@acms-subir/core 0.3.12 → 0.3.13

package/src/pages/api/export.ts

@@ -1,9 +1,10 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../lib/repo';
 import { getMediaStore } from '../../lib/media/store';
-import { apiError, requireSession } from '../../lib/api';
+import { apiError } from '../../lib/api';
 import { exportBundle } from '../../lib/import/export';
 import { zipStream, type ZipEntry } from '../../lib/backup/zip';
+import { requirePermission } from '../../lib/permissions/access';
 
 // Portable content export (acms-export v1): bundle.json + media/<key>.
 // Import it into any acms site from Admin → Import & export; unlike a backup
@@ -11,7 +12,7 @@ import { zipStream, type ZipEntry } from '../../lib/backup/zip';
 export const GET: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'data.import');
     const now = Date.now();
     const bundle = await exportBundle(repo, now);
     const store = getMediaStore(locals);

package/src/pages/api/import/asset.ts

@@ -1,8 +1,9 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, readJson, readResponseBytes, requireSession } from '../../../lib/api';
+import { ApiError, apiError, readJson, readResponseBytes } from '../../../lib/api';
 import { fetchPublicUrl } from '../../../lib/net';
+import { requirePermission } from '../../../lib/permissions/access';
 
 // Download one file from the site being imported. The old site won't send
 // CORS headers, so the browser can't fetch it directly; it asks here, then
@@ -15,7 +16,7 @@ const Body = z.object({ url: z.string().url().max(2000) });
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'data.import');
     const { url } = Body.parse(await readJson(request, 10_000));
     const got = await fetchPublicUrl(url, { accept: '*/*', userAgent: 'acms-importer/1.0', timeoutMs: 30_000 });
     if (!got) throw new ApiError(502, 'The old site could not be reached for this file.');

package/src/pages/api/import/index.ts

@@ -2,9 +2,10 @@ import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
 import { getMediaStore } from '../../../lib/media/store';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { ImportBundle } from '../../../lib/import/bundle';
 import { FinishInput, ImportOptions, ItemsInput, StartInput, finishImport, importItems, planImport, startImport, undoImport } from '../../../lib/import/apply';
+import { requirePermission } from '../../../lib/permissions/access';
 
 // Import pipeline steps (see lib/import/apply.ts). Owner-only: an import can
 // create accounts, rewrite navigation and change site settings.
@@ -19,7 +20,7 @@ const Body = z.discriminatedUnion('op', [
 export const GET: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'data.import');
     return json({ runs: await repo.listImportRuns() });
   } catch (e) { return apiError(e); }
 };
@@ -27,7 +28,7 @@ export const GET: APIRoute = async ({ request, cookies, locals }) => {
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'data.import');
     // item batches carry full post bodies
     const body = Body.parse(await readJson(request, 12 * 1024 * 1024));
     switch (body.op) {

package/src/pages/api/import/media.ts

@@ -1,8 +1,9 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
 import { getMediaStore } from '../../../lib/media/store';
-import { ApiError, apiError, requireSession } from '../../../lib/api';
+import { ApiError, apiError } from '../../../lib/api';
 import { Media } from '../../../lib/schema';
+import { requirePermission } from '../../../lib/permissions/access';
 
 // Verbatim media from an acms export: the row keeps its id and storage keys,
 // so every /media URL in the imported content resolves unchanged. Fields:
@@ -10,7 +11,7 @@ import { Media } from '../../../lib/schema';
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'data.import');
     const form = await request.formData();
     const media = Media.parse(JSON.parse(String(form.get('media') ?? 'null')));
     const keys = [media.key, ...media.variants.map((v) => v.key)];

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -1,16 +1,16 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../../../lib/repo';
 import { ApiError } from '../../../../../lib/api';
-import { OWNER_ENV } from '../../../../../lib/auth';
-import { requestSessionBinding, validateRequestSession } from '../../../../../lib/auth/request';
+import { requestSessionBinding } from '../../../../../lib/auth/request';
+import { accessFor } from '../../../../../lib/permissions/access';
 import { finishOAuth } from '../../../../../lib/live/service';
 export const GET:APIRoute=async({request,cookies,locals,url})=>{
   const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
   try{
     const repo=await getRepo(locals),session=await requestSessionBinding(request,cookies,locals);
     // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
-    const user=await validateRequestSession(request,cookies,repo);
-    if(!session||!user||user!==OWNER_ENV&&(await repo.getUser(user))?.role!=='owner')throw new ApiError(403,'Sign in as the site owner and start authorization again.');
+    const access=await accessFor(request,cookies,repo);
+    if(!session||!access?.can('services.manage'))throw new ApiError(403,'Sign in as someone who manages connected services and start authorization again.');
     await finishOAuth(repo,session,url,locals);
     return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});
   }catch{

package/src/pages/api/live/settings.ts

@@ -1,10 +1,11 @@
 import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { requestSessionBinding } from '../../../lib/auth/request';
 import { Provider } from '../../../lib/live/types';
 import { adminState, beginOAuth, disconnect, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
+import { requirePermission } from '../../../lib/permissions/access';
 const Input=z.discriminatedUnion('action',[
   z.object({action:z.literal('saveConnection'),provider:Provider,clientId:z.string().trim().min(1).max(200),clientSecret:z.string().trim().max(8192).default(''),channelInput:z.string().trim().max(2048).default(''),googleStatus:z.enum(['testing','production']).default('testing')}).strict(),
   z.object({action:z.literal('test'),provider:Provider}).strict(),
@@ -15,11 +16,11 @@ const Input=z.discriminatedUnion('action',[
   z.object({action:z.literal('saveConfig'),config:z.unknown()}).strict(),
 ]);
 export const GET:APIRoute=async({request,cookies,locals,url})=>{
-  try{const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);return json(await adminState(repo,url,locals));}catch(e){return apiError(e);}
+  try{const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'services.manage');return json(await adminState(repo,url,locals));}catch(e){return apiError(e);}
 };
 export const POST:APIRoute=async({request,cookies,locals,url})=>{
   try{
-    const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);
+    const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'services.manage');
     // Browser-based credential changes must originate at this site.
     if(request.headers.get('origin')!==url.origin)throw new ApiError(403,'Submit changes from this site’s admin.');
     const input=Input.parse(await readJson(request,24_000));

package/src/pages/api/media/upload.ts

@@ -3,6 +3,8 @@ import { validateRequestSession } from '../../../lib/auth/request';
 import { getRepo } from '../../../lib/repo';
 import { ApiError } from '../../../lib/api';
 import { storeUpload } from '../../../lib/media/upload';
+import { accessFor } from '../../../lib/permissions/access';
+import { deniedMessage } from '../../../lib/permissions/catalog';
 
 // Multipart upload from the admin; the rules live in lib/media/upload.ts
 // (shared with editor apps).
@@ -10,6 +12,8 @@ export const POST: APIRoute = async ({ request, cookies, locals }) => {
   if (!(await validateRequestSession(request, cookies, locals))) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
+  const access = await accessFor(request, cookies, await getRepo(locals));
+  if (!access?.can('media.upload')) return Response.json({ error: deniedMessage('media.upload') }, { status: 403 });
   const form = await request.formData();
   try {
     const media = await storeUpload(form, locals, await getRepo(locals));

package/src/pages/api/mobile/access.ts

@@ -1,20 +1,21 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { AppAccessInput, appAccessAction, appAccessState } from '../../../lib/mobile/access-admin';
+import { requirePermission } from '../../../lib/permissions/access';
 
 // Admin → Mobile app → App access (owner only, this site's admin only).
 export const GET: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     return json(await appAccessState(repo, locals));
   } catch (e) { return apiError(e); }
 };
 export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
     await appAccessAction(repo, AppAccessInput.parse(await readJson(request, 5_000)));
     return json(await appAccessState(repo, locals));

package/src/pages/api/monitoring.ts

@@ -1,20 +1,21 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../lib/api';
 import { MonitoringInput, monitoringAction, monitoringState } from '../../lib/monitoring';
+import { requirePermission } from '../../lib/permissions/access';
 
 // Settings → Monitoring (owner only, this site's admin only).
 export const GET: APIRoute = async ({ request, cookies, locals }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     return json(await monitoringState(repo, locals));
   } catch (e) { return apiError(e); }
 };
 export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
     await monitoringAction(repo, MonitoringInput.parse(await readJson(request, 5_000)), locals);
     return json(await monitoringState(repo, locals));

package/src/pages/api/push/admin.ts

@@ -1,22 +1,23 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
-import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { OWNER_ENV } from '../../../lib/auth';
 import { validateRequestSession } from '../../../lib/auth/request';
 import { AdminPushInput, adminPushAction, adminPushState } from '../../../lib/push/api';
+import { requirePermission } from '../../../lib/permissions/access';
 
 // Admin → Mobile app (owner only; registered only when push is enabled).
 export const GET: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     return json(await adminPushState(repo, url, locals));
   } catch (e) { return apiError(e); }
 };
 export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
   try {
     const repo = await getRepo(locals);
-    await requireSession(request, cookies, repo, true);
+    await requirePermission(request, cookies, repo, 'services.manage');
     // sending reaches every installed app: only from this site's admin
     if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Send from this site’s admin.');
     const input = AdminPushInput.parse(await readJson(request, 20_000));

package/src/pages/api/roles.ts

@@ -0,0 +1,36 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { ApiError, apiError, json, readJson, requireSession } from '../../lib/api';
+import { accessFor } from '../../lib/permissions/access';
+import { AUTH } from '../../lib/auth/config';
+import { getRequestAuth } from '../../lib/auth/request';
+import { RolesSave, rolesState, saveRoles } from '../../lib/permissions/service';
+
+// Team → Roles. Owners and administrators can read the policy (admins invite
+// people and benefit from seeing what each role does); only owners save.
+async function reader(request: Request, cookies: Parameters<APIRoute>[0]['cookies'], repo: Awaited<ReturnType<typeof getRepo>>) {
+  await requireSession(request, cookies, repo);
+  const access = await accessFor(request, cookies, repo);
+  if (!access) throw new ApiError(401, 'Sign in to continue.');
+  if (access.role !== 'owner' && access.role !== 'administrator') throw new ApiError(403, 'Only owners and administrators can see role permissions.');
+  return access;
+}
+
+export const GET: APIRoute = async ({ request, cookies, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    return json(await rolesState(repo, await reader(request, cookies, repo)));
+  } catch (e) { return apiError(e); }
+};
+
+export const PUT: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    const access = await reader(request, cookies, repo);
+    if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
+    // like Users: with Clerk, permission changes need a recent sign-in
+    if (AUTH.provider === 'clerk' && !(await getRequestAuth(request, cookies, repo)).reverified) throw new ApiError(403, 'Changing permissions needs a sign-in from the last ten minutes. Sign in again, then save.');
+    await saveRoles(repo, access, RolesSave.parse(await readJson(request, 50_000)));
+    return json(await rolesState(repo, access));
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/v1/admin/bookings/[id]/[action].ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../../../lib/editor/http';
+import { editorRoute, logWrite, requireCan } from '../../../../../../lib/editor/http';
 import { BookingActionInput, bookingAction } from '../../../../../../lib/editor/bookings';
 import { RescheduleInput, staffReschedule } from '../../../../../../lib/editor/schedule';
 import { methodNotAllowed } from '../../../../../../lib/mobile/http';
@@ -7,6 +7,7 @@ export { preflight as OPTIONS } from '../../../../../../lib/mobile/http';
 // approve | decline | cancel | reschedule — the guest is emailed, as from Admin → Bookings
 export const POST = editorRoute(async (c) => {
   const { id, action } = c.context.params;
+  await requireCan(c, 'schedule.bookings');
   if (action === 'reschedule') {
     const result = await staffReschedule(c, id!, RescheduleInput.parse(await readJson(c.context.request, 5_000)));
     await logWrite(c, 'booking-reschedule', `booking:${id}`);

package/src/pages/api/v1/admin/bookings/index.ts

@@ -1,12 +1,13 @@
-import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { editorRoute, logWrite, requireCan } from '../../../../../lib/editor/http';
 import { InboxQuery, inbox } from '../../../../../lib/editor/bookings';
 import { StaffBookingInput, staffBook } from '../../../../../lib/editor/schedule';
 import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
 import { readJson } from '../../../../../lib/api';
 export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
-export const GET = editorRoute(async ({ repo, context }) => inbox(repo, InboxQuery.parse(queryParams(context.url))));
+export const GET = editorRoute(async (c) => { await requireCan(c, 'schedule.bookings'); return inbox(c.repo, InboxQuery.parse(queryParams(c.context.url))); });
 // book on someone's behalf (the guest gets the usual emails)
 export const POST = editorRoute(async (c) => {
+  await requireCan(c, 'schedule.bookings');
   const b = await staffBook(c, StaffBookingInput.parse(await readJson(c.context.request, 50_000)));
   await logWrite(c, 'booking-create', `booking:${b.id}`);
   return b;

package/src/pages/api/v1/admin/documents/[kind]/[id]/[action].ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { canPublish, editorRoute, logWrite, requireCan } from '../../../../../../../lib/editor/http';
 import { ActionInput, DocKindParam, docAction, docJson } from '../../../../../../../lib/editor/documents';
 import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
 import { ApiError, readJson } from '../../../../../../../lib/api';
@@ -9,8 +9,9 @@ export const POST = editorRoute(async (c) => {
   const kind = DocKindParam.parse(c.context.params.kind);
   const action = c.context.params.action!;
   if (!['publish', 'unpublish', 'schedule', 'discard'].includes(action)) throw new ApiError(404, 'Unknown action.');
+  await requireCan(c, action === 'discard' ? 'content.edit' : 'content.publish');
   const body = ActionInput.parse(await readJson(c.context.request, 5_000));
-  const doc = await docAction(c.repo, kind, c.context.params.id!, action, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  const doc = await docAction(c.repo, kind, c.context.params.id!, action, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache, canPublish: await canPublish(c) });
   await logWrite(c, action, `${kind}:${doc.id}`);
   return docJson(kind, doc);
 }, { write: true });

package/src/pages/api/v1/admin/documents/[kind]/[id]/index.ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { canPublish, editorRoute, logWrite, requireCan } from '../../../../../../../lib/editor/http';
 import { DocKindParam, SaveInput, docJson, loadDoc, saveDoc } from '../../../../../../../lib/editor/documents';
 import { methodNotAllowed, queryParams } from '../../../../../../../lib/mobile/http';
 import { readJson } from '../../../../../../../lib/api';
@@ -11,9 +11,10 @@ export const GET = editorRoute(async ({ repo, context }) => {
   return docJson(kind, await loadDoc(repo, kind, context.params.id!));
 });
 export const PUT = editorRoute(async (c) => {
+  await requireCan(c, 'content.edit');
   const kind = DocKindParam.parse(c.context.params.kind);
   const body = SaveInput.parse(await readJson(c.context.request, 2_500_000));
-  const doc = await saveDoc(c.repo, kind, c.context.params.id!, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  const doc = await saveDoc(c.repo, kind, c.context.params.id!, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache, canPublish: await canPublish(c) });
   await logWrite(c, 'save', `${kind}:${doc.id}`);
   return docJson(kind, doc);
 }, { write: true });

package/src/pages/api/v1/admin/documents/[kind]/[id]/translations/[locale]/[action].ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { canPublish, editorRoute, logWrite, requireCan } from '../../../../../../../../../lib/editor/http';
 import { DocKindParam } from '../../../../../../../../../lib/editor/documents';
 import { AiDocInput, ReviewDocInput, changeDocTranslation } from '../../../../../../../../../lib/editor/translations';
 import { failure, methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
@@ -9,7 +9,8 @@ export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http
 const handler = (ai: boolean) => editorRoute(async (c) => {
   const { params } = c.context;
   const kind = DocKindParam.parse(params.kind);
-  const hooks = { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache };
+  await requireCan(c, 'content.edit');
+  const hooks = { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache, canPublish: await canPublish(c) };
   const raw = await readJson(c.context.request, 10_000);
   const result = ai
     ? await (async () => { const b = AiDocInput.parse(raw); return changeDocTranslation(c.repo, kind, params.id!, params.locale!, b.revision, { op: 'ai', paths: b.paths, includeReviewed: b.includeReviewed }, hooks); })()

package/src/pages/api/v1/admin/documents/[kind]/[id]/translations/[locale]/index.ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { canPublish, editorRoute, logWrite, requireCan } from '../../../../../../../../../lib/editor/http';
 import { DocKindParam } from '../../../../../../../../../lib/editor/documents';
 import { SetDocInput, changeDocTranslation, getDocTranslation } from '../../../../../../../../../lib/editor/translations';
 import { methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
@@ -8,10 +8,11 @@ export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http
 export const GET = editorRoute(async ({ repo, context: { params } }) => getDocTranslation(repo, DocKindParam.parse(params.kind), params.id!, params.locale!));
 // a person's words: stored as reviewed
 export const PUT = editorRoute(async (c) => {
+  await requireCan(c, 'content.edit');
   const { params } = c.context;
   const kind = DocKindParam.parse(params.kind);
   const body = SetDocInput.parse(await readJson(c.context.request, 2_500_000));
-  const result = await changeDocTranslation(c.repo, kind, params.id!, params.locale!, body.revision, { op: 'set', values: body.values }, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  const result = await changeDocTranslation(c.repo, kind, params.id!, params.locale!, body.revision, { op: 'set', values: body.values }, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache, canPublish: await canPublish(c) });
   await logWrite(c, 'translate', `${kind}:${params.id}:${params.locale}`);
   return result;
 }, { write: true });

package/src/pages/api/v1/admin/documents/index.ts

@@ -1,10 +1,11 @@
-import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { canPublish, editorRoute, logWrite, requireCan } from '../../../../../lib/editor/http';
 import { CreateInput, createDoc, docJson, listDocs, listQuery } from '../../../../../lib/editor/documents';
 import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
 import { readJson } from '../../../../../lib/api';
 export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
 export const GET = editorRoute(async ({ repo, context }) => listDocs(repo, listQuery.parse(queryParams(context.url))));
 export const POST = editorRoute(async (c) => {
+  await requireCan(c, 'content.edit');
   const input = CreateInput.parse(await readJson(c.context.request, 20_000));
   const doc = await createDoc(c.repo, input, c.who.user.id);
   await logWrite(c, 'create', `${input.kind}:${doc.id}`);

package/src/pages/api/v1/admin/links.ts

@@ -1,4 +1,4 @@
-import { editorRoute, logWrite } from '../../../../lib/editor/http';
+import { editorRoute, logWrite, requireCan } from '../../../../lib/editor/http';
 import { LinksPut, getLinksFor, putLinksFor } from '../../../../lib/editor/site-data';
 import { methodNotAllowed } from '../../../../lib/mobile/http';
 import { readJson } from '../../../../lib/api';
@@ -6,6 +6,7 @@ export { preflight as OPTIONS } from '../../../../lib/mobile/http';
 export const GET = editorRoute(async (c) => getLinksFor(c));
 // replaces the whole page (profile + blocks in order)
 export const PUT = editorRoute(async (c) => {
+  await requireCan(c, 'site.links');
   const result = await putLinksFor(c, LinksPut.parse(await readJson(c.context.request, 300_000)));
   await logWrite(c, 'links-update', 'links');
   return result;

package/src/pages/api/v1/admin/media/index.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { editorRoute, logWrite, requireCan } from '../../../../../lib/editor/http';
 import { methodNotAllowed, pageQuery, queryParams } from '../../../../../lib/mobile/http';
 import { ApiError, readResponseBytes } from '../../../../../lib/api';
 import { MAX_UPLOAD_BODY, storeUpload } from '../../../../../lib/media/upload';
@@ -19,6 +19,7 @@ export const GET = editorRoute(async ({ repo, context }) => {
 });
 // same types, limits and storage as the admin uploader (images arrive pre-compressed)
 export const POST = editorRoute(async (c) => {
+  await requireCan(c, 'media.upload');
   const type = c.context.request.headers.get('content-type') ?? '';
   if (!type.toLowerCase().startsWith('multipart/form-data')) throw new ApiError(415, 'Use Content-Type: multipart/form-data with a "file" field.');
   const bytes = await readResponseBytes(c.context.request, MAX_UPLOAD_BODY);