@fideliosai/server 2026.331.0-canary.0

package/dist/routes/assets.js

@@ -0,0 +1,309 @@
+import { Router } from "express";
+import multer from "multer";
+import createDOMPurify from "dompurify";
+import { JSDOM } from "jsdom";
+import { createAssetImageMetadataSchema } from "@fideliosai/shared";
+import { assetService, logActivity } from "../services/index.js";
+import { isAllowedContentType, MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
+const SVG_CONTENT_TYPE = "image/svg+xml";
+const ALLOWED_COMPANY_LOGO_CONTENT_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/jpg",
+    "image/webp",
+    "image/gif",
+    SVG_CONTENT_TYPE,
+]);
+function sanitizeSvgBuffer(input) {
+    const raw = input.toString("utf8").trim();
+    if (!raw)
+        return null;
+    const baseDom = new JSDOM("");
+    const domPurify = createDOMPurify(baseDom.window);
+    domPurify.addHook("uponSanitizeAttribute", (_node, data) => {
+        const attrName = data.attrName.toLowerCase();
+        const attrValue = (data.attrValue ?? "").trim();
+        if (attrName.startsWith("on")) {
+            data.keepAttr = false;
+            return;
+        }
+        if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
+            data.keepAttr = false;
+        }
+    });
+    let parsedDom = null;
+    try {
+        const sanitized = domPurify.sanitize(raw, {
+            USE_PROFILES: { svg: true, svgFilters: true, html: false },
+            FORBID_TAGS: ["script", "foreignObject"],
+            FORBID_CONTENTS: ["script", "foreignObject"],
+            RETURN_TRUSTED_TYPE: false,
+        });
+        parsedDom = new JSDOM(sanitized, { contentType: SVG_CONTENT_TYPE });
+        const document = parsedDom.window.document;
+        const root = document.documentElement;
+        if (!root || root.tagName.toLowerCase() !== "svg")
+            return null;
+        for (const el of Array.from(root.querySelectorAll("script, foreignObject"))) {
+            el.remove();
+        }
+        for (const el of Array.from(root.querySelectorAll("*"))) {
+            for (const attr of Array.from(el.attributes)) {
+                const attrName = attr.name.toLowerCase();
+                const attrValue = attr.value.trim();
+                if (attrName.startsWith("on")) {
+                    el.removeAttribute(attr.name);
+                    continue;
+                }
+                if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
+                    el.removeAttribute(attr.name);
+                }
+            }
+        }
+        const output = root.outerHTML.trim();
+        if (!output || !/^<svg[\s>]/i.test(output))
+            return null;
+        return Buffer.from(output, "utf8");
+    }
+    catch {
+        return null;
+    }
+    finally {
+        parsedDom?.window.close();
+        baseDom.window.close();
+    }
+}
+export function assetRoutes(db, storage) {
+    const router = Router();
+    const svc = assetService(db);
+    const assetUpload = multer({
+        storage: multer.memoryStorage(),
+        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
+    });
+    const companyLogoUpload = multer({
+        storage: multer.memoryStorage(),
+        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
+    });
+    async function runSingleFileUpload(upload, req, res) {
+        await new Promise((resolve, reject) => {
+            upload.single("file")(req, res, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    router.post("/companies/:companyId/assets/images", async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        try {
+            await runSingleFileUpload(assetUpload, req, res);
+        }
+        catch (err) {
+            if (err instanceof multer.MulterError) {
+                if (err.code === "LIMIT_FILE_SIZE") {
+                    res.status(422).json({ error: `File exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    return;
+                }
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            throw err;
+        }
+        const file = req.file;
+        if (!file) {
+            res.status(400).json({ error: "Missing file field 'file'" });
+            return;
+        }
+        const parsedMeta = createAssetImageMetadataSchema.safeParse(req.body ?? {});
+        if (!parsedMeta.success) {
+            res.status(400).json({ error: "Invalid image metadata", details: parsedMeta.error.issues });
+            return;
+        }
+        const namespaceSuffix = parsedMeta.data.namespace ?? "general";
+        const contentType = (file.mimetype || "").toLowerCase();
+        if (contentType !== SVG_CONTENT_TYPE && !isAllowedContentType(contentType)) {
+            res.status(422).json({ error: `Unsupported file type: ${contentType || "unknown"}` });
+            return;
+        }
+        let fileBody = file.buffer;
+        if (contentType === SVG_CONTENT_TYPE) {
+            const sanitized = sanitizeSvgBuffer(file.buffer);
+            if (!sanitized || sanitized.length <= 0) {
+                res.status(422).json({ error: "SVG could not be sanitized" });
+                return;
+            }
+            fileBody = sanitized;
+        }
+        if (fileBody.length <= 0) {
+            res.status(422).json({ error: "Image is empty" });
+            return;
+        }
+        const actor = getActorInfo(req);
+        const stored = await storage.putFile({
+            companyId,
+            namespace: `assets/${namespaceSuffix}`,
+            originalFilename: file.originalname || null,
+            contentType,
+            body: fileBody,
+        });
+        const asset = await svc.create(companyId, {
+            provider: stored.provider,
+            objectKey: stored.objectKey,
+            contentType: stored.contentType,
+            byteSize: stored.byteSize,
+            sha256: stored.sha256,
+            originalFilename: stored.originalFilename,
+            createdByAgentId: actor.agentId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "asset.created",
+            entityType: "asset",
+            entityId: asset.id,
+            details: {
+                originalFilename: asset.originalFilename,
+                contentType: asset.contentType,
+                byteSize: asset.byteSize,
+            },
+        });
+        res.status(201).json({
+            assetId: asset.id,
+            companyId: asset.companyId,
+            provider: asset.provider,
+            objectKey: asset.objectKey,
+            contentType: asset.contentType,
+            byteSize: asset.byteSize,
+            sha256: asset.sha256,
+            originalFilename: asset.originalFilename,
+            createdByAgentId: asset.createdByAgentId,
+            createdByUserId: asset.createdByUserId,
+            createdAt: asset.createdAt,
+            updatedAt: asset.updatedAt,
+            contentPath: `/api/assets/${asset.id}/content`,
+        });
+    });
+    router.post("/companies/:companyId/logo", async (req, res) => {
+        const companyId = req.params.companyId;
+        assertCompanyAccess(req, companyId);
+        try {
+            await runSingleFileUpload(companyLogoUpload, req, res);
+        }
+        catch (err) {
+            if (err instanceof multer.MulterError) {
+                if (err.code === "LIMIT_FILE_SIZE") {
+                    res.status(422).json({ error: `Image exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    return;
+                }
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            throw err;
+        }
+        const file = req.file;
+        if (!file) {
+            res.status(400).json({ error: "Missing file field 'file'" });
+            return;
+        }
+        const contentType = (file.mimetype || "").toLowerCase();
+        if (!ALLOWED_COMPANY_LOGO_CONTENT_TYPES.has(contentType)) {
+            res.status(422).json({ error: `Unsupported image type: ${contentType || "unknown"}` });
+            return;
+        }
+        let fileBody = file.buffer;
+        if (contentType === SVG_CONTENT_TYPE) {
+            const sanitized = sanitizeSvgBuffer(file.buffer);
+            if (!sanitized || sanitized.length <= 0) {
+                res.status(422).json({ error: "SVG could not be sanitized" });
+                return;
+            }
+            fileBody = sanitized;
+        }
+        if (fileBody.length <= 0) {
+            res.status(422).json({ error: "Image is empty" });
+            return;
+        }
+        const actor = getActorInfo(req);
+        const stored = await storage.putFile({
+            companyId,
+            namespace: "assets/companies",
+            originalFilename: file.originalname || null,
+            contentType,
+            body: fileBody,
+        });
+        const asset = await svc.create(companyId, {
+            provider: stored.provider,
+            objectKey: stored.objectKey,
+            contentType: stored.contentType,
+            byteSize: stored.byteSize,
+            sha256: stored.sha256,
+            originalFilename: stored.originalFilename,
+            createdByAgentId: actor.agentId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            companyId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "asset.created",
+            entityType: "asset",
+            entityId: asset.id,
+            details: {
+                originalFilename: asset.originalFilename,
+                contentType: asset.contentType,
+                byteSize: asset.byteSize,
+                namespace: "assets/companies",
+            },
+        });
+        res.status(201).json({
+            assetId: asset.id,
+            companyId: asset.companyId,
+            provider: asset.provider,
+            objectKey: asset.objectKey,
+            contentType: asset.contentType,
+            byteSize: asset.byteSize,
+            sha256: asset.sha256,
+            originalFilename: asset.originalFilename,
+            createdByAgentId: asset.createdByAgentId,
+            createdByUserId: asset.createdByUserId,
+            createdAt: asset.createdAt,
+            updatedAt: asset.updatedAt,
+            contentPath: `/api/assets/${asset.id}/content`,
+        });
+    });
+    router.get("/assets/:assetId/content", async (req, res, next) => {
+        const assetId = req.params.assetId;
+        const asset = await svc.getById(assetId);
+        if (!asset) {
+            res.status(404).json({ error: "Asset not found" });
+            return;
+        }
+        assertCompanyAccess(req, asset.companyId);
+        const object = await storage.getObject(asset.companyId, asset.objectKey);
+        const responseContentType = asset.contentType || object.contentType || "application/octet-stream";
+        res.setHeader("Content-Type", responseContentType);
+        res.setHeader("Content-Length", String(asset.byteSize || object.contentLength || 0));
+        res.setHeader("Cache-Control", "private, max-age=60");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        if (responseContentType === SVG_CONTENT_TYPE) {
+            res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+        }
+        const filename = asset.originalFilename ?? "asset";
+        res.setHeader("Content-Disposition", `inline; filename=\"${filename.replaceAll("\"", "")}\"`);
+        object.stream.on("error", (err) => {
+            next(err);
+        });
+        object.stream.pipe(res);
+    });
+    return router;
+}
+//# sourceMappingURL=assets.js.map

package/dist/routes/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,eAAe,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;IACjD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAC/B,OAAO,CAAC,MAA0D,CACnE,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;YACxC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1D,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YACxC,eAAe,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YAC5C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QAEH,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE/D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5E,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAM,EAAE,OAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IAEH,KAAK,UAAU,mBAAmB,CAChC,MAAiC,EACjC,GAAY,EACZ,GAAa;QAEb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAY,EAAE,EAAE;gBAC/C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,WAAW,KAAK,gBAAgB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,SAAS;YACT,SAAS,EAAE,UAAU,eAAe,EAAE;YACtC,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC;QACjD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,SAAS;YACT,SAAS,EAAE,kBAAkB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,kBAAkB;aAC9B;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAClG,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;YAC7C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,8EAA8E,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/authz.d.ts

@@ -0,0 +1,16 @@
+import type { Request } from "express";
+export declare function assertBoard(req: Request): void;
+export declare function assertInstanceAdmin(req: Request): void;
+export declare function assertCompanyAccess(req: Request, companyId: string): void;
+export declare function getActorInfo(req: Request): {
+    actorType: "agent";
+    actorId: string;
+    agentId: string | null;
+    runId: string | null;
+} | {
+    actorType: "user";
+    actorId: string;
+    agentId: null;
+    runId: string | null;
+};
+//# sourceMappingURL=authz.d.ts.map

package/dist/routes/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,QAIvC;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,QAM/C;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,QAalE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;EAmBxC"}

package/dist/routes/authz.js

@@ -0,0 +1,47 @@
+import { forbidden, unauthorized } from "../errors.js";
+export function assertBoard(req) {
+    if (req.actor.type !== "board") {
+        throw forbidden("Board access required");
+    }
+}
+export function assertInstanceAdmin(req) {
+    assertBoard(req);
+    if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
+        return;
+    }
+    throw forbidden("Instance admin access required");
+}
+export function assertCompanyAccess(req, companyId) {
+    if (req.actor.type === "none") {
+        throw unauthorized();
+    }
+    if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
+        throw forbidden("Agent key cannot access another company");
+    }
+    if (req.actor.type === "board" && req.actor.source !== "local_implicit" && !req.actor.isInstanceAdmin) {
+        const allowedCompanies = req.actor.companyIds ?? [];
+        if (!allowedCompanies.includes(companyId)) {
+            throw forbidden("User does not have access to this company");
+        }
+    }
+}
+export function getActorInfo(req) {
+    if (req.actor.type === "none") {
+        throw unauthorized();
+    }
+    if (req.actor.type === "agent") {
+        return {
+            actorType: "agent",
+            actorId: req.actor.agentId ?? "unknown-agent",
+            agentId: req.actor.agentId ?? null,
+            runId: req.actor.runId ?? null,
+        };
+    }
+    return {
+        actorType: "user",
+        actorId: req.actor.userId ?? "board",
+        agentId: null,
+        runId: req.actor.runId ?? null,
+    };
+}
+//# sourceMappingURL=authz.js.map

package/dist/routes/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,SAAiB;IACjE,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACtG,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,SAAS,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,OAAgB;YAC3B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,eAAe;YAC7C,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAClC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAe;QAC1B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO;QACpC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/routes/companies.d.ts

@@ -0,0 +1,4 @@
+import type { Db } from "@fideliosai/db";
+import type { StorageService } from "../storage/types.js";
+export declare function companyRoutes(db: Db, storage?: StorageService): import("express-serve-static-core").Router;
+//# sourceMappingURL=companies.d.ts.map

package/dist/routes/companies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"companies.d.ts","sourceRoot":"","sources":["../../src/routes/companies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAmBzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,cAAc,8CA8T7D"}