✅ Chat validators
Chat routes compose local guards with shared authentication, ownership, and organization validators. Every consumer below links to the authoritative route definition, where the complete invocation and execution order are visible.
Inventory
Details
getSubscriptionByChannelAndSubscriber(...)
Implementation
This helper accepts a MongoDB subscription collection, channelId, and subscribedId. It queries their string values and returns ResultAsync<WithId<Document> | null, unknown> without converting a database rejection. It is not a route validator itself; hasSubscription(path, subscriberPath?) is its only in-SDK consumer.
channelExists(path)
Implementation
Signature: channelExists(path): Validator. This factory reads a channel ID from its payload path and queries context.db.chatChannels. Both consumers pass ['params', 'requestParams', 'channelId']. It succeeds without adding pipeline data, throws 500 for a missing collection or query failure, and throws 404 when the channel is absent.
Consumers: getChannelMessagesRoute and upsertChatChannelReadStateRoute.
hasSubscription(path, subscriberPath?)
Implementation
Signature: hasSubscription(path, subscriberPath?): Validator. This factory uses context.authenticate or the Bearer extractor, requires context.db.subscriptions, and resolves the subscriber from its optional second path or from the token identity. It throws 500 for a missing collection/query failure, 401 for an invalid token, 400 for a missing channel/subscriber ID, and 403 when no matching subscription exists.
Consumers: The channel path is requestParams.channelId in getChatChannelRoute, getChannelMessagesRoute, and upsertChatChannelReadStateRoute; requestBody.channelId in createChatMessageRoute; and requestQuery.channelId in findChatMessagesRoute and findChatSubscriptionsRoute. All six omit the subscriber path and therefore check the token identity.
hasOrganizationAccessToMessageTemplate(allowedRoles, path)
Implementation
Signature: hasOrganizationAccessToMessageTemplate(allowedRoles, path): Validator. This factory authenticates through context.authenticate or Bearer extraction, loads context.db.chatMessageTemplates, follows the template's organizationId into context.db.organizations, and permits a member whose raw role is in allowedRoles. The get, update, and delete template routes all pass ['owner', 'admin'] and ['params', 'requestParams', 'messageTemplateId'].
It throws 401 for an invalid token, 500 for either missing collection, 404 for a missing template or organization, and 403 when the template has no organization or the identity lacks an allowed membership. Each route wraps it in some(...) with the global-admin branch.
Consumers: getChatMessageTemplateRoute, updateChatMessageTemplateRoute, and deleteChatMessageTemplateRoute.
isAuthenticated()
Implementation
Signature: isAuthenticated(): Validator. This shared factory validates the access token through the service-selected Bearer or cookie extractor. It is the first validator on every Chat HTTP route. It is deliberately absent from streamChatMessagesRoute, whose source has the authentication and subscription checks commented out. See the canonical isAuthenticated contract.
Consumers: createChatChannelRoute, findChatChannelsRoute, getChatChannelRoute, updateChatChannelRoute, deleteChatChannelRoute, getChannelMessagesRoute, getChatChannelIconUploadUrlRoute, createChatMessageTemplateRoute, getChatMessageTemplateRoute, updateChatMessageTemplateRoute, deleteChatMessageTemplateRoute, findChatMessageTemplatesRoute, findChatMessageTemplatesForOrganizationRoute, createChatMessageRoute, findChatMessagesRoute, getChatMessageRoute, updateChatMessageRoute, deleteChatMessageRoute, getChatMessageAttachmentUploadUrlRoute, createChatMessageAttachmentRoute, deleteChatMessageAttachmentRoute, upsertChatChannelReadStateRoute, createChatSubscriptionRoute, findChatSubscriptionsRoute, getChatSubscriptionRoute, and deleteChatSubscriptionRoute.
checkIdentityType(types)
Implementation
Signature: checkIdentityType(types): Validator. This shared factory checks the token identity against the configured identity type IDs. Chat always passes ['admin']. It is used directly after authentication only by findChatMessageTemplatesRoute; every other consumer in the inventory uses it as the first branch of some(...). See checkIdentityType for shared failures and configuration behavior.
Consumers: createChatChannelRoute, findChatChannelsRoute, getChatChannelRoute, updateChatChannelRoute, deleteChatChannelRoute, getChatChannelIconUploadUrlRoute, createChatMessageTemplateRoute, getChatMessageTemplateRoute, updateChatMessageTemplateRoute, deleteChatMessageTemplateRoute, findChatMessageTemplatesRoute, findChatMessagesRoute, getChatMessageRoute, deleteChatMessageRoute, deleteChatMessageAttachmentRoute, createChatSubscriptionRoute, findChatSubscriptionsRoute, getChatSubscriptionRoute, and deleteChatSubscriptionRoute.
isSelf(path)
Implementation
Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. This shared factory compares the token identity ID with a request value. Chat passes requestBody.ownerId for createChatChannelRoute, requestQuery.ownerId for findChatChannelsRoute, requestBody.senderId for createChatMessageRoute, requestQuery.senderId for findChatMessagesRoute, requestBody.identityId for upsertChatChannelReadStateRoute, requestBody.subscribedId for createChatSubscriptionRoute, and requestQuery.subscribedId for findChatSubscriptionsRoute. The message-create and read-state usages are direct; the others are branches of some(...). See the canonical isSelf contract.
Consumers: createChatChannelRoute, findChatChannelsRoute, createChatMessageRoute, findChatMessagesRoute, upsertChatChannelReadStateRoute, createChatSubscriptionRoute, and findChatSubscriptionsRoute.
ownsChannel(path)
Implementation
Signature: ownsChannel(path): Validator. This ownsResource specialization reads context.db.chatChannels, resolves the ID at the supplied path, and compares the channel's ownerId with the token identity. It receives requestParams.channelId for the channel get, update, delete, and icon-upload routes, and requestQuery.channelId for findChatSubscriptionsRoute. Every use is a some(...) branch. See the shared ownsResource contract.
Consumers: getChatChannelRoute, updateChatChannelRoute, deleteChatChannelRoute, getChatChannelIconUploadUrlRoute, and findChatSubscriptionsRoute.
ownsMessage(path)
Implementation
Signature: ownsMessage(path): Validator. This ownsResource specialization reads context.db.chatMessages, resolves requestParams.messageId, and compares the message's senderId with the token identity. It is direct on updateChatMessageRoute, getChatMessageAttachmentUploadUrlRoute, and createChatMessageAttachmentRoute; it is a some(...) branch on message get/delete and attachment delete. See the shared ownsResource contract.
Consumers: getChatMessageRoute, updateChatMessageRoute, deleteChatMessageRoute, getChatMessageAttachmentUploadUrlRoute, createChatMessageAttachmentRoute, and deleteChatMessageAttachmentRoute.
ownsSubscription(path)
Implementation
Signature: ownsSubscription(path): Validator. This ownsResource specialization reads context.db.subscriptions, resolves requestParams.subscriptionId, and compares the subscription's subscribedId with the token identity. See the shared ownsResource contract.
Consumers: getChatSubscriptionRoute and deleteChatSubscriptionRoute.
hasOrgRole(roles, path)
Implementation
Signature: hasOrgRole(roles, path): Validator. This shared factory authenticates the identity and checks membership against configured organization role IDs. createChatMessageTemplateRoute passes ['owner', 'admin'] with requestBody.organizationId as a some(...) branch. findChatMessageTemplatesForOrganizationRoute passes the same roles with requestParams.organizationId directly. See the canonical hasOrgRole contract.
Consumers: createChatMessageTemplateRoute and findChatMessageTemplatesForOrganizationRoute.
some(...)
Implementation
Signature: some(...args: Validator[]): Validator. This shared combinator receives already-created validators and succeeds when any branch succeeds. Chat uses it after isAuthenticated() for admin-or-self, admin-or-owner, admin-or-subscriber, and admin-or-organization-member policies. Branches execute in their route-source order, and the combinator rethrows only after every branch fails. See the canonical some contract.
Consumers: createChatChannelRoute, findChatChannelsRoute, getChatChannelRoute, updateChatChannelRoute, deleteChatChannelRoute, getChatChannelIconUploadUrlRoute, createChatMessageTemplateRoute, getChatMessageTemplateRoute, updateChatMessageTemplateRoute, deleteChatMessageTemplateRoute, findChatMessagesRoute, getChatMessageRoute, deleteChatMessageRoute, deleteChatMessageAttachmentRoute, createChatSubscriptionRoute, findChatSubscriptionsRoute, getChatSubscriptionRoute, and deleteChatSubscriptionRoute.