@terreno/api 0.7.2 → 0.8.0

package/dist/__tests__/{versionCheck.test.js → versionCheckPlugin.test.js}

@@ -131,7 +131,7 @@ var versionCheckPlugin_1 = require("../versionCheckPlugin");
                 case 2:
                     res = _a.sent();
                     (0, bun_test_1.expect)(res.status).toBe(200);
-                    (0, bun_test_1.expect)(res.body).toEqual({ status: "ok" });
+                    (0, bun_test_1.expect)(res.body).toEqual({ requiredVersion: 50, status: "ok", warningVersion: 100 });
                     return [2 /*return*/];
             }
         });
@@ -236,7 +236,7 @@ var versionCheckPlugin_1 = require("../versionCheckPlugin");
                 case 2:
                     res = _a.sent();
                     (0, bun_test_1.expect)(res.status).toBe(200);
-                    (0, bun_test_1.expect)(res.body).toEqual({ status: "ok" });
+                    (0, bun_test_1.expect)(res.body).toEqual({ requiredVersion: 50, status: "ok", warningVersion: 100 });
                     return [2 /*return*/];
             }
         });

package/dist/api.d.ts

@@ -108,8 +108,8 @@ export interface ModelRouterOptions<T> {
      * query, max limit,
      *  or 500. */
     maxLimit?: number;
-    /** */
-    endpoints?: (router: any) => void;
+    /** Custom route setup function. Receives the router and optionally the full options (including openApi). */
+    endpoints?: (router: any, options?: Partial<ModelRouterOptions<T>>) => void;
     /**
      * Hook that runs after `transformer.transform` but before the object is created.
      * Can update the body fields based on the request or the user.
@@ -234,6 +234,8 @@ export interface ModelRouterRegistration {
     path: string;
     /** The Express router containing CRUD endpoints */
     router: express.Router;
+    /** @internal Rebuilds the router with the openApi instance injected into options */
+    _buildWithOpenApi: (openApi: any) => express.Router;
 }
 /**
  * Create a set of CRUD routes given a Mongoose model and configuration options.

package/dist/api.js

@@ -299,7 +299,12 @@ function modelRouter(pathOrModel, modelOrOptions, maybeOptions) {
     }
     var router = _buildModelRouter(model, options);
     if (path !== undefined) {
-        return { __type: "modelRouter", path: path, router: router };
+        return {
+            __type: "modelRouter",
+            _buildWithOpenApi: function (openApi) { return _buildModelRouter(model, __assign(__assign({}, options), { openApi: openApi })); },
+            path: path,
+            router: router,
+        };
     }
     return router;
 }
@@ -309,7 +314,7 @@ function _buildModelRouter(model, options) {
     var router = express_1.default.Router();
     // Do before the other router options so endpoints take priority.
     if (options.endpoints) {
-        options.endpoints(router);
+        options.endpoints(router, options);
     }
     var responseHandler = (_a = options.responseHandler) !== null && _a !== void 0 ? _a : transformers_1.defaultResponseHandler;
     // Always install validation middleware — they are no-ops until configureOpenApiValidator() is called

package/dist/consentApp.d.ts

@@ -0,0 +1,33 @@
+/**
+ * ConsentApp plugin for @terreno/api.
+ *
+ * Registers consent form management and user consent response routes as a TerrenoPlugin.
+ * Provides admin CRUD for consent forms, read-only access to responses, and user-facing
+ * endpoints for fetching pending consents and submitting responses.
+ */
+import type express from "express";
+import type { User } from "./auth";
+import type { TerrenoPlugin } from "./terrenoPlugin";
+import type { ConsentFormDocument } from "./types/consentForm";
+export interface ConsentAppOptions {
+    auditTrail?: boolean;
+    aiConfig?: {
+        generateContent: (params: {
+            type: string;
+            description: string;
+            locale: string;
+        }) => Promise<string>;
+        translateContent: (params: {
+            content: string;
+            fromLocale: string;
+            toLocale: string;
+        }) => Promise<string>;
+    };
+    resolveConsentForms?: (user: User, forms: ConsentFormDocument[]) => ConsentFormDocument[] | Promise<ConsentFormDocument[]>;
+    supportedLocales?: string[];
+}
+export declare class ConsentApp implements TerrenoPlugin {
+    private options;
+    constructor(options?: ConsentAppOptions);
+    register(app: express.Application): void;
+}

package/dist/consentApp.js

@@ -0,0 +1,484 @@
+"use strict";
+/**
+ * ConsentApp plugin for @terreno/api.
+ *
+ * Registers consent form management and user consent response routes as a TerrenoPlugin.
+ * Provides admin CRUD for consent forms, read-only access to responses, and user-facing
+ * endpoints for fetching pending consents and submitting responses.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConsentApp = void 0;
+var luxon_1 = require("luxon");
+var api_1 = require("./api");
+var auth_1 = require("./auth");
+var errors_1 = require("./errors");
+var logger_1 = require("./logger");
+var consentForm_1 = require("./models/consentForm");
+var consentResponse_1 = require("./models/consentResponse");
+var permissions_1 = require("./permissions");
+var ConsentApp = /** @class */ (function () {
+    function ConsentApp(options) {
+        if (options === void 0) { options = {}; }
+        this.options = options;
+    }
+    ConsentApp.prototype.register = function (app) {
+        var _this = this;
+        var _a = this.options, auditTrail = _a.auditTrail, resolveConsentForms = _a.resolveConsentForms, aiConfig = _a.aiConfig;
+        // Admin CRUD for consent forms
+        app.use("/consent-forms", (0, api_1.modelRouter)(consentForm_1.ConsentForm, {
+            endpoints: function (router) {
+                if (aiConfig) {
+                    // POST /consent-forms/generate - generate consent form content with AI
+                    router.post("/generate", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+                        var user, _a, type, description, _b, locale, content;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    user = req.user;
+                                    if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                                        throw new errors_1.APIError({ status: 403, title: "Admin access required" });
+                                    }
+                                    _a = req.body, type = _a.type, description = _a.description, _b = _a.locale, locale = _b === void 0 ? "en" : _b;
+                                    if (!type) {
+                                        throw new errors_1.APIError({ status: 400, title: "type is required" });
+                                    }
+                                    if (!description) {
+                                        throw new errors_1.APIError({ status: 400, title: "description is required" });
+                                    }
+                                    return [4 /*yield*/, aiConfig.generateContent({ description: description, locale: locale, type: type })];
+                                case 1:
+                                    content = _c.sent();
+                                    logger_1.logger.info("ConsentForm content generated", { locale: locale, type: type });
+                                    return [2 /*return*/, res.json({ data: { content: content } })];
+                            }
+                        });
+                    }); }));
+                    // POST /consent-forms/translate - translate consent form content with AI
+                    router.post("/translate", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+                        var user, _a, content, fromLocale, toLocale, translated;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    user = req.user;
+                                    if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                                        throw new errors_1.APIError({ status: 403, title: "Admin access required" });
+                                    }
+                                    _a = req.body, content = _a.content, fromLocale = _a.fromLocale, toLocale = _a.toLocale;
+                                    if (!content) {
+                                        throw new errors_1.APIError({ status: 400, title: "content is required" });
+                                    }
+                                    if (!fromLocale) {
+                                        throw new errors_1.APIError({ status: 400, title: "fromLocale is required" });
+                                    }
+                                    if (!toLocale) {
+                                        throw new errors_1.APIError({ status: 400, title: "toLocale is required" });
+                                    }
+                                    return [4 /*yield*/, aiConfig.translateContent({ content: content, fromLocale: fromLocale, toLocale: toLocale })];
+                                case 1:
+                                    translated = _b.sent();
+                                    logger_1.logger.info("ConsentForm content translated", { fromLocale: fromLocale, toLocale: toLocale });
+                                    return [2 /*return*/, res.json({ data: { content: translated } })];
+                            }
+                        });
+                    }); }));
+                }
+                // POST /consent-forms/:id/publish - clone form with incremented version and activate
+                router.post("/:id/publish", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+                    var user, form, newFormData, newForm;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                user = req.user;
+                                if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                                    throw new errors_1.APIError({ status: 403, title: "Admin access required" });
+                                }
+                                return [4 /*yield*/, consentForm_1.ConsentForm.findExactlyOne({ _id: req.params.id })];
+                            case 1:
+                                form = _a.sent();
+                                newFormData = {
+                                    active: true,
+                                    agreeButtonText: form.agreeButtonText,
+                                    allowDecline: form.allowDecline,
+                                    captureSignature: form.captureSignature,
+                                    checkboxes: form.checkboxes,
+                                    content: form.content,
+                                    declineButtonText: form.declineButtonText,
+                                    defaultLocale: form.defaultLocale,
+                                    order: form.order,
+                                    required: form.required,
+                                    requireScrollToBottom: form.requireScrollToBottom,
+                                    slug: form.slug,
+                                    title: form.title,
+                                    type: form.type,
+                                    version: form.version + 1,
+                                };
+                                return [4 /*yield*/, consentForm_1.ConsentForm.create(newFormData)];
+                            case 2:
+                                newForm = _a.sent();
+                                // Deactivate all other versions of the same slug
+                                return [4 /*yield*/, consentForm_1.ConsentForm.updateMany({ _id: { $ne: newForm._id }, slug: form.slug }, { active: false })];
+                            case 3:
+                                // Deactivate all other versions of the same slug
+                                _a.sent();
+                                logger_1.logger.info("ConsentForm published", {
+                                    newVersion: newForm.version,
+                                    slug: newForm.slug,
+                                });
+                                return [2 /*return*/, res.json({ data: newForm })];
+                        }
+                    });
+                }); }));
+            },
+            permissions: {
+                create: [permissions_1.Permissions.IsAdmin],
+                delete: [permissions_1.Permissions.IsAdmin],
+                list: [permissions_1.Permissions.IsAdmin],
+                read: [permissions_1.Permissions.IsAdmin],
+                update: [permissions_1.Permissions.IsAdmin],
+            },
+            queryFields: ["slug", "type", "active", "version"],
+            sort: "order",
+        }));
+        // Admin read-only access to consent responses
+        app.use("/consent-responses", (0, api_1.modelRouter)(consentResponse_1.ConsentResponse, {
+            permissions: {
+                create: [],
+                delete: [],
+                list: [permissions_1.Permissions.IsAdmin],
+                read: [permissions_1.Permissions.IsAdmin],
+                update: [],
+            },
+            populatePaths: [
+                {
+                    fields: ["title", "slug", "version", "type"],
+                    path: "consentFormId",
+                },
+            ],
+        }));
+        // User-facing consent endpoints
+        var router = require("express").Router();
+        // GET /consents/pending - fetch pending consent forms for the current user
+        router.get("/pending", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+            var user, activeForms, resolvedForms, existingResponses, respondedFormVersions, existingResponses_1, existingResponses_1_1, response, formId, respondedFormIds, respondedForms, formVersionByFormId, respondedForms_1, respondedForms_1_1, form, pendingForms, filteredOutByResolverCount, filteredOutByResponsesCount;
+            var e_1, _a, e_2, _b;
+            var _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        user = req.user;
+                        if (!user) {
+                            throw new errors_1.APIError({ status: 401, title: "Authentication required" });
+                        }
+                        logger_1.logger.debug("Fetching pending consent forms", { userId: user.id });
+                        return [4 /*yield*/, consentForm_1.ConsentForm.find({ active: true }).sort({ order: 1 })];
+                    case 1:
+                        activeForms = _d.sent();
+                        if (!resolveConsentForms) return [3 /*break*/, 3];
+                        return [4 /*yield*/, resolveConsentForms(user, activeForms)];
+                    case 2:
+                        resolvedForms = _d.sent();
+                        logger_1.logger.debug("resolveConsentForms applied", {
+                            activeFormCount: activeForms.length,
+                            resolvedFormCount: resolvedForms.length,
+                            userAdmin: Boolean(user.admin),
+                            userId: user.id,
+                        });
+                        return [3 /*break*/, 4];
+                    case 3:
+                        resolvedForms = activeForms;
+                        _d.label = 4;
+                    case 4: return [4 /*yield*/, consentResponse_1.ConsentResponse.find({ userId: user.id })];
+                    case 5:
+                        existingResponses = _d.sent();
+                        respondedFormVersions = new Map();
+                        try {
+                            for (existingResponses_1 = __values(existingResponses), existingResponses_1_1 = existingResponses_1.next(); !existingResponses_1_1.done; existingResponses_1_1 = existingResponses_1.next()) {
+                                response = existingResponses_1_1.value;
+                                formId = response.consentFormId.toString();
+                                respondedFormVersions.set(formId, (_c = response.formVersionSnapshot) !== null && _c !== void 0 ? _c : 0);
+                            }
+                        }
+                        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                        finally {
+                            try {
+                                if (existingResponses_1_1 && !existingResponses_1_1.done && (_a = existingResponses_1.return)) _a.call(existingResponses_1);
+                            }
+                            finally { if (e_1) throw e_1.error; }
+                        }
+                        respondedFormIds = existingResponses.map(function (r) { return r.consentFormId; });
+                        return [4 /*yield*/, consentForm_1.ConsentForm.find({ _id: { $in: respondedFormIds } })];
+                    case 6:
+                        respondedForms = _d.sent();
+                        formVersionByFormId = new Map();
+                        try {
+                            for (respondedForms_1 = __values(respondedForms), respondedForms_1_1 = respondedForms_1.next(); !respondedForms_1_1.done; respondedForms_1_1 = respondedForms_1.next()) {
+                                form = respondedForms_1_1.value;
+                                formVersionByFormId.set(form._id.toString(), form.version);
+                            }
+                        }
+                        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+                        finally {
+                            try {
+                                if (respondedForms_1_1 && !respondedForms_1_1.done && (_b = respondedForms_1.return)) _b.call(respondedForms_1);
+                            }
+                            finally { if (e_2) throw e_2.error; }
+                        }
+                        pendingForms = resolvedForms.filter(function (form) {
+                            var formId = form._id.toString();
+                            // Find responses for this form
+                            var matchingResponses = existingResponses.filter(function (r) { return r.consentFormId.toString() === formId; });
+                            if (matchingResponses.length === 0) {
+                                return true;
+                            }
+                            // Check if any response matches the current form version
+                            return !matchingResponses.some(function (r) { return r.formVersionSnapshot === form.version; });
+                        });
+                        filteredOutByResolverCount = Math.max(activeForms.length - resolvedForms.length, 0);
+                        filteredOutByResponsesCount = Math.max(resolvedForms.length - pendingForms.length, 0);
+                        logger_1.logger.info("Pending consent forms fetched", {
+                            activeFormCount: activeForms.length,
+                            filteredOutByResolverCount: filteredOutByResolverCount,
+                            filteredOutByResponsesCount: filteredOutByResponsesCount,
+                            pendingFormCount: pendingForms.length,
+                            resolvedFormCount: resolvedForms.length,
+                            responseCount: existingResponses.length,
+                            userAdmin: Boolean(user.admin),
+                            userId: user.id,
+                        });
+                        return [2 /*return*/, res.json({ data: pendingForms })];
+                }
+            });
+        }); }));
+        // POST /consents/respond - submit a consent response
+        router.post("/respond", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+            var user, _a, agreed, checkboxValues, consentFormId, locale, signature, form, values, i, checkbox, responseData, response;
+            var _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        user = req.user;
+                        if (!user) {
+                            throw new errors_1.APIError({ status: 401, title: "Authentication required" });
+                        }
+                        _a = req.body, agreed = _a.agreed, checkboxValues = _a.checkboxValues, consentFormId = _a.consentFormId, locale = _a.locale, signature = _a.signature;
+                        if (!consentFormId) {
+                            throw new errors_1.APIError({ status: 400, title: "consentFormId is required" });
+                        }
+                        if (agreed === undefined || agreed === null) {
+                            throw new errors_1.APIError({ status: 400, title: "agreed field is required" });
+                        }
+                        if (!locale) {
+                            throw new errors_1.APIError({ status: 400, title: "locale is required" });
+                        }
+                        return [4 /*yield*/, consentForm_1.ConsentForm.findExactlyOne({ _id: consentFormId }, { status: 404, title: "Consent form not found" })];
+                    case 1:
+                        form = _c.sent();
+                        if (!form.active) {
+                            throw new errors_1.APIError({ status: 400, title: "Consent form is not active" });
+                        }
+                        // Validate signature requirement
+                        if (form.captureSignature && agreed && !signature) {
+                            throw new errors_1.APIError({
+                                status: 400,
+                                title: "Signature is required for this consent form",
+                            });
+                        }
+                        // Validate required checkboxes
+                        if (agreed && form.checkboxes.length > 0) {
+                            values = checkboxValues !== null && checkboxValues !== void 0 ? checkboxValues : {};
+                            for (i = 0; i < form.checkboxes.length; i++) {
+                                checkbox = form.checkboxes[i];
+                                if (checkbox.required && !values[i.toString()]) {
+                                    throw new errors_1.APIError({
+                                        status: 400,
+                                        title: "Required checkbox \"".concat(checkbox.label, "\" must be checked"),
+                                    });
+                                }
+                            }
+                        }
+                        responseData = {
+                            agreed: agreed,
+                            agreedAt: luxon_1.DateTime.now().toJSDate(),
+                            consentFormId: form._id,
+                            locale: locale,
+                            userId: user.id,
+                        };
+                        if (checkboxValues !== undefined) {
+                            responseData.checkboxValues = checkboxValues;
+                        }
+                        if (signature) {
+                            responseData.signature = signature;
+                            responseData.signedAt = luxon_1.DateTime.now().toJSDate();
+                        }
+                        if (auditTrail) {
+                            responseData.ipAddress = req.ip;
+                            responseData.userAgent = req.headers["user-agent"];
+                            responseData.contentSnapshot =
+                                (_b = form.content.get(locale)) !== null && _b !== void 0 ? _b : form.content.get(form.defaultLocale);
+                            responseData.formVersionSnapshot = form.version;
+                        }
+                        else {
+                            responseData.formVersionSnapshot = form.version;
+                        }
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.create(responseData)];
+                    case 2:
+                        response = _c.sent();
+                        logger_1.logger.info("Consent response recorded", {
+                            agreed: agreed,
+                            consentFormId: form._id.toString(),
+                            locale: locale,
+                            userId: user.id,
+                        });
+                        return [2 /*return*/, res.json({ data: response })];
+                }
+            });
+        }); }));
+        // GET /consents/my - fetch the current user's consent responses with form data
+        router.get("/my", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+            var user, responses, formIds, forms, formMap, data;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        user = req.user;
+                        if (!user) {
+                            throw new errors_1.APIError({ status: 401, title: "Authentication required" });
+                        }
+                        return [4 /*yield*/, consentResponse_1.ConsentResponse.find({ userId: user.id }).sort({ agreedAt: -1 })];
+                    case 1:
+                        responses = _a.sent();
+                        formIds = responses.map(function (r) { return r.consentFormId; });
+                        return [4 /*yield*/, consentForm_1.ConsentForm.find({ _id: { $in: formIds } })];
+                    case 2:
+                        forms = _a.sent();
+                        formMap = new Map(forms.map(function (f) { return [f._id.toString(), f]; }));
+                        data = responses.map(function (response) {
+                            var form = formMap.get(response.consentFormId.toString());
+                            return {
+                                _id: response._id,
+                                agreed: response.agreed,
+                                agreedAt: response.agreedAt,
+                                checkboxValues: response.checkboxValues,
+                                contentSnapshot: response.contentSnapshot,
+                                form: form
+                                    ? {
+                                        captureSignature: form.captureSignature,
+                                        checkboxes: form.checkboxes,
+                                        slug: form.slug,
+                                        title: form.title,
+                                        type: form.type,
+                                        version: form.version,
+                                    }
+                                    : null,
+                                formVersionSnapshot: response.formVersionSnapshot,
+                                ipAddress: response.ipAddress,
+                                locale: response.locale,
+                                signature: response.signature,
+                                signedAt: response.signedAt,
+                                userAgent: response.userAgent,
+                            };
+                        });
+                        return [2 /*return*/, res.json({ data: data })];
+                }
+            });
+        }); }));
+        // GET /consents/audit/:userId - admin audit trail for a specific user
+        if (auditTrail) {
+            router.get("/audit/:userId", (0, auth_1.authenticateMiddleware)(), (0, api_1.asyncHandler)(function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+                var user, responses, formIds, forms, formMap, auditEntries;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            user = req.user;
+                            if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                                throw new errors_1.APIError({ status: 403, title: "Admin access required" });
+                            }
+                            return [4 /*yield*/, consentResponse_1.ConsentResponse.find({ userId: req.params.userId }).sort({
+                                    agreedAt: -1,
+                                })];
+                        case 1:
+                            responses = _a.sent();
+                            formIds = responses.map(function (r) { return r.consentFormId; });
+                            return [4 /*yield*/, consentForm_1.ConsentForm.find({ _id: { $in: formIds } })];
+                        case 2:
+                            forms = _a.sent();
+                            formMap = new Map(forms.map(function (f) { return [f._id.toString(), f]; }));
+                            auditEntries = responses.map(function (response) {
+                                var form = formMap.get(response.consentFormId.toString());
+                                return {
+                                    agreed: response.agreed,
+                                    agreedAt: response.agreedAt,
+                                    contentSnapshot: response.contentSnapshot,
+                                    form: form
+                                        ? {
+                                            slug: form.slug,
+                                            title: form.title,
+                                            type: form.type,
+                                            version: form.version,
+                                        }
+                                        : null,
+                                    formVersionSnapshot: response.formVersionSnapshot,
+                                    ipAddress: response.ipAddress,
+                                    locale: response.locale,
+                                    responseId: response._id,
+                                    signedAt: response.signedAt,
+                                    userAgent: response.userAgent,
+                                };
+                            });
+                            return [2 /*return*/, res.json({ data: auditEntries })];
+                    }
+                });
+            }); }));
+        }
+        app.use("/consents", router);
+        logger_1.logger.info("ConsentApp registered", { auditTrail: Boolean(auditTrail) });
+    };
+    return ConsentApp;
+}());
+exports.ConsentApp = ConsentApp;

package/dist/consentApp.test.d.ts

@@ -0,0 +1 @@
+export {};