@critical-path/server 0.16.0 → 0.18.0

package/src/index.test.ts

@@ -3,7 +3,7 @@ import { CriticalPathRouter } from './router.js';
 import { createNextHandler } from './adapters/next.js';
 import { createSvelteKitHandler } from './adapters/sveltekit.js';
 import { createUniversalHandler } from './adapters/universal.js';
-import { InMemoryStore } from '@critical-path/core';
+import { InMemoryStore, createRolePolicy } from '@critical-path/core';
 
 describe('@critical-path/server Router Tests', () => {
   it('handles project creation and retrieval over HTTP Fetch Requests', async () => {
@@ -111,7 +111,7 @@ describe('@critical-path/server Router Tests', () => {
     const postCmtReq = new Request(`http://localhost:3000/api/critical-path/tasks/${task.id}/comments`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ content: 'Root comment', authorId: 'u1', authorType: 'user' })
+      body: JSON.stringify({ content: 'Root comment' })
     });
     const postCmtRes = await router.handleRequest(postCmtReq);
     expect(postCmtRes.status).toBe(201);
@@ -146,8 +146,7 @@ describe('@critical-path/server Router Tests', () => {
         mimeType: 'text/markdown',
         sizeBytes: 100,
         taskId: task.id,
-        projectId: proj.id,
-        uploaderId: 'u1'
+        projectId: proj.id
       })
     });
     const postAttRes = await router.handleRequest(postAttReq);
@@ -183,8 +182,7 @@ describe('@critical-path/server Router Tests', () => {
       body: JSON.stringify({
         filename: 'huge.pdf',
         url: `data:application/pdf;base64,${'B'.repeat(3000)}`,
-        taskId: task.id,
-        uploaderId: 'u1'
+        taskId: task.id
       })
     });
     const invalidAttRes = await router.handleRequest(invalidAttReq);
@@ -203,29 +201,29 @@ describe('@critical-path/server Router Tests', () => {
     const addReactReq = new Request(`http://localhost:3000/api/critical-path/comments/${comment.id}/reactions`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ emoji: '❤️', userId: 'u2' })
+      body: JSON.stringify({ emoji: '❤️' })
     });
     const addReactRes = await router.handleRequest(addReactReq);
     expect(addReactRes.status).toBe(200);
     const addReactData = await addReactRes.json();
     expect(addReactData.comment.reactions).toHaveLength(1);
     expect(addReactData.comment.reactions[0].emoji).toBe('❤️');
+    expect(addReactData.comment.reactions[0].userId).toBe('anonymous');
 
-    // 2. Add reaction validation error (missing emoji or userId)
+    // 2. Add reaction validation error (missing emoji, or identity claimed in the body)
     const badReactReq = new Request(`http://localhost:3000/api/critical-path/comments/${comment.id}/reactions`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ emoji: '❤️' })
+      body: JSON.stringify({ emoji: '❤️', userId: 'u2' })
     });
     const badReactRes = await router.handleRequest(badReactReq);
     expect(badReactRes.status).toBe(400);
 
     // 3. Remove reaction via DELETE
-    const delReactReq = new Request(`http://localhost:3000/api/critical-path/comments/${comment.id}/reactions`, {
-      method: 'DELETE',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ emoji: '❤️', userId: 'u2' })
-    });
+    const delReactReq = new Request(
+      `http://localhost:3000/api/critical-path/comments/${comment.id}/reactions?emoji=${encodeURIComponent('❤️')}`,
+      { method: 'DELETE' }
+    );
     const delReactRes = await router.handleRequest(delReactReq);
     expect(delReactRes.status).toBe(200);
     const delReactData = await delReactRes.json();
@@ -483,11 +481,16 @@ describe('@critical-path/server Router Tests', () => {
       }
     });
 
-    it('answers CORS preflight requests', async () => {
-      const router = new CriticalPathRouter();
-      const res = await router.handleRequest(new Request(`${base}/tasks`, { method: 'OPTIONS' }));
-      expect(res.status).toBe(204);
-      expect(res.headers.get('Access-Control-Allow-Methods')).toContain('PATCH');
+    it('answers CORS preflight requests, sending CORS headers only when configured', async () => {
+      const preflight = () => new Request(`${base}/tasks`, { method: 'OPTIONS', headers: { Origin: 'https://x.test' } });
+
+      const closed = await new CriticalPathRouter().handleRequest(preflight());
+      expect(closed.status).toBe(204);
+      expect(closed.headers.get('Access-Control-Allow-Origin')).toBeNull();
+
+      const open = await new CriticalPathRouter(undefined, { cors: { origins: '*' } }).handleRequest(preflight());
+      expect(open.headers.get('Access-Control-Allow-Origin')).toBe('*');
+      expect(open.headers.get('Access-Control-Allow-Methods')).toContain('PATCH');
     });
   });
 
@@ -500,7 +503,7 @@ describe('@critical-path/server Router Tests', () => {
     expect((await GET(req())).status).toBe(200);
   });
 
-  it('updates projects via PATCH without allowing id or timestamp overrides', async () => {
+  it('updates projects via PATCH and rejects id or timestamp overrides', async () => {
     const router = new CriticalPathRouter();
     const proj = await router.engine.createProject({ key: 'UPD', name: 'Before' });
     const patch = (id: string, body: unknown) =>
@@ -512,7 +515,10 @@ describe('@critical-path/server Router Tests', () => {
         })
       );
 
-    const res = await patch(proj.id, { name: 'After', id: 'hijacked', createdAt: '1999-01-01T00:00:00.000Z' });
+    expect((await patch(proj.id, { name: 'After', id: 'hijacked' })).status).toBe(400);
+    expect((await patch(proj.id, { name: 'After', createdAt: '1999-01-01T00:00:00.000Z' })).status).toBe(400);
+
+    const res = await patch(proj.id, { name: 'After' });
     expect(res.status).toBe(200);
     const { project } = await res.json();
     expect(project.id).toBe(proj.id);
@@ -632,7 +638,7 @@ describe('@critical-path/server Router Tests', () => {
       expect((await call(router, '/projects', { method: 'OPTIONS' })).status).toBe(204);
     });
 
-    it('attributes mutations to the context user and ignores identity in bodies', async () => {
+    it('attributes mutations to the context user', async () => {
       const router = new CriticalPathRouter(undefined, { getContext: tokenContext });
       const project = await router.engine.createProject({ key: 'CTX', name: 'Context' });
       const task = await router.engine.createTask({ projectId: project.id, title: 'T' });
@@ -640,14 +646,14 @@ describe('@critical-path/server Router Tests', () => {
       const patched = await call(router, `/tasks/${task.id}`, {
         method: 'PATCH',
         token: 'alice',
-        body: JSON.stringify({ title: 'Renamed', actorId: 'ceo', actorName: 'CEO' })
+        body: JSON.stringify({ title: 'Renamed' })
       });
       expect(patched.status).toBe(200);
 
       const commented = await call(router, `/tasks/${task.id}/comments`, {
         method: 'POST',
         token: 'alice',
-        body: JSON.stringify({ content: 'hi', authorId: 'ceo' })
+        body: JSON.stringify({ content: 'hi' })
       });
       const { comment } = await commented.json();
       expect(comment.authorId).toBe('alice');
@@ -727,7 +733,7 @@ describe('@critical-path/server Router Tests', () => {
         new Request(`http://localhost/api/critical-path/tasks/${task.id}/comments`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ content: 'from svelte', authorId: 'spoofed' })
+          body: JSON.stringify({ content: 'from svelte' })
         });
 
       expect((await POST({ request: commentReq(), locals: {} })).status).toBe(401);
@@ -763,7 +769,7 @@ describe('@critical-path/server Router Tests', () => {
         })
       );
 
-    it('ignores attempts to move tasks or rewrite server-assigned fields', async () => {
+    it('rejects attempts to move tasks or rewrite server-assigned fields', async () => {
       const router = new CriticalPathRouter();
       const home = await router.engine.createProject({ key: 'HOME', name: 'Home' });
       const other = await router.engine.createProject({ key: 'OTH', name: 'Other' });
@@ -776,12 +782,14 @@ describe('@critical-path/server Router Tests', () => {
         createdAt: '1999-01-01T00:00:00.000Z',
         injected: '<script>'
       });
-      expect(res.status).toBe(200);
+      expect(res.status).toBe(400);
+      const { issues } = await res.json();
+      expect(issues[0].message).toMatch(/Unrecognized key/);
+      expect(issues[0].message).toMatch(/projectId/);
+
       const stored = await router.engine.getTask(task.id);
-      expect(stored?.title).toBe('Renamed');
+      expect(stored?.title).toBe('Stay');
       expect(stored?.projectId).toBe(home.id);
-      expect(stored?.createdAt).toBe(task.createdAt);
-      expect((stored as any).injected).toBeUndefined();
     });
 
     it('returns 400 with field-level issues for invalid bodies', async () => {
@@ -797,7 +805,7 @@ describe('@critical-path/server Router Tests', () => {
       expect((await send(router, 'POST', '/iterations', { projectId: project.id, name: 'S1', status: 'later' })).status).toBe(400);
     });
 
-    it('requires an author unless the caller is resolved, and path ids win over body ids', async () => {
+    it('takes authorship from the caller (or anonymous), never the body, and path ids win', async () => {
       const router = new CriticalPathRouter(undefined, {
         getContext: (request) => {
           const token = request.headers.get('Authorization')?.replace('Bearer ', '');
@@ -809,8 +817,11 @@ describe('@critical-path/server Router Tests', () => {
       const decoy = await router.engine.createTask({ projectId: project.id, title: 'Decoy' });
 
       const anonymous = await send(router, 'POST', `/tasks/${task.id}/comments`, { content: 'hi' });
-      expect(anonymous.status).toBe(400);
-      expect((await anonymous.json()).error).toContain('authorId');
+      expect(anonymous.status).toBe(201);
+      expect((await anonymous.json()).comment.authorId).toBe('anonymous');
+
+      const spoofed = await send(router, 'POST', `/tasks/${task.id}/comments`, { content: 'hi', authorId: 'ceo' }, 'alice');
+      expect(spoofed.status).toBe(400);
 
       const authed = await send(router, 'POST', `/tasks/${task.id}/comments`, { content: 'hi', taskId: decoy.id }, 'alice');
       expect(authed.status).toBe(201);
@@ -819,15 +830,65 @@ describe('@critical-path/server Router Tests', () => {
       expect(comment.taskId).toBe(task.id);
     });
 
-    it('keeps accepting actor claims from unauthenticated trusted callers', async () => {
+    it('attributes unauthenticated writes to the anonymous actor and rejects actor claims', async () => {
       const router = new CriticalPathRouter();
-      const project = await router.engine.createProject({ key: 'CLI', name: 'CLI' });
+      const project = await router.engine.createProject({ key: 'ANO', name: 'Anonymous' });
       const task = await router.engine.createTask({ projectId: project.id, title: 'T' });
 
-      const res = await send(router, 'PATCH', `/tasks/${task.id}`, { isBlocked: true, actorId: 'agent-7', actorType: 'agent' });
+      const claimed = await send(router, 'PATCH', `/tasks/${task.id}`, { isBlocked: true, actorId: 'agent-7' });
+      expect(claimed.status).toBe(400);
+
+      const res = await send(router, 'PATCH', `/tasks/${task.id}`, { isBlocked: true });
       expect(res.status).toBe(200);
       const activities = await router.engine.store.getActivities({ taskId: task.id });
-      expect(activities.some((a) => a.actorId === 'agent-7')).toBe(true);
+      expect(activities.some((a) => a.actorId === 'anonymous')).toBe(true);
+    });
+  });
+
+  describe('authorization and tenancy over HTTP', () => {
+    const users: Record<string, { userId: string; tenantId: string; roles?: string[] }> = {
+      alice: { userId: 'alice', tenantId: 'acme' },
+      vic: { userId: 'vic', tenantId: 'acme' },
+      gus: { userId: 'gus', tenantId: 'globex' }
+    };
+    const router = new CriticalPathRouter(
+      { authorize: createRolePolicy() },
+      {
+        requireAuth: true,
+        getContext: (request) => users[request.headers.get('Authorization')?.replace('Bearer ', '') ?? ''] ?? null
+      }
+    );
+    const call = (token: string, method: string, path: string, body?: unknown) =>
+      router.handleRequest(
+        new Request(`http://localhost/api/critical-path${path}`, {
+          method,
+          headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+          ...(body ? { body: JSON.stringify(body) } : {})
+        })
+      );
+
+    it('enforces roles with 403 and hides other tenants with 404', async () => {
+      const created = await call('alice', 'POST', '/projects', {
+        name: 'Acme roadmap',
+        members: [{ userId: 'vic', role: 'viewer' }]
+      });
+      expect(created.status).toBe(201);
+      const { project } = await created.json();
+      expect(project.members).toEqual(expect.arrayContaining([{ userId: 'alice', role: 'admin' }]));
+
+      const viewerWrite = await call('vic', 'POST', '/tasks', { projectId: project.id, title: 'Nope' });
+      expect(viewerWrite.status).toBe(403);
+
+      const viewerRead = await call('vic', 'GET', `/projects/${project.id}`);
+      expect(viewerRead.status).toBe(200);
+
+      const otherTenant = await call('gus', 'GET', `/projects/${project.id}`);
+      expect(otherTenant.status).toBe(404);
+      const otherTenantList = await (await call('gus', 'GET', '/projects')).json();
+      expect(otherTenantList.projects).toHaveLength(0);
+
+      const tenantInBody = await call('alice', 'PATCH', `/projects/${project.id}`, { tenantId: 'globex' });
+      expect(tenantInBody.status).toBe(400);
     });
   });
 });

package/src/openapi.ts

@@ -83,7 +83,7 @@ export const ROUTES: RouteDoc[] = [
   { method: 'patch', path: '/comments/{commentId}', summary: 'Update a comment', tag: 'Comments', body: schemas.UpdateCommentSchema, responseKey: 'comment' },
   { method: 'delete', path: '/comments/{commentId}', summary: 'Delete a comment', tag: 'Comments' },
   { method: 'post', path: '/comments/{commentId}/reactions', summary: 'Add a reaction', tag: 'Comments', body: schemas.CommentReactionSchema, responseKey: 'comment' },
-  { method: 'delete', path: '/comments/{commentId}/reactions', summary: 'Remove a reaction', tag: 'Comments', query: ['emoji', 'userId'], responseKey: 'comment' },
+  { method: 'delete', path: '/comments/{commentId}/reactions', summary: 'Remove a reaction', tag: 'Comments', query: ['emoji!'], responseKey: 'comment' },
 
   { method: 'get', path: '/attachments', summary: 'List attachments', tag: 'Attachments', query: ['taskId', 'projectId', 'commentId'], responseKey: 'attachments' },
   { method: 'post', path: '/attachments', summary: 'Register an attachment', tag: 'Attachments', body: schemas.CreateAttachmentSchema, responseKey: 'attachment', status: 201 },
@@ -162,6 +162,7 @@ export function buildOpenApiDocument(options: OpenApiOptions = {}): Record<strin
         [status]: { description: 'Success', content: { 'application/json': { schema: successSchema } } },
         '400': errorResponse,
         '401': errorResponse,
+        '403': errorResponse,
         '404': errorResponse,
         ...(route.path.endsWith('/dependencies') && route.method === 'post' ? { '409': errorResponse } : {}),
         '500': errorResponse

package/src/router.ts

@@ -2,6 +2,9 @@ import { CriticalPathEngine, type AuthorType, type CriticalPathConfig } from '@c
 import * as schemas from '@critical-path/core/schemas';
 import { buildOpenApiDocument } from './openapi.js';
 
+/** Actor for requests when no `getContext` is configured or it resolves no user. */
+export const ANONYMOUS_ACTOR = Object.freeze({ userId: 'anonymous', username: 'Anonymous', actorType: 'user' as const });
+
 const CORS_ALLOW_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
 const DEFAULT_CORS_ALLOW_HEADERS = ['Content-Type', 'Authorization'];
 
@@ -14,6 +17,10 @@ export interface RequestContext {
   userId?: string;
   userName?: string;
   actorType?: AuthorType;
+  /** Tenant the caller belongs to; scopes projects, workflows and teams (see `Actor.tenantId`). */
+  tenantId?: string;
+  /** Workspace roles, e.g. `['admin']`, interpreted by the engine's `authorize` policy. */
+  roles?: string[];
   [key: string]: unknown;
 }
 
@@ -53,8 +60,8 @@ export interface CriticalPathRouterOptions {
   exposeErrors?: boolean;
   /**
    * Resolves the caller's identity from the request (session cookie, bearer token, etc.).
-   * When it returns a `userId`, all mutations in the request are attributed to that user and
-   * identity fields in request bodies (`actorId`, `authorId`, `userId`, ...) are ignored.
+   * When it returns a `userId`, all mutations in the request are attributed to that user;
+   * otherwise they are attributed to `ANONYMOUS_ACTOR`. Request bodies never carry identity.
    */
   getContext?: (request: Request) => RequestContext | null | undefined | Promise<RequestContext | null | undefined>;
   /** Reject requests with `401` unless `getContext` returns a `userId`. Defaults to `false`. */
@@ -64,7 +71,10 @@ export interface CriticalPathRouterOptions {
    * When omitted, everything up to the first `/critical-path` segment is stripped.
    */
   basePath?: string;
-  /** CORS policy. Defaults to `{ origins: '*' }`; pass `false` to send no CORS headers. */
+  /**
+   * CORS policy. Defaults to `false` (no CORS headers, so only same-origin browsers can call the
+   * API). Set `{ origins: [...] }` to allow specific sites, or `{ origins: '*' }` for any site.
+   */
   cors?: CorsOptions | false;
 }
 
@@ -92,7 +102,7 @@ export class CriticalPathRouter {
     this.getContext = options.getContext;
     this.requireAuth = options.requireAuth ?? false;
     this.basePath = options.basePath ? '/' + options.basePath.replace(/^\/+|\/+$/g, '') : undefined;
-    this.cors = options.cors === undefined ? { origins: '*' } : options.cors;
+    this.cors = options.cors ?? false;
     if (this.cors && this.cors.origins === '*' && this.cors.credentials) {
       throw new Error('CORS credentials cannot be combined with origins "*"; list the allowed origins instead.');
     }
@@ -170,9 +180,18 @@ export class CriticalPathRouter {
     if (this.requireAuth && !context?.userId) {
       return this.jsonResponse({ error: 'Authentication required' }, 401);
     }
-    const engine = context?.userId
-      ? this.engine.withActor({ userId: context.userId, username: context.userName, actorType: context.actorType })
-      : this.engine;
+    // Every request runs as an actor, so authorship never comes from request bodies.
+    const engine = this.engine.withActor(
+      context?.userId
+        ? {
+            userId: context.userId,
+            username: context.userName,
+            actorType: context.actorType,
+            tenantId: context.tenantId,
+            roles: context.roles
+          }
+        : { ...ANONYMOUS_ACTOR, tenantId: context?.tenantId }
+    );
 
     try {
       // OpenAPI contract (behind the same auth as every other route)
@@ -304,7 +323,7 @@ export class CriticalPathRouter {
           }
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.CreateCommentSchema, { taskId });
-            const comment = await engine.addComment({ ...body, authorId: this.requireIdentity(context, body.authorId, 'authorId') });
+            const comment = await engine.addComment(body);
             return this.jsonResponse({ comment }, 201);
           }
         } else if (subResource === 'attachments') {
@@ -314,7 +333,7 @@ export class CriticalPathRouter {
           }
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.CreateAttachmentSchema, { taskId });
-            const attachment = await engine.createAttachment({ ...body, uploaderId: this.requireIdentity(context, body.uploaderId, 'uploaderId') });
+            const attachment = await engine.createAttachment(body);
             return this.jsonResponse({ attachment }, 201);
           }
         } else if (subResource === 'dependencies') {
@@ -530,7 +549,7 @@ export class CriticalPathRouter {
         if (method === 'GET') {
           const projectId = url.searchParams.get('projectId') || undefined;
           const taskId = url.searchParams.get('taskId') || undefined;
-          const activities = await engine.store.getActivities({ projectId, taskId });
+          const activities = await engine.getActivities({ projectId, taskId });
           return this.jsonResponse({ activities });
         }
       }
@@ -542,24 +561,16 @@ export class CriticalPathRouter {
         if (commentId && subResource === 'reactions') {
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.CommentReactionSchema);
-            const userId = this.requireIdentity(context, body.userId, 'userId');
-            const comment = await engine.addCommentReaction(commentId, { emoji: body.emoji, userId });
+            const comment = await engine.addCommentReaction(commentId, body);
             if (!comment) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment }, 200);
           }
           if (method === 'DELETE') {
-            let body: any = {};
-            try {
-              body = await this.readJson(request);
-            } catch {
-              // Body may be empty on DELETE, fallback to searchParams
-            }
-            const emoji = body.emoji || url.searchParams.get('emoji');
-            const userId = context?.userId ?? (body.userId || url.searchParams.get('userId'));
-            if (!emoji || !userId) {
-              return this.jsonResponse({ error: 'emoji and userId are required' }, 400);
+            const emoji = url.searchParams.get('emoji');
+            if (!emoji) {
+              return this.jsonResponse({ error: 'emoji query parameter is required' }, 400);
             }
-            const comment = await engine.removeCommentReaction(commentId, { emoji, userId });
+            const comment = await engine.removeCommentReaction(commentId, { emoji });
             if (!comment) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment }, 200);
           }
@@ -572,7 +583,7 @@ export class CriticalPathRouter {
           }
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.CreateCommentSchema);
-            const comment = await engine.addComment({ ...body, authorId: this.requireIdentity(context, body.authorId, 'authorId') });
+            const comment = await engine.addComment(body);
             return this.jsonResponse({ comment }, 201);
           }
         } else {
@@ -607,7 +618,7 @@ export class CriticalPathRouter {
         } else if (attachmentId === 'upload') {
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.UploadAttachmentSchema);
-            const attachment = await engine.uploadAttachmentFile({ ...body, uploaderId: this.requireIdentity(context, body.uploaderId, 'uploaderId') });
+            const attachment = await engine.uploadAttachmentFile(body);
             return this.jsonResponse({ attachment }, 201);
           }
         } else if (!attachmentId) {
@@ -620,7 +631,7 @@ export class CriticalPathRouter {
           }
           if (method === 'POST') {
             const body = await this.readBody(request, schemas.CreateAttachmentSchema);
-            const attachment = await engine.createAttachment({ ...body, uploaderId: this.requireIdentity(context, body.uploaderId, 'uploaderId') });
+            const attachment = await engine.createAttachment(body);
             return this.jsonResponse({ attachment }, 201);
           }
         } else {
@@ -642,7 +653,7 @@ export class CriticalPathRouter {
         if (method === 'GET') {
           const taskId = url.searchParams.get('taskId');
           if (!taskId) return this.jsonResponse({ error: 'taskId parameter required' }, 400);
-          const entries = await engine.store.getTimeEntries(taskId);
+          const entries = await engine.getTimeEntries(taskId);
           return this.jsonResponse({ timeEntries: entries });
         }
         if (method === 'POST') {
@@ -724,16 +735,6 @@ export class CriticalPathRouter {
     return schemas.parsePayload(schema as any, { ...body, ...overrides });
   }
 
-  /**
-   * Returns the identity to record for a write: the resolved caller when there is one, otherwise
-   * the value supplied in the body. Throws a 400 when neither is present.
-   */
-  private requireIdentity(context: RequestContext | null | undefined, claimed: string | undefined, field: string): string {
-    const identity = context?.userId ?? claimed;
-    if (!identity) throw new BadRequestError(`${field} is required`);
-    return identity;
-  }
-
   /** The API root as seen by this request, e.g. `https://host/api/critical-path`. */
   private openApiServerUrl(url: URL, subpath: string): string {
     const root = url.pathname.slice(0, url.pathname.length - subpath.length).replace(/\/+$/, '');
@@ -766,6 +767,8 @@ export class CriticalPathRouter {
         return this.jsonResponse({ error: e.message, cyclePath: e.cyclePath }, 409);
       case 'NotFoundError':
         return this.jsonResponse({ error: e.message }, 404);
+      case 'ForbiddenError':
+        return this.jsonResponse({ error: e.message }, 403);
     }
 
     // Unexpected errors may carry internals (SQL, URLs, config details), so they are only