captify 0.1.18 → 0.1.19

package/dist/collaboration/api/collaboration.handlers.js

@@ -0,0 +1,1017 @@
+/**
+ * Collaboration API Route Handlers
+ *
+ * Handlers for document CRUD operations, collaborator management, and AI generation.
+ */
+import { requireDocumentAccess } from "./collaboration.api-utilities";
+import { AccessDeniedError } from "../collaboration.errors";
+import { addCollaboratorBodySchema, commentIdSchema, createCommentBodySchema, createDocumentBodySchema, createVersionBodySchema, documentIdSchema, generateContentBodySchema, generateDocumentBodySchema, listCommentsQuerySchema, listDocumentsQuerySchema, updateCollaboratorBodySchema, updateCommentBodySchema, updateDocumentBodySchema, } from "../collaboration.schemas";
+import { userIdSchema } from "../../shared/services/services.schemas";
+import { decodeFromBase64, encodeToBase64 } from "../collaboration.utilities";
+import { getCollaborationService } from "../services/collaboration.service";
+import { getCollaboratorService } from "../services/collaborator.service";
+import { getCommentService } from "../services/comment.service";
+import { getDocumentGenerationService } from "../services/document-generation.service";
+import { getVersionService } from "../services/version.service";
+import { ACTION, RESOURCE } from "../../permissions/permissions.constants";
+import { requirePermission } from "../../permissions/permissions.utilities";
+import { ServiceError } from "../../shared/services";
+import { HTTP_STATUS } from "../../shared/shared.constants";
+import { getUserAwsCredentials, handleApi, withAuth } from "../../shared/utilities/api";
+import { NextResponse } from "next/server";
+import { ZodError } from "zod";
+/**
+ * GET /api/collaboration/documents
+ *
+ * Lists documents for the authenticated user with optional filtering.
+ *
+ * @query filter - Document filter (all, my-documents, shared-with-me, recent, trashed)
+ * @query search - Search term to filter by title/preview
+ * @query limit - Maximum number of documents to return (1-100)
+ * @query nextToken - Pagination token for next page
+ *
+ * @returns Object containing:
+ *   - documents: Array of document objects
+ *   - nextToken: Pagination token (if more results)
+ *   - total: Total count of matching documents
+ */
+export const listDocuments = withAuth(async (request, { userId, user, idToken, tenantId }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.LIST,
+        groups: user.groups,
+        userCredentials,
+    });
+    const url = new URL(request.url);
+    const params = listDocumentsQuerySchema.parse({
+        filter: url.searchParams.get("filter") || undefined,
+        search: url.searchParams.get("search") || undefined,
+        limit: url.searchParams.get("limit") || undefined,
+        nextToken: url.searchParams.get("nextToken") || undefined,
+    });
+    return getCollaborationService().list({
+        tenantId,
+        userId,
+        filter: params.filter,
+        search: params.search,
+        limit: params.limit,
+        nextToken: params.nextToken,
+        userCredentials,
+    });
+}));
+/**
+ * POST /api/collaboration/documents
+ *
+ * Creates a new document for the authenticated user.
+ *
+ * @body title - Document title
+ *
+ * @returns The created document
+ */
+export const createDocument = withAuth(async (request, { userId, user, idToken, tenantId }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.CREATE,
+        groups: user.groups,
+        userCredentials,
+    });
+    const body = createDocumentBodySchema.parse(await request.json());
+    return getCollaborationService().create({
+        tenantId,
+        title: body.title,
+        ownerId: userId,
+        ownerName: user.name,
+        ownerEmail: user.email,
+        userCredentials,
+    });
+}, { successStatus: HTTP_STATUS.CREATED }));
+/**
+ * GET /api/collaboration/documents/[documentId]
+ *
+ * Gets a single document by ID.
+ *
+ * @param documentId - Document ID (UUID)
+ *
+ * @returns The document
+ */
+export const getDocument = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId } = await params;
+    documentIdSchema.parse(documentId);
+    return getCollaborationService().get({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+}));
+/**
+ * PATCH /api/collaboration/documents/[documentId]
+ *
+ * Updates a document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @body title - New document title (optional)
+ * @body content - New document content as base64 (optional)
+ * @body wordCount - Word count (optional, calculated if content provided)
+ * @body previewSnippet - Preview snippet (optional)
+ *
+ * @returns The updated document
+ */
+export const updateDocument = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (owner or collaborator with edit/admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.UPDATE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "edit",
+        operationName: "update document",
+    });
+    const body = updateDocumentBodySchema.parse(await request.json());
+    const updates = {};
+    if (body.title !== undefined) {
+        updates.title = body.title;
+    }
+    if (body.content !== undefined) {
+        // Content is base64 encoded in API
+        updates.content = decodeFromBase64(body.content);
+    }
+    if (body.wordCount !== undefined) {
+        updates.wordCount = body.wordCount;
+    }
+    if (body.previewSnippet !== undefined) {
+        updates.previewSnippet = body.previewSnippet;
+    }
+    return getCollaborationService().update({
+        tenantId,
+        documentId,
+        userId,
+        updates,
+        userCredentials,
+    });
+}));
+/**
+ * DELETE /api/collaboration/documents/[documentId]
+ *
+ * Soft deletes a document (moves to trash).
+ *
+ * @param documentId - Document ID (UUID)
+ *
+ * @returns 204 No Content on success
+ */
+export const deleteDocument = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (only owner can delete)
+    const { isOwner } = await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.DELETE,
+        groups: user.groups,
+        userCredentials,
+        operationName: "delete document",
+    });
+    // Only document owner can delete
+    if (!isOwner) {
+        throw new AccessDeniedError(userId, documentId, "delete document (owner only)");
+    }
+    await getCollaborationService().delete({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * POST /api/collaboration/documents/[documentId]/restore
+ *
+ * Restores a trashed document.
+ *
+ * @param documentId - Document ID (UUID)
+ *
+ * @returns 204 No Content on success
+ */
+export const restoreDocument = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (only owner can restore)
+    const { isOwner } = await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.UPDATE,
+        groups: user.groups,
+        userCredentials,
+        operationName: "restore document",
+    });
+    // Only document owner can restore
+    if (!isOwner) {
+        throw new AccessDeniedError(userId, documentId, "restore document (owner only)");
+    }
+    await getCollaborationService().restore({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+// ============================================================================
+// Collaborator Handlers
+// ============================================================================
+/**
+ * GET /api/collaboration/documents/[documentId]/collaborators
+ *
+ * Lists all collaborators for a document.
+ *
+ * @param documentId - Document ID (UUID)
+ *
+ * @returns Object containing:
+ *   - collaborators: Array of collaborator objects
+ */
+export const listCollaborators = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId } = await params;
+    documentIdSchema.parse(documentId);
+    // Check if user is the document owner (owners have implicit access)
+    const document = await getCollaborationService().get({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+    const isOwner = document.ownerId === userId;
+    if (!isOwner) {
+        // Verify user has access via collaborators
+        const permissionLevel = await getCollaboratorService().getPermissionLevel({
+            documentId,
+            userId,
+            userCredentials,
+        });
+        if (!permissionLevel) {
+            throw new AccessDeniedError(userId, documentId, "read");
+        }
+    }
+    return getCollaboratorService().list({ documentId, userCredentials });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/collaborators
+ *
+ * Adds a collaborator to a document.
+ * Requires admin permission on the document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @body userId - User ID to add as collaborator
+ * @body permissionLevel - Permission level (view, edit, admin)
+ *
+ * @returns The created collaborator
+ */
+export const addCollaborator = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (owner or collaborator with admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.SHARE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "admin",
+        operationName: "add collaborator",
+    });
+    const body = addCollaboratorBodySchema.parse(await request.json());
+    // TODO: Look up user info from Cognito/Users service
+    // For now, we require userName and userEmail to be provided or use placeholders
+    return getCollaboratorService().add({
+        documentId,
+        userId: body.userId,
+        userName: body.userId, // Placeholder - should look up from users service
+        userEmail: `${body.userId}@placeholder.com`, // Placeholder
+        permissionLevel: body.permissionLevel,
+        invitedById: userId,
+        invitedByName: user.name,
+        userCredentials,
+    });
+}, { successStatus: HTTP_STATUS.CREATED }));
+/**
+ * PATCH /api/collaboration/documents/[documentId]/collaborators/[userId]
+ *
+ * Updates a collaborator's permission level.
+ * Requires admin permission on the document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param userId - User ID of the collaborator to update
+ * @body permissionLevel - New permission level (view, edit, admin)
+ *
+ * @returns 204 No Content on success
+ */
+export const updateCollaborator = withAuth(async (request, { userId: currentUserId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId: currentUserId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.SHARE,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId, userId: targetUserId } = await params;
+    // Check document access (owner or collaborator with admin permission)
+    await requireDocumentAccess({
+        userId: currentUserId,
+        tenantId,
+        documentId,
+        action: ACTION.SHARE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "admin",
+        operationName: "update collaborator",
+    });
+    userIdSchema.parse(targetUserId);
+    const body = updateCollaboratorBodySchema.parse(await request.json());
+    await getCollaboratorService().update({
+        documentId,
+        userId: targetUserId,
+        permissionLevel: body.permissionLevel,
+        updatedById: currentUserId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * DELETE /api/collaboration/documents/[documentId]/collaborators/[userId]
+ *
+ * Removes a collaborator from a document.
+ * Requires admin permission on the document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param userId - User ID of the collaborator to remove
+ *
+ * @returns 204 No Content on success
+ */
+export const removeCollaborator = withAuth(async (_, { userId: currentUserId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId: currentUserId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.SHARE,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId, userId: targetUserId } = await params;
+    // Check document access (owner or collaborator with admin permission)
+    await requireDocumentAccess({
+        userId: currentUserId,
+        tenantId,
+        documentId,
+        action: ACTION.SHARE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "admin",
+        operationName: "remove collaborator",
+    });
+    userIdSchema.parse(targetUserId);
+    await getCollaboratorService().remove({
+        documentId,
+        userId: targetUserId,
+        removedById: currentUserId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * DELETE /api/collaboration/documents/[documentId]/permanent
+ *
+ * Permanently deletes a trashed document.
+ * Document must be in trashed status and user must be owner.
+ *
+ * @param documentId - Document ID (UUID)
+ *
+ * @returns 204 No Content on success
+ */
+export const permanentDeleteDocument = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (only owner can permanently delete)
+    const { isOwner } = await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.DELETE,
+        groups: user.groups,
+        userCredentials,
+        operationName: "permanently delete document",
+    });
+    // Only document owner can permanently delete
+    if (!isOwner) {
+        throw new AccessDeniedError(userId, documentId, "permanently delete document (owner only)");
+    }
+    await getCollaborationService().permanentDelete({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * Grouped handlers for API routes.
+ * Use these in route files for consistency.
+ */
+export const collaborationHandlers = {
+    list: listDocuments,
+    create: createDocument,
+    get: getDocument,
+    update: updateDocument,
+    delete: deleteDocument,
+    restore: restoreDocument,
+    permanentDelete: permanentDeleteDocument,
+};
+/**
+ * Collaborator-specific handlers for sharing routes.
+ */
+export const collaboratorHandlers = {
+    list: listCollaborators,
+    add: addCollaborator,
+    update: updateCollaborator,
+    remove: removeCollaborator,
+};
+// ============================================================================
+// AI Generation Handlers
+// ============================================================================
+/**
+ * POST /api/collaboration/generate/stream
+ *
+ * Streams AI-generated content for document editing.
+ * Uses Server-Sent Events (SSE) to stream partial results.
+ *
+ * @body documentId - Document ID for context
+ * @body prompt - User prompt for generation
+ * @body contextMode - "selection" or "full-document"
+ * @body selectionText - Selected text (if contextMode is "selection")
+ * @body documentContent - Full document text content
+ * @body files - Optional file attachments
+ *
+ * @returns SSE stream of generated content
+ */
+export const streamContentGeneration = withAuth(async (request, { idToken, tenantId, userId, user }) => {
+    var _a, _b, _c, _d;
+    try {
+        const userCredentials = await getUserAwsCredentials(idToken);
+        await requirePermission({
+            userId,
+            tenantId,
+            resource: RESOURCE.COLLABORATIVE_DOCS,
+            action: ACTION.GENERATE,
+            groups: user.groups,
+            userCredentials,
+        });
+        const body = generateContentBodySchema.parse(await request.json());
+        // Extract prompt text from useChat messages
+        const lastUserMessage = [...body.messages]
+            .reverse()
+            .find((m) => m.role === "user");
+        const prompt = (_d = (_c = (_b = (_a = lastUserMessage === null || lastUserMessage === void 0 ? void 0 : lastUserMessage.parts) === null || _a === void 0 ? void 0 : _a.find((p) => p.type === "text")) === null || _b === void 0 ? void 0 : _b.text) !== null && _c !== void 0 ? _c : lastUserMessage === null || lastUserMessage === void 0 ? void 0 : lastUserMessage.content) !== null && _d !== void 0 ? _d : "";
+        // Service returns a Response with AI SDK streaming format
+        const response = await getDocumentGenerationService().streamContentGeneration({
+            tenantId,
+            userId,
+            documentId: body.documentId,
+            prompt,
+            contextMode: body.contextMode,
+            selectionText: body.selectionText,
+            documentContent: body.documentContent,
+            files: body.files,
+            modelId: body.modelId,
+            agentId: body.agentId,
+            messages: body.messages,
+            userCredentials,
+        });
+        return new NextResponse(response.body, {
+            status: response.status,
+            headers: response.headers,
+        });
+    }
+    catch (err) {
+        if (err instanceof ZodError) {
+            const message = err.issues.map((issue) => issue.message).join(", ");
+            return NextResponse.json({ error: message }, { status: 400 });
+        }
+        if (err instanceof ServiceError) {
+            return NextResponse.json({ error: err.message }, { status: err.statusCode });
+        }
+        if (err instanceof AccessDeniedError) {
+            return NextResponse.json({ error: err.message }, { status: 403 });
+        }
+        return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+    }
+});
+/**
+ * POST /api/collaboration/documents/[documentId]/generate
+ *
+ * Generates document title/content from a prompt and updates the document.
+ */
+export const generateDocument = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.GENERATE,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId } = await params;
+    documentIdSchema.parse(documentId);
+    const body = generateDocumentBodySchema.parse(await request.json());
+    return getDocumentGenerationService().generateDocumentFromPrompt({
+        tenantId,
+        userId,
+        documentId,
+        prompt: body.prompt,
+        userCredentials,
+    });
+}));
+/**
+ * AI generation handlers
+ */
+export const aiGenerationHandlers = {
+    stream: streamContentGeneration,
+    generateDocument,
+};
+// ============================================================================
+// Version Handlers
+// ============================================================================
+/**
+ * GET /api/collaboration/documents/[documentId]/versions
+ *
+ * Lists all versions for a document (newest first).
+ *
+ * @param documentId - Document ID (UUID)
+ * @query limit - Maximum number of versions to return (default: 50)
+ *
+ * @returns Object containing:
+ *   - versions: Array of version objects
+ */
+export const listVersions = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    await requirePermission({
+        userId,
+        tenantId,
+        resource: RESOURCE.COLLABORATIVE_DOCS,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+    });
+    const { documentId } = await params;
+    documentIdSchema.parse(documentId);
+    // Check if user is the document owner (owners have implicit access)
+    const document = await getCollaborationService().get({
+        tenantId,
+        documentId,
+        userId,
+        userCredentials,
+    });
+    const isOwner = document.ownerId === userId;
+    if (!isOwner) {
+        // Verify user has access via collaborators
+        const permissionLevel = await getCollaboratorService().getPermissionLevel({
+            documentId,
+            userId,
+            userCredentials,
+        });
+        if (!permissionLevel) {
+            throw new AccessDeniedError(userId, documentId, "read");
+        }
+    }
+    const url = new URL(request.url);
+    const limit = url.searchParams.get("limit");
+    return getVersionService().list({
+        documentId,
+        limit: limit ? parseInt(limit, 10) : undefined,
+        userCredentials,
+    });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/versions
+ *
+ * Creates a manual version snapshot.
+ * Requires edit permission.
+ *
+ * @param documentId - Document ID (UUID)
+ * @body label - Optional label for the version
+ *
+ * @returns The created version
+ */
+export const createVersion = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (owner or collaborator with edit/admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.UPDATE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "edit",
+        operationName: "create version",
+    });
+    const body = createVersionBodySchema.parse(await request.json());
+    // Decode base64 content to Uint8Array
+    // Create a new Uint8Array by copying buffer data to avoid Node.js Buffer offset issues
+    const buffer = Buffer.from(body.content, "base64");
+    const contentBytes = Uint8Array.from(buffer);
+    return getVersionService().create({
+        documentId,
+        content: contentBytes,
+        wordCount: body.wordCount,
+        editorId: userId,
+        editorName: user.name || "Unknown",
+        snapshotType: "manual",
+        label: body.label,
+        userCredentials,
+    });
+}, { successStatus: HTTP_STATUS.CREATED }));
+/**
+ * GET /api/collaboration/documents/[documentId]/versions/[versionId]
+ *
+ * Gets a single version by ID.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param versionId - Version ID (UUID)
+ *
+ * @returns The version
+ */
+export const getVersion = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, versionId } = await params;
+    // Check document access (owner or any collaborator)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+        operationName: "get version",
+    });
+    const version = await getVersionService().get({
+        documentId,
+        versionId,
+        userCredentials,
+    });
+    // Encode content as base64 for JSON transport
+    return Object.assign(Object.assign({}, version), { content: version.content ? encodeToBase64(version.content) : undefined });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/versions/[versionId]/restore
+ *
+ * Restores a document to a specific version.
+ * Requires edit permission.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param versionId - Version ID to restore
+ *
+ * @returns 204 No Content on success
+ */
+export const restoreVersion = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, versionId } = await params;
+    // Check document access (owner or collaborator with edit/admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.UPDATE,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "edit",
+        operationName: "restore version",
+    });
+    await getVersionService().restore({
+        documentId,
+        versionId,
+        tenantId,
+        userId,
+        userName: user.name || "Unknown",
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * Version handlers for API routes.
+ */
+export const versionHandlers = {
+    list: listVersions,
+    create: createVersion,
+    get: getVersion,
+    restore: restoreVersion,
+};
+// ============================================================================
+// Comment Handlers
+// ============================================================================
+/**
+ * GET /api/collaboration/documents/[documentId]/comments
+ *
+ * Lists comments for a document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @query status - Filter by status (open, resolved, all)
+ * @query limit - Maximum results
+ *
+ * @returns List of comments
+ */
+export const listComments = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (owner or any collaborator)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+        operationName: "list comments",
+    });
+    const url = new URL(request.url);
+    const query = listCommentsQuerySchema.parse({
+        status: url.searchParams.get("status") || undefined,
+        limit: url.searchParams.get("limit") || undefined,
+    });
+    return getCommentService().list({
+        documentId,
+        status: query.status,
+        limit: query.limit,
+        userCredentials,
+    });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/comments
+ *
+ * Creates a new comment on a document.
+ *
+ * @param documentId - Document ID (UUID)
+ * @body anchorStart - Base64-encoded yjs RelativePosition
+ * @body anchorEnd - Base64-encoded yjs RelativePosition
+ * @body anchorText - Selected text
+ * @body content - Comment content
+ * @body parentId - Parent comment ID for replies (optional)
+ * @body mentions - Array of mentioned user IDs (optional)
+ *
+ * @returns The created comment
+ */
+export const createComment = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    var _a;
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId } = await params;
+    // Check document access (owner or any collaborator)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.COMMENT,
+        groups: user.groups,
+        userCredentials,
+        operationName: "create comment",
+    });
+    const body = createCommentBodySchema.parse(await request.json());
+    return getCommentService().create({
+        documentId,
+        parentId: body.parentId,
+        anchorStart: decodeFromBase64(body.anchorStart),
+        anchorEnd: decodeFromBase64(body.anchorEnd),
+        anchorText: (_a = body.anchorText) !== null && _a !== void 0 ? _a : "",
+        content: body.content,
+        authorId: userId,
+        authorName: user.name,
+        authorEmail: user.email,
+        mentions: body.mentions,
+        userCredentials,
+    });
+}, { successStatus: HTTP_STATUS.CREATED }));
+/**
+ * GET /api/collaboration/documents/[documentId]/comments/[commentId]
+ *
+ * Gets a single comment.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param commentId - Comment ID (UUID)
+ *
+ * @returns The comment
+ */
+export const getComment = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, commentId } = await params;
+    // Check document access (owner or any collaborator)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.READ,
+        groups: user.groups,
+        userCredentials,
+        operationName: "get comment",
+    });
+    commentIdSchema.parse(commentId);
+    return getCommentService().get({
+        documentId,
+        commentId,
+        userCredentials,
+    });
+}));
+/**
+ * PATCH /api/collaboration/documents/[documentId]/comments/[commentId]
+ *
+ * Updates a comment's content.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param commentId - Comment ID (UUID)
+ * @body content - Updated content
+ * @body mentions - Updated mentions
+ *
+ * @returns The updated comment
+ */
+export const updateComment = withAuth(async (request, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, commentId } = await params;
+    // Check document access (owner or any collaborator)
+    const { isOwner, permissionLevel } = await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.COMMENT,
+        groups: user.groups,
+        userCredentials,
+        operationName: "update comment",
+    });
+    commentIdSchema.parse(commentId);
+    // Get comment to verify ownership
+    const comment = await getCommentService().get({
+        documentId,
+        commentId,
+        userCredentials,
+    });
+    // Allow if user is comment author, document owner, or admin collaborator
+    if (comment.authorId !== userId && !isOwner && permissionLevel !== "admin") {
+        throw new AccessDeniedError(userId, commentId, "update comment");
+    }
+    const body = updateCommentBodySchema.parse(await request.json());
+    return getCommentService().update({
+        documentId,
+        commentId,
+        content: body.content,
+        mentions: body.mentions,
+        userId,
+        userCredentials,
+    });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/comments/[commentId]/resolve
+ *
+ * Resolves a comment thread.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param commentId - Comment ID (UUID)
+ *
+ * @returns The resolved comment
+ */
+export const resolveComment = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, commentId } = await params;
+    // Check document access (owner or collaborator with edit/admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.COMMENT,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "edit",
+        operationName: "resolve comment",
+    });
+    commentIdSchema.parse(commentId);
+    return getCommentService().resolve({
+        documentId,
+        commentId,
+        resolvedById: userId,
+        userCredentials,
+    });
+}));
+/**
+ * POST /api/collaboration/documents/[documentId]/comments/[commentId]/reopen
+ *
+ * Reopens a resolved comment thread.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param commentId - Comment ID (UUID)
+ *
+ * @returns The reopened comment
+ */
+export const reopenComment = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, commentId } = await params;
+    // Check document access (owner or collaborator with edit/admin permission)
+    await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.COMMENT,
+        groups: user.groups,
+        userCredentials,
+        minPermissionLevel: "edit",
+        operationName: "reopen comment",
+    });
+    commentIdSchema.parse(commentId);
+    return getCommentService().reopen({
+        documentId,
+        commentId,
+        userCredentials,
+    });
+}));
+/**
+ * DELETE /api/collaboration/documents/[documentId]/comments/[commentId]
+ *
+ * Deletes a comment.
+ *
+ * @param documentId - Document ID (UUID)
+ * @param commentId - Comment ID (UUID)
+ *
+ * @returns 204 No Content on success
+ */
+export const deleteComment = withAuth(async (_, { userId, user, idToken, tenantId }, { params }) => handleApi(async () => {
+    const userCredentials = await getUserAwsCredentials(idToken);
+    const { documentId, commentId } = await params;
+    // Check document access (owner or any collaborator)
+    const { isOwner, permissionLevel } = await requireDocumentAccess({
+        userId,
+        tenantId,
+        documentId,
+        action: ACTION.COMMENT,
+        groups: user.groups,
+        userCredentials,
+        operationName: "delete comment",
+    });
+    commentIdSchema.parse(commentId);
+    // Get comment to verify ownership
+    const comment = await getCommentService().get({
+        documentId,
+        commentId,
+        userCredentials,
+    });
+    // Allow if user is comment author, document owner, or admin collaborator
+    if (comment.authorId !== userId && !isOwner && permissionLevel !== "admin") {
+        throw new AccessDeniedError(userId, commentId, "delete comment");
+    }
+    await getCommentService().delete({
+        documentId,
+        commentId,
+        userCredentials,
+    });
+    return null;
+}, { successStatus: HTTP_STATUS.NO_CONTENT }));
+/**
+ * Comment handlers for API routes.
+ */
+export const commentHandlers = {
+    list: listComments,
+    create: createComment,
+    get: getComment,
+    update: updateComment,
+    resolve: resolveComment,
+    reopen: reopenComment,
+    delete: deleteComment,
+};
+//# sourceMappingURL=collaboration.handlers.js.map