@portaidentity/server 1.7.0

package/dist/routes/applications.js

@@ -0,0 +1,284 @@
+/**
+ * Application management API routes.
+ *
+ * All routes are under `/api/admin/applications` and require
+ * admin authentication (Bearer JWT). Provides CRUD for applications,
+ * status lifecycle (activate, deactivate, archive), and nested
+ * module management (CRUD, deactivate).
+ *
+ * Route structure:
+ *   POST   /                                — Create a new application
+ *   GET    /                                — List applications (paginated)
+ *   GET    /:id                             — Get application by ID
+ *   PUT    /:id                             — Update application
+ *   POST   /:id/archive                     — Archive application
+ *   POST   /:id/activate                    — Activate application
+ *   POST   /:id/deactivate                  — Deactivate application
+ *   POST   /:id/modules                     — Create module
+ *   GET    /:id/modules                     — List modules
+ *   PUT    /:id/modules/:moduleId           — Update module
+ *   POST   /:id/modules/:moduleId/deactivate — Deactivate module
+ *
+ * Error mapping:
+ *   ApplicationNotFoundError → 404
+ *   ApplicationValidationError → 400
+ *   ZodError → 400 with validation details
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import * as applicationService from '../applications/service.js';
+import { setETagHeader, checkIfMatch } from '../lib/etag.js';
+import { getEntityHistory } from '../lib/entity-history.js';
+import { ApplicationNotFoundError, ApplicationValidationError } from '../applications/errors.js';
+// ---------------------------------------------------------------------------
+// Validation schemas
+// ---------------------------------------------------------------------------
+/** Schema for creating a new application */
+const createApplicationSchema = z.object({
+    name: z.string().min(1).max(255),
+    slug: z.string().min(3).max(100).optional(),
+    description: z.string().max(2000).optional(),
+});
+/** Schema for updating an application (all fields optional) */
+const updateApplicationSchema = z.object({
+    name: z.string().min(1).max(255).optional(),
+    description: z.string().max(2000).nullable().optional(),
+});
+/** Schema for listing applications with pagination and filters */
+const listApplicationsSchema = z.object({
+    page: z.coerce.number().int().min(1).default(1),
+    pageSize: z.coerce.number().int().min(1).max(100).default(20),
+    status: z.enum(['active', 'inactive', 'archived']).optional(),
+    search: z.string().max(255).optional(),
+    sortBy: z.enum(['name', 'created_at']).default('created_at'),
+    sortOrder: z.enum(['asc', 'desc']).default('desc'),
+});
+/** Schema for cursor-based listing (keyset pagination) */
+const listApplicationsCursorSchema = z.object({
+    cursor: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(25),
+    status: z.enum(['active', 'inactive', 'archived']).optional(),
+    search: z.string().max(255).optional(),
+    sortBy: z.enum(['name', 'created_at']).default('created_at'),
+    sortOrder: z.enum(['asc', 'desc']).default('desc'),
+});
+/** Schema for creating a module within an application */
+const createModuleSchema = z.object({
+    name: z.string().min(1).max(255),
+    slug: z.string().min(3).max(100).optional(),
+    description: z.string().max(2000).optional(),
+});
+/** Schema for updating a module (all fields optional) */
+const updateModuleSchema = z.object({
+    name: z.string().min(1).max(255).optional(),
+    description: z.string().max(2000).nullable().optional(),
+});
+// ---------------------------------------------------------------------------
+// Error handler helper
+// ---------------------------------------------------------------------------
+/**
+ * Handle domain errors and map them to HTTP responses.
+ * Unknown errors are re-thrown for the global error handler.
+ */
+function handleError(ctx, err) {
+    if (err instanceof ApplicationNotFoundError) {
+        ctx.throw(404, 'Application not found');
+    }
+    if (err instanceof ApplicationValidationError) {
+        ctx.throw(400, 'Application request is invalid');
+    }
+    if (err instanceof z.ZodError) {
+        ctx.status = 400;
+        ctx.body = { error: 'Application request is invalid' };
+        return undefined;
+    }
+    throw err;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the application management router.
+ *
+ * All routes require admin authentication (Bearer JWT via requireAdminAuth).
+ * Provides full CRUD for applications and nested modules, plus status
+ * lifecycle actions.
+ *
+ * Prefix: /api/admin/applications
+ *
+ * @returns Configured Koa Router
+ */
+export function createApplicationRouter() {
+    const router = new Router({ prefix: '/api/admin/applications' });
+    // All routes require admin authentication
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // POST / — Create application
+    // -------------------------------------------------------------------------
+    router.post('/', requirePermission(ADMIN_PERMISSIONS.APP_CREATE), async (ctx) => {
+        try {
+            const body = createApplicationSchema.parse(ctx.request.body);
+            const app = await applicationService.createApplication(body);
+            ctx.status = 201;
+            ctx.body = { data: app };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET / — List applications (paginated)
+    // -------------------------------------------------------------------------
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.APP_READ), async (ctx) => {
+        try {
+            // Cursor-based pagination when `cursor` or `limit` param is present
+            if (ctx.query.cursor !== undefined || ctx.query.limit !== undefined) {
+                const query = listApplicationsCursorSchema.parse(ctx.query);
+                const result = await applicationService.listApplicationsCursor(query);
+                ctx.body = result;
+                return;
+            }
+            // Default: offset-based pagination (backward compatible)
+            const query = listApplicationsSchema.parse(ctx.query);
+            const result = await applicationService.listApplications(query);
+            ctx.body = result;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id — Get application by ID
+    // -------------------------------------------------------------------------
+    router.get('/:id', requirePermission(ADMIN_PERMISSIONS.APP_READ), async (ctx) => {
+        const param = ctx.params.id;
+        // Support both UUID and slug lookups — CLI and API consumers may use either
+        const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(param);
+        const app = isUuid
+            ? await applicationService.getApplicationById(param)
+            : await applicationService.getApplicationBySlug(param);
+        if (!app) {
+            ctx.throw(404, 'Application not found');
+            return; // unreachable — keeps TS narrowing happy
+        }
+        setETagHeader(ctx, 'application', app.id, app.updatedAt);
+        ctx.body = { data: app };
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:id — Update application
+    // -------------------------------------------------------------------------
+    router.put('/:id', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            const body = updateApplicationSchema.parse(ctx.request.body);
+            // Check If-Match for optimistic concurrency (optional — backward compatible)
+            const current = await applicationService.getApplicationById(ctx.params.id);
+            if (current && !checkIfMatch(ctx, 'application', current.id, current.updatedAt, current))
+                return;
+            const app = await applicationService.updateApplication(ctx.params.id, body);
+            setETagHeader(ctx, 'application', app.id, app.updatedAt);
+            ctx.body = { data: app };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/archive — Archive application
+    // -------------------------------------------------------------------------
+    router.post('/:id/archive', requirePermission(ADMIN_PERMISSIONS.APP_ARCHIVE), async (ctx) => {
+        try {
+            await applicationService.archiveApplication(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/activate — Activate application
+    // -------------------------------------------------------------------------
+    router.post('/:id/activate', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            await applicationService.activateApplication(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/deactivate — Deactivate application
+    // -------------------------------------------------------------------------
+    router.post('/:id/deactivate', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            await applicationService.deactivateApplication(ctx.params.id);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/modules — Create module
+    // -------------------------------------------------------------------------
+    router.post('/:id/modules', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            const body = createModuleSchema.parse(ctx.request.body);
+            const mod = await applicationService.createModule(ctx.params.id, body);
+            ctx.status = 201;
+            ctx.body = { data: mod };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id/modules — List modules for an application
+    // -------------------------------------------------------------------------
+    router.get('/:id/modules', requirePermission(ADMIN_PERMISSIONS.APP_READ), async (ctx) => {
+        const modules = await applicationService.listModules(ctx.params.id);
+        ctx.body = { data: modules };
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:id/modules/:moduleId — Update module
+    // -------------------------------------------------------------------------
+    router.put('/:id/modules/:moduleId', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            const body = updateModuleSchema.parse(ctx.request.body);
+            const mod = await applicationService.updateModule(ctx.params.moduleId, body);
+            ctx.body = { data: mod };
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // GET /:id/history — Application change history
+    // -------------------------------------------------------------------------
+    router.get('/:id/history', requirePermission(ADMIN_PERMISSIONS.APP_READ), async (ctx) => {
+        const { limit, after, event_type } = ctx.query;
+        const result = await getEntityHistory('application', ctx.params.id, {
+            limit: limit ? parseInt(limit, 10) : undefined,
+            after: after || undefined,
+            eventTypePrefix: event_type || undefined,
+        });
+        ctx.body = result;
+    });
+    // -------------------------------------------------------------------------
+    // POST /:id/modules/:moduleId/deactivate — Deactivate module
+    // -------------------------------------------------------------------------
+    router.post('/:id/modules/:moduleId/deactivate', requirePermission(ADMIN_PERMISSIONS.APP_UPDATE), async (ctx) => {
+        try {
+            await applicationService.deactivateModule(ctx.params.moduleId);
+            ctx.status = 204;
+        }
+        catch (err) {
+            handleError(ctx, err);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=applications.js.map

package/dist/routes/applications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.js","sourceRoot":"","sources":["../../src/routes/applications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,kBAAkB,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEjG,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,4CAA4C;AAC5C,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACvD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAEjE,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACtE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAChE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,MAAM,MAAM,GAAG,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM;YAChB,CAAC,CAAC,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,MAAM,kBAAkB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YACxC,OAAO,CAAC,yCAAyC;QACnD,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,6EAA6E;YAC7E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBACtF,OAAO;YACT,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5E,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACzD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4CAA4C;IAC5C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1F,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gDAAgD;IAChD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5F,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,qDAAqD;IACrD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,wBAAwB,EACxB,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,gDAAgD;IAChD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACtF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAA+B,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YAClE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9C,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,eAAe,EAAE,UAAU,IAAI,SAAS;SACzC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,mCAAmC,EACnC,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAC/C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/audit.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Audit log admin API routes.
+ *
+ * All routes are under `/api/admin/audit` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List audit log events (filtered, paginated)
+ *   POST   /cleanup           — Delete audit entries older than retention period
+ *
+ * Query parameters:
+ *   limit  — Maximum number of events (default: 50, max: 500)
+ *   event  — Filter by event_type (exact match)
+ *   org    — Filter by organization_id (UUID)
+ *   user   — Filter by user_id (UUID)
+ *   since  — Filter events created after this ISO 8601 date
+ *
+ * @module routes/audit
+ */
+import Router from '@koa/router';
+/**
+ * Create the audit log admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read-only access to the `audit_log` table with optional
+ * filtering by event type, organization, user, and date range.
+ *
+ * @returns Koa router mounted at /api/admin/audit
+ */
+export declare function createAuditRouter(): Router;
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAYjC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CA2I1C"}

package/dist/routes/audit.js

@@ -0,0 +1,140 @@
+/**
+ * Audit log admin API routes.
+ *
+ * All routes are under `/api/admin/audit` and require admin
+ * authorization with granular permissions.
+ *
+ * Route structure:
+ *   GET    /                  — List audit log events (filtered, paginated)
+ *   POST   /cleanup           — Delete audit entries older than retention period
+ *
+ * Query parameters:
+ *   limit  — Maximum number of events (default: 50, max: 500)
+ *   event  — Filter by event_type (exact match)
+ *   org    — Filter by organization_id (UUID)
+ *   user   — Filter by user_id (UUID)
+ *   since  — Filter events created after this ISO 8601 date
+ *
+ * @module routes/audit
+ */
+import Router from '@koa/router';
+import { z } from 'zod';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import { getPool } from '../lib/database.js';
+import { getSystemConfigNumber } from '../lib/system-config.js';
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the audit log admin API router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * Provides read-only access to the `audit_log` table with optional
+ * filtering by event type, organization, user, and date range.
+ *
+ * @returns Koa router mounted at /api/admin/audit
+ */
+export function createAuditRouter() {
+    const router = new Router({ prefix: '/api/admin/audit' });
+    // Apply admin auth to all audit routes
+    router.use(requireAdminAuth());
+    // ── GET / — List audit log events ─────────────────────────────────
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.AUDIT_READ), async (ctx) => {
+        // Parse and validate query parameters
+        const limit = Math.min(Math.max(1, parseInt(ctx.query.limit, 10) || 50), 500);
+        const event = ctx.query.event;
+        const org = ctx.query.org;
+        const user = ctx.query.user;
+        const since = ctx.query.since;
+        // Build dynamic WHERE clause based on filters
+        const conditions = [];
+        const params = [];
+        let paramIdx = 1;
+        if (event) {
+            conditions.push(`event_type = $${paramIdx++}`);
+            params.push(event);
+        }
+        if (org) {
+            conditions.push(`organization_id = $${paramIdx++}`);
+            params.push(org);
+        }
+        if (user) {
+            conditions.push(`user_id = $${paramIdx++}`);
+            params.push(user);
+        }
+        if (since) {
+            conditions.push(`created_at >= $${paramIdx++}`);
+            params.push(since);
+        }
+        const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+        params.push(limit);
+        const query = `SELECT id, event_type, event_category, actor_id, organization_id,
+                          user_id, description, metadata, ip_address, created_at
+                   FROM audit_log ${whereClause}
+                   ORDER BY created_at DESC
+                   LIMIT $${paramIdx}`;
+        const result = await getPool().query(query, params);
+        const data = result.rows.map((r) => ({
+            id: r.id,
+            eventType: r.event_type,
+            eventCategory: r.event_category,
+            actorId: r.actor_id,
+            organizationId: r.organization_id,
+            userId: r.user_id,
+            description: r.description,
+            metadata: r.metadata,
+            ipAddress: r.ip_address,
+            createdAt: r.created_at,
+        }));
+        ctx.body = { data, total: data.length };
+    });
+    // ── POST /cleanup — Delete old audit log entries ──────────────────
+    //
+    // Accepts optional JSON body:
+    //   { retentionDays?: number, dryRun?: boolean }
+    //
+    // If retentionDays is not provided, reads `audit_retention_days` from
+    // system_config (default: 90 days). In dry-run mode, returns the count
+    // of entries that would be deleted without actually removing them.
+    //
+    // Designed to be called from `porta audit cleanup` or via cron/CronJob.
+    /** Zod schema for the cleanup request body */
+    const cleanupSchema = z.object({
+        retentionDays: z.number().int().min(1).optional(),
+        dryRun: z.boolean().optional().default(false),
+    });
+    router.post('/cleanup', requirePermission(ADMIN_PERMISSIONS.CONFIG_UPDATE), async (ctx) => {
+        // Parse and validate request body (all fields optional)
+        const body = cleanupSchema.parse(ctx.request.body ?? {});
+        // Resolve retention days: explicit param → system_config → default 90
+        const retentionDays = body.retentionDays
+            ?? await getSystemConfigNumber('audit_retention_days', 90);
+        if (body.dryRun) {
+            // Dry-run: count entries that would be deleted
+            const countResult = await getPool().query(`SELECT COUNT(*) AS count FROM audit_log
+         WHERE created_at < NOW() - INTERVAL '1 day' * $1`, [retentionDays]);
+            const count = parseInt(countResult.rows[0].count, 10);
+            ctx.body = {
+                dryRun: true,
+                retentionDays,
+                entriesFound: count,
+                deleted: 0,
+            };
+        }
+        else {
+            // Delete entries older than retention period
+            const deleteResult = await getPool().query(`DELETE FROM audit_log
+         WHERE created_at < NOW() - INTERVAL '1 day' * $1`, [retentionDays]);
+            ctx.body = {
+                dryRun: false,
+                retentionDays,
+                entriesFound: deleteResult.rowCount ?? 0,
+                deleted: deleteResult.rowCount ?? 0,
+            };
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=audit.js.map

package/dist/routes/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE1D,uCAAuC;IACvC,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,qEAAqE;IACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7E,sCAAsC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAC1D,GAAG,CACJ,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAyB,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAA0B,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QAEpD,8CAA8C;QAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,IAAI,CAAC,iBAAiB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,UAAU,CAAC,IAAI,CAAC,sBAAsB,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,IAAI,CAAC,kBAAkB,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GACf,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG;;oCAEkB,WAAW;;4BAEnB,QAAQ,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAC1B,CAAC,CAWA,EAAE,EAAE,CAAC,CAAC;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,cAAc;YAC/B,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,cAAc,EAAE,CAAC,CAAC,eAAe;YACjC,MAAM,EAAE,CAAC,CAAC,OAAO;YACjB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,EAAE;IACF,8BAA8B;IAC9B,iDAAiD;IACjD,EAAE;IACF,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,EAAE;IACF,wEAAwE;IAExE,8CAA8C;IAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;QAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,wDAAwD;QACxD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEzD,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa;eACnC,MAAM,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,+CAA+C;YAC/C,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CACvC;0DACkD,EAClD,CAAC,aAAa,CAAC,CAChB,CAAC;YACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEtD,GAAG,CAAC,IAAI,GAAG;gBACT,MAAM,EAAE,IAAI;gBACZ,aAAa;gBACb,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,CAAC;aACX,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,6CAA6C;YAC7C,MAAM,YAAY,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CACxC;0DACkD,EAClD,CAAC,aAAa,CAAC,CAChB,CAAC;YAEF,GAAG,CAAC,IAAI,GAAG;gBACT,MAAM,EAAE,KAAK;gBACb,aAAa;gBACb,YAAY,EAAE,YAAY,CAAC,QAAQ,IAAI,CAAC;gBACxC,OAAO,EAAE,YAAY,CAAC,QAAQ,IAAI,CAAC;aACpC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/branding.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Branding assets API routes.
+ *
+ * Manages organization logo and favicon image uploads. Images are stored
+ * as PostgreSQL bytea for simplicity (images are small, <512KB).
+ *
+ * Route structure:
+ *   GET    /api/admin/organizations/:orgId/branding         — List assets
+ *   GET    /api/admin/organizations/:orgId/branding/:type   — Get asset (binary)
+ *   PUT    /api/admin/organizations/:orgId/branding/:type   — Upload asset
+ *   DELETE /api/admin/organizations/:orgId/branding/:type   — Delete asset
+ *
+ * @see 06-bulk-operations-branding.md
+ */
+import Router from '@koa/router';
+export declare function createBrandingRouter(): Router;
+//# sourceMappingURL=branding.d.ts.map

package/dist/routes/branding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/routes/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAmBjC,wBAAgB,oBAAoB,IAAI,MAAM,CA0F7C"}

package/dist/routes/branding.js

@@ -0,0 +1,104 @@
+/**
+ * Branding assets API routes.
+ *
+ * Manages organization logo and favicon image uploads. Images are stored
+ * as PostgreSQL bytea for simplicity (images are small, <512KB).
+ *
+ * Route structure:
+ *   GET    /api/admin/organizations/:orgId/branding         — List assets
+ *   GET    /api/admin/organizations/:orgId/branding/:type   — Get asset (binary)
+ *   PUT    /api/admin/organizations/:orgId/branding/:type   — Upload asset
+ *   DELETE /api/admin/organizations/:orgId/branding/:type   — Delete asset
+ *
+ * @see 06-bulk-operations-branding.md
+ */
+import Router from '@koa/router';
+import { requireAdminAuth } from '../middleware/admin-auth.js';
+import { requirePermission } from '../middleware/require-permission.js';
+import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
+import * as brandingAssets from '../lib/branding-assets.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function validateAssetType(type) {
+    return type === 'logo' || type === 'favicon';
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+export function createBrandingRouter() {
+    const router = new Router({ prefix: '/api/admin/organizations/:orgId/branding' });
+    router.use(requireAdminAuth());
+    // -------------------------------------------------------------------------
+    // GET / — List branding assets (metadata only)
+    // -------------------------------------------------------------------------
+    router.get('/', requirePermission(ADMIN_PERMISSIONS.ORG_READ), async (ctx) => {
+        const assets = await brandingAssets.listAssets(ctx.params.orgId);
+        ctx.body = { data: assets };
+    });
+    // -------------------------------------------------------------------------
+    // GET /:type — Get branding asset (serves binary image)
+    // -------------------------------------------------------------------------
+    router.get('/:type', requirePermission(ADMIN_PERMISSIONS.ORG_READ), async (ctx) => {
+        const { type } = ctx.params;
+        if (!validateAssetType(type)) {
+            ctx.throw(400, 'Invalid asset type. Must be "logo" or "favicon"');
+            return;
+        }
+        const asset = await brandingAssets.getAsset(ctx.params.orgId, type);
+        if (!asset) {
+            ctx.throw(404, `No ${type} asset found`);
+            return;
+        }
+        ctx.type = asset.contentType;
+        ctx.set('Cache-Control', 'public, max-age=3600');
+        ctx.body = asset.data;
+    });
+    // -------------------------------------------------------------------------
+    // PUT /:type — Upload/replace branding asset
+    //
+    // Expects raw binary body with appropriate Content-Type header.
+    // For JSON-based uploads, accepts base64-encoded body:
+    //   { "data": "<base64>", "contentType": "image/png" }
+    // -------------------------------------------------------------------------
+    router.put('/:type', requirePermission(ADMIN_PERMISSIONS.ORG_UPDATE), async (ctx) => {
+        const { type } = ctx.params;
+        if (!validateAssetType(type)) {
+            ctx.throw(400, 'Invalid asset type. Must be "logo" or "favicon"');
+            return;
+        }
+        // Support JSON-encoded base64 uploads for admin UI convenience
+        const body = ctx.request.body;
+        if (body && typeof body.data === 'string' && typeof body.contentType === 'string') {
+            try {
+                const buffer = Buffer.from(body.data, 'base64');
+                const asset = await brandingAssets.uploadAsset(ctx.params.orgId, type, body.contentType, buffer);
+                ctx.body = { data: asset };
+                return;
+            }
+            catch {
+                ctx.throw(400, 'Branding upload is invalid');
+                return;
+            }
+        }
+        ctx.throw(400, 'Request body must include "data" (base64) and "contentType" fields');
+    });
+    // -------------------------------------------------------------------------
+    // DELETE /:type — Delete branding asset
+    // -------------------------------------------------------------------------
+    router.delete('/:type', requirePermission(ADMIN_PERMISSIONS.ORG_UPDATE), async (ctx) => {
+        const { type } = ctx.params;
+        if (!validateAssetType(type)) {
+            ctx.throw(400, 'Invalid asset type. Must be "logo" or "favicon"');
+            return;
+        }
+        const deleted = await brandingAssets.deleteAsset(ctx.params.orgId, type);
+        if (!deleted) {
+            ctx.throw(404, `No ${type} asset found`);
+            return;
+        }
+        ctx.status = 204;
+    });
+    return router;
+}
+//# sourceMappingURL=branding.js.map

package/dist/routes/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/routes/branding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,cAAc,MAAM,2BAA2B,CAAC;AAG5D,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAElF,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wDAAwD;IACxD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,EAAE;IACF,gEAAgE;IAChE,uDAAuD;IACvD,uDAAuD;IACvD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA2C,CAAC;QACrE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,CAC5C,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,IAAI,EACJ,IAAI,CAAC,WAAW,EAChB,MAAM,CACP,CAAC;gBACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC3B,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oEAAoE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wCAAwC;IACxC,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}