✅ Organization validators
Organization routes compose these local and shared validator factories against the route payload. Validators resolve without a response value; failures throw the source-defined NodeblocksError before the handler pipeline runs.
Inventory
| Validator | Reads | Success condition | Failure / error | Consumers |
|---|---|---|---|---|
isAuthenticated() | context.authenticate or Bearer fallback | Selected auth transport accepts the request. | Authentication-adapter error. | All 18 Organization routes. |
checkIdentityType(['admin']) | Auth adapter, db.identities, configuration.identity.typeIds | Caller has configured administrator type. | 500 setup; 401 token; 403 identity/access. | All 18 Organization routes: direct on admin-only routes or through some(...). |
some(...validators) | Supplied validators | At least one branch succeeds. | First collected validator error when all branches fail. | getOrganizationRoute, updateOrganizationRoute, deleteOrganizationRoute, member routes, hierarchy/upload/change-request routes, and getOrganizationFollowersRoute. |
all(...validators) | Supplied validators | Every branch succeeds in sequence. | First failed validator error. | upsertOrganizationMembersRoute, deleteOrganizationMemberRoute. |
isSelf(path) | Authentication result and configured payload path | Token identityId equals target ID. | 401/403. | findOrganizationsForMemberRoute. |
hasOrgRole(...) | Organizations store, role configuration, token, organization-ID path | Caller is a member with an allowed configured role. | 400, 401, 403, or 500. | Organization role branches in routes. |
hasOrgRoleSameOrAbove(...) | Organizations store, role configuration, token, organization/member paths | Caller rank is at least target member rank. | 400, 401, 403, or 500. | deleteOrganizationMemberRoute. |
hasOrgRoleAssignmentPermission(...) | Organizations store, role configuration, token, organization/members paths | Caller may assign every requested role. | 400, 401, 403, 422, or 500. | upsertOrganizationMembersRoute. |
hasOrgOwnerRemainingAfterMemberRemoval(...) | Organizations store, role configuration, organization/member paths | Removal leaves an owner. | 400, 403, 409, or 500. | deleteOrganizationMemberRoute. |
hasOrgOwnerRemainingAfterMembersUpsert(...) | Organizations store, role configuration, organization/members paths | Upsert leaves an owner. | 400, 403, 409, or 500. | upsertOrganizationMembersRoute. |
Details
isAuthenticated()
Implementation
Signature: isAuthenticated(): Validator. Calls context.authenticate; organizationService selects Bearer transport by default and cookie transport when authMode is 'cookie'.
Consumers: It is the first validator on createOrganizationRoute, getOrganizationRoute, findOrganizationsRoute, updateOrganizationRoute, updateOrganizationAsAdminRoute, deleteOrganizationRoute, all member routes, hierarchy/upload/change-request routes, and getOrganizationFollowersRoute.
checkIdentityType(['admin'])
Implementation
Signature: checkIdentityType(['admin']): Validator. Reads db.identities and configuration.identity.typeIds.admin, authenticates, loads the identity, and accepts the configured administrator type. Missing setup is 500, token failure 401, and identity/type failure 403.
Consumers: It runs directly after authentication on createOrganizationRoute, findOrganizationsRoute, and updateOrganizationAsAdminRoute, and is the administrator branch of some(...) on every remaining Organization route.
some(...validators)
Implementation
Signature: some(...args: Validator[]): Validator. Administrator-or-alternative branch combinator; the member-list route uses admin or isSelf, and all other listed branches use admin or an Organization-role condition.
Consumers: getOrganizationRoute, updateOrganizationRoute, deleteOrganizationRoute, getOrganizationMemberRoleRoute, checkOrganizationMemberExistenceRoute, findOrganizationMembersRoute, upsertOrganizationMembersRoute, deleteOrganizationMemberRoute, findOrganizationsForMemberRoute, findOrganizationDescendantsRoute, upload/change-request routes, and getOrganizationFollowersRoute.
all(...validators)
Implementation
Signature: all(...args: Validator[]): Validator. Requires every supplied branch to succeed in sequence.
Consumers: Forms the non-administrator branch of upsertOrganizationMembersRoute: hasOrgRole(['owner', 'admin'], ['params', 'requestParams', 'organizationId']) and hasOrgRoleAssignmentPermission(['params', 'requestParams', 'organizationId'], ['params', 'requestBody']). On deleteOrganizationMemberRoute, it combines the same owner/admin role check with hasOrgRoleSameOrAbove using the target requestParams.identityId.
isSelf(path)
Implementation
Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. Requires the configured path value to equal the valid token identity ID.
Consumers: findOrganizationsForMemberRoute invokes isSelf(['params', 'requestParams', 'identityId']) as the non-administrator some(...) branch.
hasOrgRole(...)
Implementation
Signature: hasOrgRole(allowedRoles, organizationIdPathInPayload): Validator. All Organization invocations read ['params', 'requestParams', 'organizationId']. getOrganizationRoute permits owner, admin, or member; member-role, existence, member-list, descendant, and member-mutation role checks permit owner or admin; update, deletion, upload, change-request, and follower role checks permit owner. It requires db.organizations and configuration.organization.roles; setup is 500, invalid token 401, invalid ID 400, and lookup/membership/role failures 403.
Consumers: Organization role branches in routes.
hasOrgRoleSameOrAbove(...)
Implementation
Signature: hasOrgRoleSameOrAbove(organizationIdPathInPayload, memberIdPathInPayload): Validator. Default ascending role keys are member, admin, owner; configuration/order mismatch is 500, token failure 401, invalid paths 400, and disallowed membership/rank 403.
Consumers: deleteOrganizationMemberRoute invokes hasOrgRoleSameOrAbove(['params', 'requestParams', 'organizationId'], ['params', 'requestParams', 'identityId']) inside all(...).
hasOrgRoleAssignmentPermission(...)
Implementation
Signature: hasOrgRoleAssignmentPermission(organizationIdPathInPayload, membersPathInPayload): Validator. Permits assignments at or below the caller's role rank. Missing/invalid members is 400, invalid configured/requested roles is 422 or 500, and insufficient rank is 403.
Consumers: upsertOrganizationMembersRoute invokes hasOrgRoleAssignmentPermission(['params', 'requestParams', 'organizationId'], ['params', 'requestBody']) inside all(...).
hasOrgOwnerRemainingAfterMemberRemoval(...)
Implementation
Signature: hasOrgOwnerRemainingAfterMemberRemoval(organizationIdPathInPayload, memberIdPathInPayload): Validator. Returns 409 when removal would leave no configured owner; invalid payload is 400, organization lookup failure 403, and missing setup 500.
Consumers: deleteOrganizationMemberRoute invokes hasOrgOwnerRemainingAfterMemberRemoval(['params', 'requestParams', 'organizationId'], ['params', 'requestParams', 'identityId']) after some(...).
hasOrgOwnerRemainingAfterMembersUpsert(...)
Implementation
Signature: hasOrgOwnerRemainingAfterMembersUpsert(organizationIdPathInPayload, membersPathInPayload): Validator. Overlays requested member roles and returns 409 if no configured owner remains; invalid payload is 400, organization lookup failure 403, and missing setup 500.
Consumers: upsertOrganizationMembersRoute invokes hasOrgOwnerRemainingAfterMembersUpsert(['params', 'requestParams', 'organizationId'], ['params', 'requestBody']) after some(...).