@critical-path/core 0.25.0 → 0.27.0

package/dist/engine/index.js

@@ -7,7 +7,9 @@ import { DomainEventBus } from '../domain/events.js';
 import { validateAttachmentUrl } from '../domain/entities.js';
 import { validateCustomFieldValues } from '../domain/custom-fields.js';
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
-import { ValidationError, NotFoundError } from '../domain/errors.js';
+import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
+import { WebhookDispatcher, assertWebhookUrl } from '../webhooks/dispatcher.js';
+import { generateWebhookSecret } from '../webhooks/signature.js';
 import { calculateCPM } from '../domain/cpm.js';
 import { buildTimelineLadder, aggregateConcreteEvidenceForTask } from '../domain/ladder.js';
 import { calculateTaskMetrics, reconstructTaskProgressHistory } from '../domain/metrics.js';
@@ -18,9 +20,13 @@ export class CriticalPathEngine {
     fileStorage;
     plugins;
     events;
+    /** Delivers domain events to registered webhooks. Exposed for custom queues (`deliver`) and tests (`idle`). */
+    webhooks;
     ready = Promise.resolve();
     /** The identity mutations are attributed to. Set only on views returned by `withActor`. */
     actor;
+    /** Set on internal views that keep the actor for attribution but skip authorization. */
+    authorizationBypassed;
     constructor(config = {}) {
         this.config = config;
         this.store = typeof config.store === 'object' && config.store !== null
@@ -29,6 +35,11 @@ export class CriticalPathEngine {
         this.fileStorage = config.fileStorage;
         this.plugins = new PluginRegistry();
         this.events = new DomainEventBus();
+        this.webhooks = new WebhookDispatcher({
+            listWebhooks: () => this.listAllWebhooks(),
+            resolveTenant: (event) => this.resolveEventTenant(event)
+        }, config.webhookDelivery);
+        this.events.subscribe('*', (event) => this.webhooks.handle(event));
         if (config.plugins) {
             for (const plugin of config.plugins) {
                 this.plugins.register(plugin);
@@ -53,6 +64,102 @@ export class CriticalPathEngine {
     actorIdOr(fallback) {
         return this.actor?.userId ?? fallback;
     }
+    // --- Authorization (applies only to withActor views; the base engine is trusted) ---
+    /**
+     * True when calls must be checked: on a withActor view (not an internal elevated view) with a
+     * policy or a tenant to enforce. Otherwise there is nothing to check, so lookups are skipped.
+     */
+    get enforcing() {
+        return !!this.actor && !this.authorizationBypassed && (!!this.config.authorize || !!this.actor.tenantId);
+    }
+    /** A view that keeps the actor for attribution but skips checks, for cascades already authorized. */
+    elevated() {
+        if (!this.enforcing)
+            return this;
+        const view = Object.create(this);
+        Object.defineProperty(view, 'authorizationBypassed', { value: true });
+        return view;
+    }
+    inActorTenant(entity) {
+        const tenant = this.actor?.tenantId;
+        return !tenant || entity?.tenantId === tenant;
+    }
+    async isAllowed(action, project, resource) {
+        if (!this.enforcing)
+            return true;
+        if (project && !this.inActorTenant(project))
+            return false;
+        const policy = this.config.authorize;
+        return policy ? await policy({ actor: this.actor, action, project, resource }) : true;
+    }
+    /** The project if the actor may read it, otherwise null (callers report "not found"). */
+    async readableProject(projectId) {
+        if (!projectId)
+            return null;
+        const project = await this.store.getProject(projectId);
+        if (!project)
+            return null;
+        return (await this.isAllowed('project.read', project)) ? project : null;
+    }
+    async canReadProject(projectId) {
+        if (!this.enforcing)
+            return true;
+        return (await this.readableProject(projectId)) !== null;
+    }
+    /**
+     * Ensures the actor may perform `action` in `projectId`. Projects the actor cannot read (or
+     * that belong to another tenant) are reported as not found so their existence is not revealed.
+     */
+    async requireProjectAccess(action, projectId, resource) {
+        if (!this.enforcing)
+            return;
+        const project = await this.readableProject(projectId);
+        if (!project)
+            throw new NotFoundError(`Project "${projectId}" not found.`);
+        if (action !== 'project.read' && !(await this.isAllowed(action, project, resource))) {
+            throw new ForbiddenError(`Not allowed to ${action} in project "${projectId}".`);
+        }
+    }
+    async requireWorkspaceAccess(action) {
+        if (!(await this.isAllowed(action)))
+            throw new ForbiddenError(`Not allowed to ${action}.`);
+    }
+    /** Keeps only items in projects the actor may read. Items with no project are hidden on views. */
+    async filterReadable(items, projectIdOf) {
+        if (!this.enforcing)
+            return items;
+        const readable = new Map();
+        const result = [];
+        for (const item of items) {
+            const projectId = await projectIdOf(item);
+            if (!projectId)
+                continue;
+            if (!readable.has(projectId))
+                readable.set(projectId, await this.canReadProject(projectId));
+            if (readable.get(projectId))
+                result.push(item);
+        }
+        return result;
+    }
+    async projectIdOfTask(taskId) {
+        return taskId ? (await this.store.getTask(taskId))?.projectId : undefined;
+    }
+    async projectIdOfComment(commentId) {
+        if (!commentId)
+            return undefined;
+        const comment = await this.store.getComment(commentId);
+        return this.projectIdOfTask(comment?.taskId);
+    }
+    async projectIdOfAttachment(a) {
+        return a.projectId ?? (await this.projectIdOfTask(a.taskId)) ?? (await this.projectIdOfComment(a.commentId));
+    }
+    /** Strips fields only the engine may set (tenancy) from updates made through a view. */
+    withoutTenant(updates) {
+        if (!this.actor || !('tenantId' in updates))
+            return updates;
+        const { tenantId: _ignored, ...rest } = updates;
+        return rest;
+    }
     async seedInitialData(data) {
         if (data.workflows) {
             for (const wf of data.workflows) {
@@ -92,13 +199,16 @@ export class CriticalPathEngine {
     }
     // --- Workflows ---
     async getWorkflows() {
-        return this.store.getWorkflows();
+        const workflows = await this.store.getWorkflows();
+        return workflows.filter((w) => this.inActorTenant(w));
     }
     async getWorkflow(id) {
-        return this.store.getWorkflow(id);
+        const workflow = await this.store.getWorkflow(id);
+        return workflow && this.inActorTenant(workflow) ? workflow : null;
     }
     async createWorkflow(workflow) {
-        const created = await this.store.createWorkflow(workflow);
+        await this.requireWorkspaceAccess('workspace.manage');
+        const created = await this.store.createWorkflow({ ...workflow, tenantId: this.actor ? this.actor.tenantId : workflow.tenantId });
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -114,13 +224,14 @@ export class CriticalPathEngine {
             action: 'workflow.created',
             details: { name: created.name }
         });
-        this.dispatchWebhook('workflow.created', { workflow: created });
         return created;
     }
     async updateWorkflow(id, updates) {
-        const existing = await this.store.getWorkflow(id);
+        const existing = await this.getWorkflow(id);
         if (!existing)
             return null;
+        await this.requireWorkspaceAccess('workspace.manage');
+        updates = this.withoutTenant(updates);
         const updated = await this.store.updateWorkflow(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -138,14 +249,14 @@ export class CriticalPathEngine {
                 action: 'workflow.updated',
                 details: { name: updated.name }
             });
-            this.dispatchWebhook('workflow.updated', { workflow: updated, previous: existing });
         }
         return updated;
     }
     async deleteWorkflow(id) {
-        const existing = await this.store.getWorkflow(id);
+        const existing = await this.getWorkflow(id);
         if (!existing)
             return false;
+        await this.requireWorkspaceAccess('workspace.manage');
         const deleted = await this.store.deleteWorkflow(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -155,7 +266,7 @@ export class CriticalPathEngine {
                 aggregateId: id,
                 aggregateType: 'Workflow',
                 occurredAt: now,
-                payload: { workflowId: id, name: existing.name }
+                payload: { workflowId: id, name: existing.name, tenantId: existing.tenantId }
             };
             await this.events.publish(event);
             await this.store.logActivity({
@@ -163,7 +274,6 @@ export class CriticalPathEngine {
                 action: 'workflow.deleted',
                 details: { name: existing.name }
             });
-            this.dispatchWebhook('workflow.deleted', { workflowId: id, name: existing.name });
         }
         return deleted;
     }
@@ -176,7 +286,8 @@ export class CriticalPathEngine {
             if (wf)
                 return wf;
         }
-        const workflows = await this.store.getWorkflows();
+        // Only fall back to workflows from the project's own tenant.
+        const workflows = (await this.store.getWorkflows()).filter((w) => w.tenantId === project?.tenantId);
         const defaultWf = workflows.find((w) => w.isDefault);
         if (defaultWf)
             return defaultWf;
@@ -185,21 +296,21 @@ export class CriticalPathEngine {
         return DEFAULT_SOFTWARE_WORKFLOW;
     }
     async getAllowedTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
         return getAllowedTransitions(workflow || undefined, task.status);
     }
     async getAllowedNextTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
         return getAllowedNextStatuses(workflow || undefined, task.status);
     }
     async getAllowedPreviousTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
@@ -207,13 +318,23 @@ export class CriticalPathEngine {
     }
     // --- Projects ---
     async getProjects() {
-        return this.store.getProjects();
+        const projects = await this.store.getProjects();
+        return this.filterReadable(projects, (p) => p.id);
     }
     async getProject(id) {
-        return this.store.getProject(id);
+        if (!this.enforcing)
+            return this.store.getProject(id);
+        return this.readableProject(id);
     }
     async createProject(project) {
-        const created = await this.store.createProject(project);
+        await this.requireWorkspaceAccess('project.create');
+        // Views always use the actor's tenant (possibly none); only trusted base-engine calls may set it.
+        const input = { ...project, tenantId: this.actor ? this.actor.tenantId : project.tenantId };
+        // The creator administers the project they create.
+        if (this.actor && this.actor.userId !== 'anonymous' && !input.members?.some((m) => m.userId === this.actor.userId)) {
+            input.members = [...(input.members ?? []), { userId: this.actor.userId, role: 'admin' }];
+        }
+        const created = await this.store.createProject(input);
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -230,13 +351,16 @@ export class CriticalPathEngine {
             action: 'project.created',
             details: { name: created.name, key: created.key }
         });
-        this.dispatchWebhook('project.created', { project: created });
         return created;
     }
     async updateProject(id, updates) {
-        const existing = await this.store.getProject(id);
+        const existing = await this.getProject(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('project.update', id);
+        if ('members' in updates)
+            await this.requireProjectAccess('project.manage_members', id);
+        updates = this.withoutTenant(updates);
         const updated = await this.store.updateProject(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -255,7 +379,6 @@ export class CriticalPathEngine {
                 action: 'project.updated',
                 details: { name: updated.name }
             });
-            this.dispatchWebhook('project.updated', { project: updated });
         }
         return updated;
     }
@@ -264,13 +387,16 @@ export class CriticalPathEngine {
      * hooks run and `task.deleted` events fire before `project.deleted` is published.
      */
     async deleteProject(id) {
-        const existing = await this.store.getProject(id);
+        const existing = await this.getProject(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('project.delete', id);
+        // Deleting the project implies deleting its tasks; skip per-task checks for the cascade.
+        const cascade = this.elevated();
         const tasks = await this.store.getTasks(id);
         const deletedTaskIds = [];
         for (const task of tasks) {
-            if (await this.deleteTask(task.id)) {
+            if (await cascade.deleteTask(task.id)) {
                 deletedTaskIds.push(task.id);
             }
         }
@@ -283,7 +409,7 @@ export class CriticalPathEngine {
                 aggregateId: id,
                 aggregateType: 'Project',
                 occurredAt: now,
-                payload: { projectId: id, name: existing.name, deletedTaskIds }
+                payload: { projectId: id, name: existing.name, deletedTaskIds, tenantId: existing.tenantId }
             };
             await this.events.publish(event);
             await this.store.logActivity({
@@ -292,18 +418,24 @@ export class CriticalPathEngine {
                 action: 'project.deleted',
                 details: { name: existing.name, deletedTaskCount: deletedTaskIds.length }
             });
-            this.dispatchWebhook('project.deleted', { projectId: id, name: existing.name, deletedTaskIds });
         }
         return deleted;
     }
     // --- Tasks ---
     async getTasks(projectId) {
-        return this.store.getTasks(projectId);
+        if (projectId && !(await this.canReadProject(projectId)))
+            return [];
+        const tasks = await this.store.getTasks(projectId);
+        return projectId ? tasks : this.filterReadable(tasks, (t) => t.projectId);
     }
     async getTask(id) {
-        return this.store.getTask(id);
+        const task = await this.store.getTask(id);
+        if (!task)
+            return null;
+        return (await this.canReadProject(task.projectId)) ? task : null;
     }
     async createTask(taskInput) {
+        await this.requireProjectAccess('task.create', taskInput.projectId);
         if (this.actor && !taskInput.reporterId) {
             taskInput = { ...taskInput, reporterId: this.actor.userId };
         }
@@ -385,13 +517,13 @@ export class CriticalPathEngine {
             action: 'task.created',
             details: { title: created.title, status: created.status }
         });
-        this.dispatchWebhook('task.created', { task: created });
         return created;
     }
     async updateTask(id, updates, options) {
-        const existing = await this.store.getTask(id);
+        const existing = await this.getTask(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('task.update', existing.projectId);
         // Identity comes from trusted options or the withActor view, never from the update payload.
         options = options ?? (this.actor ? { actor: this.actor } : undefined);
         const actorId = options?.actorId || options?.actor?.userId || 'system';
@@ -629,10 +761,6 @@ export class CriticalPathEngine {
                 action: 'task.blocked',
                 details: { reason: blockedReason, ...(actorName ? { actorName } : {}) }
             });
-            this.dispatchWebhook('task.blocked', {
-                task: updated,
-                reason: blockedReason
-            });
         }
         else if (wasBlocked && !isNowBlocked) {
             const unblockedEvent = {
@@ -656,9 +784,6 @@ export class CriticalPathEngine {
                 action: 'task.unblocked',
                 details: { ...(actorName ? { actorName } : {}) }
             });
-            this.dispatchWebhook('task.unblocked', {
-                task: updated
-            });
         }
         await this.store.logActivity({
             projectId: updated.projectId,
@@ -671,10 +796,6 @@ export class CriticalPathEngine {
                 ...(actorName ? { actorName } : {})
             }
         });
-        this.dispatchWebhook(isStatusChange ? 'task.status_changed' : 'task.updated', {
-            task: updated,
-            previous: existing
-        });
         return updated;
     }
     async checkAndUnblockDownstreamTasks(completedTask) {
@@ -736,10 +857,6 @@ export class CriticalPathEngine {
                         action: 'task.unblocked',
                         details: { unblockedByTaskId: completedTask.id }
                     });
-                    this.dispatchWebhook('task.unblocked', {
-                        task: updatedDownstream,
-                        upstreamTaskId: completedTask.id
-                    });
                 }
             }
         }
@@ -748,9 +865,10 @@ export class CriticalPathEngine {
         }
     }
     async deleteTask(id) {
-        const existing = await this.store.getTask(id);
+        const existing = await this.getTask(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('task.delete', existing.projectId);
         await this.plugins.runBeforeTaskDelete(id);
         const deleted = await this.store.deleteTask(id);
         if (deleted) {
@@ -776,12 +894,19 @@ export class CriticalPathEngine {
                 action: 'task.deleted',
                 details: { title: existing.title }
             });
-            this.dispatchWebhook('task.deleted', { taskId: id, title: existing.title });
         }
         return deleted;
     }
     // --- Task Dependencies & Graph ---
     async addDependency(dep) {
+        if (this.enforcing) {
+            const [task, upstream] = await Promise.all([this.getTask(dep.taskId), this.getTask(dep.dependsOnTaskId)]);
+            if (!task)
+                throw new NotFoundError(`Task "${dep.taskId}" not found.`);
+            if (!upstream)
+                throw new NotFoundError(`Task "${dep.dependsOnTaskId}" not found.`);
+            await this.requireProjectAccess('task.update', task.projectId);
+        }
         // Enforce Directed Acyclic Graph (DAG) Invariant
         const reachableDeps = await this.collectUpstreamDependencies(dep.dependsOnTaskId);
         const cycleCheck = detectDependencyCycle(reachableDeps, dep);
@@ -830,6 +955,9 @@ export class CriticalPathEngine {
         return Array.from(edges.values());
     }
     async getTaskDependencyGraph(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId))) {
+            return { taskId, upstreamTasks: [], downstreamTasks: [], dependencies: [] };
+        }
         const dependencies = await this.store.getDependencies(taskId);
         const upstreamTaskIds = new Set();
         const downstreamTaskIds = new Set();
@@ -841,8 +969,8 @@ export class CriticalPathEngine {
                 downstreamTaskIds.add(dep.taskId);
             }
         }
-        const upstreamTasks = (await Promise.all(Array.from(upstreamTaskIds).map((id) => this.store.getTask(id)))).filter((t) => t !== null);
-        const downstreamTasks = (await Promise.all(Array.from(downstreamTaskIds).map((id) => this.store.getTask(id)))).filter((t) => t !== null);
+        const upstreamTasks = (await Promise.all(Array.from(upstreamTaskIds).map((id) => this.getTask(id)))).filter((t) => t !== null);
+        const downstreamTasks = (await Promise.all(Array.from(downstreamTaskIds).map((id) => this.getTask(id)))).filter((t) => t !== null);
         return {
             taskId,
             upstreamTasks,
@@ -871,7 +999,12 @@ export class CriticalPathEngine {
         if (!Number.isFinite(entry.hours) || entry.hours <= 0) {
             throw new ValidationError('Logged hours must be a positive number.');
         }
-        const task = await this.store.getTask(entry.taskId);
+        const task = await this.getTask(entry.taskId);
+        if (this.enforcing) {
+            if (!task)
+                throw new NotFoundError(`Task "${entry.taskId}" not found.`);
+            await this.requireProjectAccess('time.log', task.projectId);
+        }
         if (task) {
             const newLoggedHours = (task.loggedHours || 0) + entry.hours;
             const newActualHours = (task.actualHours || 0) + entry.hours;
@@ -902,12 +1035,32 @@ export class CriticalPathEngine {
     }
     // --- Comments ---
     async getComments(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId)))
+            return [];
         return this.store.getComments(taskId);
     }
     async getComment(id) {
-        return this.store.getComment(id);
+        const comment = await this.store.getComment(id);
+        if (!comment)
+            return null;
+        return (await this.canReadProject(await this.projectIdOfTask(comment.taskId))) ? comment : null;
+    }
+    async getActivities(filter) {
+        const activities = await this.store.getActivities(filter);
+        return this.filterReadable(activities, (a) => a.projectId ?? this.projectIdOfTask(a.taskId));
+    }
+    async getTimeEntries(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId)))
+            return [];
+        return this.store.getTimeEntries(taskId);
     }
     async addComment(input) {
+        if (this.enforcing) {
+            const task = await this.getTask(input.taskId);
+            if (!task)
+                throw new NotFoundError(`Task "${input.taskId}" not found.`);
+            await this.requireProjectAccess('comment.create', task.projectId);
+        }
         const comment = this.actor
             ? { ...input, authorId: this.actor.userId, authorType: this.actor.actorType ?? 'user' }
             : { ...input, authorId: input.authorId ?? 'system' };
@@ -923,13 +1076,16 @@ export class CriticalPathEngine {
             payload: { taskId: comment.taskId, comment: created }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('comment.created', { comment: created });
         return created;
     }
     async updateComment(id, updates) {
-        const existing = await this.store.getComment(id);
+        const existing = await this.getComment(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.moderate', await this.projectIdOfTask(existing.taskId), {
+            type: 'comment',
+            ownerId: existing.authorId
+        });
         const mentions = updates.mentions ?? (updates.content ? extractMentions(updates.content) : undefined);
         const toUpdate = mentions !== undefined ? { ...updates, mentions } : updates;
         const updated = await this.store.updateComment(id, toUpdate);
@@ -945,13 +1101,16 @@ export class CriticalPathEngine {
             payload: { comment: updated, previous: existing }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('comment.updated', { comment: updated });
         return updated;
     }
     async deleteComment(id) {
-        const existing = await this.store.getComment(id);
+        const existing = await this.getComment(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('comment.moderate', await this.projectIdOfTask(existing.taskId), {
+            type: 'comment',
+            ownerId: existing.authorId
+        });
         const deleted = await this.store.deleteComment(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -964,15 +1123,15 @@ export class CriticalPathEngine {
                 payload: { taskId: existing.taskId, commentId: id }
             };
             await this.events.publish(event);
-            this.dispatchWebhook('comment.deleted', { commentId: id, taskId: existing.taskId });
         }
         return deleted;
     }
     async addCommentReaction(commentId, input) {
         const reaction = { emoji: input.emoji, userId: this.actor?.userId ?? input.userId ?? 'system' };
-        const existing = await this.store.getComment(commentId);
+        const existing = await this.getComment(commentId);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.create', await this.projectIdOfTask(existing.taskId));
         let updated;
         if (this.store.addReaction) {
             updated = await this.store.addReaction(commentId, reaction);
@@ -1009,14 +1168,14 @@ export class CriticalPathEngine {
             }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('comment.reaction.added', { comment: updated, reaction });
         return updated;
     }
     async removeCommentReaction(commentId, input) {
         const reaction = { emoji: input.emoji, userId: this.actor?.userId ?? input.userId ?? 'system' };
-        const existing = await this.store.getComment(commentId);
+        const existing = await this.getComment(commentId);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.create', await this.projectIdOfTask(existing.taskId));
         let updated;
         if (this.store.removeReaction) {
             updated = await this.store.removeReaction(commentId, reaction);
@@ -1037,21 +1196,32 @@ export class CriticalPathEngine {
             payload: { commentId, reaction, comment: updated }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('comment.reaction.removed', { comment: updated, reaction });
         return updated;
     }
     // --- Attachments ---
     async getAttachments(filter) {
-        const attachments = await this.store.getAttachments(filter);
+        const attachments = await this.filterReadable(await this.store.getAttachments(filter), (a) => this.projectIdOfAttachment(a));
         if (filter?.artifactType) {
             return attachments.filter(a => a.artifactType === filter.artifactType);
         }
         return attachments;
     }
     async getAttachment(id) {
-        return this.store.getAttachment(id);
+        const attachment = await this.store.getAttachment(id);
+        if (!attachment)
+            return null;
+        return (await this.canReadProject(await this.projectIdOfAttachment(attachment))) ? attachment : null;
+    }
+    async requireAttachmentCreate(link) {
+        if (!this.enforcing)
+            return;
+        const projectId = await this.projectIdOfAttachment(link);
+        if (!projectId)
+            throw new ValidationError('Attachments must reference a project, task or comment.');
+        await this.requireProjectAccess('attachment.create', projectId);
     }
     async createAttachment(input) {
+        await this.requireAttachmentCreate(input);
         const attachment = this.actor
             ? { ...input, uploaderId: this.actor.userId, uploaderType: this.actor.actorType ?? 'user' }
             : { ...input, uploaderId: input.uploaderId ?? 'system' };
@@ -1067,13 +1237,16 @@ export class CriticalPathEngine {
             payload: { attachment: created }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('attachment.created', { attachment: created });
         return created;
     }
     async deleteAttachment(id) {
-        const existing = await this.store.getAttachment(id);
+        const existing = await this.getAttachment(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('attachment.delete', await this.projectIdOfAttachment(existing), {
+            type: 'attachment',
+            ownerId: existing.uploaderId
+        });
         if (existing.storageKey && this.fileStorage) {
             try {
                 await this.fileStorage.delete(existing.storageKey);
@@ -1091,10 +1264,14 @@ export class CriticalPathEngine {
                 aggregateId: id,
                 aggregateType: 'Attachment',
                 occurredAt: now,
-                payload: { attachmentId: id, storageKey: existing.storageKey, url: existing.url }
+                payload: {
+                    attachmentId: id,
+                    storageKey: existing.storageKey,
+                    url: existing.url,
+                    projectId: await this.projectIdOfAttachment(existing)
+                }
             };
             await this.events.publish(event);
-            this.dispatchWebhook('attachment.deleted', { attachmentId: id, taskId: existing.taskId, projectId: existing.projectId });
         }
         return deleted;
     }
@@ -1102,6 +1279,8 @@ export class CriticalPathEngine {
         if (!this.fileStorage) {
             throw new Error('No FileStorageAdapter configured in CriticalPathEngine. Pass "fileStorage" in config to enable direct file uploads.');
         }
+        // Check before uploading so denied requests do not leave orphaned files behind.
+        await this.requireAttachmentCreate(input);
         const uploadResult = await this.fileStorage.upload({
             filename: input.filename,
             data: input.data,
@@ -1155,17 +1334,33 @@ export class CriticalPathEngine {
         if (!this.fileStorage || !this.fileStorage.getPresignedUploadUrl) {
             throw new Error('Presigned uploads are not supported by the configured FileStorageAdapter.');
         }
-        return this.fileStorage.getPresignedUploadUrl(options);
+        const { projectId, ...presign } = options;
+        if (this.enforcing) {
+            // Scoped callers may only write under their project's prefix.
+            if (!projectId)
+                throw new ValidationError('projectId is required for presigned uploads.');
+            await this.requireProjectAccess('attachment.create', projectId);
+            const prefix = `projects/${projectId}/`;
+            const key = presign.storageKey.replace(/^\/+/, '');
+            if (key.split('/').some((segment) => segment === '..' || segment === '.')) {
+                throw new ValidationError('storageKey must not contain "." or ".." segments.');
+            }
+            presign.storageKey = key.startsWith(prefix) ? key : prefix + key;
+        }
+        return this.fileStorage.getPresignedUploadUrl(presign);
     }
     // --- Teams ---
     async getTeams() {
-        return this.store.getTeams();
+        const teams = await this.store.getTeams();
+        return teams.filter((t) => this.inActorTenant(t));
     }
     async getTeam(id) {
-        return this.store.getTeam(id);
+        const team = await this.store.getTeam(id);
+        return team && this.inActorTenant(team) ? team : null;
     }
     async createTeam(team) {
-        const created = await this.store.createTeam(team);
+        await this.requireWorkspaceAccess('workspace.manage');
+        const created = await this.store.createTeam({ ...team, tenantId: this.actor ? this.actor.tenantId : team.tenantId });
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -1176,23 +1371,34 @@ export class CriticalPathEngine {
             payload: { team: created }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('team.created', { team: created });
         return created;
     }
     async updateTeam(id, updates) {
-        return this.store.updateTeam(id, updates);
+        if (!(await this.getTeam(id)))
+            return null;
+        await this.requireWorkspaceAccess('workspace.manage');
+        return this.store.updateTeam(id, this.withoutTenant(updates));
     }
     async deleteTeam(id) {
+        if (!(await this.getTeam(id)))
+            return false;
+        await this.requireWorkspaceAccess('workspace.manage');
         return this.store.deleteTeam(id);
     }
     // --- Containers ---
     async getContainers(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getContainers(projectId);
     }
     async getContainer(id) {
-        return this.store.getContainer(id);
+        const container = await this.store.getContainer(id);
+        if (!container)
+            return null;
+        return (await this.canReadProject(container.projectId)) ? container : null;
     }
     async createContainer(container) {
+        await this.requireProjectAccess('plan.manage', container.projectId);
         const created = await this.store.createContainer(container);
         const now = new Date().toISOString();
         const event = {
@@ -1204,23 +1410,36 @@ export class CriticalPathEngine {
             payload: { container: created }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('container.created', { container: created });
         return created;
     }
     async updateContainer(id, updates) {
+        const existing = await this.getContainer(id);
+        if (!existing)
+            return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.updateContainer(id, updates);
     }
     async deleteContainer(id) {
+        const existing = await this.getContainer(id);
+        if (!existing)
+            return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.deleteContainer(id);
     }
     // --- Deliverables ---
     async getDeliverables(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getDeliverables(projectId);
     }
     async getDeliverable(id) {
-        return this.store.getDeliverable(id);
+        const deliverable = await this.store.getDeliverable(id);
+        if (!deliverable)
+            return null;
+        return (await this.canReadProject(deliverable.projectId)) ? deliverable : null;
     }
     async createDeliverable(input) {
+        await this.requireProjectAccess('plan.manage', input.projectId);
         const project = await this.store.getProject(input.projectId);
         if (project?.customFieldDefinitions && input.customFields) {
             validateCustomFieldValues(project.customFieldDefinitions, input.customFields);
@@ -1247,13 +1466,13 @@ export class CriticalPathEngine {
             action: 'deliverable.created',
             details: { title: created.title, format: created.format }
         });
-        this.dispatchWebhook('deliverable.created', { deliverable: created });
         return created;
     }
     async updateDeliverable(id, updates) {
-        const existing = await this.store.getDeliverable(id);
+        const existing = await this.getDeliverable(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         if (updates.status && updates.status === 'delivered' && !existing.deliveredAt && !updates.deliveredAt) {
             updates.deliveredAt = new Date().toISOString();
         }
@@ -1274,11 +1493,6 @@ export class CriticalPathEngine {
                     }
                 };
                 await this.events.publish(statusEvent);
-                this.dispatchWebhook('deliverable.status_changed', {
-                    deliverable: updated,
-                    previousStatus: existing.status,
-                    newStatus: updated.status
-                });
             }
             const updateEvent = {
                 id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -1295,14 +1509,14 @@ export class CriticalPathEngine {
                 action: 'deliverable.updated',
                 details: { title: updated.title, status: updated.status }
             });
-            this.dispatchWebhook('deliverable.updated', { deliverable: updated });
         }
         return updated;
     }
     async deleteDeliverable(id) {
-        const existing = await this.store.getDeliverable(id);
+        const existing = await this.getDeliverable(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         const deleted = await this.store.deleteDeliverable(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -1321,12 +1535,11 @@ export class CriticalPathEngine {
                 action: 'deliverable.deleted',
                 details: { title: existing.title }
             });
-            this.dispatchWebhook('deliverable.deleted', { deliverableId: id, projectId: existing.projectId });
         }
         return deleted;
     }
     async getDeliverableSummary(deliverableId) {
-        const deliverable = await this.store.getDeliverable(deliverableId);
+        const deliverable = await this.getDeliverable(deliverableId);
         if (!deliverable)
             return null;
         const project = await this.store.getProject(deliverable.projectId);
@@ -1371,12 +1584,18 @@ export class CriticalPathEngine {
     }
     // --- Iterations ---
     async getIterations(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getIterations(projectId);
     }
     async getIteration(id) {
-        return this.store.getIteration(id);
+        const iteration = await this.store.getIteration(id);
+        if (!iteration)
+            return null;
+        return (await this.canReadProject(iteration.projectId)) ? iteration : null;
     }
     async createIteration(iteration) {
+        await this.requireProjectAccess('plan.manage', iteration.projectId);
         const created = await this.store.createIteration(iteration);
         if (created.status === 'active') {
             const now = new Date().toISOString();
@@ -1389,14 +1608,14 @@ export class CriticalPathEngine {
                 payload: { iteration: created }
             };
             await this.events.publish(event);
-            this.dispatchWebhook('iteration.started', { iteration: created });
         }
         return created;
     }
     async updateIteration(id, updates) {
-        const existing = await this.store.getIteration(id);
+        const existing = await this.getIteration(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         const updated = await this.store.updateIteration(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -1410,7 +1629,6 @@ export class CriticalPathEngine {
                     payload: { iteration: updated }
                 };
                 await this.events.publish(event);
-                this.dispatchWebhook('iteration.started', { iteration: updated });
             }
             else if (existing.status !== 'completed' && updated.status === 'completed') {
                 const event = {
@@ -1422,16 +1640,20 @@ export class CriticalPathEngine {
                     payload: { iteration: updated }
                 };
                 await this.events.publish(event);
-                this.dispatchWebhook('iteration.completed', { iteration: updated });
             }
         }
         return updated;
     }
     async deleteIteration(id) {
+        const existing = await this.getIteration(id);
+        if (!existing)
+            return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.deleteIteration(id);
     }
     // --- Ladder of Abstraction & Critical Path Method ---
     async calculateCriticalPath(projectId, options = {}) {
+        await this.requireProjectAccess('project.read', projectId);
         const project = await this.store.getProject(projectId);
         const tasks = await this.store.getTasks(projectId);
         const allDepArrays = await Promise.all(tasks.map((t) => this.store.getDependencies(t.id)));
@@ -1450,6 +1672,7 @@ export class CriticalPathEngine {
         return calculateCPM(projectId, tasks, dependencies, { schedule, projectStartDate });
     }
     async getTimelineLadder(projectId, options = {}) {
+        await this.requireProjectAccess('project.read', projectId);
         const project = await this.store.getProject(projectId);
         if (!project) {
             throw new NotFoundError(`Project with ID "${projectId}" not found.`);
@@ -1496,7 +1719,7 @@ export class CriticalPathEngine {
         }, options);
     }
     async getTaskLadder(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const project = await this.store.getProject(task.projectId);
@@ -1518,7 +1741,7 @@ export class CriticalPathEngine {
         };
     }
     async getTaskMetrics(taskId, options) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const [activities, timeEntries, project, workflow] = await Promise.all([
@@ -1534,7 +1757,7 @@ export class CriticalPathEngine {
         });
     }
     async getTaskProgressHistory(taskId, options) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const [activities, project, workflow] = await Promise.all([
@@ -1549,8 +1772,10 @@ export class CriticalPathEngine {
         });
     }
     async getWorkloadDistribution(projectId, options = {}) {
-        const tasks = await this.store.getTasks(projectId);
-        const teams = await this.store.getTeams();
+        if (projectId)
+            await this.requireProjectAccess('project.read', projectId);
+        const tasks = await this.getTasks(projectId);
+        const teams = await this.getTeams();
         const project = projectId ? await this.store.getProject(projectId) : undefined;
         const schedule = options.schedule || project?.schedule || this.config.defaultSchedule;
         const timeEntriesNested = await Promise.all(tasks.map((t) => this.store.getTimeEntries(t.id)));
@@ -1565,18 +1790,93 @@ export class CriticalPathEngine {
             schedule
         });
     }
-    async dispatchWebhook(event, payload) {
+    // --- Webhooks ---
+    /** Webhooks from `config.webhooks` (static, not editable) plus those in the store. */
+    async listAllWebhooks() {
+        const fromConfig = (this.config.webhooks ?? []).map((w, i) => ({
+            ...w,
+            id: `config_${i}`,
+            createdAt: new Date(0).toISOString()
+        }));
+        return [...fromConfig, ...(await this.store.getWebhooks())];
+    }
+    toPublicWebhook({ secret, ...webhook }) {
+        return { ...webhook, hasSecret: !!secret };
+    }
+    /** Webhooks in the actor's tenant, with secrets redacted. Requires `workspace.manage` on views. */
+    async getWebhooks() {
+        await this.requireWorkspaceAccess('workspace.manage');
         const webhooks = await this.store.getWebhooks();
-        const active = webhooks.filter((w) => w.active && w.events.includes(event));
-        for (const wh of active) {
-            fetch(wh.url, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ event, timestamp: new Date().toISOString(), data: payload })
-            }).catch(() => {
-                // Silent catch for webhook errors in dev
-            });
+        return webhooks.filter((w) => this.inActorTenant(w)).map((w) => this.toPublicWebhook(w));
+    }
+    async getWebhook(id) {
+        await this.requireWorkspaceAccess('workspace.manage');
+        const webhook = await this.store.getWebhook(id);
+        return webhook && this.inActorTenant(webhook) ? this.toPublicWebhook(webhook) : null;
+    }
+    /**
+     * Registers a webhook. The signing secret is returned only here; generate one by omitting
+     * `secret`. Deliveries carry `X-CriticalPath-Signature` (see `verifyWebhookSignature`).
+     */
+    async createWebhook(input) {
+        await this.requireWorkspaceAccess('workspace.manage');
+        this.validateWebhookUrl(input.url);
+        const secret = input.secret ?? generateWebhookSecret();
+        const created = await this.store.addWebhook({
+            name: input.name,
+            url: input.url,
+            events: input.events,
+            secret,
+            active: input.active ?? true,
+            tenantId: this.actor?.tenantId
+        });
+        this.webhooks.invalidate();
+        return { webhook: this.toPublicWebhook(created), secret };
+    }
+    async updateWebhook(id, updates) {
+        if (!(await this.getWebhook(id)))
+            return null;
+        if (updates.url)
+            this.validateWebhookUrl(updates.url);
+        const { name, url, events, active, secret } = updates;
+        const updated = await this.store.updateWebhook(id, Object.fromEntries(Object.entries({ name, url, events, active, secret }).filter(([, v]) => v !== undefined)));
+        this.webhooks.invalidate();
+        return updated ? this.toPublicWebhook(updated) : null;
+    }
+    async deleteWebhook(id) {
+        if (!(await this.getWebhook(id)))
+            return false;
+        const deleted = await this.store.deleteWebhook(id);
+        this.webhooks.invalidate();
+        return deleted;
+    }
+    validateWebhookUrl(url) {
+        try {
+            assertWebhookUrl(url, this.config.webhookDelivery?.allowPrivateUrls);
         }
+        catch (err) {
+            throw new ValidationError(err.message);
+        }
+    }
+    /** Finds the tenant an event belongs to, from the entity in its payload or its project. */
+    async resolveEventTenant(event) {
+        const p = event.payload;
+        const owner = p.project ?? p.workflow ?? p.team;
+        if (owner)
+            return owner.tenantId ?? undefined;
+        // Deleted projects and workflows carry their tenant in the payload.
+        if ('tenantId' in p)
+            return p.tenantId ?? undefined;
+        const projectId = p.projectId ??
+            p.task?.projectId ??
+            p.deliverable?.projectId ??
+            p.iteration?.projectId ??
+            p.container?.projectId ??
+            p.attachment?.projectId ??
+            (await this.projectIdOfTask(p.taskId ?? p.comment?.taskId ?? p.attachment?.taskId ?? p.dependency?.taskId ?? p.timeEntry?.taskId));
+        if (!projectId)
+            return undefined;
+        return (await this.store.getProject(projectId))?.tenantId ?? undefined;
     }
 }
 //# sourceMappingURL=index.js.map