labimotion 2.3.0 → 2.4.0.rc11

data/lib/labimotion/apis/labimotion_ai_api.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require 'labimotion/version'
+
+module Labimotion
+  # Per-user LabIMotion AI settings: the model, an optional personal API key and
+  # an optional provider endpoint of one's own.
+  #
+  # They live in our own user_settings table under the 'ai' key
+  # (Labimotion::UserAiSettings). The routes stay under /profiles, where clients
+  # already reach them, but nothing is stored on the host's profile any more.
+  #
+  # The API key is stored encrypted and never returned; a read only reports
+  # whether one is set.
+  class LabimotionAiAPI < Grape::API
+    # Fallback model choices when the server config (config/labimotion_ai.yml
+    # :models) lists none. A representative subset of the chat-capable KI-Toolbox
+    # models (ki-toolbox.scc.kit.edu); the full list lives in the yml.
+    DEFAULT_MODELS = %w[
+      models/DeepSeek-R1-Distill-Qwen-1.5B-Q4_K_M.gguf
+      kit.mistral-small-4-119b-a8b
+      azure.gpt-4.1-mini
+      azure.gpt-4.1
+      azure.gpt-5
+      azure.gpt-5-mini
+      google.claude-sonnet-4.6
+      google.claude-haiku-4.5
+      google.gemini-2.5-pro
+      kit.gpt-oss-120b
+    ].freeze
+
+    # rubocop:disable Metrics/BlockLength
+    resource :profiles do
+      namespace :labimotion_ai do
+        # Per-user LabIMotion AI settings (model + personal API key) for the
+        # AI dataset-template feature. The API key is stored encrypted and is
+        # never returned — only whether one is set.
+
+        # These settings only exist to serve the AI integration, so they follow
+        # the same whitelist (matrices.configs :ai_uids). Users off the list get
+        # a 403 rather than a settings page they cannot act on.
+        before do
+          error!({ status: false, error: 'AI integration is not enabled for this account.' }, 403) unless
+            Matrice.ai_enabled_for_any?(current_user)
+        end
+
+        helpers do
+          # Normalize a configured model entry (an id String, or a Hash with
+          # :id/:label) into { id:, label: }. Label falls back to the id.
+          def normalize_ai_model(entry)
+            if entry.respond_to?(:[]) && !entry.is_a?(String)
+              id = (entry[:id] || entry['id']).to_s
+              label = (entry[:label] || entry['label']).to_s
+            else
+              id = entry.to_s
+              label = ''
+            end
+            return nil if id.blank?
+
+            { id: id, label: label.presence || id }
+          end
+
+          # Add id (with a label) to models unless already present. Mutates models.
+          def append_ai_model(models, id)
+            return if id.blank? || models.any? { |m| m[:id] == id }
+
+            models << { id: id, label: id }
+          end
+
+          # The admin-approved models [{ id:, label: }] for the SHARED server key:
+          # the configured :models pick-list (or the built-in default) plus the
+          # server default (:model). No per-user selection — safe to enforce.
+          def labimotion_ai_server_models
+            configured = Rails.configuration.respond_to?(:labimotion_ai) ? Rails.configuration.labimotion_ai : nil
+            models = Array(configured && configured[:models]).filter_map { |e| normalize_ai_model(e) }
+            models = Labimotion::LabimotionAiAPI::DEFAULT_MODELS.map { |id| { id: id, label: id } } if models.empty?
+            append_ai_model(models, (configured && configured[:model]).to_s)
+            models
+          end
+
+          # The selectable models as [{ id:, label: }]. Extends the server models
+          # with the user's saved model so their current selection is always valid.
+          def labimotion_ai_models
+            models = labimotion_ai_server_models
+            append_ai_model(models, ai_settings.model.to_s)
+            models
+          end
+
+          # This user's stored AI settings. Memoized per request: several of the
+          # routes below read it more than once.
+          def ai_settings
+            @ai_settings ||= Labimotion::UserAiSettings.for(current_user)
+          end
+
+          # Model ids the SHARED server key permits — the server models plus the
+          # ENV default. Unlike available_models this excludes the user's own saved
+          # model, so it is safe to enforce a keyless user's selection against.
+          def labimotion_ai_admin_model_ids
+            ids = labimotion_ai_server_models.pluck(:id)
+            (ids << ENV['KI_TOOLBOX_MODEL'].to_s).compact_blank.uniq
+          end
+
+          # A well-formed URL with a host, https only. In non-production envs
+          # (dev/test against local providers) http is also accepted. The deep
+          # SSRF check (host resolves to a public address) runs server-side in
+          # the gem at request time; this is only a fast format check for
+          # immediate UI feedback.
+          def valid_ai_endpoint?(url)
+            uri = URI.parse(url.to_s.strip)
+            return false unless uri.host.present?
+
+            Rails.env.production? ? uri.is_a?(URI::HTTPS) : uri.is_a?(URI::HTTP)
+          rescue URI::InvalidURIError
+            false
+          end
+
+          # A personal provider endpoint is only usable with a personal key, and
+          # must be a valid https URL (http allowed outside production). Raises
+          # a 422 otherwise; no-op when unset.
+          def validate_ai_endpoint!(base_url_arg, will_have_key)
+            return if base_url_arg.blank?
+
+            unless will_have_key
+              error!(
+                { status: false, error: 'Add your personal API key to use your own AI provider endpoint.' },
+                422
+              )
+            end
+            return if valid_ai_endpoint?(base_url_arg)
+
+            scheme_msg = Rails.env.production? ? 'https://' : 'http:// or https://'
+            error!({ status: false, error: "The AI provider endpoint must be a valid #{scheme_msg} URL." }, 422)
+          end
+        end
+
+        desc 'get the current user LabIMotion AI settings (never returns the key)'
+        get do
+          settings = ai_settings
+          configured = Rails.configuration.respond_to?(:labimotion_ai) ? Rails.configuration.labimotion_ai : nil
+          {
+            model: settings.model,
+            api_key_set: settings.api_key?,
+            base_url: settings.base_url,
+            api_path: settings.api_path,
+            available_models: labimotion_ai_models,
+            default_model: (configured && configured[:model]).presence || DEFAULT_MODELS.first,
+            default_base_url: (configured && configured[:base_url]).presence,
+            server_api_key_set: (configured && configured[:api_key]).present?
+          }
+        end
+
+        desc 'update the current user LabIMotion AI settings'
+        params do
+          optional :model, type: String, desc: 'Selected model id'
+          optional :api_key, type: String, desc: 'Personal API key (stored encrypted)'
+          optional :clear_api_key, type: Boolean, default: false, desc: 'Remove the stored API key'
+          optional :base_url, type: String, desc: 'Personal AI provider base URL (https; needs a personal key)'
+          optional :api_path, type: String, desc: 'Personal AI provider chat-completions path'
+          optional :clear_endpoint, type: Boolean, default: false, desc: 'Remove the stored provider endpoint'
+        end
+        put do
+          settings = ai_settings
+          api_key_arg =
+            if params[:clear_api_key]
+              '' # blank -> clear
+            elsif params[:api_key].present?
+              params[:api_key]
+            end
+          # nil -> keep the stored key
+
+          # Whether the user will hold a personal key after this save.
+          will_have_key =
+            if params[:clear_api_key]
+              false
+            elsif params[:api_key].present?
+              true
+            else
+              settings.api_key?
+            end
+          # A keyless user's AI calls run on the shared server key, so the chosen
+          # model must be one the admin approved. A user on their own key may pick
+          # any model. Enforce only when an allowlist is actually configured.
+          if params[:model].present? && !will_have_key
+            allowed = labimotion_ai_admin_model_ids
+            if allowed.any? && allowed.exclude?(params[:model])
+              error!(
+                { status: false,
+                  error: 'That model is not available on the shared server key. Pick a listed ' \
+                         'model, or add your personal API key in My LabIMotion to use it.' },
+                422
+              )
+            end
+          end
+
+          # base_url/api_path: '' clears (via clear_endpoint), a value sets, nil keeps.
+          base_url_arg = params[:clear_endpoint] ? '' : params[:base_url]
+          api_path_arg = params[:clear_endpoint] ? '' : params[:api_path]
+          validate_ai_endpoint!(base_url_arg, will_have_key)
+
+          summary = settings.update(
+            model: params[:model].presence, api_key: api_key_arg,
+            base_url: base_url_arg, api_path: api_path_arg
+          )
+          {
+            model: summary[:model],
+            api_key_set: summary[:api_key_set],
+            base_url: summary[:base_url],
+            api_path: summary[:api_path],
+            available_models: labimotion_ai_models
+          }
+        rescue StandardError => e
+          error!({ status: false, error: e.message }, 422)
+        end
+
+        desc 'fetch the live model list from the AI provider with the user personal key'
+        post 'models' do
+          settings = ai_settings
+          # Deliberately the PERSONAL key only: the shared server key must not be
+          # sent to a user-supplied provider URL, and a keyless user's model choice
+          # is restricted to labimotion_ai_admin_model_ids anyway.
+          result = Labimotion::AiModels.new(
+            api_key: settings.api_key,
+            base_url: settings.base_url,
+            api_path: settings.api_path
+          ).call
+          { status: true, models: result[:models], endpoint: result[:endpoint] }
+        rescue StandardError => e
+          error!({ status: false, error: e.message }, 422)
+        end
+
+        desc 'test the current user LabIMotion AI connection (nothing is saved)'
+        post 'test' do
+          settings = ai_settings
+          # Same values the runtime override path reads, so the test exercises the
+          # real config: base_url/api_path are honored by the gem only alongside a
+          # personal key, and a custom endpoint is SSRF-validated there.
+          result = Labimotion::AiTemplate.ping(
+            model: settings.model,
+            api_key: settings.api_key,
+            base_url: settings.base_url,
+            api_path: settings.api_path
+          )
+          { status: true, ok: true, model: result['model'],
+            endpoint: result['endpoint'], ms: result['ms'] }
+        rescue StandardError => e
+          error!({ status: false, ok: false, error: e.message }, 422)
+        end
+      end
+    end
+    # rubocop:enable Metrics/BlockLength
+  end
+end

data/lib/labimotion/apis/labimotion_api.rb

@@ -12,7 +12,11 @@ module Labimotion
     mount Labimotion::LabimotionHubAPI
     mount Labimotion::StandardLayerAPI
     mount Labimotion::VocabularyAPI
+    mount Labimotion::OntologyRootAPI
     mount Labimotion::UserAPI
+    mount Labimotion::LabimotionAiAPI
+    mount Labimotion::UserKlassSettingsAPI
+    mount Labimotion::KlassShareAPI
     mount Labimotion::MttAPI
     mount Labimotion::ElementVariationAPI
     mount Labimotion::LabimotionDoiAPI

data/lib/labimotion/apis/labimotion_doi_api.rb

@@ -7,6 +7,10 @@ module Labimotion
     # rubocop:disable Metrics/BlockLength
     # Grape route and helper DSL blocks are necessarily large.
     KLASS_TYPES = Labimotion::TemplateDoiHelpers::KLASS_BY_TYPE.keys.freeze
+    # Publication fields exposed on the public (anonymous) DOI endpoints.
+    # `contributor` (singular) is kept for DOIs released before contributors
+    # became a list — their snapshot still carries it.
+    PUBLIC_PUBLICATION_KEYS = %w[title description authors contributors contributor references license].freeze
 
     helpers do
       def resolve_klass!(type, id)
@@ -41,25 +45,36 @@ module Labimotion
         )
       end
 
-      # Public, read-only view of one released DOI version.
-      def released_doi_version(doi)
+      # Public, read-only view of one released DOI version, carrying the
+      # publication metadata that version was released with.
+      def released_doi_version(record, doi)
         full = doi.full_doi
         {
           doi: full,
           doi_url: "https://dx.doi.org/#{full}",
           version: ::Doi.labimotion_doi_version(doi),
-          minted_at: doi.minted_at
+          minted_at: doi.minted_at,
+          publication: released_publication(record, doi)
         }
       end
 
+      # The snapshot taken when this version was released. DOIs released before
+      # snapshots were kept have none, and fall back to the template's current
+      # publication — the best available answer for them.
+      def released_publication(record, doi)
+        publication = ::Doi.labimotion_doi_publication(doi).presence ||
+                      (record.properties_template || {})['publication']
+        publication.is_a?(Hash) ? publication.slice(*PUBLIC_PUBLICATION_KEYS) : {}
+      end
+
       # Public payload for a template that has at least one released DOI: the
       # latest released DOI promoted to the top level, plus its publication
-      # metadata, hub deep-link and every released version. `record_id` matches
-      # the hub grid's row id (identifier || uuid) so the frontend can merge it.
+      # metadata, hub deep-link and every released version. Each version brings
+      # its own publication, so the top-level one is the latest release's rather
+      # than the template's work-in-progress. `record_id` matches the hub grid's
+      # row id (identifier || uuid) so the frontend can merge it.
       def released_template_doi(record, dois)
-        versions = dois.sort_by(&:id).map { |doi| released_doi_version(doi) }
-        publication = (record.properties_template || {})['publication']
-        publication = publication.is_a?(Hash) ? publication.slice('title', 'description', 'authors', 'license') : {}
+        versions = dois.sort_by(&:id).map { |doi| released_doi_version(record, doi) }
         versions.last.merge(
           record_id: record.try(:identifier).presence || record.try(:uuid).presence || record.id,
           identifier: record.try(:identifier),
@@ -68,7 +83,6 @@ module Labimotion
           template_version: record.try(:version),
           next_doi_version: ::Doi.labimotion_version_segment(record),
           template_url: Labimotion::TemplateDoiHelpers.template_url(record),
-          publication: publication,
           versions: versions
         )
       end
@@ -125,7 +139,7 @@ module Labimotion
                 version: ::Doi.labimotion_doi_version(doi),
                 full_doi: doi.full_doi,
                 minted: doi.minted == true,
-                xml: Labimotion::BuildTemplateDoiXml.new(record, doi, current_user).call
+                xml: Labimotion::BuildTemplateDoiXml.new(record, doi).call
               }
             end
             { versions: versions }

data/lib/labimotion/apis/labimotion_template_browse_api.rb

@@ -9,6 +9,10 @@ module Labimotion
   class LabimotionTemplateBrowseAPI < Grape::API
     KLASS_BY_TYPE = Labimotion::TemplateDoiHelpers::KLASS_BY_TYPE
     KLASS_TYPES = KLASS_BY_TYPE.keys.freeze
+    # Publication fields exposed alongside a template / its released DOIs.
+    # `contributor` (singular) is kept for DOIs released before contributors
+    # became a list — their snapshot still carries it.
+    PUBLICATION_KEYS = %w[title description authors contributors contributor references license].freeze
     # type => [revision model, foreign key to the klass]
     REVISION_BY_TYPE = {
       'element' => [::Labimotion::ElementKlassesRevision, :element_klass_id],
@@ -76,7 +80,14 @@ module Labimotion
       # The template's DOI publication metadata (shown alongside the DOI).
       def template_publication(record)
         pub = (record.properties_template || {})['publication']
-        pub.is_a?(Hash) ? pub.slice('title', 'description', 'authors', 'license') : {}
+        pub.is_a?(Hash) ? pub.slice(*PUBLICATION_KEYS) : {}
+      end
+
+      # The publication a released DOI was published with. Falls back to the
+      # template's current metadata for DOIs released before snapshots were kept.
+      def released_publication(record, doi)
+        pub = ::Doi.labimotion_doi_publication(doi)
+        pub.is_a?(Hash) && pub.any? ? pub.slice(*PUBLICATION_KEYS) : template_publication(record)
       end
 
       # Released (minted) DOIs of the template, each tagged with its DOI version
@@ -88,6 +99,7 @@ module Labimotion
           full = doi.full_doi
           { version: ::Doi.labimotion_doi_version(doi), doi: full,
             doi_url: "https://dx.doi.org/#{full}", minted_at: doi.minted_at,
+            publication: released_publication(record, doi),
             xml: Labimotion::BuildTemplateDoiXml.new(record, doi).call }
         end
       end

data/lib/labimotion/apis/ontology_root_api.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'labimotion/version'
+
+module Labimotion
+  # Serves the stored subtree behind one "ontology-select" root, and lets a user
+  # refresh it.
+  #
+  # The client sends the `ontology_term` string its field already holds and the
+  # server derives the file path from it. Nothing about the naming scheme is
+  # public, so it can change later without touching the frontend or migrating
+  # anything — worst case the files are fetched again.
+  #
+  # One root per request. A field may pin several, and the picker already walks
+  # them one at a time.
+  class OntologyRootAPI < Grape::API
+    helpers Labimotion::GenericHelpers
+
+    resource :ontology_roots do
+      helpers do
+        # The one root a request is about, or a 400 naming what was unusable.
+        def ontology_root!(term)
+          root = Labimotion::OntologyTerms.parse(term).first
+          error!({ status: 'error', message: 'not a usable ontology term' }, 400) if root.nil?
+
+          root
+        end
+
+        def refresher
+          current_user.respond_to?(:name_abbreviation) ? current_user.name_abbreviation : nil
+        rescue StandardError
+          nil
+        end
+      end
+
+      desc "One root's subtree, as the picker and the auto-fill both read it"
+      params do
+        requires :term, type: String, desc: "The field's ontology_term value"
+      end
+      get do
+        root = ontology_root!(params[:term])
+        doc = Labimotion::OntologyStore.document(root, synced_by: refresher)
+        if doc.nil?
+          # The store could not be filled and the service could not be reached.
+          # The picker falls back to what it can, rather than showing an empty
+          # vocabulary as though the ontology genuinely had no terms.
+          { status: 'error', message: 'this ontology could not be reached' }
+        else
+          { status: 'success', root: doc }
+        end
+      rescue StandardError => e
+        Labimotion.log_exception(e, current_user)
+        { status: 'error', message: e.message }
+      end
+
+      desc 'Re-fetch this root from the ontology service and store what comes back'
+      params do
+        requires :term, type: String, desc: "The field's ontology_term value"
+      end
+      post :refresh do
+        root = ontology_root!(params[:term])
+        { status: 'success', root: Labimotion::OntologyStore.refresh!(root, synced_by: refresher) }
+      rescue Labimotion::OntologyStore::Error => e
+        # Expected refusals — already refreshed a moment ago, someone else is
+        # refreshing, the result came back empty or collapsed. The person who
+        # pressed the button gets the reason; what is stored is untouched.
+        { status: 'error', message: e.message }
+      rescue StandardError => e
+        Labimotion.log_exception(e, current_user)
+        { status: 'error', message: e.message }
+      end
+    end
+  end
+end

data/lib/labimotion/apis/segment_api.rb

@@ -25,8 +25,21 @@ module Labimotion
           optional :displayed_in_list, type: Boolean, desc: 'Display in list format', default: false
         end
         get do
-          list = klass_list(nil, params[:is_active], false)
-          present list, with: Labimotion::SegmentKlassEntity, root: 'klass', displayed_in_list: false
+          # SegmentKlassEntity nests ElementKlassEntity, and Grape hands serialization options
+          # down into nested entities — so the element klasses resolve an owner too. Their
+          # authors have to go into the same map, or every row falls back to its own user
+          # query and the preload this option exists for buys nothing. `klass_list` only
+          # preloads the association when filtering by element, which this call does not, so
+          # ask for it here or `map(&:element_klass)` is itself one query per row.
+          list = klass_list(nil, params[:is_active], false).preload(:element_klass)
+          owners = Labimotion::OwnerResolver.map_for(list.to_a + list.map(&:element_klass))
+          # The nested element klasses go into the same share context for the same reason
+          # they share the owners map; ShareResolver folds a segment's parent in by itself.
+          share_context = Labimotion::ShareResolver.context_for(
+            list.to_a + list.map(&:element_klass), current_user
+          )
+          present list, with: Labimotion::SegmentKlassEntity, root: 'klass', displayed_in_list: false,
+                        with_ownership: true, owners: owners, share_context: share_context
         end
       end
 
@@ -36,7 +49,7 @@ module Labimotion
           use :create_segment_klass_params
         end
         after_validation do
-          authenticate_admin!('segments')
+          authenticate_admin!(Labimotion::Constants::Family::SEGMENT)
           @klass = fetch_klass('ElementKlass', params[:element_klass])
         end
         post do
@@ -46,14 +59,47 @@ module Labimotion
         end
       end
 
-      namespace :update_segment_klass do
-        desc 'update Generic Segment Klass'
+      namespace :create_ai_klass do
+        desc 'create a Generic Segment Klass from an AI-generated template'
         params do
-          use :update_segment_klass_params
+          use :create_ai_segment_klass_params
         end
         after_validation do
           authenticate_admin!('segments')
+          @klass = fetch_klass('ElementKlass', params[:element_klass])
+        end
+        post do
+          # Settle the cheap objections BEFORE spending a provider call on this:
+          # a taken name is knowable now, and finding out after generation means
+          # 15-90s and a token spend for an answer a lookup could have given.
+          validation = Labimotion::AiKlassValidator.error_for(kind: 'segment', params: params, element_klass: @klass)
+          next { status: 'error', message: validation } if validation
+
+          # Generation is a long provider call, so it is handed to the host's worker
+          # and the request answers at once; the result arrives as a notification
+          # linking back into the designer. A host with no such worker gets the
+          # old inline behaviour rather than an error.
+          if Labimotion::AiKlassQueue.queue(kind: 'segment', params: params, user: current_user,
+                                            element_klass_id: @klass&.id)
+            next { status: 'queued',
+                   message: 'Generating the template in the background. You will be notified when it is ready.' }
+          end
+
+          msg = create_ai_segment_klass(current_user, params)
+          { status: msg[:status], message: msg[:message],
+            klass: Labimotion::SegmentKlassEntity.represent(Labimotion::SegmentKlass.all) }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { error: e.message }
         end
+      end
+
+      namespace :update_segment_klass do
+        desc 'update Generic Segment Klass'
+        params do
+          use :update_segment_klass_params
+        end
+        # authorize_klass!(:write) runs inside the helper, on the loaded record.
         post do
           update_segment_klass(current_user, params)
         rescue StandardError => e
@@ -67,7 +113,10 @@ module Labimotion
         params do
           requires :identifier, type: String, desc: 'identifier'
         end
-        post do
+        post do # rubocop:disable Metrics/BlockLength
+          # Pulling from the repository creates or overwrites a local template — the same
+          # create/upgrade pair the import endpoints gate, so it takes the same two gates.
+          authenticate_admin!(Labimotion::Constants::Family::SEGMENT)
           sk_obj = fetch_repo_generic_template('Segment', params[:identifier])
           sk_obj = sk_obj.deep_symbolize_keys[:generic_template]
           return { error: 'No template data found' } unless sk_obj.present?
@@ -75,9 +124,17 @@ module Labimotion
           ek_obj = Labimotion::ElementKlass.find_by(name: sk_obj.dig(:element_klass, :klass_name))
           return { error: 'No related element data found' } unless ek_obj.present?
 
-          segment_klass = Labimotion::SegmentKlass.find_or_create_by(
-            identifier: sk_obj.dig(:identifier),
-          )
+          segment_klass = Labimotion::SegmentKlass.find_by(identifier: sk_obj.dig(:identifier))
+          # Syncing over an existing template replaces its released properties — :release,
+          # owner-only, exactly like the upgrade branch of validate_klass.
+          authorize_klass!(segment_klass, :release) if segment_klass
+          newly_created = segment_klass.nil?
+          # created_by belongs in this INSERT, not only in the update below: the column is
+          # NOT NULL since tighten_klass_created_columns, so a bare create is one relaxed
+          # label validation away from an ActiveRecord::NotNullViolation that would break
+          # every Hub pull of a new segment template.
+          segment_klass ||= Labimotion::SegmentKlass.create(identifier: sk_obj.dig(:identifier),
+                                                            created_by: current_user.id)
           segment_klass.update(sk_obj.slice(
             :label,
             :desc,
@@ -92,6 +149,10 @@ module Labimotion
             released_at: DateTime.now,
             sync_time: DateTime.now,
           ))
+          # Owner bookkeeping only for a template this pull just created. An existing
+          # owner-less row stays owner-less: assigning it a first owner is the
+          # administrator's transfer_ownership call, not a side effect of syncing.
+          Labimotion::KlassShare.seed_owner!(segment_klass, current_user.id) if newly_created
 
           present segment_klass, with: Labimotion::SegmentKlassEntity, root: 'klass'
         rescue StandardError => e
@@ -126,6 +187,9 @@ module Labimotion
           requires :identifier, type: String, desc: 'Identifier'
         end
         post do
+          # Importing needs the global create right; upgrading an existing template is gated
+          # owner-only inside validate_klass, where the create/update branch is decided.
+          authenticate_admin!(Labimotion::Constants::Family::SEGMENT)
           msg = create_repo_klass(params, current_user, request.headers['Origin'])
           klass = Labimotion::SegmentKlassEntity.represent(Labimotion::SegmentKlass.all)
           { status: msg[:status], message: msg[:message], klass: klass }
@@ -142,6 +206,9 @@ module Labimotion
           use :upload_segment_klass_params
         end
         post do
+          # Same split as create_repo_klass: create right here, owner-only upgrade inside
+          # validate_klass. This route previously had no gate at all.
+          authenticate_admin!(Labimotion::Constants::Family::SEGMENT)
           declared_params = declared(params, include_missing: false)
           attributes = declared_params.merge(
               created_by: current_user.id,