+    .int()
+    .min(1)
+    .max(24 * 365)
+    .nullable()
+    .default(null),
+  locale: z.string().max(10).nullable().default(null),
+});
+
+const scheduleTrigger = z.object({
+  kind: z.literal('schedule'),
+  cron: z.string().max(100),
+  timezone: z.string().max(60).default('UTC'),
+  selection: selection.nullable().default(null),
+  perDocument: z.boolean().default(false),
+});
+
+const stepBase = {
+  id: z.string().max(64).default(''),
+  name: z.string().max(200).default(''),
+  enabled: z.boolean().default(true),
+  continueOnError: z.boolean().default(false),
+};
+
+const emailStep = z.object({
+  ...stepBase,
+  type: z.literal('email'),
+  to: z.array(z.string().max(500)).max(50).default([]),
+  toRoles: z.array(z.string().max(64)).max(50).default([]),
+  subject: template,
+  body: template,
+  html: z.boolean().default(false),
+});
+
+const httpStep = z.object({
+  ...stepBase,
+  type: z.literal('http'),
+  method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']).default('POST'),
+  url: z.string().max(2000),
+  headers: z
+    .array(z.object({ name: z.string().max(200), value: z.string().max(4000) }))
+    .max(50)
+    .default([]),
+  body: z
+    .object({
+      mode: z.enum(['event', 'custom', 'none']).default('event'),
+      template: template.default(''),
+    })
+    .default({ mode: 'event', template: '' }),
+  secret: z.string().max(500).nullable().default(null),
+  timeoutMs: z.number().int().min(1000).max(120_000).default(10_000),
+});
+
+const pushStep = z.object({
+  ...stepBase,
+  type: z.literal('push'),
+  roles: z.array(z.string().max(64)).max(50).default([]),
+  userIds: z.array(uuid).max(200).default([]),
+  title: template,
+  body: template.default(''),
+  url: z.string().max(2000).default(''),
+});
+
+const rules = z
+  .array(
+    z.object({
+      field: z.string().max(300),
+      operator: z.enum(WORKFLOW_CONDITION_OPERATORS),
+      value: z.string().max(4000).default(''),
+    }),
+  )
+  .max(50);
+
+const conditionStep = z.object({
+  ...stepBase,
+  type: z.literal('condition'),
+  match: z.enum(['all', 'any']).default('all'),
+  rules,
+});
+
+const delayStep = z.object({
+  ...stepBase,
+  type: z.literal('delay'),
+  minutes: z
+    .number()
+    .min(1)
+    .max(60 * 24 * 30),
+});
+
+/** A fork carries two chains of its own, so the step schema refers to itself (Zod 4 getters). */
+const branchStep = z.object({
+  ...stepBase,
+  type: z.literal('branch'),
+  match: z.enum(['all', 'any']).default('all'),
+  rules,
+  // Annotated by hand: the getter's inferred type would go through `step`, which is
+  // being defined in terms of this object.
+  get then(): z.ZodType<WorkflowStep[], WorkflowStepInput[] | undefined> {
+    return z.array(step).max(50).default([]) as never;
+  },
+  get else(): z.ZodType<WorkflowStep[], WorkflowStepInput[] | undefined> {
+    return z.array(step).max(50).default([]) as never;
+  },
+});
+
+/** What the client may send for a fork; the sides are optional and default to empty. */
+export interface WorkflowBranchStepInput {
+  id?: string | undefined;
+  name?: string | undefined;
+  enabled?: boolean | undefined;
+  continueOnError?: boolean | undefined;
+  type: 'branch';
+  match?: 'all' | 'any' | undefined;
+  rules: z.input<typeof rules>;
+  then?: WorkflowStepInput[] | undefined;
+  else?: WorkflowStepInput[] | undefined;
+}
+
+export type WorkflowStepInput =
+  | z.input<typeof emailStep>
+  | z.input<typeof httpStep>
+  | z.input<typeof pushStep>
+  | z.input<typeof conditionStep>
+  | z.input<typeof delayStep>
+  | WorkflowBranchStepInput;
+
+const step = z.discriminatedUnion('type', [
+  emailStep,
+  httpStep,
+  pushStep,
+  conditionStep,
+  branchStep,
+  delayStep,
+]);
+
+const workflowSchema = z.object({
+  spaceId: uuid,
+  name: z.string().max(200),
+  description: z.string().max(2000).nullable().optional(),
+  enabled: z.boolean().optional(),
+  trigger: z.discriminatedUnion('kind', [eventTrigger, scheduleTrigger]),
+  steps: z.array(step).max(50),
+});
+
+const pushSubscription = z.object({
+  endpoint: z.string().max(4000),
+  keys: z.object({ p256dh: z.string().max(500), auth: z.string().max(500) }),
+});
+
+/**
+ * Workflows. The rules — a cron that parses, a step with somewhere to go — live in
+ * `WorkflowService`; a procedure here is an input schema, a permission and one call.
+ */
+export const workflowRouter = {
+  /** The events, step types and operators the editor offers, and what the instance can send. */
+  catalog: authed.handler(async ({ context }) => context.workflows.catalog()),
+
+  list: scoped('workflow:read')
+    .input(z.object({ spaceId: uuid }))
+    .handler(async ({ input, context }) => context.workflows.list(input.spaceId)),
+
+  get: scoped('workflow:read')
+    .input(z.object({ spaceId: uuid, id: uuid }))
+    .handler(async ({ input, context }) => context.workflows.get(input.spaceId, input.id)),
+
+  create: scoped('workflow:write')
+    .input(workflowSchema)
+    .handler(async ({ input, context }) => {
+      const { spaceId, ...data } = input;
+      return context.workflows.create(spaceId, data);
+    }),
+
+  update: scoped('workflow:write')
+    .input(workflowSchema.extend({ id: uuid }))
+    .handler(async ({ input, context }) => {
+      const { spaceId, id, ...data } = input;
+      return context.workflows.update(spaceId, id, data);
+    }),
+
+  setEnabled: scoped('workflow:write')
+    .input(z.object({ spaceId: uuid, id: uuid, enabled: z.boolean() }))
+    .handler(async ({ input, context }) =>
+      context.workflows.setEnabled(input.spaceId, input.id, input.enabled),
+    ),
+
+  delete: scoped('workflow:write')
+    .input(z.object({ spaceId: uuid, id: uuid }))
+    .handler(async ({ input, context }) => {
+      await context.workflows.delete(input.spaceId, input.id);
+      return { ok: true };
+    }),
+
+  /** The latest runs of a workflow, newest first, each with its step log. */
+  runs: scoped('workflow:read')
+    .input(
+      z.object({ spaceId: uuid, id: uuid, limit: z.number().int().min(1).max(200).default(50) }),
+    )
+    .handler(async ({ input, context }) =>
+      context.workflows.runs(input.spaceId, input.id, input.limit),
+    ),
+
+  run: scoped('workflow:read')
+    .input(z.object({ spaceId: uuid, id: uuid }))
+    .handler(async ({ input, context }) => context.workflows.run(input.spaceId, input.id)),
+
+  /** Runs the workflow now, against a document when one is named, and returns the run. */
+  runNow: scoped('workflow:write')
+    .input(z.object({ spaceId: uuid, id: uuid, contentId: uuid.nullable().optional() }))
+    .handler(async ({ input, context }) =>
+      context.workflows.runNow(input.spaceId, input.id, input.contentId ?? null),
+    ),
+
+  // --- the caller's own push subscriptions ------------------------------------------
+
+  pushSubscriptions: authed.handler(async ({ context }) =>
+    context.workflows.subscriptions(context.principal.userId),
+  ),
+
+  pushSubscribe: authed
+    .input(pushSubscription)
+    .handler(async ({ input, context }) =>
+      context.workflows.subscribe(
+        context.principal.userId,
+        input,
+        context.headers.get('user-agent'),
+      ),
+    ),
+
+  pushUnsubscribe: authed
+    .input(z.object({ endpoint: z.string().max(4000) }))
+    .handler(async ({ input, context }) => {
+      await context.workflows.unsubscribe(context.principal.userId, input.endpoint);
+      return { ok: true };
+    }),
+};

package/src/schemas.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+
+/** Input primitives shared by every management router. */
+export const uuid = z.string().uuid();
+
+/** BCP-47-ish, the way the rest of the system stores it: `en`, `de-AT`. */
+export const locale = z.string().min(2).max(10);
+export const localeList = z.array(locale).min(1);
+
+/**
+ * A technical name: lower-case, starts with a letter, may carry digits, `_` and `-`. It
+ * keys the GraphQL schema and the public API's space pinning, so it is stricter than a
+ * label.
+ */
+export const machineName = z
+  .string()
+  .regex(/^[a-z][a-z0-9_-]*$/)
+  .max(64);
+
+/** A role's machine name: one of the built-in five, or a role created for the space. */
+export const spaceRole = machineName;
+
+export const searchTerm = z.string().max(200);
+
+/** `image/png`, or a family with a trailing slash: `image/`. */
+export const mimeTypePattern = z
+  .string()
+  .regex(/^[a-z0-9-]+\/([a-z0-9.+-]+)?$/)
+  .max(100);
+
+/** `limit`/`offset` with the caller's defaults and ceiling. */
+export function pagination(options: { limit: number; max: number }) {
+  return z.object({
+    limit: z.number().int().min(1).max(options.max).default(options.limit),
+    offset: z.number().int().min(0).default(0),
+  });
+}
+
+/** Every space-scoped procedure names its space; `scoped()` reads it from here. */
+export const spaceScoped = z.object({ spaceId: uuid });

package/test/asset.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, it, vi } from 'vitest';
+import { assetRouter } from '../src/routers/asset.js';
+import { failure, invoke, principal, SPACE_ID, stubContext } from './helpers.js';
+
+const ASSET_ID = '88888888-8888-4888-8888-888888888888';
+
+const asset = (overrides = {}) => ({
+  id: ASSET_ID,
+  spaceId: SPACE_ID,
+  filename: 'hero.jpg',
+  name: 'hero',
+  mimeType: 'image/jpeg',
+  size: 4,
+  meta: {},
+  ...overrides,
+});
+
+function context(overrides: Record<string, unknown> = {}) {
+  const assets = { list: vi.fn(), findById: vi.fn(), update: vi.fn() };
+  const urlFor = (row: { id: string }, preset?: string) =>
+    `/media/${row.id}${preset ? `/${preset}` : ''}`;
+  const media = {
+    limits: vi.fn(),
+    urlFor: vi.fn(urlFor),
+    // The real `present()` in miniature: the row, its URL, a thumbnail for images.
+    present: (row: { id: string; mimeType: string }) => ({
+      ...row,
+      url: urlFor(row),
+      thumbnailUrl: row.mimeType.startsWith('image/') ? urlFor(row, 'thumb') : null,
+    }),
+    setImageEdits: vi.fn(),
+    delete: vi.fn(),
+  };
+  const ctx = stubContext({ media: media as never, ...overrides });
+  (ctx.repos as unknown as { assets: typeof assets }).assets = assets;
+  return { ctx, assets, media };
+}
+
+describe('assets.list / get', () => {
+  it('decorates every row with its URL, and a thumbnail only for images', async () => {
+    const { ctx, assets } = context();
+    assets.list.mockResolvedValue({
+      items: [
+        asset(),
+        asset({ id: '99999999-9999-4999-8999-999999999999', mimeType: 'application/pdf' }),
+      ],
+      total: 2,
+      limit: 40,
+      offset: 0,
+    });
+    const page = await invoke<{ items: Array<{ url: string; thumbnailUrl: string | null }> }>(
+      assetRouter.list,
+      { spaceId: SPACE_ID },
+      ctx,
+    );
+    expect(page.items[0]).toMatchObject({
+      url: `/media/${ASSET_ID}`,
+      thumbnailUrl: `/media/${ASSET_ID}/thumb`,
+    });
+    expect(page.items[1]?.thumbnailUrl).toBeNull();
+    expect(assets.list).toHaveBeenCalledWith({ spaceId: SPACE_ID }, { limit: 40, offset: 0 });
+  });
+
+  it('forwards the search and type filter only when given', async () => {
+    const { ctx, assets } = context();
+    assets.list.mockResolvedValue({ items: [], total: 0, limit: 10, offset: 5 });
+    await invoke(
+      assetRouter.list,
+      { spaceId: SPACE_ID, search: 'hero', mimeType: 'image/', limit: 10, offset: 5 },
+      ctx,
+    );
+    expect(assets.list).toHaveBeenCalledWith(
+      { spaceId: SPACE_ID, mimeType: 'image/', search: 'hero' },
+      { limit: 10, offset: 5 },
+    );
+  });
+
+  it('answers null for an asset that is not there', async () => {
+    const { ctx, assets } = context();
+    assets.findById.mockResolvedValue(null);
+    expect(await invoke(assetRouter.get, { spaceId: SPACE_ID, id: ASSET_ID }, ctx)).toBeNull();
+    assets.findById.mockResolvedValue(asset());
+    expect(await invoke(assetRouter.get, { spaceId: SPACE_ID, id: ASSET_ID }, ctx)).toMatchObject({
+      id: ASSET_ID,
+      url: `/media/${ASSET_ID}`,
+    });
+  });
+
+  it('needs asset:read, which a member of another space lacks', async () => {
+    const { ctx } = context({ principal: principal({ spaces: {} }) });
+    expect(await failure(invoke(assetRouter.list, { spaceId: SPACE_ID }, ctx))).toMatchObject({
+      code: 'FORBIDDEN',
+    });
+  });
+});
+
+describe('assets.update / setImageEdits / delete', () => {
+  it('writes only the named fields, never the space', async () => {
+    const { ctx, assets } = context();
+    assets.update.mockResolvedValue(asset({ alt: 'A hero' }));
+    await invoke(assetRouter.update, { spaceId: SPACE_ID, id: ASSET_ID, alt: 'A hero' }, ctx);
+    expect(assets.update).toHaveBeenCalledWith(ASSET_ID, { alt: 'A hero' });
+  });
+
+  it('states the whole edit: an omitted crop or focal point clears it', async () => {
+    const { ctx, media } = context();
+    media.setImageEdits.mockResolvedValue(asset());
+    const result = await invoke<{ thumbnailUrl: string }>(
+      assetRouter.setImageEdits,
+      { spaceId: SPACE_ID, id: ASSET_ID, focalPoint: { x: 0.5, y: 0.25 } },
+      ctx,
+    );
+    expect(media.setImageEdits).toHaveBeenCalledWith(ASSET_ID, {
+      crop: null,
+      focalPoint: { x: 0.5, y: 0.25 },
+    });
+    expect(result.thumbnailUrl).toBe(`/media/${ASSET_ID}/thumb`);
+  });
+
+  it('refuses a focal point outside the image', async () => {
+    const { ctx, media } = context();
+    const result = await failure(
+      invoke(
+        assetRouter.setImageEdits,
+        { spaceId: SPACE_ID, id: ASSET_ID, focalPoint: { x: 2, y: 0 } },
+        ctx,
+      ),
+    );
+    expect(result.code).toBe('BAD_REQUEST');
+    expect(media.setImageEdits).not.toHaveBeenCalled();
+  });
+
+  it('lets an editor delete and an author only upload', async () => {
+    const { ctx, media } = context({ principal: principal({ spaces: { [SPACE_ID]: 'author' } }) });
+    media.delete.mockResolvedValue(undefined);
+    expect(
+      await failure(invoke(assetRouter.delete, { spaceId: SPACE_ID, id: ASSET_ID }, ctx)),
+    ).toMatchObject({ code: 'FORBIDDEN' });
+    const editor = { ...ctx, principal: principal({ spaces: { [SPACE_ID]: 'editor' } }) };
+    expect(await invoke(assetRouter.delete, { spaceId: SPACE_ID, id: ASSET_ID }, editor)).toEqual({
+      ok: true,
+    });
+  });
+});

package/test/content.test.ts

@@ -0,0 +1,256 @@
+import { ManabloxError } from '@manablox/core';
+import { describe, expect, it, vi } from 'vitest';
+import { contentRouter } from '../src/routers/content.js';
+import {
+  failure,
+  invoke,
+  mocks,
+  principal,
+  SPACE_ID,
+  stubContext,
+  TYPE_ID,
+  USER_ID,
+} from './helpers.js';
+
+const DOC_ID = '88888888-8888-4888-8888-888888888888';
+const OTHER_TYPE_ID = '77777777-7777-4777-8777-777777777777';
+
+function content() {
+  return {
+    list: vi.fn(),
+    tree: vi.fn(),
+    get: vi.fn(),
+    initFields: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+    publish: vi.fn(),
+    unpublish: vi.fn(),
+    move: vi.fn(),
+    translations: vi.fn(),
+    createTranslation: vi.fn(),
+    restore: vi.fn(),
+  };
+}
+
+const row = (overrides = {}) => ({
+  id: DOC_ID,
+  spaceId: SPACE_ID,
+  typeId: TYPE_ID,
+  locale: 'en',
+  title: 'Hello',
+  slug: 'hello',
+  fields: {},
+  ...overrides,
+});
+
+const page = { items: [], total: 0, limit: 25, offset: 0 };
+
+/** A role that reads and writes one type only, the way a custom grant narrows it. */
+const narrowed = () =>
+  principal({
+    spaces: { [SPACE_ID]: 'blogger' },
+    permissions: {
+      [SPACE_ID]: [
+        'space:read',
+        'contentType:read',
+        `content:read:${TYPE_ID}`,
+        `content:write:${TYPE_ID}`,
+      ],
+    },
+  });
+
+describe('content.list', () => {
+  it('reads the space out of the filter and passes the actor along', async () => {
+    const service = content();
+    service.list.mockResolvedValue(page);
+    const ctx = stubContext({ content: service as never });
+    await invoke(contentRouter.list, { filter: { spaceId: SPACE_ID } }, ctx);
+    expect(service.list).toHaveBeenCalledWith({ spaceId: SPACE_ID }, { limit: 25, offset: 0 }, [], {
+      actor: { userId: USER_ID, roles: ['editor', 'owner'] },
+    });
+  });
+
+  it('narrows a type-scoped role to the types it may read, and answers empty when none remain', async () => {
+    const service = content();
+    service.list.mockResolvedValue(page);
+    const ctx = stubContext({ content: service as never, principal: narrowed() });
+
+    await invoke(contentRouter.list, { filter: { spaceId: SPACE_ID } }, ctx);
+    expect(service.list.mock.calls[0]?.[0]).toEqual({ spaceId: SPACE_ID, typeIds: [TYPE_ID] });
+
+    const empty = await invoke(
+      contentRouter.list,
+      { filter: { spaceId: SPACE_ID, typeIds: [OTHER_TYPE_ID] } },
+      ctx,
+    );
+    expect(empty).toEqual(page);
+    expect(service.list).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses a filter operator and a sort key it does not know', async () => {
+    const ctx = stubContext({ content: content() as never });
+    const bad = await failure(
+      invoke(
+        contentRouter.list,
+        { filter: { spaceId: SPACE_ID, fields: [{ name: 'x', op: 'regex' }] } },
+        ctx,
+      ),
+    );
+    expect(bad.code).toBe('BAD_REQUEST');
+    const badSort = await failure(
+      invoke(contentRouter.list, { filter: { spaceId: SPACE_ID }, sort: [{ by: 'colour' }] }, ctx),
+    );
+    expect(badSort.code).toBe('BAD_REQUEST');
+  });
+});
+
+describe('content.get / delete / publish', () => {
+  it('reads the document without a second lookup for a broad role', async () => {
+    const service = content();
+    service.get.mockResolvedValue(row());
+    const ctx = stubContext({ content: service as never });
+    expect(await invoke(contentRouter.get, { spaceId: SPACE_ID, id: DOC_ID }, ctx)).toEqual(row());
+    expect(mocks(ctx).content.findById).not.toHaveBeenCalled();
+  });
+
+  it('checks the document’s type for a narrowed role, and hides one it may not read', async () => {
+    const service = content();
+    service.get.mockResolvedValue(row());
+    const ctx = stubContext({ content: service as never, principal: narrowed() });
+    const repos = mocks(ctx);
+
+    repos.content.findById.mockResolvedValue(row());
+    expect(await invoke(contentRouter.get, { spaceId: SPACE_ID, id: DOC_ID }, ctx)).toEqual(row());
+
+    repos.content.findById.mockResolvedValue(row({ typeId: OTHER_TYPE_ID }));
+    expect(
+      await failure(invoke(contentRouter.get, { spaceId: SPACE_ID, id: DOC_ID }, ctx)),
+    ).toMatchObject({ code: 'FORBIDDEN' });
+
+    repos.content.findById.mockResolvedValue(null);
+    expect(
+      await failure(invoke(contentRouter.get, { spaceId: SPACE_ID, id: DOC_ID }, ctx)),
+    ).toMatchObject({ code: 'NOT_FOUND', key: 'content.notFound' });
+  });
+
+  it('keeps publishing from an author, who may write but never publish', async () => {
+    const service = content();
+    service.publish.mockResolvedValue(row());
+    const ctx = stubContext({
+      content: service as never,
+      principal: principal({ spaces: { [SPACE_ID]: 'author' } }),
+    });
+    expect(
+      await failure(invoke(contentRouter.publish, { spaceId: SPACE_ID, id: DOC_ID }, ctx)),
+    ).toMatchObject({ code: 'FORBIDDEN' });
+    expect(await invoke(contentRouter.delete, { spaceId: SPACE_ID, id: DOC_ID }, ctx)).toEqual({
+      deleted: undefined,
+    });
+  });
+});
+
+describe('content.create / update', () => {
+  it('defaults the locale and fields and checks the type for a narrowed role', async () => {
+    const service = content();
+    service.create.mockResolvedValue(row());
+    const ctx = stubContext({ content: service as never, principal: narrowed() });
+    await invoke(contentRouter.create, { spaceId: SPACE_ID, typeId: TYPE_ID, title: 'Hello' }, ctx);
+    expect(service.create).toHaveBeenCalledWith(
+      { spaceId: SPACE_ID, typeId: TYPE_ID, title: 'Hello', locale: 'en', fields: {} },
+      { userId: USER_ID, roles: ['editor', 'blogger'] },
+    );
+    expect(
+      await failure(
+        invoke(contentRouter.create, { spaceId: SPACE_ID, typeId: OTHER_TYPE_ID, title: 'X' }, ctx),
+      ),
+    ).toMatchObject({ code: 'FORBIDDEN' });
+  });
+
+  it('maps a validation error to BAD_REQUEST with every detail', async () => {
+    const service = content();
+    service.update.mockRejectedValue(
+      ManabloxError.validation(
+        [
+          { key: 'content.slug.duplicate', path: ['slug'] },
+          { key: 'field.required', path: ['fields', 'body'] },
+        ],
+        'content.validation.failed',
+      ),
+    );
+    const ctx = stubContext({ content: service as never });
+    const result = await failure(
+      invoke(
+        contentRouter.update,
+        { spaceId: SPACE_ID, id: DOC_ID, typeId: TYPE_ID, title: 'Hello' },
+        ctx,
+      ),
+    );
+    expect(result).toMatchObject({ code: 'BAD_REQUEST', key: 'content.validation.failed' });
+    expect(result.details?.map((d) => d.path)).toEqual([['slug'], ['fields', 'body']]);
+  });
+
+  it('refuses an empty title before the service', async () => {
+    const service = content();
+    const ctx = stubContext({ content: service as never });
+    const result = await failure(
+      invoke(contentRouter.create, { spaceId: SPACE_ID, typeId: TYPE_ID, title: '' }, ctx),
+    );
+    expect(result.code).toBe('BAD_REQUEST');
+    expect(service.create).not.toHaveBeenCalled();
+  });
+});
+
+describe('content.move / translations / blank', () => {
+  it('hands the destination through and maps a cross-space parent to BAD_REQUEST', async () => {
+    const service = content();
+    service.move.mockResolvedValueOnce(row());
+    service.move.mockRejectedValueOnce(
+      ManabloxError.badRequest('content.parent.notInSpace', { parentId: DOC_ID }),
+    );
+    const ctx = stubContext({ content: service as never });
+    await invoke(
+      contentRouter.move,
+      { spaceId: SPACE_ID, id: DOC_ID, parentId: null, position: 2 },
+      ctx,
+    );
+    expect(service.move).toHaveBeenCalledWith(SPACE_ID, DOC_ID, null, 2);
+    expect(
+      await failure(
+        invoke(
+          contentRouter.move,
+          { spaceId: SPACE_ID, id: DOC_ID, parentId: DOC_ID, position: 0 },
+          ctx,
+        ),
+      ),
+    ).toMatchObject({ code: 'BAD_REQUEST', key: 'content.parent.notInSpace' });
+  });
+
+  it('starts a translation in the named locale', async () => {
+    const service = content();
+    service.createTranslation.mockResolvedValue(row({ locale: 'de' }));
+    const ctx = stubContext({ content: service as never });
+    await invoke(
+      contentRouter.createTranslation,
+      { spaceId: SPACE_ID, id: DOC_ID, locale: 'de' },
+      ctx,
+    );
+    expect(service.createTranslation).toHaveBeenCalledWith(SPACE_ID, DOC_ID, 'de', {
+      userId: USER_ID,
+      roles: ['editor', 'owner'],
+    });
+  });
+
+  it('opens a blank document with the type’s defaults', async () => {
+    const service = content();
+    service.initFields.mockResolvedValue({ body: '' });
+    const ctx = stubContext({ content: service as never });
+    (ctx.manablox as unknown as { contentTypes: { get: () => unknown } }).contentTypes.get =
+      () => ({
+        id: TYPE_ID,
+      });
+    expect(await invoke(contentRouter.blank, { spaceId: SPACE_ID, typeId: TYPE_ID }, ctx)).toEqual({
+      fields: { body: '' },
+    });
+  });
+});