{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/byline-fields/index.ts"],"sourcesContent":["/**\n * Byline custom-field schema management — list + create.\n *\n * - GET  /_emdash/api/admin/byline-fields           list every registered field\n * - POST /_emdash/api/admin/byline-fields           create a new field definition\n *\n * Thin wrappers around `handleBylineFieldList` / `handleBylineFieldCreate`\n * in `api/handlers/byline-fields.ts`. Both endpoints require\n * `schema:manage`. Reserved-slug + identifier validation runs at the\n * zod layer in `bylineFieldCreateBody`; the registry repeats the check\n * for defence-in-depth. Domain errors surface as typed `ErrorCode`s and\n * are mapped to HTTP statuses by `unwrapResult` → `mapErrorStatus`.\n *\n * Phase 4 of Discussion #1174.\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleBylineFieldCreate, handleBylineFieldList } from \"#api/handlers/byline-fields.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { bylineFieldCreateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\n// GET requires `schema:read` (Editor+), not `schema:manage` — Phase 6\n// of #1174 surfaced the split: editors need to read field definitions\n// to render custom-field inputs in the byline edit form, while only\n// admins manage the registry. The Phase 4 review-round constraint\n// \"every endpoint returns 403 for a user without schema:manage\" is\n// superseded for the read endpoints; mutations remain admin-only.\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:read\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst result = await handleBylineFieldList(emdash.db);\n\treturn unwrapResult(result);\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst denied = requirePerm(user, \"schema:manage\");\n\tif (denied) return denied;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\n\tconst body = await parseBody(request, bylineFieldCreateBody);\n\tif (isParseError(body)) return body;\n\n\tconst result = await handleBylineFieldCreate(emdash.db, {\n\t\tslug: body.slug,\n\t\tlabel: body.label,\n\t\ttype: body.type,\n\t\trequired: body.required,\n\t\ttranslatable: body.translatable,\n\t\tvalidation: body.validation ?? null,\n\t\tsortOrder: body.sortOrder,\n\t});\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAQzB,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,cAAc;AAC/C,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;AAGlB,QAAO,aADQ,MAAM,sBAAsB,OAAO,GAAG,CAC1B;;AAG5B,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;CAEnB,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAElB,MAAM,OAAO,MAAM,UAAU,SAAS,sBAAsB;AAC5D,KAAI,aAAa,KAAK,CAAE,QAAO;AAW/B,QAAO,aATQ,MAAM,wBAAwB,OAAO,IAAI;EACvD,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,UAAU,KAAK;EACf,cAAc,KAAK;EACnB,YAAY,KAAK,cAAc;EAC/B,WAAW,KAAK;EAChB,CAAC,EAC0B,IAAI"}