@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/routes/oauth-server/index.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const metadata_1 = require("../../services/auth/oauth-server/metadata");
+const registration_1 = __importDefault(require("./registration"));
+const authorize_1 = __importDefault(require("./authorize"));
+const token_1 = __importDefault(require("./token"));
+const grants_1 = __importDefault(require("./grants"));
+/**
+ * OAuth authorization server endpoints under /api/oauth. The public ones
+ * (metadata, register, token, revoke) take no Long Tail session and allow
+ * any origin. The consent endpoints take the person's dashboard session.
+ * Every endpoint answers 404 until the server is configured.
+ */
+const router = (0, http_1.Router)();
+router.use((_req, res, next) => {
+    if (!(0, oauth_server_1.getOAuthServerSettings)()) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+    }
+    next();
+});
+/**
+ * GET /api/oauth/metadata
+ * The authorization server metadata, for clients that do not use the
+ * well-known document.
+ */
+router.get('/metadata', (0, http_1.allowAnyOrigin)(['GET']), (_req, res) => {
+    res.json((0, metadata_1.authorizationServerMetadata)((0, oauth_server_1.getOAuthServerSettings)()));
+});
+router.use(registration_1.default);
+router.use(authorize_1.default);
+router.use(token_1.default);
+router.use(grants_1.default);
+/**
+ * Anything an endpoint did not answer itself answers in the RFC 6749 error
+ * shape: a body that does not parse is the client's error, anything else the
+ * server's. No message or stack reaches the client.
+ */
+router.use((err, _req, res, _next) => {
+    if (res.headersSent)
+        return;
+    const malformed = err?.type === 'entity.parse.failed' || err?.status === 400;
+    res.status(malformed ? 400 : 500).json(malformed
+        ? { error: 'invalid_request', error_description: 'the request body is malformed' }
+        : { error: 'server_error', error_description: 'the request could not be completed' });
+});
+exports.default = router;

package/build/routes/oauth-server/registration.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/registration.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const registration_1 = require("../../services/auth/oauth-server/registration");
+const router = (0, http_1.Router)();
+const limiter = new registration_1.RegistrationLimiter(defaults_1.OAUTH_REGISTRATIONS_PER_WINDOW, defaults_1.OAUTH_REGISTRATION_WINDOW_SECONDS * 1000);
+/**
+ * POST /api/oauth/register
+ * Dynamic client registration (RFC 7591) for public clients.
+ * Body: { redirect_uris, client_name?, grant_types?, response_types?, token_endpoint_auth_method? }
+ */
+router.options('/register', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/register', (0, http_1.allowAnyOrigin)(['POST']), async (req, res) => {
+    if (!limiter.allow((0, registration_1.registrationAddressKey)(req.ip ?? 'unknown'))) {
+        res.status(429).json({ error: 'rate_limited', error_description: 'too many client registrations; try again later' });
+        return;
+    }
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const checked = (0, registration_1.validateClientMetadata)(req.body, settings.allowedRedirectUris);
+    if (!checked.ok) {
+        res.status(400).json({ error: checked.error, error_description: checked.description });
+        return;
+    }
+    const client = await (0, oauth_server_2.registerClient)({ clientName: checked.clientName, redirectUris: checked.redirectUris });
+    res.status(201).json({
+        client_id: client.client_id,
+        client_id_issued_at: Math.floor(new Date(client.created_at).getTime() / 1000),
+        client_name: client.client_name ?? undefined,
+        redirect_uris: client.redirect_uris,
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+    });
+});
+exports.default = router;

package/build/routes/oauth-server/token.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/oauth-server/token.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = require("../../lib/http");
+const oauth_server_1 = require("../../modules/oauth-server");
+const defaults_1 = require("../../modules/defaults");
+const oauth_server_2 = require("../../services/auth/oauth-server");
+const registration_1 = require("../../services/auth/oauth-server/registration");
+const router = (0, http_1.Router)();
+/**
+ * A form field, taking the first value when the host parsed repeats into an
+ * array. A value carrying a control character is treated as absent: no
+ * token, id or URI contains one.
+ */
+function field(body, name) {
+    const value = body?.[name];
+    const first = Array.isArray(value) ? value[0] : value;
+    return typeof first === 'string' && first !== '' && !(0, registration_1.hasControlCharacters)(first) ? first : undefined;
+}
+/** RFC 7636 §4.1: 43 to 128 unreserved characters. */
+const CODE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
+function tokenError(res, error, description) {
+    res.status(400).json({ error, error_description: description });
+}
+function sendTokens(res, snapshot, refreshToken) {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const { token, expiresIn } = (0, oauth_server_2.signAccessToken)(snapshot, { issuer: settings.issuer, audience: settings.resource });
+    res.json({ access_token: token, token_type: 'Bearer', expires_in: expiresIn, refresh_token: refreshToken, scope: snapshot.scope });
+}
+const tokenEndpoint = [(0, http_1.allowAnyOrigin)(['POST']), (0, http_1.formBody)()];
+/**
+ * POST /api/oauth/token
+ * grant_type=authorization_code: code, redirect_uri, client_id, code_verifier
+ * grant_type=refresh_token: refresh_token, client_id
+ * Returns { access_token, token_type, expires_in, refresh_token, scope }.
+ */
+router.options('/token', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/token', ...tokenEndpoint, async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const grantType = field(req.body, 'grant_type');
+    const clientId = field(req.body, 'client_id');
+    if (!clientId)
+        return tokenError(res, 'invalid_request', 'client_id is required');
+    if (grantType === 'authorization_code') {
+        const code = field(req.body, 'code');
+        const redirectUri = field(req.body, 'redirect_uri');
+        const codeVerifier = field(req.body, 'code_verifier');
+        if (!code || !redirectUri || !codeVerifier) {
+            return tokenError(res, 'invalid_request', 'code, redirect_uri and code_verifier are required');
+        }
+        if (!CODE_VERIFIER.test(codeVerifier)) {
+            return tokenError(res, 'invalid_request', 'code_verifier must be 43 to 128 unreserved characters');
+        }
+        const resource = field(req.body, 'resource');
+        if (resource !== undefined && resource !== settings.resource) {
+            return tokenError(res, 'invalid_target', `resource must be ${settings.resource}`);
+        }
+        const exchanged = await (0, oauth_server_2.exchangeAuthorizationCode)({
+            code, clientId, redirectUri, codeVerifier, refreshTtlSeconds: defaults_1.OAUTH_REFRESH_TOKEN_TTL_SECONDS,
+        });
+        if (!exchanged)
+            return tokenError(res, 'invalid_grant', 'the authorization code is invalid, expired or already used');
+        return sendTokens(res, exchanged.snapshot, exchanged.refreshToken);
+    }
+    if (grantType === 'refresh_token') {
+        const refreshToken = field(req.body, 'refresh_token');
+        if (!refreshToken)
+            return tokenError(res, 'invalid_request', 'refresh_token is required');
+        const rotated = await (0, oauth_server_2.rotateRefreshToken)({ refreshToken, clientId, refreshTtlSeconds: defaults_1.OAUTH_REFRESH_TOKEN_TTL_SECONDS });
+        if (rotated.snapshot === null) {
+            return tokenError(res, 'invalid_grant', 'the refresh token is invalid, expired or revoked');
+        }
+        return sendTokens(res, rotated.snapshot, rotated.refreshToken);
+    }
+    return tokenError(res, 'unsupported_grant_type', 'grant_type must be authorization_code or refresh_token');
+});
+/**
+ * POST /api/oauth/revoke
+ * Token revocation (RFC 7009): a refresh token or an access token, with the
+ * client_id that holds it. Revokes the whole grant. Always answers 200.
+ */
+router.options('/revoke', (0, http_1.allowAnyOrigin)(['POST']));
+router.post('/revoke', ...tokenEndpoint, async (req, res) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    const token = field(req.body, 'token');
+    const clientId = field(req.body, 'client_id');
+    if (token && clientId) {
+        const claims = (0, oauth_server_2.verifyAccessToken)(token, { issuer: settings.issuer, audience: settings.resource });
+        if (claims) {
+            if (claims.client_id === clientId)
+                await (0, oauth_server_2.revokeGrant)(claims.gid);
+        }
+        else {
+            await (0, oauth_server_2.revokeByRefreshToken)(token, clientId);
+        }
+    }
+    res.status(200).end();
+});
+exports.default = router;

package/build/routes/oauth-well-known.d.ts

@@ -0,0 +1,8 @@
+import { Router } from '../lib/http';
+/**
+ * The two OAuth well-known documents, mounted at the host's root. Answers
+ * exactly those paths and passes every other request on, so it never shadows
+ * the host's routes. Paths are computed per request because the issuer is
+ * configured after the router is mounted.
+ */
+export declare function createWellKnownRouter(): Router;

package/build/routes/oauth-well-known.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWellKnownRouter = createWellKnownRouter;
+const http_1 = require("../lib/http");
+const oauth_server_1 = require("../modules/oauth-server");
+const metadata_1 = require("../services/auth/oauth-server/metadata");
+/**
+ * The two OAuth well-known documents, mounted at the host's root. Answers
+ * exactly those paths and passes every other request on, so it never shadows
+ * the host's routes. Paths are computed per request because the issuer is
+ * configured after the router is mounted.
+ */
+function createWellKnownRouter() {
+    const router = (0, http_1.Router)();
+    const cors = (0, http_1.allowAnyOrigin)(['GET']);
+    router.use((req, res, next) => {
+        const settings = (0, oauth_server_1.getOAuthServerSettings)();
+        if (!settings || (req.method !== 'GET' && req.method !== 'OPTIONS'))
+            return next();
+        const paths = (0, metadata_1.wellKnownPaths)(settings);
+        const document = req.path === paths.authorizationServer
+            ? (0, metadata_1.authorizationServerMetadata)(settings)
+            : req.path === paths.protectedResource
+                ? (0, metadata_1.protectedResourceMetadata)(settings)
+                : null;
+        if (!document)
+            return next();
+        cors(req, res, () => res.json(document));
+    });
+    return router;
+}

package/build/routes/oauth.js

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setOAuthConfig = setOAuthConfig;
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const logger_1 = require("../lib/logger");
 const oauth_1 = require("../services/oauth");
 const user_1 = require("../services/user");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── OAuth startup config (set by initializeOAuth) ────────────────────────────
 let _oauthConfig = {
     autoProvision: true,

package/build/routes/overview.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/overview"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/overview?period=24h
  * System overview — triage, throughput, trends, infrastructure, processes.

package/build/routes/personas.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/personas"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Personas are role bundles — a management surface. Reads and writes share the
 // role-management gate (admin type, superadmin, engineer), the same audience
 // that manages roles and users.

package/build/routes/pipelines.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/pipelines"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Routes ───────────────────────────────────────────────────────────────────
 /**
  * GET /api/pipelines/entities
@@ -71,7 +72,7 @@ router.get('/', async (req, res) => {
  */
 router.get('/:jobId/execution', async (req, res) => {
     const result = await api.getJobExecution({
-        jobId: req.params.jobId,
+        jobId: String(req.params.jobId),
         app_id: req.query.app_id,
     });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -81,9 +82,9 @@ router.get('/:jobId/execution', async (req, res) => {
  * Interrupt a running pipeline job via HotMesh.interrupt().
  * Body: { topic, app_id }
  */
-router.post('/:jobId/interrupt', async (req, res) => {
+router.post('/:jobId/interrupt', auth_1.requireBuilder, async (req, res) => {
     const result = await api.interruptJob({
-        jobId: req.params.jobId,
+        jobId: String(req.params.jobId),
         topic: req.body.topic,
         app_id: req.body.app_id,
     });

package/build/routes/roles.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/roles"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/roles
  * List all distinct roles known to the system.

package/build/routes/scan-codes.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/scan-codes"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // ── Execute ───────────────────────────────────────────────────────────────
 /**
  * POST /api/scan-codes/execute

package/build/routes/settings.js

@@ -34,10 +34,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/settings"));
 const branding_1 = require("../modules/branding");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/settings
  * Returns frontend-relevant configuration (no secrets).

package/build/routes/tasks.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/tasks"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/tasks
  * Create a new task record.
@@ -74,7 +74,7 @@ router.get('/', async (req, res) => {
         origin_id: req.query.origin_id,
         limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
         offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
-    });
+    }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -106,7 +106,7 @@ router.get('/processes', async (req, res) => {
  * Get all tasks and escalations for a process (origin_id).
  */
 router.get('/processes/:originId', async (req, res) => {
-    const result = await api.getProcess({ originId: req.params.originId });
+    const result = await api.getProcess({ originId: req.params.originId }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
@@ -114,7 +114,7 @@ router.get('/processes/:originId', async (req, res) => {
  * Get a single task by ID.
  */
 router.get('/:id', async (req, res) => {
-    const result = await api.getTask({ id: req.params.id });
+    const result = await api.getTask({ id: req.params.id }, req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/topics.js

@@ -33,9 +33,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/topics"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../modules/auth");
+const user_1 = require("../services/user");
+/**
+ * Subjects the platform itself publishes and acts on (agent triggers, system
+ * lifecycle). Only a superadmin may publish one over REST.
+ */
+const RESERVED_SUBJECT_PREFIXES = ['system.', 'agent.'];
+const router = (0, http_1.Router)();
 /**
  * GET /api/topics
  * List topics with optional filters.
@@ -54,7 +61,7 @@ router.get('/', async (req, res) => {
  * POST /api/topics
  * Register a new topic in the catalog.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { topic, category } = req.body;
     if (!topic || !category) {
         res.status(400).json({ error: 'topic and category are required' });
@@ -75,26 +82,31 @@ router.get('/by-name/:topic', async (req, res) => {
  * PUT /api/topics/by-name/:topic
  * Update a topic in the catalog.
  */
-router.put('/by-name/:topic', async (req, res) => {
-    const result = await api.updateTopic({ topic: decodeURIComponent(req.params.topic), ...req.body });
+router.put('/by-name/:topic', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.updateTopic({ ...req.body, topic: decodeURIComponent(String(req.params.topic)) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/topics/by-name/:topic
  * Delete a topic from the catalog (system topics are protected).
  */
-router.delete('/by-name/:topic', async (req, res) => {
-    const result = await api.deleteTopic({ topic: decodeURIComponent(req.params.topic) });
+router.delete('/by-name/:topic', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteTopic({ topic: decodeURIComponent(String(req.params.topic)) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/topics/by-name/:topic/publish
  * Publish a test event to the event bus with the given topic and payload.
  */
-router.post('/by-name/:topic/publish', async (req, res) => {
+router.post('/by-name/:topic/publish', auth_1.requireBuilder, async (req, res) => {
     // The request body IS the event envelope (Partial<LTEvent> + optional subject).
+    const subject = String(req.body?.subject || decodeURIComponent(String(req.params.topic)));
+    if (RESERVED_SUBJECT_PREFIXES.some((prefix) => subject.startsWith(prefix)) && !(await (0, user_1.isSuperAdmin)(req.auth.userId))) {
+        res.status(403).json({ error: 'Forbidden: only superadmin can publish a system subject' });
+        return;
+    }
     const result = await api.publishTopic({
-        topic: decodeURIComponent(req.params.topic),
+        topic: decodeURIComponent(String(req.params.topic)),
         event: (req.body ?? {}),
     });
     res.status(result.status).json(result.data ?? { error: result.error });

package/build/routes/users.js

@@ -33,11 +33,19 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
+const capabilities_1 = require("../modules/capabilities");
 const api = __importStar(require("../api/users"));
 const personasApi = __importStar(require("../api/personas"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** Answer a refused decision with 403; true when the request may go on. */
+function allowed(decision, res) {
+    if (decision.allowed)
+        return true;
+    res.status(403).json({ error: decision.error });
+    return false;
+}
 // ── User CRUD ─────────────────────────────────────────────────────────────────
 /**
  * GET /api/users
@@ -88,6 +96,8 @@ router.get('/:id', async (req, res) => {
  * Body: { external_id, email?, display_name?, roles?: [{ role, type }], metadata? }
  */
 router.post('/', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayGrantRoles)(req.auth.userId, (req.body || {}).roles), res))
+        return;
     const result = await api.createUser(req.body || {});
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -97,6 +107,8 @@ router.post('/', auth_1.requireBuilder, async (req, res) => {
  * Body: { email?, display_name?, status?, metadata? }
  */
 router.put('/:id', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.updateUser({ id: req.params.id, ...(req.body || {}) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -107,6 +119,8 @@ router.put('/:id', auth_1.requireBuilder, async (req, res) => {
  * Body: { set?: { key: value }, remove?: [key], rename?: { old: new } }
  */
 router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const { set, remove, rename } = req.body || {};
     const result = await api.patchUserProperties({
         id: req.params.id,
@@ -121,6 +135,8 @@ router.patch('/:id/properties', auth_1.requireBuilder, async (req, res) => {
  * Delete a user. Builder only.
  */
 router.delete('/:id', auth_1.requireBuilder, async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.deleteUser({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -148,26 +164,10 @@ router.get('/:id/roles', async (req, res) => {
  */
 router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
     const { role, type, read_scope, write_scope } = req.body || {};
-    const userId = req.auth.userId;
-    // Superadmin bypasses all scoping
-    const { isSuperAdmin } = await Promise.resolve().then(() => __importStar(require('../services/user/rbac')));
-    if (!(await isSuperAdmin(userId))) {
-        // Non-superadmin can never assign superadmin type
-        if (type === 'superadmin') {
-            res.status(403).json({ error: 'Only superadmin can assign superadmin role type' });
-            return;
-        }
-        // Check if caller has the engineer role (builder) — can assign any non-superadmin role
-        const { hasRole: checkRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
-        const isEngineer = await checkRole(userId, 'engineer');
-        if (!isEngineer) {
-            // Non-builder admin: can only assign roles they themselves hold
-            const callerHasRole = await checkRole(userId, role);
-            if (!callerHasRole) {
-                res.status(403).json({ error: `You can only assign roles you hold. You do not have the '${role}' role.` });
-                return;
-            }
-        }
+    const decision = await (0, capabilities_1.mayGrantRole)(req.auth.userId, { role, type });
+    if (!decision.allowed) {
+        res.status(403).json({ error: decision.error });
+        return;
     }
     const result = await api.addUserRole({ id: req.params.id, role, type, read_scope, write_scope });
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -177,6 +177,9 @@ router.post('/:id/roles', auth_1.requireAdmin, async (req, res) => {
  * Remove a role from a user.
  */
 router.delete('/:id/roles/:role', auth_1.requireAdmin, async (req, res) => {
+    const decision = await (0, capabilities_1.mayRevokeRole)(req.auth.userId, String(req.params.id), String(req.params.role));
+    if (!allowed(decision, res))
+        return;
     const result = await api.removeUserRole({ id: req.params.id, role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/workflow-sets.js

@@ -33,14 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/workflow-sets"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/workflow-sets
  * Create a workflow set from a specification and start the planner workflow.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { name, description, specification } = req.body;
     const result = await api.createWorkflowSet({ name, description, specification }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -63,17 +64,17 @@ router.get('/', async (req, res) => {
  * Get a single workflow set with its plan and workflow statuses.
  */
 router.get('/:id', async (req, res) => {
-    const result = await api.getWorkflowSet({ id: req.params.id });
+    const result = await api.getWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/workflow-sets/:id/plan
  * Update the plan (engineer adjustments before building).
  */
-router.put('/:id/plan', async (req, res) => {
+router.put('/:id/plan', auth_1.requireBuilder, async (req, res) => {
     const { plan, namespaces } = req.body;
     const result = await api.updateWorkflowSetPlanApi({
-        id: req.params.id,
+        id: String(req.params.id),
         plan,
         namespaces,
     });
@@ -83,25 +84,25 @@ router.put('/:id/plan', async (req, res) => {
  * POST /api/workflow-sets/:id/add
  * Add additional workflows to an existing set from a new specification.
  */
-router.post('/:id/add', async (req, res) => {
+router.post('/:id/add', auth_1.requireBuilder, async (req, res) => {
     const { specification } = req.body;
-    const result = await api.addToWorkflowSet({ id: req.params.id, specification }, req.auth ? { userId: req.auth.userId } : undefined);
+    const result = await api.addToWorkflowSet({ id: String(req.params.id), specification }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/workflow-sets/:id/build
  * Trigger the build phase (resume the planner workflow).
  */
-router.post('/:id/build', async (req, res) => {
-    const result = await api.buildWorkflowSet({ id: req.params.id });
+router.post('/:id/build', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.buildWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * POST /api/workflow-sets/:id/deploy
  * Deploy all namespaces in the set.
  */
-router.post('/:id/deploy', async (req, res) => {
-    const result = await api.deployWorkflowSet({ id: req.params.id });
+router.post('/:id/deploy', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deployWorkflowSet({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;