Projects API

المشاريع — a community's project showcase with optional progress tracking.

Plan: every route needs the projects feature (403 FEATURE_NOT_AVAILABLE).

Who reads what (GET / and GET /{id} accept an optional token):

• approved member → every project of the community;
• guest or signed-in non-member → only projects with isGuestVisible: true, and only when the community exposes projects to guests; otherwise an empty page / 404. A token alone is not membership.
• creator.email is removed for guests.

Who writes what:

• create: projects:manage, projects:create or projects:moderate;
• edit / delete ANY project: projects:manage, projects:moderate or projects:edit; the creator (createdBy) may always edit and delete their own. projects:create alone does NOT edit other people's projects.
• assignedOwnerId (hand a project to another member) needs projects:manage or projects:moderate, and the target must be an APPROVED member of this community (403 PROJECT_OWNER_ASSIGN_FORBIDDEN / 400 PROJECT_OWNER_NOT_MEMBER).
• create and edit are refused to members restricted from media or suspended (403 RESTRICTION_BLOCKED), and count against the storage quota.
• communityId in the body is optional; if sent it must equal the path's (400 COMMUNITY_MISMATCH).

5 endpoints.

GET /api/communities/{communityId}/projects

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

POST /api/communities/{communityId}/projects

Auth: Bearer JWT required.

Parameters

Request body (required) — multipart/form-data

Type: ProjectWriteForm

Responses

DELETE /api/communities/{communityId}/projects/{id}

Auth: Bearer JWT required.

Parameters

Responses

GET /api/communities/{communityId}/projects/{id}

Auth: optional — a token changes what you can see (see "Who may read what").

Parameters

Responses

PUT /api/communities/{communityId}/projects/{id}

Send only the fields to change. removeLogo is refused unless a new projectLogo is uploaded; removeBanner=true clears the banner. assignedOwnerId="" gives the project back to the caller. Auth: Bearer JWT required.

Parameters

Request body — multipart/form-data

Type: object

Responses