A professionally designed full-stack foundation, built into your repo

const accessRoute = securedRoute(verifier, { tags: ['Access requests'] })

app.openapi(
  accessRoute({
    method: 'post',
    path: '/apps/v1/apps/{appId}/access-requests',
    operationId: 'requestAccess',
    summary: 'Ask for access to an app; the owner (or IT, when group-managed) is notified',
    request: { params: AppParamsSchema, body: { content: json(AccessRequestInputSchema), required: false } },
    responses: { 201: { content: json(AccessRequestSchema), description: 'The pending request' } },
  }),
  async c => {
    const body = await c.req.json().catch(() => ({}))
    return c.json(await appsService.requestAccess(requirePrincipal(c), c.req.valid('param').appId, body), 201)
  },
)

async requestAccess(principal: ConsolePrincipal, appId: string, input: unknown): Promise<AccessRequestView> {
  assertConsole(principal)
  const app = await this.publishedApp(await this.apps.get(appId))
  const reason = validAccessReason(input)
  if (await this.holdsAppAccess(app, principal.id)) throw accessAlreadyHeld(app)

  const sentTo = await this.accessManager(app)
  const recipients = sentTo.kind === 'it' ? await this.installAdminIds() : [app.ownerUserId]
  const request: AccessRequestRecord = {
    requestId: crypto.randomUUID(), appId: app.appId, requesterUserId: principal.id,
    reason, status: 'pending', createdAt: new Date(),
  }
  try {
    // the request and its notification commit together
    await this.accessRequests.createPending(request, requestNotification(app, request, recipients))
  } catch (error) {
    if (!(error instanceof AccessRequestPendingError)) throw error
    throw new E11Error({
      type: 'apps/access-request-pending',
      title: `You already asked for access to ${app.name}. Your request is still pending.`,
      status: 409,
    })
  }
  await this.deps.audit.record({ actor: principal.id, action: 'app.access.requested', target: { type: 'app', id: app.appId } })
  return { requestId: request.requestId, status: 'pending', sentTo }
}

/**
 * What every deployed environment runs. rest.ts never knows whether it got this file
 * or bindings.local.ts. Swap this for whichever provider you run (SES, Mailgun, ...);
 * nothing outside it needs to change.
 */
import type { EmailSender } from '@engineering11/v2-notifications-core'
import { SendGridEmailSender } from '@engineering11/v2-notifications-sendgrid'

function required(name: string): string {
  const v = process.env[name]
  if (!v) throw new Error(`${name} is required to bind the email sender`)
  return v
}

export const emailSender: EmailSender = new SendGridEmailSender({
  apiKey: required('SENDGRID_API_KEY'),
  defaultFrom: process.env.NOTIFICATIONS_FROM_EMAIL,
})