@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/routes/oauth-well-known.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWellKnownRouter = createWellKnownRouter;
+const http_1 = require("../lib/http");
+const oauth_server_1 = require("../modules/oauth-server");
+const metadata_1 = require("../services/auth/oauth-server/metadata");
+/**
+ * The two OAuth well-known documents, mounted at the host's root. Answers
+ * exactly those paths and passes every other request on, so it never shadows
+ * the host's routes. Paths are computed per request because the issuer is
+ * configured after the router is mounted.
+ */
+function createWellKnownRouter() {
+    const router = (0, http_1.Router)();
+    const cors = (0, http_1.allowAnyOrigin)(['GET']);
+    router.use((req, res, next) => {
+        const settings = (0, oauth_server_1.getOAuthServerSettings)();
+        if (!settings || (req.method !== 'GET' && req.method !== 'OPTIONS'))
+            return next();
+        const paths = (0, metadata_1.wellKnownPaths)(settings);
+        const document = req.path === paths.authorizationServer
+            ? (0, metadata_1.authorizationServerMetadata)(settings)
+            : req.path === paths.protectedResource
+                ? (0, metadata_1.protectedResourceMetadata)(settings)
+                : null;
+        if (!document)
+            return next();
+        cors(req, res, () => res.json(document));
+    });
+    return router;
+}

package/build/routes/oauth.js

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setOAuthConfig = setOAuthConfig;
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const logger_1 = require("../lib/logger");
 const oauth_1 = require("../services/oauth");
 const user_1 = require("../services/user");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── OAuth startup config (set by initializeOAuth) ────────────────────────────
 let _oauthConfig = {
     autoProvision: true,

package/build/routes/overview.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/overview"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/overview?period=24h
  * System overview — triage, throughput, trends, infrastructure, processes.

package/build/routes/personas.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/personas"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Personas are role bundles — a management surface. Reads and writes share the
 // role-management gate (admin type, superadmin, engineer), the same audience
 // that manages roles and users.

package/build/routes/pipelines.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/pipelines"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Routes ───────────────────────────────────────────────────────────────────
 /**
  * GET /api/pipelines/entities
@@ -71,7 +72,7 @@ router.get('/', async (req, res) => {
  */
 router.get('/:jobId/execution', async (req, res) => {
     const result = await api.getJobExecution({
-        jobId: req.params.jobId,
+        jobId: String(req.params.jobId),
         app_id: req.query.app_id,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -81,9 +82,9 @@ router.get('/:jobId/execution', async (req, res) => {
  * Interrupt a running pipeline job via HotMesh.interrupt().
  * Body: { topic, app_id }
  */
-router.post('/:jobId/interrupt', async (req, res) => {
+router.post('/:jobId/interrupt', auth_1.requireBuilder, async (req, res) => {
     const result = await api.interruptJob({
-        jobId: req.params.jobId,
+        jobId: String(req.params.jobId),
         topic: req.body.topic,
         app_id: req.body.app_id,
     });

package/build/routes/roles.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/roles"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/roles
  * List all distinct roles known to the system.

package/build/routes/scan-codes.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/scan-codes"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Execute ───────────────────────────────────────────────────────────────
 /**
  * POST /api/scan-codes/execute

package/build/routes/settings.js

@@ -34,10 +34,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/settings"));
 const branding_1 = require("../modules/branding");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/settings
  * Returns frontend-relevant configuration (no secrets).

package/build/routes/tasks.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/tasks"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/tasks
  * Create a new task record.
@@ -74,7 +74,7 @@ router.get('/', async (req, res) => {
         origin_id: req.query.origin_id,
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -106,7 +106,7 @@ router.get('/processes', async (req, res) => {
  * Get all tasks and escalations for a process (origin_id).
  */
 router.get('/processes/:originId', async (req, res) => {
-    const result = await api.getProcess({ originId: req.params.originId });
+    const result = await api.getProcess({ originId: req.params.originId }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -114,7 +114,7 @@ router.get('/processes/:originId', async (req, res) => {
  * Get a single task by ID.
  */
 router.get('/:id', async (req, res) => {
-    const result = await api.getTask({ id: req.params.id });
+    const result = await api.getTask({ id: req.params.id }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/topics.js

@@ -33,9 +33,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/topics"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../modules/auth");
+const user_1 = require("../services/user");
+/**
+ * Subjects the platform itself publishes and acts on (agent triggers, system
+ * lifecycle). Only a superadmin may publish one over REST.
+ */
+const RESERVED_SUBJECT_PREFIXES = ['system.', 'agent.'];
+const router = (0, http_1.Router)();
 /**
  * GET /api/topics
  * List topics with optional filters.
@@ -54,7 +61,7 @@ router.get('/', async (req, res) => {
  * POST /api/topics
  * Register a new topic in the catalog.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { topic, category } = req.body;
     if (!topic || !category) {
         res.status(400).json({ error: 'topic and category are required' });
@@ -75,26 +82,31 @@ router.get('/by-name/:topic', async (req, res) => {
  * PUT /api/topics/by-name/:topic
  * Update a topic in the catalog.
  */
-router.put('/by-name/:topic', async (req, res) => {
-    const result = await api.updateTopic({ topic: decodeURIComponent(req.params.topic), ...req.body });
+router.put('/by-name/:topic', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.updateTopic({ ...req.body, topic: decodeURIComponent(String(req.params.topic)) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/topics/by-name/:topic
  * Delete a topic from the catalog (system topics are protected).
  */
-router.delete('/by-name/:topic', async (req, res) => {
-    const result = await api.deleteTopic({ topic: decodeURIComponent(req.params.topic) });
+router.delete('/by-name/:topic', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteTopic({ topic: decodeURIComponent(String(req.params.topic)) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/topics/by-name/:topic/publish
  * Publish a test event to the event bus with the given topic and payload.
  */
-router.post('/by-name/:topic/publish', async (req, res) => {
+router.post('/by-name/:topic/publish', auth_1.requireBuilder, async (req, res) => {
     // The request body IS the event envelope (Partial<LTEvent> + optional subject).
+    const subject = String(req.body?.subject || decodeURIComponent(String(req.params.topic)));
+    if (RESERVED_SUBJECT_PREFIXES.some((prefix) => subject.startsWith(prefix)) && !(await (0, user_1.isSuperAdmin)(req.auth.userId))) {
+        res.status(403).json({ error: 'Forbidden: only superadmin can publish a system subject' });
+        return;
+    }
     const result = await api.publishTopic({
-        topic: decodeURIComponent(req.params.topic),
+        topic: decodeURIComponent(String(req.params.topic)),
         event: (req.body ?? {}),
     });
     res.status(result.status).json(result.data ?? { error: result.error });

package/build/routes/users.js

@@ -33,11 +33,19 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
+const capabilities_1 = require("../modules/capabilities");
 const api = __importStar(require("../api/users"));
 const personasApi = __importStar(require("../api/personas"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** Answer a refused decision with 403; true when the request may go on. */
+function allowed(decision, res) {
+    if (decision.allowed)
+        return true;
+    res.status(403).json({ error: decision.error });
+    return false;
+}
 // ── User CRUD ─────────────────────────────────────────────────────────────────
 /**
  * GET /api/users
@@ -88,6 +96,8 @@ router.get('/:id', async (req, res) => {
  * Body: { external_id, email?, display_name?, roles?: [{ role, type }], metadata? }
  */
 router.post('/', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayGrantRoles)(req.auth.userId, (req.body || {}).roles), res))
+        return;
     const result = await api.createUser(req.body || {});
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -97,6 +107,8 @@ router.post('/', auth_1.requireBuilder, async (req, res) => {
  * Body: { email?, display_name?, status?, metadata? }
  */
 router.put('/:id', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.updateUser({ id: req.params.id, ...(req.body || {}) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -107,6 +119,8 @@ router.put('/:id', auth_1.requireBuilder, async (req, res) => {
  * Body: { set?: { key: value }, remove?: [key], rename?: { old: new } }
  */
 router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const { set, remove, rename } = req.body || {};
     const result = await api.patchUserProperties({
         id: req.params.id,
@@ -121,6 +135,8 @@ router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
  * Delete a user. Builder only.
  */
 router.delete('/:id', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.deleteUser({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -148,26 +164,10 @@ router.get('/:id/roles', async (req, res) => {
  */
 router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
     const { role, type, read_scope, write_scope } = req.body || {};
-    const userId = req.auth.userId;
-    // Superadmin bypasses all scoping
-    const { isSuperAdmin } = await Promise.resolve().then(() => __importStar(require('../services/user/rbac')));
-    if (!(await isSuperAdmin(userId))) {
-        // Non-superadmin can never assign superadmin type
-        if (type === 'superadmin') {
-            res.status(403).json({ error: 'Only superadmin can assign superadmin role type' });
-            return;
-        }
-        // Check if caller has the engineer role (builder) — can assign any non-superadmin role
-        const { hasRole: checkRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-        const isEngineer = await checkRole(userId, 'engineer');
-        if (!isEngineer) {
-            // Non-builder admin: can only assign roles they themselves hold
-            const callerHasRole = await checkRole(userId, role);
-            if (!callerHasRole) {
-                res.status(403).json({ error: `You can only assign roles you hold. You do not have the '${role}' role.` });
-                return;
-            }
-        }
+    const decision = await (0, capabilities_1.mayGrantRole)(req.auth.userId, { role, type });
+    if (!decision.allowed) {
+        res.status(403).json({ error: decision.error });
+        return;
     }
     const result = await api.addUserRole({ id: req.params.id, role, type, read_scope, write_scope });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -177,6 +177,9 @@ router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
  * Remove a role from a user.
  */
 router.delete('/:id/roles/:role', auth_1.requireAdmin, async (req, res) => {
+    const decision = await (0, capabilities_1.mayRevokeRole)(req.auth.userId, String(req.params.id), String(req.params.role));
+    if (!allowed(decision, res))
+        return;
     const result = await api.removeUserRole({ id: req.params.id, role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/workflow-sets.js

@@ -33,14 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/workflow-sets"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/workflow-sets
  * Create a workflow set from a specification and start the planner workflow.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { name, description, specification } = req.body;
     const result = await api.createWorkflowSet({ name, description, specification }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -63,17 +64,17 @@ router.get('/', async (req, res) => {
  * Get a single workflow set with its plan and workflow statuses.
  */
 router.get('/:id', async (req, res) => {
-    const result = await api.getWorkflowSet({ id: req.params.id });
+    const result = await api.getWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/workflow-sets/:id/plan
  * Update the plan (engineer adjustments before building).
  */
-router.put('/:id/plan', async (req, res) => {
+router.put('/:id/plan', auth_1.requireBuilder, async (req, res) => {
     const { plan, namespaces } = req.body;
     const result = await api.updateWorkflowSetPlanApi({
-        id: req.params.id,
+        id: String(req.params.id),
         plan,
         namespaces,
     });
@@ -83,25 +84,25 @@ router.put('/:id/plan', async (req, res) => {
  * POST /api/workflow-sets/:id/add
  * Add additional workflows to an existing set from a new specification.
  */
-router.post('/:id/add', async (req, res) => {
+router.post('/:id/add', auth_1.requireBuilder, async (req, res) => {
     const { specification } = req.body;
-    const result = await api.addToWorkflowSet({ id: req.params.id, specification }, req.auth ? { userId: req.auth.userId } : undefined);
+    const result = await api.addToWorkflowSet({ id: String(req.params.id), specification }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/workflow-sets/:id/build
  * Trigger the build phase (resume the planner workflow).
  */
-router.post('/:id/build', async (req, res) => {
-    const result = await api.buildWorkflowSet({ id: req.params.id });
+router.post('/:id/build', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.buildWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/workflow-sets/:id/deploy
  * Deploy all namespaces in the set.
  */
-router.post('/:id/deploy', async (req, res) => {
-    const result = await api.deployWorkflowSet({ id: req.params.id });
+router.post('/:id/deploy', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deployWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/workflows/config.js

@@ -33,10 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
 const api = __importStar(require("../../api/workflows"));
 const auth_1 = require("../../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Workflow configuration ────────────────────────────────────────────────────
 /**
  * GET /api/workflows/config
@@ -69,6 +70,18 @@ router.get('/:type/input-lookups', async (req, res) => {
  * Requires admin or superadmin role.
  */
 router.put('/:type/config', auth_1.requireAdmin, async (req, res) => {
+    // Every invocation of this workflow runs as execute_as, so it may not exceed the caller.
+    if (req.body.execute_as) {
+        try {
+            await (0, workflow_invocation_1.assertMayActAs)(req.auth.userId, req.body.execute_as);
+        }
+        catch (err) {
+            if (!(err instanceof workflow_invocation_1.InvocationError))
+                throw err;
+            res.status(err.statusCode).json({ error: err.message });
+            return;
+        }
+    }
     const result = await api.upsertWorkflowConfig({
         type: req.params.type,
         invocable: req.body.invocable,

package/build/routes/workflows/discovery.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Active workers ───────────────────────────────────────────────────────────
 /**
  * GET /api/workflows/workers

package/build/routes/workflows/index.js

@@ -3,11 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const discovery_1 = __importDefault(require("./discovery"));
 const config_1 = __importDefault(require("./config"));
 const invocation_1 = __importDefault(require("./invocation"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Mount in original route registration order:
 // 1. Discovery: /workers, /discovered, /cron/status
 router.use(discovery_1.default);

package/build/routes/workflows/invocation.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
+const auth_1 = require("../../modules/auth");
 const api = __importStar(require("../../api/workflows"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Workflow invocation ─────────────────────────────────────────────────────
 /**
  * POST /api/workflows/:type/invoke
@@ -69,9 +70,9 @@ router.post('/:type/invoke', async (req, res) => {
  * Get the status of a workflow. Optional `app_id` query param selects the
  * HotMesh namespace for resolution (default: durable).
  */
-router.get('/:workflowId/status', async (req, res) => {
+router.get('/:workflowId/status', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowStatus({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -82,9 +83,9 @@ router.get('/:workflowId/status', async (req, res) => {
  * Never blocks — always returns immediately. Optional `app_id` query param
  * selects the HotMesh namespace for resolution (default: durable).
  */
-router.get('/:workflowId/result', async (req, res) => {
+router.get('/:workflowId/result', auth_1.requireWorkflowReader, async (req, res) => {
     const result = await api.getWorkflowResult({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         appId: typeof req.query.app_id === 'string' ? req.query.app_id : undefined,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -93,16 +94,16 @@ router.get('/:workflowId/result', async (req, res) => {
  * POST /api/workflows/:workflowId/terminate
  * Interrupt/terminate a running workflow.
  */
-router.post('/:workflowId/terminate', async (req, res) => {
-    const result = await api.terminateWorkflow({ workflowId: req.params.workflowId });
+router.post('/:workflowId/terminate', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.terminateWorkflow({ workflowId: String(req.params.workflowId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * GET /api/workflows/:workflowId/export
  * Export workflow state. Convenience alias for /api/workflow-states/:workflowId.
  */
-router.get('/:workflowId/export', async (req, res) => {
-    const result = await api.exportWorkflow({ workflowId: req.params.workflowId });
+router.get('/:workflowId/export', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.exportWorkflow({ workflowId: String(req.params.workflowId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/yaml-workflows/cron.js

@@ -33,16 +33,29 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const api = __importStar(require("../../api/yaml-workflows"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../../modules/auth");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
+const router = (0, http_1.Router)();
 /**
  * PUT /api/yaml-workflows/:id/cron
  * Set or update cron schedule + envelope + execute_as.
  */
-router.put('/:id/cron', async (req, res) => {
+router.put('/:id/cron', auth_1.requireBuilder, async (req, res) => {
+    if (req.body.execute_as) {
+        try {
+            await (0, workflow_invocation_1.assertMayActAs)(req.auth.userId, req.body.execute_as);
+        }
+        catch (err) {
+            if (!(err instanceof workflow_invocation_1.InvocationError))
+                throw err;
+            res.status(err.statusCode).json({ error: err.message });
+            return;
+        }
+    }
     const result = await api.setCronSchedule({
-        id: req.params.id,
+        id: String(req.params.id),
         cron_schedule: req.body.cron_schedule,
         cron_envelope: req.body.cron_envelope,
         execute_as: req.body.execute_as,
@@ -53,8 +66,8 @@ router.put('/:id/cron', async (req, res) => {
  * DELETE /api/yaml-workflows/:id/cron
  * Clear cron schedule.
  */
-router.delete('/:id/cron', async (req, res) => {
-    const result = await api.clearCronSchedule({ id: req.params.id });
+router.delete('/:id/cron', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.clearCronSchedule({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**