Stop Building Backends.
Start Shipping Products.

// Generated: src/routes/todos.ts

// Firewall: org isolation middleware
app.use('/api/v1/todos/*', async (c, next) => {
  const ctx = c.get('ctx');
  if (!ctx.organizationId) throw new ForbiddenError('No org context');
  await next();
});

// Access: list (member, admin)
app.get('/api/v1/todos', async (c) => {
  const ctx = c.get('ctx');
  await checkAccess(ctx, 'todos', 'list');
  let query = db.select().from(todos);
  query = applyFirewall(query, ctx);
  const results = await query;
  return c.json({ data: applyMasking(results, ctx) });
});

// Access + Guards: create (title, content only)
app.post('/api/v1/todos', async (c) => {
  const ctx = c.get('ctx');
  await checkAccess(ctx, 'todos', 'create');
  const body = guardFields(
    await c.req.json(),
    ['title', 'content']
  );
  const result = await db.insert(todos).values({
    ...body, organizationId: ctx.organizationId
  });
  return c.json({ data: result }, 201);
});

// View: summary (member) - field projection
app.get('/api/v1/todos/views/summary', async (c) => {
  await checkAccess(ctx, 'todos', 'view:summary');
  const results = await db
    .select({ id, title, status })
    .from(todos);
  return c.json({ data: results });
});