From a76b173f4bceb9ac69e9bf633d6ba5e35e69bb87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hartmut=20N=C3=B6renberg?= <hn@hartmut-noerenberg.com>
Date: Tue, 31 Mar 2026 22:55:26 +0200
Subject: [PATCH] refactor(api): narrow import-export procedure contexts

---
 .../router/import-export-procedure-support.ts | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/packages/api/src/router/import-export-procedure-support.ts b/packages/api/src/router/import-export-procedure-support.ts
index eac9abf..e2f7941 100644
--- a/packages/api/src/router/import-export-procedure-support.ts
+++ b/packages/api/src/router/import-export-procedure-support.ts
@@ -4,8 +4,10 @@ import { z } from "zod";
 import type { TRPCContext } from "../trpc.js";
 import { requirePermission } from "../trpc.js";
 
-type ImportExportProcedureContext = Pick<TRPCContext, "db"> & {
-  permissions?: Set<PermissionKey>;
+type ImportExportReadContext = Pick<TRPCContext, "db">;
+
+type ImportExportMutationContext = ImportExportReadContext & {
+  permissions: Set<PermissionKey>;
 };
 
 type ImportRow = Record<string, string>;
@@ -33,7 +35,7 @@ function buildCsv(headers: unknown[], rows: unknown[][]) {
   return [headers.map(escapeCsvValue).join(","), ...rows.map((row) => row.map(escapeCsvValue).join(","))].join("\n");
 }
 
-export async function exportResourcesCsv(ctx: ImportExportProcedureContext) {
+export async function exportResourcesCsv(ctx: ImportExportReadContext) {
   const [resources, globalBlueprints] = await Promise.all([
     ctx.db.resource.findMany({
       where: { isActive: true },
@@ -78,7 +80,7 @@ export async function exportResourcesCsv(ctx: ImportExportProcedureContext) {
   return buildCsv(headers, rows);
 }
 
-export async function exportProjectsCsv(ctx: ImportExportProcedureContext) {
+export async function exportProjectsCsv(ctx: ImportExportReadContext) {
   const [projects, globalBlueprints] = await Promise.all([
     ctx.db.project.findMany({ orderBy: { shortCode: "asc" } }),
     ctx.db.blueprint.findMany({
@@ -120,7 +122,7 @@ export async function exportProjectsCsv(ctx: ImportExportProcedureContext) {
   return buildCsv(headers, rows);
 }
 
-async function importResourceRow(ctx: ImportExportProcedureContext, row: ImportRow) {
+async function importResourceRow(ctx: ImportExportMutationContext, row: ImportRow) {
   const existing = await ctx.db.resource.findFirst({
     where: { eid: row["eid"] ?? "" },
   });
@@ -142,11 +144,8 @@ async function importResourceRow(ctx: ImportExportProcedureContext, row: ImportR
   return { updated: true, error: null };
 }
 
-export async function importCsv(ctx: ImportExportProcedureContext, input: ImportCsvInput) {
-  requirePermission(
-    { permissions: ctx.permissions ?? new Set<PermissionKey>() },
-    PermissionKey.IMPORT_DATA,
-  );
+export async function importCsv(ctx: ImportExportMutationContext, input: ImportCsvInput) {
+  requirePermission(ctx, PermissionKey.IMPORT_DATA);
 
   const results = {
     total: input.rows.length,