{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/admin/roles/index.ts"],"sourcesContent":["/**\n * GET  /_emdash/api/admin/roles — list roles with their policies and user counts\n * POST /_emdash/api/admin/roles — create a role\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { roleCreateBody } from \"#api/schemas.js\";\nimport { invalidateAuthzCache } from \"#auth/authz.js\";\nimport { AuthzError, AuthzRepository } from \"#db/repositories/authz.js\";\n\nexport const prerender = false;\n\nexport function authzErrorResponse(error: unknown): Response | null {\n\tif (!(error instanceof AuthzError)) return null;\n\tconst status: Record<AuthzError[\"code\"], number> = {\n\t\tNOT_FOUND: 404,\n\t\tSLUG_TAKEN: 409,\n\t\tBUILTIN_IMMUTABLE: 409,\n\t\tROLE_IN_USE: 409,\n\t\tPOLICY_IN_USE: 409,\n\t\tINVALID_RULES: 400,\n\t\tUNKNOWN_POLICY: 400,\n\t\tINVALID_SLUG: 400,\n\t\tINVALID_LEVEL: 400,\n\t};\n\treturn apiError(error.code, error.message, status[error.code], error.details);\n}\n\nexport const GET: APIRoute = async ({ locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst denied = requirePerm(user, \"roles:read\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst items = await new AuthzRepository(emdash.db).listRoles();\n\t\treturn apiSuccess({ items });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to list roles\", \"ROLE_LIST_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst denied = requirePerm(user, \"roles:manage\");\n\tif (denied) return denied;\n\n\ttry {\n\t\tconst body = await parseBody(request, roleCreateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst item = await new AuthzRepository(emdash.db).createRole(body);\n\t\tinvalidateAuthzCache();\n\t\treturn apiSuccess({ item }, 201);\n\t} catch (error) {\n\t\treturn (\n\t\t\tauthzErrorResponse(error) ?? handleError(error, \"Failed to create role\", \"ROLE_CREATE_ERROR\")\n\t\t);\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,SAAgB,mBAAmB,OAAiC;AACnE,KAAI,EAAE,iBAAiB,YAAa,QAAO;AAY3C,QAAO,SAAS,MAAM,MAAM,MAAM,SAXiB;EAClD,WAAW;EACX,YAAY;EACZ,mBAAmB;EACnB,aAAa;EACb,eAAe;EACf,eAAe;EACf,gBAAgB;EAChB,cAAc;EACd,eAAe;EACf,CACiD,MAAM,OAAO,MAAM,QAAQ;;AAG9E,MAAa,MAAgB,OAAO,EAAE,aAAa;CAClD,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpF,MAAM,SAAS,YAAY,MAAM,aAAa;AAC9C,KAAI,OAAQ,QAAO;AAEnB,KAAI;AAEH,SAAO,WAAW,EAAE,OADN,MAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,WAAW,EACnC,CAAC;UACpB,OAAO;AACf,SAAO,YAAY,OAAO,wBAAwB,kBAAkB;;;AAItE,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;CAC5D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GAAI,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpF,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,OAAO,MAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,WAAW,KAAK;AAClE,wBAAsB;AACtB,SAAO,WAAW,EAAE,MAAM,EAAE,IAAI;UACxB,OAAO;AACf,SACC,mBAAmB,MAAM,IAAI,YAAY,OAAO,yBAAyB,oBAAoB"}