@meridianjs/meridian 1.31.0 → 2.0.0

package/dist/api/admin/events/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/events/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAsChD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/admin/events/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA8ChD,CAAA"}

package/dist/api/admin/events/route.js

@@ -12,16 +12,21 @@ import { sseManager } from "@meridianjs/framework";
  */
 export const GET = async (req, res) => {
     const workspaceId = req.query.workspaceId;
-    if (!workspaceId) {
+    const mode = req.query.mode;
+    // User-only mode: no workspace required, receives user-scoped events
+    const isUserMode = mode === "user";
+    if (!isUserMode && !workspaceId) {
         res.status(400).json({ error: { message: "workspaceId query param required" } });
         return;
     }
-    // Validate the user actually belongs to this workspace
-    const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
-    const [members] = await workspaceMemberService.listAndCountWorkspaceMembers({ workspace_id: workspaceId, user_id: req.user.id }, { limit: 1 });
-    if (members.length === 0) {
-        res.status(403).json({ error: { message: "You are not a member of this workspace" } });
-        return;
+    if (!isUserMode) {
+        // Validate the user actually belongs to this workspace
+        const workspaceMemberService = req.scope.resolve("workspaceMemberModuleService");
+        const [members] = await workspaceMemberService.listAndCountWorkspaceMembers({ workspace_id: workspaceId, user_id: req.user.id }, { limit: 1 });
+        if (members.length === 0) {
+            res.status(403).json({ error: { message: "You are not a member of this workspace" } });
+            return;
+        }
     }
     res.setHeader("Content-Type", "text/event-stream");
     res.setHeader("Cache-Control", "no-cache");
@@ -37,7 +42,9 @@ export const GET = async (req, res) => {
             clearInterval(heartbeat);
         }
     }, 30_000);
-    const unsubscribe = sseManager.subscribe(workspaceId, res);
+    const unsubscribe = isUserMode
+        ? sseManager.subscribe(`user:${req.user.id}`, res)
+        : sseManager.subscribe(workspaceId, res);
     req.on("close", () => {
         clearInterval(heartbeat);
         unsubscribe();

package/dist/api/admin/events/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/events/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAiC,CAAA;IAE/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;QAChF,OAAM;IACR,CAAC;IAED,uDAAuD;IACvD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;IACvF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EACnD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;QACtF,OAAM;IACR,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAA;IAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACzC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA,CAAC,0BAA0B;IAEnE,GAAG,CAAC,YAAY,EAAE,CAAA;IAElB,mEAAmE;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC;YAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;IACzE,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAE1D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,aAAa,CAAC,SAAS,CAAC,CAAA;QACxB,WAAW,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../src/api/admin/events/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAiC,CAAA;IAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAA0B,CAAA;IAEjD,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,KAAK,MAAM,CAAA;IAElC,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;QAChF,OAAM;IACR,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,uDAAuD;QACvD,MAAM,sBAAsB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAQ,CAAA;QACvF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC,4BAA4B,CACzE,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EACnD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;YACtF,OAAM;QACR,CAAC;IACH,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAA;IAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACzC,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA,CAAC,0BAA0B;IAEnE,GAAG,CAAC,YAAY,EAAE,CAAA;IAElB,mEAAmE;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC;YAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAAC,CAAC;IACzE,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,MAAM,WAAW,GAAG,UAAU;QAC5B,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC;QAClD,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,WAAY,EAAE,GAAG,CAAC,CAAA;IAE3C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,aAAa,CAAC,SAAS,CAAC,CAAA;QACxB,WAAW,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/attachments/[attachmentId]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/attachments/[attachmentId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIvC,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAqCnD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/attachments/[attachmentId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAKvC,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAuCnD,CAAA"}

package/dist/api/admin/issues/[id]/attachments/[attachmentId]/route.js

@@ -1,36 +1,39 @@
+import { requirePermission } from "@meridianjs/auth";
 import fs from "node:fs/promises";
 import path from "node:path";
 export const DELETE = async (req, res) => {
-    const issueService = req.scope.resolve("issueModuleService");
-    const repo = req.scope.resolve("attachmentRepository");
-    const attachment = await repo.findOne({ id: req.params.attachmentId });
-    if (!attachment) {
-        res.status(404).json({ error: { message: "Attachment not found" } });
-        return;
-    }
-    // Verify the attachment belongs to the issue referenced in the URL (IDOR cross-reference)
-    if (attachment.issue_id !== req.params.id) {
-        res.status(403).json({ error: { message: "Forbidden" } });
-        return;
-    }
-    // Verify caller uploaded the attachment or has manager/admin role
-    const roles = req.user?.roles ?? [];
-    const isPrivileged = roles.includes("super-admin") || roles.includes("admin") || roles.includes("manager");
-    if (!isPrivileged && attachment.uploader_id !== req.user?.id) {
-        res.status(403).json({ error: { message: "Forbidden" } });
-        return;
-    }
-    const rootDir = req.scope.resolve("config")?.rootDir ?? process.cwd();
-    const uploadsDir = path.join(rootDir, "uploads", "issue-attachments") + path.sep;
-    const filePath = path.join(rootDir, "uploads", "issue-attachments", attachment.filename);
-    // Path traversal guard: resolved path must be within uploads dir
-    const resolvedPath = path.resolve(filePath);
-    if (!resolvedPath.startsWith(uploadsDir)) {
-        res.status(400).json({ error: { message: "Invalid attachment path" } });
-        return;
-    }
-    await issueService.deleteAttachment(req.params.attachmentId);
-    await fs.unlink(resolvedPath).catch(() => { });
-    res.json({ attachment });
+    requirePermission("issue:update")(req, res, async () => {
+        const issueService = req.scope.resolve("issueModuleService");
+        const repo = req.scope.resolve("attachmentRepository");
+        const attachment = await repo.findOne({ id: req.params.attachmentId });
+        if (!attachment) {
+            res.status(404).json({ error: { message: "Attachment not found" } });
+            return;
+        }
+        // Verify the attachment belongs to the issue referenced in the URL (IDOR cross-reference)
+        if (attachment.issue_id !== req.params.id) {
+            res.status(403).json({ error: { message: "Forbidden" } });
+            return;
+        }
+        // Verify caller uploaded the attachment or has manager/admin role
+        const roles = req.user?.roles ?? [];
+        const isPrivileged = roles.includes("super-admin") || roles.includes("admin") || roles.includes("manager");
+        if (!isPrivileged && attachment.uploader_id !== req.user?.id) {
+            res.status(403).json({ error: { message: "Forbidden" } });
+            return;
+        }
+        const rootDir = req.scope.resolve("config")?.rootDir ?? process.cwd();
+        const uploadsDir = path.join(rootDir, "uploads", "issue-attachments") + path.sep;
+        const filePath = path.join(rootDir, "uploads", "issue-attachments", attachment.filename);
+        // Path traversal guard: resolved path must be within uploads dir
+        const resolvedPath = path.resolve(filePath);
+        if (!resolvedPath.startsWith(uploadsDir)) {
+            res.status(400).json({ error: { message: "Invalid attachment path" } });
+            return;
+        }
+        await issueService.deleteAttachment(req.params.attachmentId);
+        await fs.unlink(resolvedPath).catch(() => { });
+        res.json({ attachment });
+    });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/issues/[id]/attachments/[attachmentId]/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/attachments/[attachmentId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;IAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QACpE,OAAM;IACR,CAAC;IAED,0FAA0F;IAC1F,IAAI,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,kEAAkE;IAClE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1G,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IAExF,iEAAiE;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;AAC1B,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/attachments/[attachmentId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;QAC7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,0FAA0F;QAC1F,IAAI,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QAED,kEAAkE;QAClE,MAAM,KAAK,GAAa,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC1G,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;QAExF,iEAAiE;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAA;YACvE,OAAM;QACR,CAAC;QAED,MAAM,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/attachments/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/attachments/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAIhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAuBjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/attachments/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAIhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAyBjD,CAAA"}

package/dist/api/admin/issues/[id]/attachments/route.js

@@ -1,3 +1,4 @@
+import { requirePermission } from "@meridianjs/auth";
 import { processUpload } from "../../../../../utils/upload.js";
 export const GET = async (req, res) => {
     const issueService = req.scope.resolve("issueModuleService");
@@ -5,28 +6,30 @@ export const GET = async (req, res) => {
     res.json({ attachments });
 };
 export const POST = async (req, res) => {
-    const upload = await processUpload(req, res, "file", "issue-attachments");
-    if (!upload) {
-        res.status(400).json({ error: { message: "No file uploaded. Use multipart/form-data with field name 'file'." } });
-        return;
-    }
-    const issueService = req.scope.resolve("issueModuleService");
-    const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
-    if (!issue) {
-        res.status(404).json({ error: { message: "Issue not found." } });
-        return;
-    }
-    const attachment = await issueService.createAttachment({
-        issue_id: req.params.id,
-        comment_id: req.body?.comment_id || null,
-        filename: upload.filename,
-        original_name: upload.originalName,
-        mime_type: upload.mimetype,
-        size: upload.size,
-        url: upload.url,
-        uploader_id: req.user?.id ?? "system",
-        workspace_id: issue.workspace_id,
+    requirePermission("issue:update")(req, res, async () => {
+        const upload = await processUpload(req, res, "file", "issue-attachments");
+        if (!upload) {
+            res.status(400).json({ error: { message: "No file uploaded. Use multipart/form-data with field name 'file'." } });
+            return;
+        }
+        const issueService = req.scope.resolve("issueModuleService");
+        const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
+        if (!issue) {
+            res.status(404).json({ error: { message: "Issue not found." } });
+            return;
+        }
+        const attachment = await issueService.createAttachment({
+            issue_id: req.params.id,
+            comment_id: req.body?.comment_id || null,
+            filename: upload.filename,
+            original_name: upload.originalName,
+            mime_type: upload.mimetype,
+            size: upload.size,
+            url: upload.url,
+            uploader_id: req.user?.id ?? "system",
+            workspace_id: issue.workspace_id,
+        });
+        res.status(201).json({ attachment });
     });
-    res.status(201).json({ attachment });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/issues/[id]/attachments/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/attachments/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAE9D,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAA;QACjH,OAAM;IACR,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAAC,OAAM;IAAC,CAAC;IAExF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;QACrD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACvB,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;QACrC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAA;IACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;AACtC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/attachments/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAE9D,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE,CAAC,CAAA;YACjH,OAAM;QACR,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QAExF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;YACrD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;YACrC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAA;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/comments/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/comments/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAqBvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAKhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAkBjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/comments/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAsBvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAKhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAoBjD,CAAA"}

package/dist/api/admin/issues/[id]/comments/route.js

@@ -1,3 +1,4 @@
+import { requirePermission } from "@meridianjs/auth";
 import { hasProjectAccess } from "../../../../utils/project-access.js";
 async function assertIssueAccess(req, res) {
     const issueService = req.scope.resolve("issueModuleService");
@@ -24,23 +25,25 @@ export const GET = async (req, res) => {
     res.json({ comments });
 };
 export const POST = async (req, res) => {
-    if (!await assertIssueAccess(req, res))
-        return;
-    const issueService = req.scope.resolve("issueModuleService");
-    const eventBus = req.scope.resolve("eventBus");
-    const { body, metadata } = req.body;
-    if (!body || typeof body !== "string" || body.trim().length === 0) {
-        res.status(400).json({ error: { message: "body is required" } });
-        return;
-    }
-    const comment = await issueService.createComment({
-        issue_id: req.params.id, body: body.trim(), author_id: req.user?.id ?? "system",
-        metadata: metadata ?? null,
+    requirePermission("issue:create")(req, res, async () => {
+        if (!await assertIssueAccess(req, res))
+            return;
+        const issueService = req.scope.resolve("issueModuleService");
+        const eventBus = req.scope.resolve("eventBus");
+        const { body, metadata } = req.body;
+        if (!body || typeof body !== "string" || body.trim().length === 0) {
+            res.status(400).json({ error: { message: "body is required" } });
+            return;
+        }
+        const comment = await issueService.createComment({
+            issue_id: req.params.id, body: body.trim(), author_id: req.user?.id ?? "system",
+            metadata: metadata ?? null,
+        });
+        const mentionedUserIds = Array.isArray(metadata?.mentioned_user_ids)
+            ? metadata.mentioned_user_ids.filter((id) => typeof id === "string")
+            : [];
+        eventBus.emit({ name: "comment.created", data: { comment_id: comment.id, issue_id: req.params.id, author_id: comment.author_id, mentioned_user_ids: mentionedUserIds } }).catch(() => { });
+        res.status(201).json({ comment });
     });
-    const mentionedUserIds = Array.isArray(metadata?.mentioned_user_ids)
-        ? metadata.mentioned_user_ids.filter((id) => typeof id === "string")
-        : [];
-    eventBus.emit({ name: "comment.created", data: { comment_id: comment.id, issue_id: req.params.id, author_id: comment.author_id, mentioned_user_ids: mentionedUserIds } }).catch(() => { });
-    res.status(201).json({ comment });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/issues/[id]/comments/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/comments/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAEtE,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,GAAa;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACxF,IAAI,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;IACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAChE,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;QAC/C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;QAC/E,QAAQ,EAAE,QAAQ,IAAI,IAAI;KAC3B,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5E,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;QAC7E,CAAC,CAAC,EAAE,CAAA;IACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACzL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;AACnC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/comments/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAEtE,KAAK,UAAU,iBAAiB,CAAC,GAAQ,EAAE,GAAa;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAQ,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACxF,IAAI,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,OAAM;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAM;QAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAQ,CAAA;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;YAChE,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;YAC/C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;YAC/E,QAAQ,EAAE,QAAQ,IAAI,IAAI;SAC3B,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC;YAC5E,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAA;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACzL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/[logId]/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/[logId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA8ChD,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAwBnD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/[logId]/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA8ChD,CAAA;AAED,eAAO,MAAM,MAAM,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA0BnD,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/[logId]/route.js

@@ -1,66 +1,69 @@
+import { requirePermission } from "@meridianjs/auth";
 export const PUT = async (req, res) => {
-    const issueService = req.scope.resolve("issueModuleService");
-    const activityService = req.scope.resolve("activityModuleService");
-    const entry = await issueService.retrieveTimeLog(req.params.logId);
-    if (!entry) {
-        res.status(404).json({ error: { message: "Time log not found" } });
-        return;
-    }
-    if (entry.user_id !== req.user?.id) {
-        res.status(403).json({ error: { message: "Forbidden" } });
-        return;
-    }
-    const { duration_minutes, description, logged_date } = req.body;
-    // Capture previous values for activity diff
-    const before = {
-        duration_minutes: entry.duration_minutes,
-        description: entry.description,
-        logged_date: entry.logged_date,
-    };
-    const updated = await issueService.updateTimeLog(req.params.logId, {
-        duration_minutes,
-        description,
-        logged_date: logged_date ? new Date(logged_date) : undefined,
+    requirePermission("issue:update")(req, res, async () => {
+        const issueService = req.scope.resolve("issueModuleService");
+        const activityService = req.scope.resolve("activityModuleService");
+        const entry = await issueService.retrieveTimeLog(req.params.logId);
+        if (!entry) {
+            res.status(404).json({ error: { message: "Time log not found" } });
+            return;
+        }
+        if (entry.user_id !== req.user?.id) {
+            res.status(403).json({ error: { message: "Forbidden" } });
+            return;
+        }
+        const { duration_minutes, description, logged_date } = req.body;
+        const before = {
+            duration_minutes: entry.duration_minutes,
+            description: entry.description,
+            logged_date: entry.logged_date,
+        };
+        const updated = await issueService.updateTimeLog(req.params.logId, {
+            duration_minutes,
+            description,
+            logged_date: logged_date ? new Date(logged_date) : undefined,
+        });
+        const changes = {};
+        if (duration_minutes !== undefined && duration_minutes !== before.duration_minutes) {
+            changes.duration_minutes = { from: before.duration_minutes, to: duration_minutes };
+        }
+        if (description !== undefined && description !== before.description) {
+            changes.description = { from: before.description, to: description };
+        }
+        if (logged_date !== undefined) {
+            changes.logged_date = { from: before.logged_date, to: logged_date };
+        }
+        activityService.recordActivity({
+            entity_type: "issue", entity_id: entry.issue_id,
+            actor_id: req.user?.id ?? "system", action: "time_log_updated", workspace_id: entry.workspace_id,
+            changes,
+        }).catch(() => { });
+        res.json({ time_log: updated });
     });
-    // Build changes object (only fields that actually changed)
-    const changes = {};
-    if (duration_minutes !== undefined && duration_minutes !== before.duration_minutes) {
-        changes.duration_minutes = { from: before.duration_minutes, to: duration_minutes };
-    }
-    if (description !== undefined && description !== before.description) {
-        changes.description = { from: before.description, to: description };
-    }
-    if (logged_date !== undefined) {
-        changes.logged_date = { from: before.logged_date, to: logged_date };
-    }
-    activityService.recordActivity({
-        entity_type: "issue", entity_id: entry.issue_id,
-        actor_id: req.user?.id ?? "system", action: "time_log_updated", workspace_id: entry.workspace_id,
-        changes,
-    }).catch(() => { });
-    res.json({ time_log: updated });
 };
 export const DELETE = async (req, res) => {
-    const issueService = req.scope.resolve("issueModuleService");
-    const activityService = req.scope.resolve("activityModuleService");
-    const entry = await issueService.retrieveTimeLog(req.params.logId);
-    if (!entry) {
-        res.status(404).json({ error: { message: "Time log not found" } });
-        return;
-    }
-    if (entry.user_id !== req.user?.id) {
-        res.status(403).json({ error: { message: "Forbidden" } });
-        return;
-    }
-    const deleted = await issueService.deleteTimeLog(req.params.logId);
-    activityService.recordActivity({
-        entity_type: "issue", entity_id: entry.issue_id,
-        actor_id: req.user?.id ?? "system", action: "time_log_deleted", workspace_id: entry.workspace_id,
-        changes: {
-            duration_minutes: { from: entry.duration_minutes, to: null },
-            description: { from: entry.description, to: null },
-        },
-    }).catch(() => { });
-    res.json({ time_log: deleted });
+    requirePermission("issue:update")(req, res, async () => {
+        const issueService = req.scope.resolve("issueModuleService");
+        const activityService = req.scope.resolve("activityModuleService");
+        const entry = await issueService.retrieveTimeLog(req.params.logId);
+        if (!entry) {
+            res.status(404).json({ error: { message: "Time log not found" } });
+            return;
+        }
+        if (entry.user_id !== req.user?.id) {
+            res.status(403).json({ error: { message: "Forbidden" } });
+            return;
+        }
+        const deleted = await issueService.deleteTimeLog(req.params.logId);
+        activityService.recordActivity({
+            entity_type: "issue", entity_id: entry.issue_id,
+            actor_id: req.user?.id ?? "system", action: "time_log_deleted", workspace_id: entry.workspace_id,
+            changes: {
+                duration_minutes: { from: entry.duration_minutes, to: null },
+                description: { from: entry.description, to: null },
+            },
+        }).catch(() => { });
+        res.json({ time_log: deleted });
+    });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/issues/[id]/time-logs/[logId]/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/[logId]/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAQ,CAAA;IACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAA;QAClE,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAE/D,4CAA4C;IAC5C,MAAM,MAAM,GAAG;QACb,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QACjE,gBAAgB;QAChB,WAAW;QACX,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,OAAO,GAAmD,EAAE,CAAA;IAClE,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnF,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACpE,OAAO,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAA;IACrE,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAA;IACrE,CAAC;IAED,eAAe,CAAC,cAAc,CAAC;QAC7B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;QAC/C,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChG,OAAO;KACR,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;AACjC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAQ,CAAA;IACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAA;QAClE,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACzD,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAElE,eAAe,CAAC,cAAc,CAAC;QAC7B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;QAC/C,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChG,OAAO,EAAE;YACP,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE;YAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE;SACnD;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAElB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;AACjC,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/[logId]/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAQ,CAAA;QACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAE/D,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;YACjE,gBAAgB;YAChB,WAAW;YACX,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAA;QAEF,MAAM,OAAO,GAAmD,EAAE,CAAA;QAClE,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACnF,OAAO,CAAC,gBAAgB,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAA;QACpF,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACpE,OAAO,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAA;QACrE,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAA;QACrE,CAAC;QAED,eAAe,CAAC,cAAc,CAAC;YAC7B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;YAC/C,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChG,OAAO;SACR,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAElB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACtD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAQ,CAAA;QACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YACzD,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAElE,eAAe,CAAC,cAAc,CAAC;YAC7B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ;YAC/C,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChG,OAAO,EAAE;gBACP,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE;gBAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE;aACnD;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAElB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/time-logs/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAKhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAgBjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/time-logs/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAKhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAkBjD,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/route.js

@@ -1,3 +1,4 @@
+import { requirePermission } from "@meridianjs/auth";
 export const GET = async (req, res) => {
     const issueService = req.scope.resolve("issueModuleService");
     const logs = await issueService.listTimeLogsByIssue(req.params.id);
@@ -5,23 +6,25 @@ export const GET = async (req, res) => {
     res.json({ time_logs: logs, total_minutes });
 };
 export const POST = async (req, res) => {
-    const issueService = req.scope.resolve("issueModuleService");
-    const { duration_minutes, description, logged_date } = req.body;
-    if (typeof duration_minutes !== "number" || duration_minutes <= 0) {
-        res.status(400).json({ error: { message: "duration_minutes must be a positive number." } });
-        return;
-    }
-    const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
-    if (!issue) {
-        res.status(404).json({ error: { message: "Issue not found." } });
-        return;
-    }
-    const entry = await issueService.createManualTimeLog({
-        issue_id: req.params.id, user_id: req.user?.id ?? "system", workspace_id: issue.workspace_id,
-        project_id: issue.project_id ?? undefined,
-        duration_minutes, description: description ?? null,
-        logged_date: logged_date ? new Date(logged_date) : undefined,
+    requirePermission("issue:update")(req, res, async () => {
+        const issueService = req.scope.resolve("issueModuleService");
+        const { duration_minutes, description, logged_date } = req.body;
+        if (typeof duration_minutes !== "number" || duration_minutes <= 0) {
+            res.status(400).json({ error: { message: "duration_minutes must be a positive number." } });
+            return;
+        }
+        const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
+        if (!issue) {
+            res.status(404).json({ error: { message: "Issue not found." } });
+            return;
+        }
+        const entry = await issueService.createManualTimeLog({
+            issue_id: req.params.id, user_id: req.user?.id ?? "system", workspace_id: issue.workspace_id,
+            project_id: issue.project_id ?? undefined,
+            duration_minutes, description: description ?? null,
+            logged_date: logged_date ? new Date(logged_date) : undefined,
+        });
+        res.status(201).json({ time_log: entry });
     });
-    res.status(201).json({ time_log: entry });
 };
 //# sourceMappingURL=route.js.map

package/dist/api/admin/issues/[id]/time-logs/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/time-logs/route.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,aAAa,GAAI,IAAc,CAAC,MAAM,CAAC,CAAC,GAAW,EAAE,GAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7G,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IAC/D,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE,CAAC,CAAA;QAC3F,OAAM;IACR,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAAC,OAAM;IAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC;QACnD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAC5F,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;QACzC,gBAAgB,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI;QAClD,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC,CAAA;IACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AAC3C,CAAC,CAAA"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../../src/api/admin/issues/[id]/time-logs/route.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;IACnE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,aAAa,GAAI,IAAc,CAAC,MAAM,CAAC,CAAC,GAAW,EAAE,GAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7G,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAE,GAAa,EAAE,EAAE;IACpD,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAQ,CAAA;QACnE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;QAC/D,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE,CAAC,CAAA;YAC3F,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAAC,OAAM;QAAC,CAAC;QACxF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC;YACnD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC5F,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;YACzC,gBAAgB,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI;YAClD,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,CAAA;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/timer/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/timer/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAGvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAIhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA0BjD,CAAA"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/api/admin/issues/[id]/time-logs/timer/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIvC,eAAO,MAAM,GAAG,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBAIhD,CAAA;AAED,eAAO,MAAM,IAAI,GAAU,KAAK,GAAG,EAAE,KAAK,QAAQ,kBA4BjD,CAAA"}

package/dist/api/admin/issues/[id]/time-logs/timer/route.js

@@ -1,3 +1,4 @@
+import { requirePermission } from "@meridianjs/auth";
 import { sseManager } from "@meridianjs/framework";
 export const GET = async (req, res) => {
     const issueService = req.scope.resolve("issueModuleService");
@@ -5,33 +6,35 @@ export const GET = async (req, res) => {
     res.json({ active_timer: active ?? null });
 };
 export const POST = async (req, res) => {
-    const issueService = req.scope.resolve("issueModuleService");
-    const { action } = req.body;
-    if (action !== "start" && action !== "stop") {
-        res.status(400).json({ error: { message: "action must be 'start' or 'stop'." } });
-        return;
-    }
-    if (action === "start") {
-        const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
-        if (!issue) {
-            res.status(404).json({ error: { message: "Issue not found." } });
+    requirePermission("issue:update")(req, res, async () => {
+        const issueService = req.scope.resolve("issueModuleService");
+        const { action } = req.body;
+        if (action !== "start" && action !== "stop") {
+            res.status(400).json({ error: { message: "action must be 'start' or 'stop'." } });
             return;
         }
-        const { entry, stoppedEntry } = await issueService.startTimer(req.params.id, req.user?.id ?? "system", issue.workspace_id, issue.project_id ?? undefined);
-        sseManager.broadcast(issue.workspace_id, "timer.started", { issue_id: req.params.id, user_id: req.user?.id ?? "system" });
-        if (stoppedEntry) {
-            sseManager.broadcast(issue.workspace_id, "timer.stopped", { issue_id: stoppedEntry.issue_id, user_id: req.user?.id ?? "system" });
+        if (action === "start") {
+            const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
+            if (!issue) {
+                res.status(404).json({ error: { message: "Issue not found." } });
+                return;
+            }
+            const { entry, stoppedEntry } = await issueService.startTimer(req.params.id, req.user?.id ?? "system", issue.workspace_id, issue.project_id ?? undefined);
+            sseManager.broadcast(issue.workspace_id, "timer.started", { issue_id: req.params.id, user_id: req.user?.id ?? "system" });
+            if (stoppedEntry) {
+                sseManager.broadcast(issue.workspace_id, "timer.stopped", { issue_id: stoppedEntry.issue_id, user_id: req.user?.id ?? "system" });
+            }
+            res.status(201).json({ time_log: entry, stopped_timer: stoppedEntry ?? null });
+            return;
         }
-        res.status(201).json({ time_log: entry, stopped_timer: stoppedEntry ?? null });
-        return;
-    }
-    const entry = await issueService.stopTimer(req.params.id, req.user?.id ?? "system");
-    if (entry) {
-        const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
-        if (issue) {
-            sseManager.broadcast(issue.workspace_id, "timer.stopped", { issue_id: req.params.id, user_id: req.user?.id ?? "system" });
+        const entry = await issueService.stopTimer(req.params.id, req.user?.id ?? "system");
+        if (entry) {
+            const issue = await issueService.retrieveIssue(req.params.id).catch(() => null);
+            if (issue) {
+                sseManager.broadcast(issue.workspace_id, "timer.stopped", { issue_id: req.params.id, user_id: req.user?.id ?? "system" });
+            }
         }
-    }
-    res.json({ time_log: entry });
+        res.json({ time_log: entry });
+    });
 };
 //# sourceMappingURL=route.js.map