@inkeep/agents-api 0.0.0-dev-20260219033751 → 0.0.0-dev-20260219045007

package/dist/domains/manage/routes/apiKeys.js

@@ -1,21 +1,15 @@
 import runDbClient_default from "../../../data/db/runDbClient.js";
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import { speakeasyOffsetLimitPagination } from "../../../utils/speakeasy.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { ApiKeyApiCreationResponseSchema, ApiKeyApiInsertSchema, ApiKeyApiUpdateSchema, ApiKeyListResponse, ApiKeyResponse, ErrorResponseSchema, PaginationQueryParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, commonGetErrorResponses, createApiError, createApiKey, deleteApiKey, generateApiKey, getApiKeyById, listApiKeysPaginated, updateApiKey } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/apiKeys.ts
 const app = new OpenAPIHono();
-app.use("/", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("use")(c, next);
-	return next();
-});
-app.use("/:id", async (c, next) => {
-	if (c.req.method === "PUT" || c.req.method === "DELETE") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
+	permission: requireProjectPermission("view"),
 	path: "/",
 	summary: "List API Keys",
 	description: "List all API keys for a tenant with optional pagination",
@@ -55,13 +49,14 @@ app.openapi(createRoute({
 		pagination: result.pagination
 	});
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{id}",
 	summary: "Get API Key",
 	description: "Get a specific API key by ID (does not return the actual key)",
 	operationId: "get-api-key-by-id",
 	tags: ["API Keys"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		200: {
@@ -90,13 +85,14 @@ app.openapi(createRoute({
 		expiresAt: sanitizedApiKey.expiresAt ?? null
 	} });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Create API Key",
 	description: "Create a new API key for an agent. Returns the full key (shown only once).",
 	operationId: "create-api-key",
 	tags: ["API Keys"],
+	permission: requireProjectPermission("use"),
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: ApiKeyApiInsertSchema } } }
@@ -138,13 +134,14 @@ app.openapi(createRoute({
 		throw error;
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{id}",
 	summary: "Update API Key",
 	description: "Update an API key (currently only expiration date can be changed)",
 	operationId: "update-api-key",
 	tags: ["API Keys"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectIdParamsSchema,
 		body: { content: { "application/json": { schema: ApiKeyApiUpdateSchema } } }
@@ -181,13 +178,14 @@ app.openapi(createRoute({
 		expiresAt: sanitizedApiKey.expiresAt ?? null
 	} });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{id}",
 	summary: "Delete API Key",
 	description: "Delete an API key permanently",
 	operationId: "delete-api-key",
 	tags: ["API Keys"],
+	permission: requireProjectPermission("edit"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		204: { description: "API key deleted successfully" },

package/dist/domains/manage/routes/artifactComponents.js

@@ -1,25 +1,18 @@
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import { speakeasyOffsetLimitPagination } from "../../../utils/speakeasy.js";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { ArtifactComponentApiInsertSchema, ArtifactComponentApiUpdateSchema, ArtifactComponentListResponse, ArtifactComponentResponse, ErrorResponseSchema, PaginationQueryParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, commonGetErrorResponses, createApiError, createArtifactComponent, deleteArtifactComponent, generateId, getArtifactComponentById, listArtifactComponentsPaginated, updateArtifactComponent, validatePropsAsJsonSchema } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/artifactComponents.ts
 const app = new OpenAPIHono();
-app.use("/", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.use("/:id", async (c, next) => {
-	if (c.req.method === "PATCH" || c.req.method === "PUT") return requireProjectPermission("edit")(c, next);
-	if (c.req.method === "DELETE") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Artifact Components",
 	operationId: "list-artifact-components",
 	tags: ["Artifact Components"],
+	permission: requireProjectPermission("view"),
 	request: {
 		params: TenantProjectParamsSchema,
 		query: PaginationQueryParamsSchema
@@ -49,12 +42,13 @@ app.openapi(createRoute({
 	});
 	return c.json(result);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{id}",
 	summary: "Get Artifact Component",
 	operationId: "get-artifact-component-by-id",
 	tags: ["Artifact Components"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		200: {
@@ -79,12 +73,13 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: artifactComponent });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Create Artifact Component",
 	operationId: "create-artifact-component",
 	tags: ["Artifact Components"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: ArtifactComponentApiInsertSchema } } }
@@ -128,12 +123,13 @@ app.openapi(createRoute({
 		throw error;
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{id}",
 	summary: "Update Artifact Component",
 	operationId: "update-artifact-component",
 	tags: ["Artifact Components"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectIdParamsSchema,
 		body: { content: { "application/json": { schema: ArtifactComponentApiUpdateSchema } } }
@@ -175,12 +171,13 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: updatedArtifactComponent });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{id}",
 	summary: "Delete Artifact Component",
 	operationId: "delete-artifact-component",
 	tags: ["Artifact Components"],
+	permission: requireProjectPermission("edit"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		204: { description: "Artifact component deleted successfully" },

package/dist/domains/manage/routes/availableAgents.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono11 from "hono";
+import * as hono16 from "hono";
 
 //#region src/domains/manage/routes/availableAgents.d.ts
-declare const app: OpenAPIHono<hono11.Env, {}, "/">;
+declare const app: OpenAPIHono<hono16.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/availableAgents.js

@@ -1,8 +1,9 @@
 import { getLogger as getLogger$1 } from "../../../logger.js";
 import { env } from "../../../env.js";
 import manageDbClient_default from "../../../data/db/manageDbClient.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { createApiError, listAgentsAcrossProjectMainBranches, listUsableProjectIds, verifyTempToken } from "@inkeep/agents-core";
+import { createProtectedRoute, inheritedAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/availableAgents.ts
 const logger = getLogger$1("availableAgents");
@@ -39,7 +40,7 @@ const AvailableAgentSchema = z.object({
 	projectId: z.string()
 });
 const AvailableAgentsResponseSchema = z.object({ data: z.array(AvailableAgentSchema) });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List available agents",
@@ -47,6 +48,7 @@ app.openapi(createRoute({
 	tags: ["Agents"],
 	description: "List all agents the user can invoke. Requires a valid JWT token.",
 	security: [{ bearerAuth: [] }],
+	permission: inheritedAuth({ description: "Requires a valid JWT token (temp-jwt or work-app user token). Auth and SpiceDB authorization are enforced in the handler." }),
 	responses: {
 		200: {
 			description: "List of available agents",

package/dist/domains/manage/routes/branches.js

@@ -1,25 +1,19 @@
 import runDbClient_default from "../../../data/db/runDbClient.js";
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { BranchListResponseSchema, BranchNameParamsSchema, BranchResponseSchema, CreateBranchRequestSchema, ErrorResponseSchema, TenantProjectAgentParamsSchema, TenantProjectParamsSchema, cascadeDeleteByBranch, commonGetErrorResponses, createApiError, createBranch, deleteBranch, getBranch, listBranches, listBranchesForAgent } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/branches.ts
 const app = new OpenAPIHono();
-app.use("/", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.use("/:branchName", async (c, next) => {
-	if (c.req.method === "DELETE") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Branches",
 	description: "List all branches within a project",
 	operationId: "list-branches",
 	tags: ["Branches"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {
@@ -37,13 +31,14 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: branches });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{branchName}",
 	summary: "Get Branch",
 	description: "Get a single branch by name",
 	operationId: "get-branch",
 	tags: ["Branches"],
+	permission: requireProjectPermission("view"),
 	request: { params: BranchNameParamsSchema },
 	responses: {
 		200: {
@@ -66,13 +61,14 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: branch });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/agents/{agentId}",
 	summary: "List Branches for Agent",
 	description: "List all branches within a project that contain the agent",
 	operationId: "list-branches-for-agent",
 	tags: ["Branches"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectAgentParamsSchema },
 	responses: {
 		200: {
@@ -91,13 +87,14 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: branches });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Create Branch",
 	description: "Create a new branch",
 	operationId: "create-branch",
 	tags: ["Branches"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: CreateBranchRequestSchema } } }
@@ -138,13 +135,14 @@ app.openapi(createRoute({
 		throw error;
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{branchName}",
 	summary: "Delete Branch",
 	description: "Delete a branch. Cannot delete protected branches like main.",
 	operationId: "delete-branch",
 	tags: ["Branches"],
+	permission: requireProjectPermission("edit"),
 	request: { params: BranchNameParamsSchema },
 	responses: {
 		204: { description: "Branch deleted successfully" },

package/dist/domains/manage/routes/cliAuth.js

@@ -1,7 +1,8 @@
 import runDbClient_default from "../../../data/db/runDbClient.js";
 import { sessionAuth } from "../../../middleware/sessionAuth.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { getUserOrganizationsFromDb } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/cliAuth.ts
 const cliAuthRoutes = new OpenAPIHono();
@@ -18,13 +19,13 @@ const CLIMeResponseSchema = z.object({
 		role: z.string()
 	})
 });
-cliAuthRoutes.openapi(createRoute({
+cliAuthRoutes.openapi(createProtectedRoute({
 	method: "get",
 	path: "/me",
 	tags: ["CLI"],
 	summary: "Get CLI user info",
 	description: "Get the current authenticated user and their organization for CLI usage",
-	middleware: [sessionAuth()],
+	permission: sessionAuth(),
 	responses: {
 		200: {
 			description: "User info with organization",

package/dist/domains/manage/routes/contextConfigs.js

@@ -1,26 +1,19 @@
 import runDbClient_default from "../../../data/db/runDbClient.js";
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import { speakeasyOffsetLimitPagination } from "../../../utils/speakeasy.js";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { ContextConfigApiInsertSchema, ContextConfigApiUpdateSchema, ContextConfigListResponse, ContextConfigResponse, PaginationQueryParamsSchema, TenantProjectAgentIdParamsSchema, TenantProjectAgentParamsSchema, cascadeDeleteByContextConfig, commonDeleteErrorResponses, commonGetErrorResponses, commonUpdateErrorResponses, createApiError, createContextConfig, deleteContextConfig, getContextConfigById, listContextConfigsPaginated, updateContextConfig } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/contextConfigs.ts
 const app = new OpenAPIHono();
-app.use("/", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.use("/:id", async (c, next) => {
-	if (c.req.method === "PUT") return requireProjectPermission("edit")(c, next);
-	if (c.req.method === "DELETE") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Context Configurations",
 	operationId: "list-context-configs",
 	tags: ["Context Configs"],
+	permission: requireProjectPermission("view"),
 	request: {
 		params: TenantProjectAgentParamsSchema,
 		query: PaginationQueryParamsSchema
@@ -51,12 +44,13 @@ app.openapi(createRoute({
 	});
 	return c.json(result);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{id}",
 	summary: "Get Context Configuration",
 	operationId: "get-context-config-by-id",
 	tags: ["Context Configs"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectAgentIdParamsSchema },
 	responses: {
 		200: {
@@ -82,12 +76,13 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: contextConfig });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Create Context Configuration",
 	operationId: "create-context-config",
 	tags: ["Context Configs"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectAgentParamsSchema,
 		body: { content: { "application/json": { schema: ContextConfigApiInsertSchema } } }
@@ -111,12 +106,13 @@ app.openapi(createRoute({
 	const contextConfig = await createContextConfig(db)(configData);
 	return c.json({ data: contextConfig }, 201);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{id}",
 	summary: "Update Context Configuration",
 	operationId: "update-context-config",
 	tags: ["Context Configs"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectAgentIdParamsSchema,
 		body: { content: { "application/json": { schema: ContextConfigApiUpdateSchema } } }
@@ -147,12 +143,13 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: updatedContextConfig });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{id}",
 	summary: "Delete Context Configuration",
 	operationId: "delete-context-config",
 	tags: ["Context Configs"],
+	permission: requireProjectPermission("edit"),
 	request: { params: TenantProjectAgentIdParamsSchema },
 	responses: {
 		204: { description: "Context configuration deleted successfully" },

package/dist/domains/manage/routes/conversations.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono4 from "hono";
+import * as hono17 from "hono";
 
 //#region src/domains/manage/routes/conversations.d.ts
-declare const app: OpenAPIHono<hono4.Env, {}, "/">;
+declare const app: OpenAPIHono<hono17.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/conversations.js

@@ -1,6 +1,8 @@
 import runDbClient_default from "../../../data/db/runDbClient.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { requireProjectPermission } from "../../../middleware/projectAccess.js";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { TenantProjectIdParamsSchema, commonGetErrorResponses, createApiError, formatMessagesForLLMContext, getConversationHistory } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/conversations.ts
 const app = new OpenAPIHono();
@@ -12,12 +14,13 @@ const ConversationWithFormattedMessagesResponse = z.object({ data: z.object({
 	messages: z.array(z.any()),
 	formatted: z.object({ llmContext: z.string() })
 }) }).openapi("ConversationWithFormattedMessagesResponse");
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{id}",
 	summary: "Get Conversation",
 	operationId: "get-conversation",
 	tags: ["Conversations"],
+	permission: requireProjectPermission("view"),
 	request: {
 		params: TenantProjectIdParamsSchema,
 		query: ConversationQueryParamsSchema

package/dist/domains/manage/routes/credentialStores.js

@@ -1,19 +1,17 @@
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { CreateCredentialInStoreRequestSchema, CreateCredentialInStoreResponseSchema, CredentialStoreListResponseSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, commonGetErrorResponses, createApiError } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/credentialStores.ts
 const app = new OpenAPIHono();
-app.use("/:id/credentials", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Credential Stores",
 	operationId: "list-credential-stores",
 	tags: ["Credential Stores"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {
@@ -35,12 +33,13 @@ app.openapi(createRoute({
 	}));
 	return c.json({ data: storeStatuses });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/{id}/credentials",
 	summary: "Create Credential in Store",
 	operationId: "create-credential-in-store",
 	tags: ["Credential Stores"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectIdParamsSchema,
 		body: { content: { "application/json": { schema: CreateCredentialInStoreRequestSchema } } }
@@ -53,7 +52,7 @@ app.openapi(createRoute({
 		...commonGetErrorResponses
 	}
 }), async (c) => {
-	const { id: storeId } = c.req.param();
+	const { id: storeId } = c.req.valid("param");
 	const { key, value, metadata } = await c.req.json();
 	const store = c.get("credentialStores").get(storeId);
 	if (!store) throw createApiError({

package/dist/domains/manage/routes/credentials.js

@@ -1,24 +1,18 @@
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import { speakeasyOffsetLimitPagination } from "../../../utils/speakeasy.js";
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { CredentialReferenceApiInsertSchema, CredentialReferenceApiSelectSchema, CredentialReferenceApiUpdateSchema, CredentialReferenceListResponse, CredentialReferenceResponse, ErrorResponseSchema, ListResponseSchema, PaginationQueryParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, commonGetErrorResponses, createApiError, createCredentialReference, deleteCredentialReference, getCredentialReferenceById, getCredentialReferenceWithResources, getCredentialStoreLookupKeyFromRetrievalParams, listCredentialReferencesPaginated, updateCredentialReference } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/credentials.ts
 const app = new OpenAPIHono();
-app.use("/", async (c, next) => {
-	if (c.req.method === "POST") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.use("/:id", async (c, next) => {
-	if (c.req.method === "PATCH" || c.req.method === "DELETE" || c.req.method === "PUT") return requireProjectPermission("edit")(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Credentials",
 	operationId: "list-credentials",
 	tags: ["Credentials"],
+	permission: requireProjectPermission("view"),
 	request: {
 		params: TenantProjectParamsSchema,
 		query: PaginationQueryParamsSchema
@@ -49,12 +43,13 @@ app.openapi(createRoute({
 	const validatedResult = ListResponseSchema(CredentialReferenceApiSelectSchema).parse(result);
 	return c.json(validatedResult);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/{id}",
 	summary: "Get Credential",
 	operationId: "get-credential-by-id",
 	tags: ["Credentials"],
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		200: {
@@ -79,12 +74,13 @@ app.openapi(createRoute({
 	const validatedCredential = CredentialReferenceApiSelectSchema.parse(credential);
 	return c.json({ data: validatedCredential });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Create Credential",
 	operationId: "create-credential",
 	tags: ["Credentials"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: CredentialReferenceApiInsertSchema } } }
@@ -108,12 +104,13 @@ app.openapi(createRoute({
 	const validatedCredential = CredentialReferenceApiSelectSchema.parse(credential);
 	return c.json({ data: validatedCredential }, 201);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/{id}",
 	summary: "Update Credential",
 	operationId: "update-credential",
 	tags: ["Credentials"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectIdParamsSchema,
 		body: { content: { "application/json": { schema: CredentialReferenceApiUpdateSchema } } }
@@ -144,12 +141,13 @@ app.openapi(createRoute({
 	const validatedCredential = CredentialReferenceApiSelectSchema.parse(updatedCredential);
 	return c.json({ data: validatedCredential });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{id}",
 	summary: "Delete Credential",
 	operationId: "delete-credential",
 	tags: ["Credentials"],
+	permission: requireProjectPermission("edit"),
 	request: { params: TenantProjectIdParamsSchema },
 	responses: {
 		204: { description: "Credential deleted successfully" },