Quickback API

export default defineTable(candidates, {
  firewall: { organization: {}  },
  guards: {
    createable: ["name", "email", "resumeUrl"],
    updatable: ["name", "resumeUrl"],
  },
  masking: {
    email: { roles: ["recruiter", "hiring-manager"] },
    phone: { roles: ["recruiter"] },
  },
  crud: {
    list:   { access: { roles: ["recruiter", "hiring-manager"] } },
    create: { access: { roles: ["recruiter"] } },
    update: { access: { roles: ["recruiter", "hiring-manager"] } },
    delete: { access: { roles: ["owner"] } },
  },
});

// Firewall: org isolation middleware
app.use('/api/v1/candidates/*', async (c, next) => {
  const ctx = c.get('ctx');
  if (!ctx.organizationId) throw new ForbiddenError();
  await next();
});

// Access: list (recruiter, hiring-manager)
app.get('/api/v1/candidates', async (c) => {
  const ctx = c.get('ctx');
  await checkAccess(ctx, 'candidates', 'list');
  let query = db.select().from(candidates);
  query = applyFirewall(query, ctx);
  const results = await query;
  return c.json({ data: applyMasking(results, ctx) });
});

// Guards: only permitted fields written
app.post('/api/v1/candidates', async (c) => {
  await checkAccess(ctx, 'candidates', 'create');
  const body = await parseGuarded(c, ['name', 'email', 'resumeUrl']);
  return c.json({ data: await db.insert(candidates).values(body) });
});