Before making create-resource (POST) or update-resource (PUT) requests to the server, validate the caller-supplied payload against the OpenAPI spec for the target operation.
Refactor end-to-end tests.
Remove large test ns client-e2e-test. Move its several deftest blocks to individual namespaces under client_e2e_tests/.
Refactor client.
Move URL constructors into dvb.client.urls.
Create abstractions around common CRUD patterns in dvb.client.core and use them, e.g., for show-old (built on show-resource), create-user (built on create-resource), etc.
Add OLD access requests (OARs).
These allow a non-user of an OLD to request access to that OLD.
A user can request access.
A user can retract their request.
An admin of the target OLD can reject or approve an access request. Approval entails making the requester a viewer of the OLD. Upgrade to contributor or administrator must be a subsequent request.
An admin of the target OLD can view all access requests for their OLD.
Add migration to add new table: old_access_requests.
Add new OpenAPI schema OLDAccessRequest.
Split edges ns into resource-specific namespaces.
Only allow create-plan when tier is free.
Add delete-user-old and better validation on relationship updates.
Support delete-user-old OpenAPI operation: DELETE /users-olds.
Ensure that updates and deletes of the relationships between users and both plans and OLDs never result in a plan or an OLD that is without a manager or an administrator, respectively.
Add new 400 error code :role-transition-violation for when an attempted update is prohibited because it is a role transition that would leave a managed entity without a user authorized to manage it.
Support user deactivation.
Add support for user deactivation via GET /users/:id/deactivate.
Only allow user deactivation if the user is not an administrator of any active OLDs and not a manager of any active plans.
Add db fn to get a user along with the OLDs to which it has access.
Add ability to update the role of a user wrt an OLD via PUT /user-olds/:id.
Add optional OLDs to show-plan response payload.
Add ability to request OLDs running under a plan in :show-plan operation, using include-olds=true query param. Resulting plan will have an :olds key containing an array of OLD slugs.
Index OLDs & Improved Authorization.
Add index-olds operation: GET /olds.
Add index-olds client fn.
Add db fn to get a plan including the OLDs running under it: get-plan-with-olds.
Add db fn to get a plan including the OLDs running under it and its members: get-plan-with-olds-and-members.
Ensure that the create-old operation always transactionally makes the authenticated user an admin of the new OLD.
Enforce, in :create-plan logic, that no user can be a member of more than one plan.
Enforce, in :update-user-plan logic, that a user cannot downgrade their role in a plan from manager to non-manager if that user is the sole manager of the plan.
Ensure that plan-with-members only returns non-deleted members.
Make resource and endpoint-specific authorization helpers consistent in authorize ns.
Ensure that only administrators of an OLD can perform mutations on their OLDs. Operations affected: :delete-plan, ...
Ensure that only managers of a plan can perform mutations on their plans. Operations affected: :delete-old, ...
Prohibit deletion of a plan when it has a non-empty set of dependent OLDs.
Add docs on authorization.
Add ability to grant users access to OLDs.
Add API endpoint for creating a user OLD, ie for giving a specified user a specified role in a target OLD.
Add boolean query param include-users to GET /olds/:slug which causes the returned OLD to have a :users key whose value is a coll of users with roles (UserOfOLD).
Add db fn to get an OLD with its users as a coll.
Add new OpenAPI schemas UserOfOLD, UserOLD, UserOLDWrite, and UserOLDUpdate.
Add optional users property of OpenAPI schema OLD.
Move user-old DB functionality into its own DB ns and HugSQL file.
Updates to user mutation authorization.
Make create-user (POST /users) work with and without authentication.
Non-authenticated can never create a superuser.
Authenticated can only create a superuser if authenticated user is itself a superuser.
Allow update of a user (PUT /users/:id) by superusers or by the user itself.
Disable the DELETE /users endpoint.
Make OpenAPI machinery recognize an empty security strategy as security optional.
Add E2E tests for bootstrapping a user, plan and OLD.
Generate user email more randomly to prevent flaky tests.
Add WIP notes and docs to README.
Add FK constraint from olds.plan_id to plans.id.
Add migration: all creators & updators not null.
Add migration to ensure that only the users table can have null values in the created_by and updated_by columns.
This required adding a non-superuser root user to the users table in the migration.
Update create-old and update-old DB fns to allow for specification of a plan_id.
Only a superuser or a manager of a plan can set an OLD's plan ID to the ID of that plan. That is, only a superuser or a manager of a plan can pay for an OLD under said plan. This authorization restriction applies to both create-old and update-old.
Add authorization restrictions on update-user. Only a superuser or the user. being updated are authorized to update a specified user.
Stop updating the OLD slug during update-old. The slug should not be mutable.
Add plan_id as nullable required property of OLD in OpenAPI schema.
Add plan_id as optional property of OLDWrite and OLDUpdate in OpenAPI schema.
Make tier an enum (free, subscriber or supporter) of Plan in OpenAPI schema.
Make tier an enum with free as the only option of PlanWrite in OpenAPI schema.
Add some authorization helpers in same-named ns.
Add E2E test for creating a free plan, making a user a manager of that plan, creating an OLD, and covering the OLD under the free plan.
Add ability to remove a user from a plan.
Optionally return members of plan and plans of user.
Ensure members of plan and plans of user both have :user-plan-id keys. These are needed for the PUT and DELETE methods on the user-plans/ endpoint for managing membership on plans.
Support include-members and include-plans query params in show-plan and show-user, respectively.
Improvements around user-plan relationships.
Add db fn to get a plan with its members as a coll of maps.
Add a db constraint to allow only one active user-plan relationship at a time.
Add WIP PUT and DELETE operations on the user-plans/ID endpoint.
Add optional members property to Plan OpenAPI schema.
Improve validation on user-plan relationship creation operation handler.
CRUD on OLDs works except for index-olds.
Add ability to create and show OLDs via API.
Ensure that non-superuser clients can index and show users.
A non-superuser receives redacted users in the responses to the show and index operations. The :email and :is-superuser? keys are not present.
Refactor: move OpenAPI schema namespaces to schemas/.
Return plans of user in show-user operation.
Support include-plans boolean query param in show-user API operation.
Changes