@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/public-api/http/controllers/public-entry-writes.controller.js

@@ -0,0 +1,353 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicEntryWritesController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_tokens_1 = require("../../../content.tokens");
+const workspace_grants_query_1 = require("../../../content-types/queries/workspace-grants.query");
+const public_entry_writes_service_1 = require("../../infrastructure/public-entry-writes.service");
+const api_token_guard_1 = require("../guards/api-token.guard");
+const api_token_workspace_guard_1 = require("../guards/api-token-workspace.guard");
+const public_save_entry_dto_1 = require("../dto/public-save-entry.dto");
+const public_bulk_dto_1 = require("../dto/public-bulk.dto");
+const entries_constants_1 = require("../../../entries/entries.constants");
+const public_list_entries_query_dto_1 = require("../dto/public-list-entries-query.dto");
+const resolve_granted_type_1 = require("./resolve-granted-type");
+/**
+ * `POST|PATCH|DELETE /api/v1/content/...` — the **write half** of the public,
+ * token-authenticated content API. A `full`-scope token can author content from
+ * outside the admin: create drafts, edit them, assign and unassign relations,
+ * add translations, publish, and remove.
+ *
+ * Every route is gated by its own permission (`content:create` / `update` /
+ * `publish` / `delete`), which `ApiTokenGuard` evaluates against the token's
+ * scope through the same `AccessPolicy` the session routes use. A `read` token
+ * therefore gets a **403** on all of them without a line of code here saying so.
+ *
+ * **Batches sit alongside the single-entry writes, not instead of them**
+ * (`/bulk`, `/bulk/publish`, `/bulk/unpublish`, `/bulk/delete`). They exist
+ * because an external client is usually syncing a list — an import, a scheduled
+ * republish — and doing that one HTTP round trip per record is the difference
+ * between a job that finishes and one that times out. Every one of them runs the
+ * same use-case its single-entry sibling does, so a batch is a way of *asking*,
+ * never a second set of rules.
+ *
+ * Like the reads, every single-entry write exists in **both addressing forms** —
+ * `:id` and `group/:localeGroupId` — so a localized client that holds group ids
+ * can edit, publish, and delete without ever learning a per-locale id.
+ *
+ * **No `OriginGuard`**, unlike the admin's write controllers: those are
+ * cookie-authenticated and so CSRF-able, while a bearer token is never sent
+ * ambiently by a browser. Requiring an `Origin` header here would reject every
+ * server-side client instead of protecting anything.
+ */
+let PublicEntryWritesController = class PublicEntryWritesController {
+    registry;
+    grants;
+    writes;
+    constructor(registry, grants, writes) {
+        this.registry = registry;
+        this.grants = grants;
+        this.writes = writes;
+    }
+    /** `POST /api/v1/content/:typeName` — create a draft entry. */
+    async create(typeName, body, workspaceId) {
+        const { type, granted } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.create(type, body, workspaceId, granted);
+    }
+    // ---- batches -----------------------------------------------------------
+    //
+    // **Declared before the `:id` routes**, because `bulk/publish` and
+    // `:id/publish` are the same shape to the router and Express matches in
+    // declaration order — the single-entry routes' `ParseUUIDPipe` is a backstop
+    // that turns a mis-ordered match into a 400, not a substitute for the order.
+    // Same arrangement, same reason, as the admin's `BulkEntriesController`.
+    /** `POST /api/v1/content/:typeName/bulk` — create and/or update many entries. */
+    async bulkSave(typeName, body, workspaceId) {
+        const { type, granted } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.bulkSave(type, body.items, workspaceId, granted);
+    }
+    /** `POST /api/v1/content/:typeName/bulk/publish` — take many entries live. */
+    async bulkPublish(typeName, body, workspaceId) {
+        const { type } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.bulkPublish(type, body.ids, workspaceId);
+    }
+    /** `POST /api/v1/content/:typeName/bulk/unpublish` — take many off the air. */
+    async bulkUnpublish(typeName, body, workspaceId) {
+        const { type } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.bulkUnpublish(type, body.ids, workspaceId);
+    }
+    /** `POST /api/v1/content/:typeName/bulk/delete` — remove many entries. */
+    async bulkRemove(typeName, body, workspaceId) {
+        const { type } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.bulkRemove(type, body.ids, workspaceId);
+    }
+    // ---- addressed by translation group -----------------------------------
+    //
+    // Declared before the `:id` forms for the same reason as the reads: they
+    // cannot collide on segment count, but Express matches in declaration order
+    // and literal-prefixed routes belong ahead of wildcards.
+    /** `PATCH /api/v1/content/:typeName/group/:localeGroupId` */
+    updateByGroup(typeName, localeGroupId, body, query, workspaceId) {
+        return this.applyUpdate(typeName, { localeGroupId }, body, workspaceId, query.locale);
+    }
+    /** `POST /api/v1/content/:typeName/group/:localeGroupId/publish` */
+    publishByGroup(typeName, localeGroupId, query, workspaceId) {
+        return this.applyPublish(typeName, { localeGroupId }, workspaceId, query.locale, true);
+    }
+    /** `POST /api/v1/content/:typeName/group/:localeGroupId/unpublish` */
+    unpublishByGroup(typeName, localeGroupId, query, workspaceId) {
+        return this.applyPublish(typeName, { localeGroupId }, workspaceId, query.locale, false);
+    }
+    /** `DELETE /api/v1/content/:typeName/group/:localeGroupId` */
+    removeByGroup(typeName, localeGroupId, query, workspaceId) {
+        return this.applyRemove(typeName, { localeGroupId }, workspaceId, query.locale);
+    }
+    // ---- addressed by entry id ---------------------------------------------
+    /** `PATCH /api/v1/content/:typeName/:id` — replace an entry's values. */
+    update(typeName, id, body, workspaceId) {
+        // No locale: an entry id already names exactly one row, in whatever
+        // locale it happens to be.
+        return this.applyUpdate(typeName, { id }, body, workspaceId, undefined);
+    }
+    /** `POST /api/v1/content/:typeName/:id/publish` — take an entry live. */
+    publish(typeName, id, workspaceId) {
+        return this.applyPublish(typeName, { id }, workspaceId, undefined, true);
+    }
+    /** `POST /api/v1/content/:typeName/:id/unpublish` — take it off the air. */
+    unpublish(typeName, id, workspaceId) {
+        return this.applyPublish(typeName, { id }, workspaceId, undefined, false);
+    }
+    /** `DELETE /api/v1/content/:typeName/:id` — remove an entry. */
+    remove(typeName, id, workspaceId) {
+        return this.applyRemove(typeName, { id }, workspaceId, undefined);
+    }
+    // ---- the shared handlers, one per write --------------------------------
+    //
+    // Each is called by both addressing forms, so the pair stays a routing
+    // detail and never a behavioural fork — the same arrangement as the reads.
+    /** @see update */
+    async applyUpdate(typeName, locator, body, workspaceId, locale) {
+        const { type, granted } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return this.writes.update(type, locator, body, workspaceId, granted, locale);
+    }
+    /** @see publish */
+    async applyPublish(typeName, locator, workspaceId, locale, live) {
+        const { type, granted } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        return live
+            ? this.writes.publish(type, locator, workspaceId, granted, locale)
+            : this.writes.unpublish(type, locator, workspaceId, granted, locale);
+    }
+    /** @see remove */
+    async applyRemove(typeName, locator, workspaceId, locale) {
+        const { type } = await (0, resolve_granted_type_1.resolveGrantedType)(this.registry, this.grants, typeName, workspaceId);
+        await this.writes.remove(type, locator, workspaceId, locale);
+    }
+};
+exports.PublicEntryWritesController = PublicEntryWritesController;
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_CREATE),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Create an entry',
+        description: 'Creates the entry as a **draft** on publishable types — publish is a separate call, so a create always has a reviewable state. `values` is validated against the type’s field specs (422 with per-field issues). Pass `localeGroupId` with a different `locale` to add a translation to an existing record. 404 when the type is unknown or the workspace was not granted it.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, public_save_entry_dto_1.PublicSaveEntryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "create", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/bulk'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_CREATE, identity_server_1.PERMISSIONS.CONTENT_UPDATE),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Save many entries',
+        description: `Creates and/or updates up to ${entries_constants_1.BULK_MAX_SAVE_ITEMS} entries of one type in a single request — an item with an \`id\` updates that entry, one without creates a new draft, and an item naming only a \`localeGroupId\` must say which with \`op\`. Each item means exactly what the equivalent \`POST\` / \`PATCH\` means, merge semantics and all.\n\n**Always 200, even when items fail.** Items are written one transaction at a time, so a batch cannot be rolled back as a unit and one bad row does not reject the rest: the response carries a verdict per item in request order, with failures reporting the status and message the single-entry call would have returned (a 422 keeps its per-field \`issues\`). Retry the failures you can fix. Both \`content:create\` and \`content:update\` are required, since one request may do either.`
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, public_bulk_dto_1.PublicBulkSaveDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "bulkSave", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/bulk/publish'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Publish many entries',
+        description: 'Re-validates the listed drafts inside **one locked transaction** and publishes those that pass, reporting the rest in `skipped` with why — `already-published`, `blocked` (validation), or `not-found` (unknown, soft-deleted, or in another workspace). Partial success is the normal outcome, not an error. 400 on a type that is not publishable.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, public_bulk_dto_1.PublicBulkIdsDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "bulkPublish", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/bulk/unpublish'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Unpublish many entries',
+        description: 'Reverts the listed entries to drafts. `count` is how many actually transitioned — an id that was not a live published row of this workspace changes nothing and is not counted, which is the only way this call can "fail" for an id.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, public_bulk_dto_1.PublicBulkIdsDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "bulkUnpublish", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/bulk/delete'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_DELETE),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete many entries',
+        description: 'Soft-deletes on a `paranoid` type (recoverable from the admin’s trash) and hard-deletes otherwise. `count` is how many rows were removed. Deletes exactly the listed rows: on a localized type the other translations stay live.\n\nA `POST`, not a `DELETE`, because the ids travel in a body — the one thing a `DELETE` cannot reliably carry through proxies and client libraries.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, public_bulk_dto_1.PublicBulkIdsDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "bulkRemove", null);
+tslib_1.__decorate([
+    (0, common_1.Patch)(':typeName/group/:localeGroupId'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_UPDATE),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Update the group’s entry for a locale',
+        description: 'As the `:id` form, for the group’s row in the requested `?locale=`.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('localeGroupId', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Body)()),
+    tslib_1.__param(3, (0, common_1.Query)()),
+    tslib_1.__param(4, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, public_save_entry_dto_1.PublicSaveEntryDto,
+        public_list_entries_query_dto_1.PublicEntryQueryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "updateByGroup", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/group/:localeGroupId/publish'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({ summary: 'Publish the group’s entry for a locale' }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('localeGroupId', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Query)()),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, public_list_entries_query_dto_1.PublicEntryQueryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "publishByGroup", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/group/:localeGroupId/unpublish'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({ summary: 'Unpublish the group’s entry for a locale' }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('localeGroupId', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Query)()),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, public_list_entries_query_dto_1.PublicEntryQueryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "unpublishByGroup", null);
+tslib_1.__decorate([
+    (0, common_1.Delete)(':typeName/group/:localeGroupId'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_DELETE),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete the group’s entry for a locale',
+        description: 'Removes **one** translation — the group’s row in the requested `?locale=`. The other locales stay live.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('localeGroupId', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Query)()),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, public_list_entries_query_dto_1.PublicEntryQueryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "removeByGroup", null);
+tslib_1.__decorate([
+    (0, common_1.Patch)(':typeName/:id'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_UPDATE),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Update an entry',
+        description: 'A **partial** update: the `values` you send are merged over the stored ones, so omitting a field leaves it alone and sending `null` clears it. (The admin’s own PATCH replaces the whole bag — the editor always submits the full document — but an API client sends the two fields it changed, and silently nulling the rest would be invisible until a later publish failed.) `relations` deltas apply in the same transaction. On a publishable type a published entry moves back to **draft** while its published version stays live, so an edit never silently changes what the world is reading — publish again to ship it. 404 when no such entry exists in this workspace.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Body)()),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, public_save_entry_dto_1.PublicSaveEntryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "update", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/:id/publish'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Publish an entry',
+        description: 'Re-validates the stored row and takes it live. A draft that no longer passes validation is a 422 — `required` means required *to publish*, so an incomplete draft is legal right up until this call. 400 on a type that is not publishable.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "publish", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/:id/unpublish'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Unpublish an entry',
+        description: 'Reverts the entry to a draft. It leaves the published reads immediately; a write-scoped token can still see it with `?status=draft`.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "unpublish", null);
+tslib_1.__decorate([
+    (0, common_1.Delete)(':typeName/:id'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_DELETE),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete an entry',
+        description: 'Soft-deletes on a `paranoid` type (recoverable from the admin’s trash, invisible here either way) and hard-deletes otherwise. Deletes exactly this row: on a localized type the other translations of the group stay live.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublicEntryWritesController.prototype, "remove", null);
+exports.PublicEntryWritesController = PublicEntryWritesController = tslib_1.__decorate([
+    (0, identity_server_1.Public)(),
+    (0, common_1.UseGuards)(api_token_guard_1.ApiTokenGuard, api_token_workspace_guard_1.ApiTokenWorkspaceGuard),
+    (0, swagger_1.ApiSecurity)('apiToken'),
+    (0, swagger_1.ApiHeader)({
+        name: 'X-Workspace-Id',
+        required: false,
+        description: "The workspace to write in. Required when the token covers more than one workspace; optional when it covers exactly one. A workspace outside the token's bucket is a 403."
+    }),
+    (0, common_1.Controller)('v1/content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, workspace_grants_query_1.WorkspaceGrantsQuery,
+        public_entry_writes_service_1.PublicEntryWritesService])
+], PublicEntryWritesController);

package/dist/lib/public-api/http/controllers/resolve-granted-type.d.ts

@@ -0,0 +1,42 @@
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import type { AnyContentType } from '../../../types/content-type';
+/**
+ * Where this resolver reads a workspace's content grants from.
+ *
+ * A structural port rather than `WorkspaceGrantsQuery` itself, so a caller that
+ * has **already** read the grant set for the current request can supply it
+ * instead of provoking one query per resolved type. `WorkspaceGrantsQuery`
+ * satisfies it as-is; the GraphQL endpoint passes a cache over it, because a
+ * single document resolves many types and they must all see one consistent
+ * grant set anyway.
+ */
+export interface ContentGrantsSource {
+    /** Every content slug granted to `workspaceId`. */
+    grantedSlugs(workspaceId: string): Promise<ReadonlySet<string>>;
+}
+/**
+ * A resolved type plus the workspace's full grant set. The grants are returned
+ * alongside because the filter surface needs them to prune relation traversals
+ * into ungranted types — reading them once per request rather than twice.
+ */
+export interface GrantedType {
+    /** The registered, granted content type the route targets. */
+    type: AnyContentType;
+    /** Every content slug the workspace was granted. */
+    granted: ReadonlySet<string>;
+}
+/**
+ * Resolve a `:typeName` for a public-API request: it must be a registered
+ * content type **and** one the target workspace has been granted
+ * (`workspace_content`). Anything else — unknown name, or a real type this
+ * workspace was never granted — is the same 404, so a token can't enumerate
+ * the content model beyond what its workspace actually exposes.
+ *
+ * Grants are enforced here even though the admin's own entries list doesn't
+ * check them: the admin caller is a member of the workspace looking at its own
+ * CMS, while a token is an external credential, and the grant set is exactly
+ * the workspace's declared content surface. `GET /api/v1/content-types` lists
+ * that same set, so a consumer never has to guess which names will 404.
+ */
+export declare function resolveGrantedType(registry: ContentTypeRegistry, grants: ContentGrantsSource, typeName: string, workspaceId: string): Promise<GrantedType>;
+//# sourceMappingURL=resolve-granted-type.d.ts.map

package/dist/lib/public-api/http/controllers/resolve-granted-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-granted-type.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/controllers/resolve-granted-type.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAChC,mDAAmD;IACnD,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACnE;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,8DAA8D;IAC9D,IAAI,EAAE,cAAc,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACpC,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAOtB"}

package/dist/lib/public-api/http/controllers/resolve-granted-type.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGrantedType = resolveGrantedType;
+const common_1 = require("@nestjs/common");
+/**
+ * Resolve a `:typeName` for a public-API request: it must be a registered
+ * content type **and** one the target workspace has been granted
+ * (`workspace_content`). Anything else — unknown name, or a real type this
+ * workspace was never granted — is the same 404, so a token can't enumerate
+ * the content model beyond what its workspace actually exposes.
+ *
+ * Grants are enforced here even though the admin's own entries list doesn't
+ * check them: the admin caller is a member of the workspace looking at its own
+ * CMS, while a token is an external credential, and the grant set is exactly
+ * the workspace's declared content surface. `GET /api/v1/content-types` lists
+ * that same set, so a consumer never has to guess which names will 404.
+ */
+async function resolveGrantedType(registry, grants, typeName, workspaceId) {
+    const type = registry.get(typeName);
+    const granted = await grants.grantedSlugs(workspaceId);
+    if (!type || !granted.has(typeName)) {
+        throw new common_1.NotFoundException(`Unknown content type "${typeName}".`);
+    }
+    return { type, granted };
+}

package/dist/lib/public-api/http/decorators/current-api-token.decorator.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Parameter decorator returning the {@link PublicApiToken} that
+ * {@link ApiTokenGuard} verified and attached. Use it only on routes carrying
+ * that guard — without it the request carries no token, so this throws rather
+ * than handing a handler an `undefined` caller identity.
+ */
+export declare const CurrentApiToken: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-api-token.decorator.d.ts.map

package/dist/lib/public-api/http/decorators/current-api-token.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-api-token.decorator.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/decorators/current-api-token.decorator.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,eAAO,MAAM,eAAe,mDAU3B,CAAC"}

package/dist/lib/public-api/http/decorators/current-api-token.decorator.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentApiToken = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Parameter decorator returning the {@link PublicApiToken} that
+ * {@link ApiTokenGuard} verified and attached. Use it only on routes carrying
+ * that guard — without it the request carries no token, so this throws rather
+ * than handing a handler an `undefined` caller identity.
+ */
+exports.CurrentApiToken = (0, common_1.createParamDecorator)((_data, context) => {
+    const request = context.switchToHttp().getRequest();
+    if (!request.apiToken) {
+        throw new common_1.InternalServerErrorException('@CurrentApiToken() used on a route without ApiTokenGuard.');
+    }
+    return request.apiToken;
+});

package/dist/lib/public-api/http/dto/public-bulk.dto.d.ts

@@ -0,0 +1,58 @@
+import { type BulkSaveOp } from '../../types/public-bulk';
+import { PublicSaveEntryDto } from './public-save-entry.dto';
+/**
+ * One entry in a bulk save — a {@link PublicSaveEntryDto} plus the addressing a
+ * single-entry write takes from its URL.
+ *
+ * **It extends the single-entry body rather than restating it**, so `values`,
+ * `relations`, `locale` and `localeGroupId` mean exactly what they mean on
+ * `POST`/`PATCH` and cannot drift from them — including the delta caps, which a
+ * hand-rolled item schema would have quietly dropped.
+ */
+export declare class PublicBulkSaveItemDto extends PublicSaveEntryDto {
+    /**
+     * The entry to update — the `:id` of the single-entry `PATCH`. Absent on a
+     * create.
+     */
+    id?: string;
+    /**
+     * What this item does, when the addressing alone does not say.
+     *
+     * Only ever **required** for the one genuinely ambiguous shape: a
+     * `localeGroupId` with no `id`, which is either "create this record's row in
+     * another language" or "update the row this group already has in `locale`".
+     * Every other item infers it (see `resolveBulkSaveOp`), because making a
+     * plain list of new entries carry `op: "create"` on every element is noise
+     * for a rule that has exactly one exception.
+     */
+    op?: BulkSaveOp;
+}
+/**
+ * Body of `POST /v1/content/:typeName/bulk` — the entries to save.
+ *
+ * Capped at {@link BULK_MAX_SAVE_ITEMS}, which is deliberately lower than the
+ * id-only bulk actions' cap: every item here carries a whole document and
+ * provokes its own write transaction.
+ */
+export declare class PublicBulkSaveDto {
+    /** The entries to create and/or update, in the order they should be tried. */
+    items: PublicBulkSaveItemDto[];
+}
+/**
+ * Body of the public bulk **actions** — `bulk/publish`, `bulk/unpublish`,
+ * `bulk/delete`: the entry ids to act on.
+ *
+ * `{ ids }` rather than the save endpoint's `{ items }`, because these carry no
+ * document — and because it is the shape the admin's bulk routes have always
+ * taken, so a consumer moving between the two surfaces learns one body, not
+ * two. Capped at {@link BULK_MAX_IDS}, the same bound those routes apply.
+ *
+ * Entry **ids**, not translation groups: a group names a record across
+ * languages, and publishing "the record" would mean publishing translations the
+ * caller never listed. Address the rows themselves, one locale at a time.
+ */
+export declare class PublicBulkIdsDto {
+    /** Entry ids to act on. */
+    ids: string[];
+}
+//# sourceMappingURL=public-bulk.dto.d.ts.map

package/dist/lib/public-api/http/dto/public-bulk.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-bulk.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/dto/public-bulk.dto.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAK7D;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;IACzD;;;OAGG;IASH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;;;;;;;OASG;IAQH,EAAE,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC1B,8EAA8E;IAY9E,KAAK,EAAG,qBAAqB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,gBAAgB;IACzB,2BAA2B;IAa3B,GAAG,EAAG,MAAM,EAAE,CAAC;CAClB"}

package/dist/lib/public-api/http/dto/public-bulk.dto.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicBulkIdsDto = exports.PublicBulkSaveDto = exports.PublicBulkSaveItemDto = void 0;
+const tslib_1 = require("tslib");
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const entries_constants_1 = require("../../../entries/entries.constants");
+const public_bulk_1 = require("../../types/public-bulk");
+const public_save_entry_dto_1 = require("./public-save-entry.dto");
+/** The two operations a bulk-save item may name explicitly. */
+const BULK_SAVE_OPS = Object.values(public_bulk_1.BULK_SAVE_OP);
+/**
+ * One entry in a bulk save — a {@link PublicSaveEntryDto} plus the addressing a
+ * single-entry write takes from its URL.
+ *
+ * **It extends the single-entry body rather than restating it**, so `values`,
+ * `relations`, `locale` and `localeGroupId` mean exactly what they mean on
+ * `POST`/`PATCH` and cannot drift from them — including the delta caps, which a
+ * hand-rolled item schema would have quietly dropped.
+ */
+class PublicBulkSaveItemDto extends public_save_entry_dto_1.PublicSaveEntryDto {
+    /**
+     * The entry to update — the `:id` of the single-entry `PATCH`. Absent on a
+     * create.
+     */
+    id;
+    /**
+     * What this item does, when the addressing alone does not say.
+     *
+     * Only ever **required** for the one genuinely ambiguous shape: a
+     * `localeGroupId` with no `id`, which is either "create this record's row in
+     * another language" or "update the row this group already has in `locale`".
+     * Every other item infers it (see `resolveBulkSaveOp`), because making a
+     * plain list of new entries carry `op: "create"` on every element is noise
+     * for a rule that has exactly one exception.
+     */
+    op;
+}
+exports.PublicBulkSaveItemDto = PublicBulkSaveItemDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        format: 'uuid',
+        description: 'The entry to update — what you would put in the `PATCH` path. Absent means this item creates an entry.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    tslib_1.__metadata("design:type", String)
+], PublicBulkSaveItemDto.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        enum: BULK_SAVE_OPS,
+        description: 'What this item does. Inferred when the item is unambiguous — an `id` means update, neither `id` nor `localeGroupId` means create — and **required** when only `localeGroupId` is given, which could be either creating that record’s row in a new locale or updating the row it already has there.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)(BULK_SAVE_OPS),
+    tslib_1.__metadata("design:type", String)
+], PublicBulkSaveItemDto.prototype, "op", void 0);
+/**
+ * Body of `POST /v1/content/:typeName/bulk` — the entries to save.
+ *
+ * Capped at {@link BULK_MAX_SAVE_ITEMS}, which is deliberately lower than the
+ * id-only bulk actions' cap: every item here carries a whole document and
+ * provokes its own write transaction.
+ */
+class PublicBulkSaveDto {
+    /** The entries to create and/or update, in the order they should be tried. */
+    items;
+}
+exports.PublicBulkSaveDto = PublicBulkSaveDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [PublicBulkSaveItemDto],
+        minItems: 1,
+        maxItems: entries_constants_1.BULK_MAX_SAVE_ITEMS,
+        description: `The entries to save, applied in order and reported back positionally. Non-empty and capped at ${entries_constants_1.BULK_MAX_SAVE_ITEMS} — each item is a full document and its own write, so the cap bounds both the body and the work one request can start.`
+    }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.ArrayMaxSize)(entries_constants_1.BULK_MAX_SAVE_ITEMS),
+    (0, class_validator_1.ValidateNested)({ each: true }),
+    (0, class_transformer_1.Type)(() => PublicBulkSaveItemDto),
+    tslib_1.__metadata("design:type", Array)
+], PublicBulkSaveDto.prototype, "items", void 0);
+/**
+ * Body of the public bulk **actions** — `bulk/publish`, `bulk/unpublish`,
+ * `bulk/delete`: the entry ids to act on.
+ *
+ * `{ ids }` rather than the save endpoint's `{ items }`, because these carry no
+ * document — and because it is the shape the admin's bulk routes have always
+ * taken, so a consumer moving between the two surfaces learns one body, not
+ * two. Capped at {@link BULK_MAX_IDS}, the same bound those routes apply.
+ *
+ * Entry **ids**, not translation groups: a group names a record across
+ * languages, and publishing "the record" would mean publishing translations the
+ * caller never listed. Address the rows themselves, one locale at a time.
+ */
+class PublicBulkIdsDto {
+    /** Entry ids to act on. */
+    ids;
+}
+exports.PublicBulkIdsDto = PublicBulkIdsDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [String],
+        format: 'uuid',
+        minItems: 1,
+        maxItems: entries_constants_1.BULK_MAX_IDS,
+        example: ['3f1a7c1e-9d2b-4a6f-8c11-5b8e2f0d7a91'],
+        description: `Entry ids to act on — non-empty and capped at ${entries_constants_1.BULK_MAX_IDS}. Ids outside this workspace simply do not match; nothing distinguishes them from ids that never existed.`
+    }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.ArrayMaxSize)(entries_constants_1.BULK_MAX_IDS),
+    (0, class_validator_1.IsUUID)('4', { each: true }),
+    tslib_1.__metadata("design:type", Array)
+], PublicBulkIdsDto.prototype, "ids", void 0);