New: Move route definitions to routes.json (fixes #37)

[Copilot]

Migrates UsersModule route configuration from imperative code to a declarative routes.json, aligning with the pattern established by AbstractApiModule and AbstractAuthModule which call loadRouteConfig() in setValues().

Update

• Replaced useDefaultRouteConfig() call, manual POST / removal, and /me route push in setValues() with a routes.json declaring all routes with useDefaultRoutes: false

New

• routes.json at module root defining /me (GET/PUT/PATCH), / (GET only), /schema, /:_id, and /query routes with appropriate handlers and permissions

Testing

1. Run npm test — all tests should pass
2. Verify at startup that /api/users/me, /api/users/, /api/users/schema, /api/users/:_id, and /api/users/query are registered with correct HTTP methods and permissions

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Refactor: Move route definitions to routes.json</issue_title>
<issue_description>## Context

Route definitions are moving from imperative code to declarative routes.json files. The loadRouteConfig function in adapt-authoring-server (PR adapt-security/adapt-authoring-users#58) now handles reading routes.json, resolving handler strings to bound methods, validating against a schema, and merging with default routes.

AbstractApiModule (PR adapt-security/adapt-authoring-users#77) and AbstractAuthModule (PR adapt-security/adapt-authoring-users#68) both call loadRouteConfig in setValues() with a defaults option, so consumer modules that provide a routes.json automatically get the base default routes prepended.

Current state

UsersModule calls useDefaultRouteConfig(), then:

• Removes POST / from the default routes
• Prepends a /me route with GET/PUT/PATCH → requestHandler() (permissions: read:me, write:me)

Refactoring steps

1. Create routes.json in the module root. Since this module removes POST from / and adds /me, the full routes need to be declared with useDefaultRoutes: false:

{
  "root": "users",
  "useDefaultRoutes": false,
  "routes": [
    {
      "route": "/me",
      "handlers": { "get": "default", "put": "default", "patch": "default" },
      "permissions": { "get": ["read:me"], "put": ["write:me"], "patch": ["write:me"] }
    },
    {
      "route": "/",
      "handlers": { "get": "default" },
      "permissions": { "get": ["read:{scope}"] }
    },
    {
      "route": "/schema",
      "handlers": { "get": "serveSchema" },
      "permissions": { "get": ["read:schema"] }
    },
    {
      "route": "/:_id",
      "handlers": { "put": "default", "get": "default", "patch": "default", "delete": "default" },
      "permissions": { "put": ["write:{scope}"], "get": ["read:{scope}"], "patch": ["write:{scope}"], "delete": ["write:{scope}"] }
    },
    {
      "route": "/query",
      "validate": false,
      "modifying": false,
      "handlers": { "post": "query" },
      "permissions": { "post": ["read:{scope}"] }
    }
  ]
}

2. Remove imperative route setup from init():

   • Remove the useDefaultRouteConfig() call
   • Remove the route filter/splice logic
   • Remove the /me route push

3. Test by running npm test and verifying routes are registered correctly at startup</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Refactor: Move route definitions to routes.json #37

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[taylortom]

We've lots the metadata from the routes

[taylortom]

Closing in favour of the convert-handler-factories branch which already handles the factory-to-standard-method conversion. Will redo this routes.json migration there.