@plandesk/api 0.20.0 → 1.0.0-beta.1

package/dist/services/goals.js

@@ -1,5 +1,7 @@
-import { createGoal, createTask, getGoal, getProject, InvalidGoalStatusError, isGoalStatus, listGoals, listTagsByTaskForProject, listTasks, updateGoal, updateGoalStatus, updateTask, } from '@plandesk/db';
+import { withTransaction, createGoal, createTask, getGoal, getProject, InvalidGoalStatusError, isGoalStatus, listGoals, listTagsByTaskForProject, listTasks, updateGoal, updateGoalStatus, updateTask, } from '@plandesk/db';
 import { serializeGoal, serializeTask } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export class InvalidGoalTransitionError extends Error {
     constructor(message) {
         super(message);
@@ -112,17 +114,17 @@ function validateVerificationSurfaceInput(raw) {
 function acceptanceBlockMarker(goalId) {
     return `Acceptance-block-for: ${goalId}`;
 }
-function hasUnresolvedBlockingTask(db, projectId, goalId) {
+async function hasUnresolvedBlockingTask(db, projectId, goalId) {
     const marker = acceptanceBlockMarker(goalId);
-    return listTasks(db, projectId).some((task) => task.goalId === goalId && task.status === 'scope' && task.description?.includes(marker));
+    return (await listTasks(db, projectId)).some((task) => task.goalId === goalId && task.status === 'scope' && task.description?.includes(marker));
 }
 // When acceptance finally passes, the remediation task filed on the earlier red
 // result is obsolete — resolve it so a completed goal never shows open work.
-function resolveBlockingTasks(db, projectId, goalId) {
+async function resolveBlockingTasks(db, projectId, goalId) {
     const marker = acceptanceBlockMarker(goalId);
-    for (const task of listTasks(db, projectId)) {
+    for (const task of await listTasks(db, projectId)) {
         if (task.goalId === goalId && task.status !== 'done' && task.description?.includes(marker)) {
-            updateTask(db, task.id, { status: 'done' });
+            await updateTask(db, task.id, { status: 'done' });
         }
     }
 }
@@ -139,15 +141,12 @@ function buildBlockingTaskDescription(goalId, surfaceKind, detail) {
     }
     return lines.join('\n');
 }
-function cycleTasksForGoal(db, projectId, goalId) {
-    const tagsByTask = listTagsByTaskForProject(db, projectId);
-    return listTasks(db, projectId)
+async function cycleTasksForGoal(db, projectId, goalId) {
+    const tagsByTask = await listTagsByTaskForProject(db, projectId);
+    return (await listTasks(db, projectId))
         .filter((task) => task.goalId === goalId)
         .map((task) => serializeTask(task, tagsByTask.get(task.id) ?? []));
 }
-function emitGoalUpdated(eventBus, goalId, projectId) {
-    eventBus.emit({ type: 'goal_updated', goalId, projectId });
-}
 function recordLastVerification(at, green, kind, detail) {
     const record = { at, green, kind };
     if (detail) {
@@ -156,18 +155,24 @@ function recordLastVerification(at, green, kind, detail) {
     return JSON.stringify(record);
 }
 export function createGoalService(deps) {
-    const { db, eventBus } = deps;
+    const { db } = deps;
     return {
-        create(projectId, input) {
+        async create(projectId, input) {
+            assertPermission(deps, 'goal', 'create');
             if (input.status !== undefined && !isGoalStatus(input.status)) {
                 throw new InvalidGoalStatusError(input.status);
             }
             validateVerificationSurfaceInput(input.verificationSurface);
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            const goal = db.transaction((tx) => createGoal(tx, {
+            const goal = await withTransaction(db, async (tx) => createGoal(tx, {
                 projectId,
                 objective: input.objective,
                 status: input.status,
@@ -178,71 +183,76 @@ export function createGoalService(deps) {
                 stopCondition: input.stopCondition,
                 budget: input.budget,
             }));
-            emitGoalUpdated(eventBus, goal.id, projectId);
             return serializeGoal(goal);
         },
-        get(goalId) {
-            const goal = getGoal(db, goalId);
+        async get(goalId) {
+            const goal = await getGoal(db, goalId);
             if (!goal) {
                 return undefined;
             }
             return {
                 ...serializeGoal(goal),
-                cycle_tasks: cycleTasksForGoal(db, goal.projectId, goalId),
+                cycle_tasks: await cycleTasksForGoal(db, goal.projectId, goalId),
             };
         },
-        listByProject(projectId) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async listByProject(projectId) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            return listGoals(db, projectId).map(serializeGoal);
+            return (await listGoals(db, projectId)).map(serializeGoal);
         },
-        update(goalId, input) {
-            const existing = getGoal(db, goalId);
+        async update(goalId, input) {
+            assertPermission(deps, 'goal', 'update');
+            const existing = await getGoal(db, goalId);
             if (!existing) {
                 return undefined;
             }
             validateVerificationSurfaceInput(input.verificationSurface);
-            const goal = db.transaction((tx) => updateGoal(tx, goalId, input));
+            const goal = await withTransaction(db, async (tx) => updateGoal(tx, goalId, input));
             if (!goal) {
                 return undefined;
             }
-            emitGoalUpdated(eventBus, goalId, existing.projectId);
             return serializeGoal(goal);
         },
-        pause(goalId) {
-            const existing = getGoal(db, goalId);
+        async pause(goalId) {
+            assertPermission(deps, 'goal', 'update');
+            const existing = await getGoal(db, goalId);
             if (!existing) {
                 return undefined;
             }
             if (existing.status !== 'active') {
                 throw new InvalidGoalTransitionError('Goal can only be paused from active status');
             }
-            const goal = db.transaction((tx) => updateGoalStatus(tx, goalId, 'paused'));
+            const goal = await withTransaction(db, async (tx) => updateGoalStatus(tx, goalId, 'paused'));
             if (!goal) {
                 return undefined;
             }
-            emitGoalUpdated(eventBus, goalId, existing.projectId);
             return serializeGoal(goal);
         },
-        resume(goalId) {
-            const existing = getGoal(db, goalId);
+        async resume(goalId) {
+            assertPermission(deps, 'goal', 'update');
+            const existing = await getGoal(db, goalId);
             if (!existing) {
                 return undefined;
             }
             if (existing.status !== 'paused') {
                 throw new InvalidGoalTransitionError('Goal can only be resumed from paused status');
             }
-            const goal = db.transaction((tx) => updateGoalStatus(tx, goalId, 'active'));
+            const goal = await withTransaction(db, async (tx) => updateGoalStatus(tx, goalId, 'active'));
             if (!goal) {
                 return undefined;
             }
-            emitGoalUpdated(eventBus, goalId, existing.projectId);
             return serializeGoal(goal);
         },
-        complete(goalId, evidence) {
-            const existing = getGoal(db, goalId);
+        async complete(goalId, evidence) {
+            assertPermission(deps, 'goal', 'update');
+            const existing = await getGoal(db, goalId);
             if (!existing) {
                 return undefined;
             }
@@ -250,7 +260,7 @@ export function createGoalService(deps) {
                 throw new InvalidGoalTransitionError('Goal is already complete');
             }
             if (existing.status !== 'blocked') {
-                const incomplete = listTasks(db, existing.projectId)
+                const incomplete = (await listTasks(db, existing.projectId))
                     .filter((task) => task.goalId === goalId && task.status !== 'done')
                     .map((task) => task.id);
                 if (incomplete.length > 0) {
@@ -260,14 +270,13 @@ export function createGoalService(deps) {
             const surface = parseVerificationSurface(existing.verificationSurface);
             const at = new Date().toISOString();
             if (!surface) {
-                const goal = db.transaction((tx) => updateGoal(tx, goalId, {
+                const goal = await withTransaction(db, async (tx) => updateGoal(tx, goalId, {
                     status: 'complete',
                     lastVerification: recordLastVerification(at, true, null),
                 }));
                 if (!goal) {
                     return undefined;
                 }
-                emitGoalUpdated(eventBus, goalId, existing.projectId);
                 return serializeGoal(goal);
             }
             if (!evidence || evidence.kind !== surface.kind) {
@@ -276,33 +285,32 @@ export function createGoalService(deps) {
             const evaluation = evaluateEvidence(surface, evidence);
             const lastVerification = recordLastVerification(at, evaluation.green, surface.kind, evaluation.detail);
             if (evaluation.green) {
-                const goal = db.transaction((tx) => {
-                    const updated = updateGoal(tx, goalId, {
+                const goal = await withTransaction(db, async (tx) => {
+                    const updated = await updateGoal(tx, goalId, {
                         status: 'complete',
                         lastVerification,
                     });
                     if (!updated) {
                         return undefined;
                     }
-                    resolveBlockingTasks(tx, existing.projectId, goalId);
+                    await resolveBlockingTasks(tx, existing.projectId, goalId);
                     return updated;
                 });
                 if (!goal) {
                     return undefined;
                 }
-                emitGoalUpdated(eventBus, goalId, existing.projectId);
                 return serializeGoal(goal);
             }
-            const goal = db.transaction((tx) => {
-                const updated = updateGoal(tx, goalId, {
+            const goal = await withTransaction(db, async (tx) => {
+                const updated = await updateGoal(tx, goalId, {
                     status: 'blocked',
                     lastVerification,
                 });
                 if (!updated) {
                     return undefined;
                 }
-                if (!hasUnresolvedBlockingTask(tx, existing.projectId, goalId)) {
-                    createTask(tx, {
+                if (!(await hasUnresolvedBlockingTask(tx, existing.projectId, goalId))) {
+                    await createTask(tx, {
                         projectId: existing.projectId,
                         goalId,
                         label: `Fix acceptance failure: ${truncateObjective(existing.objective)}`,
@@ -315,7 +323,6 @@ export function createGoalService(deps) {
             if (!goal) {
                 return undefined;
             }
-            emitGoalUpdated(eventBus, goalId, existing.projectId);
             return serializeGoal(goal);
         },
     };

package/dist/services/index.d.ts

@@ -1,5 +1,4 @@
 import type { Db } from '@plandesk/db';
-import { type EventBus } from '../events.js';
 import { type StorageAdapter } from '../storage/index.js';
 import { type CanvasService } from './canvas.js';
 import { type CommentService } from './comments.js';
@@ -13,16 +12,15 @@ import { type AgentRunService } from './agent-runs.js';
 import { type TagService } from './tags.js';
 import { type GoalService } from './goals.js';
 import { type TaskService } from './tasks.js';
-import { type TokenService } from './tokens.js';
 import { type ShareService } from './share.js';
 import { type SyncService } from './sync.js';
 export type ServicesDeps = {
     db: Db;
-    eventBus?: EventBus;
     storage?: StorageAdapter;
+    /** Fixed org scope for unit tests; production request path uses auth context. */
+    orgId?: string;
 };
 export type Services = {
-    eventBus: EventBus;
     projectService: ProjectService;
     goalService: GoalService;
     taskService: TaskService;
@@ -33,7 +31,6 @@ export type Services = {
     noteService: NoteService;
     commentService: CommentService;
     agentRunService: AgentRunService;
-    tokenService: TokenService;
     shareService: ShareService;
     syncService: SyncService;
     fileService: FileService;

package/dist/services/index.js

@@ -1,4 +1,3 @@
-import { createEventBus } from '../events.js';
 import { createStorageAdapter } from '../storage/index.js';
 import { createCanvasService } from './canvas.js';
 import { createCommentService } from './comments.js';
@@ -12,29 +11,26 @@ import { createAgentRunService } from './agent-runs.js';
 import { createTagService } from './tags.js';
 import { createGoalService } from './goals.js';
 import { createTaskService } from './tasks.js';
-import { createTokenService } from './tokens.js';
 import { createShareService } from './share.js';
 import { createSyncService } from './sync.js';
 export function createServices(deps) {
-    const eventBus = deps.eventBus ?? createEventBus();
+    const scoped = { db: deps.db, orgId: deps.orgId };
     const storage = deps.storage ?? createStorageAdapter({ db: deps.db });
-    const projectService = createProjectService({ db: deps.db, eventBus });
-    const goalService = createGoalService({ db: deps.db, eventBus });
-    const taskService = createTaskService({ db: deps.db, eventBus });
-    const tagService = createTagService({ db: deps.db, eventBus });
-    const canvasService = createCanvasService({ db: deps.db, eventBus });
-    const documentService = createDocumentService({ db: deps.db, eventBus });
-    const folderService = createFolderService({ db: deps.db, eventBus });
-    const noteService = createNoteService({ db: deps.db, eventBus });
-    const commentService = createCommentService({ db: deps.db, eventBus });
-    const agentRunService = createAgentRunService({ db: deps.db, eventBus });
-    const tokenService = createTokenService({ db: deps.db });
-    const shareService = createShareService({ db: deps.db, eventBus });
-    const syncService = createSyncService({ db: deps.db, eventBus, taskService, shareService });
-    const fileService = createFileService({ db: deps.db, storage });
-    const artifactService = createArtifactService({ db: deps.db, eventBus });
+    const projectService = createProjectService(scoped);
+    const goalService = createGoalService(scoped);
+    const taskService = createTaskService(scoped);
+    const tagService = createTagService(scoped);
+    const canvasService = createCanvasService(scoped);
+    const documentService = createDocumentService(scoped);
+    const folderService = createFolderService(scoped);
+    const noteService = createNoteService(scoped);
+    const commentService = createCommentService(scoped);
+    const agentRunService = createAgentRunService(scoped);
+    const shareService = createShareService(scoped);
+    const syncService = createSyncService({ ...scoped, taskService });
+    const fileService = createFileService({ ...scoped, storage });
+    const artifactService = createArtifactService(scoped);
     return {
-        eventBus,
         projectService,
         goalService,
         taskService,
@@ -45,7 +41,6 @@ export function createServices(deps) {
         noteService,
         commentService,
         agentRunService,
-        tokenService,
         shareService,
         syncService,
         fileService,

package/dist/services/notes.d.ts

@@ -1,9 +1,8 @@
 import { type Db } from '@plandesk/db';
 import { type PaginationParams, type SerializedNote } from '../serialize.js';
-import type { EventBus } from '../events.js';
-export type NoteServiceDeps = {
+import { type OrgScopedDeps } from './org-scope.js';
+export type NoteServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
 };
 export type CreateNoteInput = {
     title: string;
@@ -17,11 +16,11 @@ export declare class InvalidNoteError extends Error {
     constructor(message: string);
 }
 export declare function createNoteService(deps: NoteServiceDeps): {
-    list(projectId: string, pagination?: PaginationParams): SerializedNote[] | undefined;
-    create(projectId: string, input: CreateNoteInput): SerializedNote | undefined;
-    get(id: string): SerializedNote | undefined;
-    update(id: string, input: UpdateNoteInput): SerializedNote | undefined;
-    delete(id: string): boolean;
+    list(projectId: string, pagination?: PaginationParams): Promise<SerializedNote[] | undefined>;
+    create(projectId: string, input: CreateNoteInput): Promise<SerializedNote | undefined>;
+    get(id: string): Promise<SerializedNote | undefined>;
+    update(id: string, input: UpdateNoteInput): Promise<SerializedNote | undefined>;
+    delete(id: string): Promise<boolean>;
 };
 export type NoteService = ReturnType<typeof createNoteService>;
 //# sourceMappingURL=notes.d.ts.map

package/dist/services/notes.js

@@ -1,5 +1,7 @@
 import { createNote as dbCreateNote, deleteCommentsByTarget, deleteNote as dbDeleteNote, getNote as dbGetNote, getProject, listNotes as dbListNotes, updateNote as dbUpdateNote, } from '@plandesk/db';
 import { serializeNote } from '../serialize.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export class InvalidNoteError extends Error {
     constructor(message) {
         super(message);
@@ -12,62 +14,72 @@ function assertNonEmptyTitle(title) {
     }
 }
 export function createNoteService(deps) {
-    const { db, eventBus } = deps;
+    const { db } = deps;
     return {
-        list(projectId, pagination = {}) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async list(projectId, pagination = {}) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            return dbListNotes(db, projectId, pagination).map(serializeNote);
+            return (await dbListNotes(db, projectId, pagination)).map(serializeNote);
         },
-        create(projectId, input) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async create(projectId, input) {
+            assertPermission(deps, 'document', 'create');
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             assertNonEmptyTitle(input.title);
-            const note = dbCreateNote(db, {
+            const note = await dbCreateNote(db, {
                 projectId,
                 title: input.title,
                 body: input.body,
             });
-            eventBus.emit({ type: 'note_created', noteId: note.id, projectId });
             return serializeNote(note);
         },
-        get(id) {
-            const note = dbGetNote(db, id);
+        async get(id) {
+            const note = await dbGetNote(db, id);
             if (!note) {
                 return undefined;
             }
             return serializeNote(note);
         },
-        update(id, input) {
-            const existing = dbGetNote(db, id);
+        async update(id, input) {
+            assertPermission(deps, 'document', 'update');
+            const existing = await dbGetNote(db, id);
             if (!existing) {
                 return undefined;
             }
             if (input.title !== undefined) {
                 assertNonEmptyTitle(input.title);
             }
-            const note = dbUpdateNote(db, id, input);
+            const note = await dbUpdateNote(db, id, input);
             if (!note) {
                 return undefined;
             }
-            eventBus.emit({ type: 'note_updated', noteId: note.id, projectId: note.projectId });
             return serializeNote(note);
         },
-        delete(id) {
-            const existing = dbGetNote(db, id);
+        async delete(id) {
+            assertPermission(deps, 'document', 'delete');
+            const existing = await dbGetNote(db, id);
             if (!existing) {
                 return false;
             }
-            const deleted = dbDeleteNote(db, id);
+            const deleted = await dbDeleteNote(db, id);
             if (!deleted) {
                 return false;
             }
-            deleteCommentsByTarget(db, 'note', id);
-            eventBus.emit({ type: 'note_updated', noteId: id, projectId: existing.projectId });
+            await deleteCommentsByTarget(db, 'note', id);
             return true;
         },
     };

package/dist/services/org-scope.d.ts

@@ -0,0 +1,22 @@
+import type { OrgRole } from '@plandesk/db';
+import { type PermissionSet } from '../permissions.js';
+export type OrgScopedDeps = {
+    /** Fixed org scope for unit tests; production uses request auth context. */
+    orgId?: string;
+    /**
+     * Fixed permission for unit tests. Production uses AuthContext.permission.
+     * When orgId is injected without permission (legacy unit-test path), defaults
+     * to owner so role checks do not require a full request context.
+     */
+    permission?: OrgRole | PermissionSet;
+};
+export declare function resolveOrgId(deps: OrgScopedDeps): string;
+/**
+ * Effective permission set for this call.
+ * Priority: deps.permission → AuthContext.permission → owner (service unit tests
+ * that invoke methods without request middleware; production always has context).
+ */
+export declare function resolvePermissionSet(deps: OrgScopedDeps): PermissionSet;
+/** requirePermission against the caller's effective permission set (deps or AuthContext). */
+export declare function assertPermission(deps: OrgScopedDeps, resource: string, action: string): void;
+//# sourceMappingURL=org-scope.d.ts.map

package/dist/services/org-scope.js

@@ -0,0 +1,38 @@
+import { getAuthContext, tryGetAuthContext } from '../auth-context.js';
+import { orgRoleToPermissionSet, requirePermission, } from '../permissions.js';
+export function resolveOrgId(deps) {
+    if (deps.orgId !== undefined) {
+        return deps.orgId;
+    }
+    const ctx = getAuthContext();
+    if (ctx.kind === 'guest') {
+        throw new Error('Guest context has no orgId');
+    }
+    return ctx.orgId;
+}
+function isOrgRole(value) {
+    return typeof value === 'string';
+}
+/**
+ * Effective permission set for this call.
+ * Priority: deps.permission → AuthContext.permission → owner (service unit tests
+ * that invoke methods without request middleware; production always has context).
+ */
+export function resolvePermissionSet(deps) {
+    if (deps.permission !== undefined) {
+        return isOrgRole(deps.permission) ? orgRoleToPermissionSet(deps.permission) : deps.permission;
+    }
+    const ctx = tryGetAuthContext();
+    if (ctx !== undefined && ctx.kind !== 'guest') {
+        return ctx.permission;
+    }
+    if (ctx?.kind === 'guest') {
+        return {};
+    }
+    return orgRoleToPermissionSet('owner');
+}
+/** requirePermission against the caller's effective permission set (deps or AuthContext). */
+export function assertPermission(deps, resource, action) {
+    requirePermission({ permission: resolvePermissionSet(deps) }, resource, action);
+}
+//# sourceMappingURL=org-scope.js.map

package/dist/services/projects.d.ts

@@ -1,6 +1,6 @@
 import { type Db, type TaskStatus } from '@plandesk/db';
-import type { EventBus } from '../events.js';
 import { serializeEdge, serializeProject, serializeTask, type PaginationParams, type SerializedDocument, type TaskStatusSummary } from '../serialize.js';
+import { type OrgScopedDeps } from './org-scope.js';
 type SerializedProject = ReturnType<typeof serializeProject>;
 type SerializedTask = ReturnType<typeof serializeTask>;
 type SerializedEdge = ReturnType<typeof serializeEdge>;
@@ -49,9 +49,8 @@ export type ScaffoldPlanResult = {
         documents: number;
     };
 };
-export type ProjectServiceDeps = {
+export type ProjectServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
 };
 export type CreateProjectInput = {
     name: string;
@@ -62,37 +61,37 @@ export type UpdateProjectInput = {
     description?: string | null;
 };
 export declare function createProjectService(deps: ProjectServiceDeps): {
-    create(input: CreateProjectInput): {
+    create(input: CreateProjectInput): Promise<{
         id: string;
         name: string;
         description: string | null;
         created_at: string;
         updated_at: string;
-    };
-    list(pagination?: PaginationParams): {
+    }>;
+    list(pagination?: PaginationParams): Promise<{
         id: string;
         name: string;
         description: string | null;
         created_at: string;
         updated_at: string;
-    }[];
-    get(id: string): {
+    }[]>;
+    get(id: string): Promise<{
         summary: TaskStatusSummary;
         id: string;
         name: string;
         description: string | null;
         created_at: string;
         updated_at: string;
-    } | undefined;
-    update(id: string, input: UpdateProjectInput): {
+    } | undefined>;
+    update(id: string, input: UpdateProjectInput): Promise<{
         id: string;
         name: string;
         description: string | null;
         created_at: string;
         updated_at: string;
-    } | undefined;
-    delete(id: string): boolean;
-    scaffoldFromPlan(input: ScaffoldPlanInput): ScaffoldPlanResult;
+    } | undefined>;
+    delete(id: string): Promise<boolean>;
+    scaffoldFromPlan(input: ScaffoldPlanInput): Promise<ScaffoldPlanResult>;
 };
 export type ProjectService = ReturnType<typeof createProjectService>;
 export {};