{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/policies/[id].ts"],"sourcesContent":["/**\n * GET    /_emdash/api/admin/policies/:id — one policy (id or slug), with the routes it grants\n * PUT    /_emdash/api/admin/policies/:id — update\n * DELETE /_emdash/api/admin/policies/:id — delete (not built-in, not held by any role)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { policyUpdateBody } from \"#api/schemas.js\";\nimport { invalidateAuthzCache } from \"#auth/authz.js\";\nimport { entriesGrantedBy, pluginCatalogEntries } from \"#auth/route-catalog.js\";\nimport { AuthzRepository } from \"#db/repositories/authz.js\";\n\nimport { authzErrorResponse } from \"../roles/index.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\tconst denied = requirePerm(user, \"policies:read\");\n\tif (denied) return denied;\n\tif (!params.id) return apiError(\"MISSING_PARAM\", \"Policy id required\", 400);\n\n\ttry {\n\t\tconst item = await new AuthzRepository(emdash.db).getPolicy(params.id);\n\t\tif (!item) return apiError(\"NOT_FOUND\", \"Policy not found\", 404);\n\t\treturn apiSuccess({\n\t\t\titem: { ...item, routeIds: entriesGrantedBy(item.rules, pluginCatalogEntries(emdash.listPluginRoutes?.() ?? [])).map((e) => e.id) },\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get policy\", \"POLICY_GET_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user, authz } = locals;\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\tconst denied = requirePerm(user, \"policies:manage\");\n\tif (denied) return denied;\n\tif (!params.id) return apiError(\"MISSING_PARAM\", \"Policy id required\", 400);\n\n\ttry {\n\t\tconst body = await parseBody(request, policyUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst repo = new AuthzRepository(emdash.db);\n\t\tconst target = await repo.getPolicy(params.id);\n\t\tif (!target) return apiError(\"NOT_FOUND\", \"Policy not found\", 404);\n\n\t\t// Rewriting a policy your own role holds can lock you out just like\n\t\t// editing your own role. Same rule: another administrator does it.\n\t\tif (body.rules !== undefined && authz?.rolePolicies.includes(target.slug)) {\n\t\t\treturn apiError(\n\t\t\t\t\"SELF_ROLE_CHANGE\",\n\t\t\t\t\"You cannot change the rules of a policy your own role holds\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\tconst item = await repo.updatePolicy(target.id, body);\n\t\tinvalidateAuthzCache();\n\t\treturn apiSuccess({\n\t\t\titem: { ...item, routeIds: entriesGrantedBy(item.rules, pluginCatalogEntries(emdash.listPluginRoutes?.() ?? [])).map((e) => e.id) },\n\t\t});\n\t} catch (error) {\n\t\treturn (\n\t\t\tauthzErrorResponse(error) ??\n\t\t\thandleError(error, \"Failed to update policy\", \"POLICY_UPDATE_ERROR\")\n\t\t);\n\t}\n};\n\nexport const DELETE: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\tconst denied = requirePerm(user, \"policies:manage\");\n\tif (denied) return denied;\n\tif (!params.id) return apiError(\"MISSING_PARAM\", \"Policy id required\", 400);\n\n\ttry {\n\t\tawait new AuthzRepository(emdash.db).deletePolicy(params.id);\n\t\tinvalidateAuthzCache();\n\t\treturn apiSuccess({ success: true });\n\t} catch (error) {\n\t\treturn (\n\t\t\tauthzErrorResponse(error) ??\n\t\t\thandleError(error, \"Failed to delete policy\", \"POLICY_DELETE_ERROR\")\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CACpF,MAAM,SAAS,YAAY,MAAM,gBAAgB;AACjD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAO,GAAI,QAAO,SAAS,iBAAiB,sBAAsB,IAAI;AAE3E,KAAI;EACH,MAAM,OAAO,MAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,UAAU,OAAO,GAAG;AACtE,MAAI,CAAC,KAAM,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAChE,SAAO,WAAW,EACjB,MAAM;GAAE,GAAG;GAAM,UAAU,iBAAiB,KAAK,OAAO,qBAAqB,OAAO,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG;GAAE,EACnI,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,mBAAmB;;;AAIvE,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,MAAM,UAAU;AAChC,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CACpF,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAO,GAAI,QAAO,SAAS,iBAAiB,sBAAsB,IAAI;AAE3E,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,OAAO,IAAI,gBAAgB,OAAO,GAAG;EAC3C,MAAM,SAAS,MAAM,KAAK,UAAU,OAAO,GAAG;AAC9C,MAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,oBAAoB,IAAI;AAIlE,MAAI,KAAK,UAAU,UAAa,OAAO,aAAa,SAAS,OAAO,KAAK,CACxE,QAAO,SACN,oBACA,+DACA,IACA;EAGF,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,IAAI,KAAK;AACrD,wBAAsB;AACtB,SAAO,WAAW,EACjB,MAAM;GAAE,GAAG;GAAM,UAAU,iBAAiB,KAAK,OAAO,qBAAqB,OAAO,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG;GAAE,EACnI,CAAC;UACM,OAAO;AACf,SACC,mBAAmB,MAAM,IACzB,YAAY,OAAO,2BAA2B,sBAAsB;;;AAKvE,MAAa,SAAmB,OAAO,EAAE,QAAQ,aAAa;CAC7D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CACpF,MAAM,SAAS,YAAY,MAAM,kBAAkB;AACnD,KAAI,OAAQ,QAAO;AACnB,KAAI,CAAC,OAAO,GAAI,QAAO,SAAS,iBAAiB,sBAAsB,IAAI;AAE3E,KAAI;AACH,QAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,aAAa,OAAO,GAAG;AAC5D,wBAAsB;AACtB,SAAO,WAAW,EAAE,SAAS,MAAM,CAAC;UAC5B,OAAO;AACf,SACC,mBAAmB,MAAM,IACzB,YAAY,OAAO,2BAA2B,sBAAsB"}