labimotion 2.4.0.rc3 → 2.4.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c40bb5efbdc756295f36c7a5a9b424639565f38912c7ef200151d124152fd30
-  data.tar.gz: 935efaab787fc3c8d1c0aee4d11ca8206def39e244249ba6c9161b3e16088d89
+  metadata.gz: 1babeffe4e43eb088d5ab781101aa48574f67aab9abf0d32df4d883742e63788
+  data.tar.gz: 8c063d368a6af316e5397804951da314d8fc65035a852f56b066097091b0b2b3
 SHA512:
-  metadata.gz: e01cbe9c498ea9bc82515c4aea85fa50e131b523fd3564d91f5f962d5b9fdd1175b197f5b0663f6e38c98e7c8d5ab5afe14d48f63c764c0b1d9ee22423dc1e9e
-  data.tar.gz: d08a91299b3c202684bfe1ab222bfe1d5765c41664c731285848ba6b03489031ea7824b50f96cc1059e8c207eb1de488a06e745f0d77e51ceda318afedf941ef
+  metadata.gz: 5d92879758e133fbf40fd433882967c8731ebf18e1e2586d8026a65b2d085359a530333cd740d00b7b0359981f155c034eee5687ffe326bb842c2dbc1ee52ad8
+  data.tar.gz: 3db447e733afbe176b1d7adb80078ef85899b473336e882d41bb9f7da4b66b51ca91d1f4084d30a0f644401e95c4312669bd1f9a6d7bc861af42dc8ad89d1abd

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 * Features and enhancements:
+  * Share notifications now fire from the gem itself ([chem-generic-ui#1040](https://github.com/LabIMotion/chem-generic-ui/issues/1040), labimotion#255): a successful grant or level change (`POST /generic_klass/shares`), an ownership transfer (`POST /generic_klass/transfer_ownership`) and the ask that creates an access-request row (`POST /generic_klass/request_access`, `created: true` only — repeat asks are not repeat pings) each send the toast the host's `Chemotion::TemplateShareAPI` used to send, through the new `Labimotion::ShareNotifier`. Recipients are Persons only, never the actor; the channel is looked up by the literal subject `'Template Share Notification'` (the host ELN's channel migration stays required for delivery); and the notifier rescues internally — an undeliverable notification is a notification not sent, never a failed share. A host without Message/Channel machinery (or without the channel row) silently sends nothing. The level-change route (`PUT /shares/:id`) stays silent, matching the host layer it replaces. Until the matching ELN change removes `TemplateShareAPI` and its caller, grants on the integration branches notify twice — accepted, dev-only.
+  * Per-template ownership and sharing, backend ([chem-generic-ui#1001](https://github.com/LabIMotion/chem-generic-ui/issues/1001) Phase 2): `klass_shares` table (viewer/editor/owner, one owner per template enforced by a partial unique index), `authorize_klass!` per-template gate replacing the designer-wide check on template mutation endpoints (owner-less templates keep the legacy behaviour permanently), share management endpoints under `/generic_klass/shares` plus `/generic_klass/transfer_ownership`, and capability booleans (`can_write` … `can_manage`) on the Designer list payloads. `download_klass` is now gated (`:read`) and no longer writes an identifier during a GET. Requires host ELN twin migrations `create_klass_shares` and `seed_klass_share_owners` (the latter seeds owner rows from `created_by` in raw SQL, idempotent via `ON CONFLICT DO NOTHING`); deploy order is migrate → **restart** (the stale schema cache otherwise silently drops the running app's writes to the new table). Ships as one upgrade with the matching chem-generic-ui and ELN changes — see the design doc's ADR 0001.
+  * `created_by` and `created_at` are now `NOT NULL` on `element_klasses` and `segment_klasses` ([chem-generic-ui#1018](https://github.com/LabIMotion/chem-generic-ui/issues/1018)); `dataset_klasses` already declared both. Two new migrations, back-dated ahead of `create_klass_shares`: `backfill_klass_created_columns` fills a NULL `created_by` with the first system administrator (falling back to the lowest-id user of any type, and raising if the `users` table is empty) and a NULL `created_at` with `COALESCE(updated_at, NOW())`; `tighten_klass_created_columns` then applies the constraints — data before constraint. The back-dating is what lets `seed_klass_share_owners` stay unchanged: with `created_by` already filled in, its `WHERE created_by IS NOT NULL` filter excludes nothing and every template gets an owner row instead of staying owner-less on the permanent legacy gate. The backfill re-runs that owner seed itself (`ON CONFLICT DO NOTHING`) so a database on which the seed had already run picks up the repaired rows. Requires host ELN twin migrations for both, back-dated the same way; deploy order is migrate → **restart** (the stale schema cache otherwise silently drops the running app's writes).
+  * Any individual account may own a template, and an owner who cannot be notified is now reported as such ([chem-generic-ui#1019](https://github.com/LabIMotion/chem-generic-ui/issues/1019)). `Labimotion::KlassShare` validates `shared_with_id` against an allowlist (`Person`, `Admin`) instead of `User.persons`, so the raw-SQL `seed_klass_share_owners` migration and the runtime `KlassShare.seed_owner!` reach the same verdict for an admin-created template: the migration used to write the owner row while the runtime path refused it and left the template owner-less on the permanent legacy gate, where any designer of the family may edit and delete it. `backfill_klass_created_columns` fills a NULL `created_by` with the first system administrator, so those templates exist in numbers. `Group` and `DeviceDeprecated` stay excluded — a group is not an individual, and ELN reserves the type for device management — and grants and ownership transfers through the API stay Person-only, since an admin owner is a state to clean up rather than one to create. `GenericKlassEntity#owner_state` gains a fourth value, `unnotifiable` (after `deleted` and `deactivated`), for an owner whose `type` is not `Person`: such a template read `active` and appeared in no banner, while a designer refused on it was told to ask an owner that ELN's `channel_type` 8 fan-out cannot reach, so `request_access` answered 422 and nothing said a transfer was needed.
+  * An access request is now stored as a `klass_shares` row rather than sent as a message ([chem-generic-ui#1023](https://github.com/LabIMotion/chem-generic-ui/issues/1023)). `Labimotion::KlassShare::LEVELS` gains `requested: 0` — additive, never a renumber, since the one-owner-per-klass partial index is `WHERE permission_level = 30` — so a level-0 row records the ask while granting nothing (`0 >= 10` is false, so every existing threshold refuses it unchanged). The last hop of the request loop used to land on the Designer, which polls no message list, so an owner working there never saw the request; as a row it survives acknowledgement, and the unique `(klass_type, klass_id, shared_with_id)` index dedupes repeat asks. New `POST /generic_klass/request_access?klass=&id=`, answering `{ mc: 'ss00', created: <Boolean> }`: self only, level 0 only, idempotent — no row creates one and answers `created: true` (the caller fires the host ping only then, so ten asks are not ten pings), an existing level-0 row answers `created: false` silently, and a caller who already holds viewer/editor/owner gets 409 `sc13`. A lost race on the unique index answers `created: false` rather than 500 — the row existing is the goal state. Gated on the legacy family designer right, not `authorize_klass!(:read)`: `:read` demands level ≥ 10 and a requester has none, so the share gate would refuse every caller the route exists for. Granting and rejecting need no new endpoint — `POST /generic_klass/shares` lifts the level-0 row to viewer/editor in place, and `DELETE /generic_klass/shares/:id` is the rejection (a hard delete, so "no" does not stick and the requester may ask again — accepted, since a tombstone would contradict `KlassShare` deliberately not being `acts_as_paranoid`). Every share route's body gains a `requests` key carrying the level-0 rows, which `shares` no longer contains: someone *waiting* for access listed under "People with access" says the opposite of what they are. `shares` keeps its contents and owner-first ordering for everything ≥ 10. Both lists go to anyone who may `:read` the template, so viewers and editors see others' pending requests — intended transparency. Klass list payloads gain `pending_request_count` (Integer, 0 when absent), derived from the share rows `ShareResolver.context_for` already loads — no extra query — and scoped to the requesting user's own owner rows, since a naive count would ship "somebody asked" to every editor and viewer in the payload. Exposed under the same `share_context` guard as the capability booleans, so exports, Hub submissions and un-migrated hosts are unaffected. No migration: `permission_level` already accepts 0. Note that `current_user_permission` now has a fourth answer, `'requested'` — a client must compare the level, not test the string for truthiness.
+  * The Designer's share poller now asks the gem instead of the host ([chem-generic-ui#1023](https://github.com/LabIMotion/chem-generic-ui/issues/1023)). New `GET /generic_klass/share_activity`, answering `{ mc: 'ss00', count: <Integer>, latest: <ISO8601 String|null> }`: how many `klass_shares` rows involve the caller — every row on the templates they own, plus the rows granting them access on other people's — and the newest `updated_at` among them. The pair is an opaque change token, and the client refreshes its grid when **either** value differs in **either** direction. Deliberately not a "newer than" cursor: a revocation is a hard delete (`KlassShare` is not `acts_as_paranoid`), so `latest` moves *backwards* while `count` drops — precisely the event a timestamp comparison would stop detecting. The library used to poll the host's `/api/v1/messages/list?is_ack=0` for this: its only reach outside gem-owned API surface, a route no embedder is obliged to mount, carrying every kind of notification with no way for the library to name the host's channels and filter it (an unrelated spectra message refreshed the Designer grid), and acknowledging message rows as a side effect of the read. Authentication only and no further gate — there is no single klass for `authorize_klass!` to take and no family for `authenticate_admin!`, and the response is two aggregates over the caller's *own* rows, naming no template, user or level and disclosing nothing about anybody else's sharing, while a gate would refuse the grantees the route exists for. Aggregates only, three indexed queries however large the account (the owned keys, then `COUNT` and `MAX` over one OR-ed scope), because an open Designer polls it about once a minute. The administrator is an implicit owner everywhere but holds rows only where they really own something, so their token moves for their own templates alone. No migration: `klass_shares` already carries `t.timestamps` and an index on `shared_with_id`.
+  * The share poller can now refresh individual template rows instead of reloading the whole Designer grid ([chem-generic-ui#1023](https://github.com/LabIMotion/chem-generic-ui/issues/1023)). Reloading the grid re-seeds the open Work Area and destroys unsaved template edits, and it fired even for the user's own grant or revoke; two reads replace it. First, `GET /generic_klass/share_activity` gains `digests`: `{ "ElementKlass:12": "<row count>|<newest updated_at, ISO8601 with milliseconds>", … }`, one entry per klass the caller is involved in — the same involvement `count` and `latest` already aggregate over, split by key, each value that klass's own count and `MAX(updated_at)`. The client diffs the map and re-reads only the keys whose digest changed, appeared or vanished. `count` and `latest` stay, unchanged, as the cheap early-out. The same inequality-in-either-direction rule applies and matters more here: a revocation is a hard delete, so a key's digest can move *backwards* or the key can drop out of the map entirely, and a "newer than" comparison would see neither. The digest string is opaque — compare it, never parse it. No extra query: the map is a `GROUP BY (klass_type, klass_id)` over the scope that was already being aggregated, and the pair is then derived from the groups rather than queried again (three indexed queries before and after), so `count` is the sum of the digests' counts by construction. Second, new `GET /generic_klass/rows?keys[]=ElementKlass:12&keys[]=SegmentKlass:3`, answering `{ mc: 'ss00', data: [<grid-shaped entity>, …], keys: [<the key of each entry>, …] }`. Each entry is exactly what the Designer list endpoints send for that record — same entity, `with_ownership: true`, preloaded `owners:` and a `share_context:` resolved over precisely the requested records — so a row can be dropped into a grid unmodified and `owner`, `can_write` … `can_manage`, `current_user_permission` and `pending_request_count` all keep meaning what they meant in the list. `GET /generic_klass/fetch` could not serve this: it represents with neither `share_context` nor `with_ownership`, and the library reads an absent capability field as permissive (that is how an un-upgraded gem stays usable), so a row patched from it would quietly turn a viewer's template editable. `keys` runs parallel to `data` because the klass entities carry no type field — an id alone cannot distinguish `ElementKlass:9` from `DatasetKlass:9` — and it is also how a client learns which requested keys were skipped. Batches are capped at 50 keys, counted before de-duplication, and refused with 400 `se00` rather than truncated, so a short answer never reads as "those templates were deleted"; malformed keys are refused the same way rather than guessed at; a key whose record no longer exists is skipped, since a template deleted between the poll and the read is an ordinary race. Grouped by klass type, so the cost is one query per type present in the batch, not one per key. Ungated, deliberately and like the list endpoints it mirrors — those list every template to every designer and let the *actions* gate — and what constrains the caller is inside the payload: the capability booleans are resolved for that user, and every mutating route still re-checks with `authorize_klass!`. No migration.
+  * The Designer now has a share inbox, derived entirely from `klass_shares` ([chem-generic-ui#1028](https://github.com/LabIMotion/chem-generic-ui/issues/1028)). An owner working in the Designer had no list of what was waiting for them, and a requester was never told they had been granted access: the request loop's last hop landed on a host message that only `NoticeButton` polls, mounted in the mydb topbar outside the Designer's React roots. New `GET /generic_klass/share_inbox`, answering `{ mc: 'ss00', requests: [{ share_id, klass_type, klass_id, klass_label, user: { id, name, name_abbreviation }, requested_at }, …], grants: [{ share_id, klass_type, klass_id, klass_label, permission, user: { … }, changed_at }, …] }`. **Both queues are queries over `klass_shares`, not a message log** — a second store would immediately have its own ack state, its own retention question, and the ability to disagree with the rows. `requests` is the owner's queue: the `permission_level = 0` rows on the templates the caller holds the level-30 row on, oldest ask first, `user` the requester and `requested_at` their `created_at`. No column gates it and none should — a grant promotes the row off level 0 and a reject hard-deletes it, so it empties itself, and it is the same predicate behind the grid's `ShareBtn` badge, so the two cannot disagree. `grants` is the requester's queue: `shared_with_id = caller AND permission_level >= 10 AND created_by <> shared_with_id AND (acked_at IS NULL OR acked_at < updated_at)`, newest change first, `user` the granter (`created_by`) and `changed_at` the `updated_at` that `acked_at` is compared against. `created_by <> shared_with_id` is load-bearing and looks removable: every owner row is a self-grant written by `KlassShare.seed_owner!`, so without it every designer would be told "you were granted owner on…" for every template they ever created; a real grant re-stamps `created_by` to the granter and so does a transfer, so both still announce. Entries whose template can no longer be resolved are dropped rather than sent with a null label — an entry exists to be clicked through to a grid row — and the share row survives, so a restore brings the entry back untouched. Labels and user names are resolved in bulk (one query per klass type present, one for the users), so the whole route is at most seven indexed queries however large the account; it is polled on the same tick as `share_activity`. Authentication only, no `authorize_klass!` and no family gate, for the same reason as `share_activity`: every row returned either names the caller or sits on a template they own, and a gate would refuse the grantees the route exists for.
+  * New `POST /generic_klass/shares/:share_id/ack`, answering `{ mc: 'ss00' }` ([chem-generic-ui#1028](https://github.com/LabIMotion/chem-generic-ui/issues/1028)). Self only — a row whose `shared_with_id` is not the caller is refused 404, the same answer an unknown id gets, so a row that does not name you is indistinguishable from one that does not exist; holding `:manage` on the template does not make somebody else's grant yours to acknowledge. Idempotent. Written with `update_column`, deliberately: `updated_at` is the other half of the unacknowledged comparison, so an ack that bumped it would leave the row announcing itself for ever, and it would also move `share_activity`'s change token and make every other Designer session re-read the grid row. `acked_at` is a nullable datetime carried by `create_klass_shares` itself rather than a separate ALTER migration — one file per table while nothing is released — so a database that already ran that version will never receive the column and must be dropped and recreated rather than migrated again. Nullable because every row standing at upgrade time is unacknowledged by definition and a backfill would silently swallow it. The ELN twin of `create_klass_shares` carries the same change, byte-identical. Deploy order is migrate → **restart** (the stale schema cache otherwise silently drops the running app's writes to the new column). The library never reads ELN's notifications and never acks them: `NoticeButton`'s read marker and `acked_at` are deliberately independent, answering different questions in different places.
   * Added per-user, per-klass toolbar configuration (Overview/Arrange visibility) via `POST /user_klass_settings/save` (upsert) and `GET /user_klass_settings/fetch` ([chem-generic-ui#905](https://github.com/LabIMotion/chem-generic-ui/issues/905)). Each user stores their own `settings` (`{ toolbar: { overview, arrange } }`) per element/segment/dataset klass, keyed by the stable klass identifier so it applies to every instance of that klass across template versions. Requires host ELN twin migration `create_user_klass_settings`.
   * Designer can enable/disable common layer functionalities (record time, add reaction, add/remove layer) per template; template-scoped and independent of template versions ([chem-generic-ui#904](https://github.com/LabIMotion/chem-generic-ui/issues/904)). Saved segments expose the effective klass `settings` so records honor the toggles after a reload. Requires host ELN twin migration `add_settings_to_klasses`.
   * Support linking CellLine elements in the generic Link Element via the `Labimotion::CellLine` wrapper ([chem-generic-ui#906](https://github.com/LabIMotion/chem-generic-ui/issues/906)). Requires a host ELN `element_klasses` row for `cell_line` (migration) — see PR notes.

data/lib/labimotion/apis/generic_dataset_api.rb

@@ -7,6 +7,7 @@ module Labimotion
 
     helpers Labimotion::GenericHelpers
     helpers Labimotion::DatasetHelpers
+    helpers Labimotion::ParamHelpers
 
     resource :generic_dataset do
       namespace :klasses do
@@ -26,7 +27,10 @@ module Labimotion
         get do
           list = klass_list(params[:is_active], params[:displayed_in_list])
           serialized_data = Labimotion::DatasetKlassEntity.represent(list,
-                                                                     displayed_in_list: params[:displayed_in_list])
+                                                                     displayed_in_list: params[:displayed_in_list],
+                                                                     with_ownership: true,
+                                                                     owners: Labimotion::OwnerResolver.map_for(list),
+                                                                     share_context: Labimotion::ShareResolver.context_for(list, current_user))
           { mc: 'ss00', data: serialized_data }
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
@@ -34,7 +38,8 @@ module Labimotion
         end
       end
 
-      # Deprecated: This namespace is no longer used, but kept for backward compatibility.
+      # Deprecated as an endpoint, but it is what the Dataset Designer grid still calls
+      # (eln GenericDSsFetcher.listDatasetKlass), so ownership has to be exposed here too.
       # It is replaced by `list_klass`.
       namespace :list_dataset_klass do
         desc 'list Generic Dataset Klass'
@@ -43,7 +48,9 @@ module Labimotion
         end
         get do
           list = klass_list(params[:is_active], false)
-          present list, with: Labimotion::DatasetKlassEntity, root: 'klass', displayed_in_list: false
+          present list, with: Labimotion::DatasetKlassEntity, root: 'klass', displayed_in_list: false,
+                        with_ownership: true, owners: Labimotion::OwnerResolver.map_for(list),
+                        share_context: Labimotion::ShareResolver.context_for(list, current_user)
         end
       end
 
@@ -60,6 +67,9 @@ module Labimotion
           requires :identifier, type: String, desc: 'Identifier'
         end
         post do
+          # Importing needs the global create right; upgrading an existing template is gated
+          # owner-only inside the helper's update branch.
+          authenticate_admin!(Labimotion::Constants::Family::DATASET)
           msg = create_repo_klass(params, current_user, request.headers['Origin'])
           klass = Labimotion::DatasetKlassEntity.represent(Labimotion::DatasetKlass.all)
           { status: msg[:status], message: msg[:message], klass: klass }
@@ -69,6 +79,34 @@ module Labimotion
         end
       end
 
+      namespace :create_ai_klass do
+        desc 'create a Generic Dataset Klass from an AI-generated template'
+        params do
+          use :create_ai_dataset_klass_params
+        end
+        post do
+          msg = create_ai_dataset_klass(params, current_user)
+          klass = Labimotion::DatasetKlassEntity.represent(Labimotion::DatasetKlass.all)
+          { status: msg[:status], message: msg[:message], klass: klass }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { error: e.message }
+        end
+      end
+
+      namespace :refine_ai_klass do
+        desc 'refine a Generic Dataset Klass template with AI (returns the revised template; not persisted)'
+        params do
+          use :refine_ai_dataset_klass_params
+        end
+        post do
+          refine_ai_dataset_klass(params, current_user)
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { status: 'error', message: e.message }
+        end
+      end
+
       namespace :find_template do
         desc 'Find best matching template for given OLS term ID'
         params do

data/lib/labimotion/apis/generic_element_api.rb

@@ -178,7 +178,7 @@ module Labimotion
           use :create_element_klass_params
         end
         post do
-          authenticate_admin!('elements')
+          authenticate_admin!(Labimotion::Constants::Family::ELEMENT)
           create_element_klass(current_user, params)
           status 201
         rescue ActiveRecord::RecordInvalid => e
@@ -186,13 +186,50 @@ module Labimotion
         end
       end
 
+      namespace :create_ai_klass do
+        desc 'create a Generic Element Klass from an AI-generated template'
+        params do
+          use :create_ai_element_klass_params
+        end
+        post do
+          authenticate_admin!('elements')
+          msg = create_ai_element_klass(params, current_user)
+          { status: msg[:status], message: msg[:message],
+            klass: Labimotion::ElementKlassEntity.represent(Labimotion::ElementKlass.where(is_active: true)) }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { error: e.message }
+        end
+      end
+
+      # Sibling namespace of :create_ai_klass — MUST stay above the route_param :id
+      # blocks below, otherwise POST /ai_fill_data falls through to the element
+      # instance route and Element.find(nil) is raised.
+      namespace :ai_fill_data do
+        desc "Auto-fill a generic element's data values from a document using AI"
+        params do
+          use :ai_fill_element_data_params
+        end
+        post do
+          msg = ai_fill_element_data(params, current_user)
+          if msg[:status] == 'success'
+            { status: 'success', values: msg[:values], summary: msg[:summary] }
+          else
+            { status: 'error', message: msg[:message] }
+          end
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { status: 'error', message: e.message }
+        end
+      end
+
       namespace :update_element_klass do
         desc 'update Generic Element Klass'
         params do
           use :update_element_klass_params
         end
         post do
-          authenticate_admin!('elements')
+          # authorize_klass!(:write) runs inside the helper, on the loaded record.
           update_element_klass(current_user, params)
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
@@ -239,7 +276,7 @@ module Labimotion
           requires :klass, type: String, desc: 'Klass', values: %w[ElementKlass SegmentKlass DatasetKlass]
         end
         post do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # authorize_klass!(:destroy) runs inside the helper, once the klass row is loaded.
           delete_klass_revision(params)
           status 201
         rescue StandardError => e
@@ -319,19 +356,26 @@ module Labimotion
           scope = scope.where(is_active: params[:is_active]) if params.key?(:is_active)
 
           list = scope.sort_by(&:place)
-          present list, with: Labimotion::ElementKlassEntity, root: 'klass', displayed_in_list: params[:displayed_in_list]
+          present list, with: Labimotion::ElementKlassEntity, root: 'klass',
+                        displayed_in_list: params[:displayed_in_list],
+                        with_ownership: true, owners: Labimotion::OwnerResolver.map_for(list),
+                        share_context: Labimotion::ShareResolver.context_for(list, current_user)
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
           raise e
         end
       end
 
-      # Deprecated: This namespace is no longer used, but kept for backward compatibility.
+      # Deprecated as an endpoint, but it is what the Element Designer grid still calls
+      # (eln GenericElsFetcher.fetchElementKlasses), so ownership has to be exposed here too —
+      # adding `created_by` to `for_list_display` alone would never reach that grid.
       namespace :klasses_all do
         desc 'get all klasses for admin function'
         get do
           list = Labimotion::ElementKlass.all.sort_by { |e| e.place }
-          present list, with: Labimotion::ElementKlassEntity, root: 'klass'
+          present list, with: Labimotion::ElementKlassEntity, root: 'klass',
+                        with_ownership: true, owners: Labimotion::OwnerResolver.map_for(list),
+                        share_context: Labimotion::ShareResolver.context_for(list, current_user)
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
           []
@@ -354,6 +398,9 @@ module Labimotion
           requires :identifier, type: String, desc: 'Identifier'
         end
         post do
+          # Importing needs the global create right; upgrading an existing template is gated
+          # owner-only inside validate_klass, where the create/update branch is decided.
+          authenticate_admin!(Labimotion::Constants::Family::ELEMENT)
           msg = create_repo_klass(params, current_user, request.headers['Origin'])
           klass = Labimotion::ElementKlassEntity.represent(Labimotion::ElementKlass.all)
           { status: msg[:status], message: msg[:message], klass: klass }
@@ -371,7 +418,8 @@ module Labimotion
           requires :is_active, type: Boolean, desc: 'Active or Inactive Klass'
         end
         after_validation do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # The share gate needs the loaded record, so it runs inside the helper
+          # (authorize_klass!(:deactivate)) rather than up here where only params exist.
           fetch_klass(params[:klass], params[:id])
         end
         post do
@@ -407,7 +455,8 @@ module Labimotion
           optional :release, type: String, default: 'draft', desc: 'release status', values: %w[draft major minor patch]
         end
         after_validation do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # authorize_klass! (:write for a draft, :release otherwise) runs inside
+          # update_template, on the loaded record.
           fetch_klass(params[:klass], params[:id])
         end
         post do
@@ -424,6 +473,9 @@ module Labimotion
           use :upload_element_klass_params
         end
         post do
+          # Same split as create_repo_klass: create right here, owner-only upgrade inside
+          # validate_klass. This route previously had no gate at all.
+          authenticate_admin!(Labimotion::Constants::Family::ELEMENT)
           declared_params = declared(params, include_missing: false)
           attributes = declared_params.merge(
               created_by: current_user.id,

data/lib/labimotion/apis/generic_klass_api.rb

@@ -17,15 +17,18 @@ module Labimotion
           requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
         end
         get do
-          entity = "Labimotion::#{params[:klass]}".constantize.find_by(id: params[:id])
-          entity.update_columns(identifier: SecureRandom.uuid) if entity&.identifier.nil?
+          # This export previously accepted any logged-in account (no admin gate at all) and,
+          # worse, wrote through update_columns inside a GET — minting the identifier that Hub
+          # sync keys on, for whoever happened to press download first. Gated :read now, and a
+          # template with no identifier simply exports without one; minting stays with the
+          # write paths.
+          entity = fetch_klass(params[:klass], params[:id])
+          authorize_klass!(entity, :read)
           env['api.format'] = :binary
           content_type('application/json')
           filename = CGI.escape("LabIMotion_#{params[:klass]}_#{entity.label}-#{Time.new.strftime("%Y%m%d%H%M%S")}.json")
-          # header['Content-Disposition'] = "attachment; filename=abc.docx"
           header('Content-Disposition', "attachment; filename=\"#{filename}\"")
           "Labimotion::#{params[:klass]}Entity".constantize.represent(entity)
-          # klass.as_json
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
           {}
@@ -40,7 +43,7 @@ module Labimotion
           requires :is_active, type: Boolean, desc: 'Active or Inactive Klass'
         end
         after_validation do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # authorize_klass!(:deactivate) runs inside the helper, on the loaded record.
           fetch_klass(params[:klass], params[:id])
         end
         post do
@@ -62,7 +65,7 @@ module Labimotion
           requires :settings, type: Hash, desc: 'Klass settings'
         end
         after_validation do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # authorize_klass!(:write) runs inside the helper, on the loaded record.
           fetch_klass(params[:klass], params[:id])
         end
         post do
@@ -76,6 +79,47 @@ module Labimotion
         end
       end
 
+      namespace :deleted_klasses do
+        desc 'list the soft-deleted Generic Klasses of one type'
+        params do
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
+        end
+        after_validation do
+          authenticate_admin!(Labimotion::Constants::Family::FAMILY_OF[params[:klass]])
+        end
+        get do
+          list = deleted_klasses(params)
+          entity_class = "Labimotion::#{params[:klass]}Entity".constantize
+          # `deleted_at` is not on the klass entities (a sibling PR owns those files), and a
+          # restore list that cannot say when a template was deleted is not much of a list.
+          serialized = list.map do |klz|
+            entity_class.represent(klz).as_json.merge(deleted_at: klz.deleted_at&.iso8601)
+          end
+          { klass: serialized }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { mc: 'se00', msg: e.message, klass: [] }
+        end
+      end
+
+      namespace :restore_klass do
+        desc 'restore a soft-deleted Generic Klass'
+        params do
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
+          requires :id, type: Integer, desc: 'Klass ID'
+        end
+        # authorize_klass!(:destroy) runs inside the helper, on the loaded deleted record —
+        # shares survive deletion, so the owner row is still there to gate the restore.
+        post do
+          restored_klass = restore_klass(params)
+          entity_class = "Labimotion::#{params[:klass]}Entity".constantize
+          { mc: 'ss00', data: entity_class.represent(restored_klass) }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { mc: 'se00', msg: e.message, data: {} }
+        end
+      end
+
       namespace :fetch do
         desc 'fetch Generic Klass by id'
         params do