@inkeep/agents-api 0.0.0-dev-20260219033751 → 0.0.0-dev-20260219045007

package/dist/domains/manage/routes/github.js

@@ -1,8 +1,9 @@
 import { getLogger as getLogger$1 } from "../../../logger.js";
 import runDbClient_default from "../../../data/db/runDbClient.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { TenantParamsSchema, WorkAppGitHubRepositorySelectSchema, WorkAppGithubInstallationApiSelectSchema, commonCreateErrorResponses, commonDeleteErrorResponses, commonGetErrorResponses, createApiError, deleteInstallation, disconnectInstallation, getInstallationById, getInstallationsByTenantId, getRepositoriesByInstallationId, getRepositoryCountsByTenantId, syncRepositories, updateInstallationStatus } from "@inkeep/agents-core";
 import { createAppJwt, fetchInstallationRepositories, getGitHubAppName, getStateSigningSecret, isGitHubAppNameConfigured, isStateSigningConfigured } from "@inkeep/agents-work-apps/github";
+import { createProtectedRoute, inheritedManageTenantAuth } from "@inkeep/agents-core/middleware";
 import { HTTPException } from "hono/http-exception";
 import { SignJWT } from "jose";
 
@@ -24,13 +25,14 @@ async function signStateToken(tenantId) {
 		typ: "JWT"
 	}).setIssuer(STATE_JWT_ISSUER).setAudience(STATE_JWT_AUDIENCE).setIssuedAt().setExpirationTime("10m").sign(secretKey);
 }
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/install-url",
 	summary: "Get GitHub App installation URL",
 	operationId: "get-github-install-url",
 	tags: ["GitHub"],
 	description: "Generates a URL to install the GitHub App on an organization or user account. The URL includes a signed state parameter that encodes the tenant ID and expires after 10 minutes. After installation, GitHub will redirect back to our callback endpoint with this state.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema },
 	responses: {
 		200: {
@@ -65,13 +67,14 @@ app.openapi(createRoute({
 const InstallationWithRepoCountSchema = WorkAppGithubInstallationApiSelectSchema.extend({ repositoryCount: z.number().describe("Number of repositories accessible to this installation") });
 const ListInstallationsResponseSchema = z.object({ installations: z.array(InstallationWithRepoCountSchema).describe("List of GitHub App installations") });
 const ListInstallationsQuerySchema = z.object({ includeDisconnected: z.string().optional().transform((val) => val === "true").describe("Include disconnected installations in the response") });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/installations",
 	summary: "List GitHub App installations",
 	operationId: "list-github-installations",
 	tags: ["GitHub"],
 	description: "Returns a list of GitHub App installations connected to this tenant. By default, deleted installations are filtered out. Use the includeDisconnected query parameter to include them.",
+	permission: inheritedManageTenantAuth(),
 	request: {
 		params: TenantParamsSchema,
 		query: ListInstallationsQuerySchema
@@ -119,13 +122,14 @@ const InstallationDetailResponseSchema = z.object({
 	installation: WorkAppGithubInstallationApiSelectSchema.describe("Installation details"),
 	repositories: z.array(WorkAppGitHubRepositorySelectSchema).describe("List of repositories")
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/installations/{installationId}",
 	summary: "Get GitHub App installation details",
 	operationId: "get-github-installation-details",
 	tags: ["GitHub"],
 	description: "Returns detailed information about a specific GitHub App installation, including the full list of repositories.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema.merge(InstallationIdParamSchema) },
 	responses: {
 		200: {
@@ -174,13 +178,14 @@ app.openapi(createRoute({
 	}, 200);
 });
 const DisconnectInstallationResponseSchema = z.object({ success: z.literal(true).describe("Whether the disconnection was successful") });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/installations/{installationId}/disconnect",
 	summary: "Disconnect a GitHub App installation",
 	operationId: "disconnect-github-installation",
 	tags: ["GitHub"],
 	description: "Disconnects a GitHub App installation from the tenant. This soft deletes the installation (sets status to \"disconnected\") and removes all project repository access entries. The installation record is preserved for audit purposes. Note: This does NOT uninstall the GitHub App from GitHub - the user can do that separately from GitHub settings.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema.merge(InstallationIdParamSchema) },
 	responses: {
 		200: {
@@ -281,13 +286,14 @@ const serviceUnavailableSchema = {
 		})
 	}) } }
 };
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/installations/{installationId}/reconnect",
 	summary: "Reconnect a disconnected GitHub App installation",
 	operationId: "reconnect-github-installation",
 	tags: ["GitHub"],
 	description: "Reconnects a previously disconnected GitHub App installation by setting its status back to \"active\" and syncing the available repositories from GitHub. This can only be used on installations with \"disconnected\" status.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema.merge(InstallationIdParamSchema) },
 	responses: {
 		200: {
@@ -386,13 +392,14 @@ app.openapi(createRoute({
 		}
 	}, 200);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/installations/{installationId}",
 	summary: "Delete a GitHub App installation permanently",
 	operationId: "delete-github-installation",
 	tags: ["GitHub"],
 	description: "Permanently deletes a GitHub App installation from the tenant. This hard deletes the installation record, all associated repositories, and project repository access entries. This action cannot be undone. Use POST /disconnect for soft delete instead. Note: This does NOT uninstall the GitHub App from GitHub - the user can do that separately from GitHub settings.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema.merge(InstallationIdParamSchema) },
 	responses: {
 		200: {
@@ -428,13 +435,14 @@ const SyncRepositoriesResponseSchema = z.object({
 		updated: z.number().describe("Number of repositories updated")
 	})
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/installations/{installationId}/sync",
 	summary: "Sync repositories for a GitHub App installation",
 	operationId: "sync-github-installation-repositories",
 	tags: ["GitHub"],
 	description: "Manually refreshes the repository list for a GitHub App installation by fetching the current list from GitHub API. This is useful if webhooks were missed or to ensure the local data is in sync with GitHub.",
+	permission: inheritedManageTenantAuth(),
 	request: { params: TenantParamsSchema.merge(InstallationIdParamSchema) },
 	responses: {
 		200: {

package/dist/domains/manage/routes/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono16 from "hono";
+import * as hono18 from "hono";
 
 //#region src/domains/manage/routes/index.d.ts
-declare const app: OpenAPIHono<hono16.Env, {}, "/">;
+declare const app: OpenAPIHono<hono18.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/index.js

@@ -1,4 +1,3 @@
-import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import agent_default from "./agent.js";
 import agentFull_default from "./agentFull.js";
 import apiKeys_default from "./apiKeys.js";
@@ -32,13 +31,11 @@ import subAgentToolRelations_default from "./subAgentToolRelations.js";
 import thirdPartyMCPServers_default from "./thirdPartyMCPServers.js";
 import tools_default from "./tools.js";
 import triggers_default from "./triggers.js";
-import userProjectMemberships_default from "./userProjectMemberships.js";
 import { OpenAPIHono } from "@hono/zod-openapi";
 
 //#region src/domains/manage/routes/index.ts
 const app = new OpenAPIHono();
 app.route("/projects", projects_default);
-app.use("/projects/:projectId/*", requireProjectPermission("view"));
 app.route("/projects/:projectId/branches", branches_default);
 app.route("/projects/:projectId/refs", ref_default);
 app.route("/projects/:projectId/members", projectMembers_default);
@@ -71,7 +68,6 @@ app.route("/projects/:projectId/third-party-mcp-servers", thirdPartyMCPServers_d
 app.route("/projects/:projectId/agents/:agentId/triggers", triggers_default);
 app.route("/projects/:projectId/agents/:agentId/scheduled-triggers", scheduledTriggers_default);
 app.route("/projects/:projectId/evals", evals_default);
-app.route("/users/:userId/project-memberships", userProjectMemberships_default);
 var routes_default = app;
 
 //#endregion

package/dist/domains/manage/routes/invitations.d.ts

@@ -1,10 +1,10 @@
 import { ManageAppVariables } from "../../../types/app.js";
 import { Hono } from "hono";
-import * as hono_types6 from "hono/types";
+import * as hono_types8 from "hono/types";
 
 //#region src/domains/manage/routes/invitations.d.ts
 declare const invitationsRoutes: Hono<{
   Variables: ManageAppVariables;
-}, hono_types6.BlankSchema, "/">;
+}, hono_types8.BlankSchema, "/">;
 //#endregion
 export { invitationsRoutes as default };

package/dist/domains/manage/routes/mcpCatalog.js

@@ -1,5 +1,7 @@
-import { OpenAPIHono, createRoute } from "@hono/zod-openapi";
+import { requireProjectPermission } from "../../../middleware/projectAccess.js";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import { MCPCatalogListResponse, MCPTransportType, TenantProjectParamsSchema, commonGetErrorResponses, fetchComposioServers } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/mcpCatalog.ts
 const app = new OpenAPIHono();
@@ -424,13 +426,14 @@ const PREBUILT_MCP_SERVERS = [
 		description: "AI-powered content creation"
 	}
 ];
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List MCP Server Catalog",
 	operationId: "list-mcp-catalog",
 	tags: ["MCP Catalog"],
 	description: "Get a list of available prebuilt MCP servers. If COMPOSIO_API_KEY is configured, also includes Composio servers for the tenant/project.",
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {

package/dist/domains/manage/routes/mcpToolGithubAccess.js

@@ -1,8 +1,9 @@
 import { getLogger as getLogger$1 } from "../../../logger.js";
 import runDbClient_default from "../../../data/db/runDbClient.js";
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { TenantProjectParamsSchema, WorkAppGitHubAccessModeSchema, WorkAppGitHubAccessSetRequestSchema, WorkAppGitHubAccessSetResponseSchema, WorkAppGitHubRepositorySelectSchema, commonGetErrorResponses, commonUpdateErrorResponses, createApiError, getMcpToolAccessMode, getMcpToolRepositoryAccessWithDetails, getToolById, setMcpToolAccessMode, setMcpToolRepositoryAccess, validateRepositoryOwnership } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/mcpToolGithubAccess.ts
 const logger = getLogger$1("mcp-tool-github-access");
@@ -39,14 +40,14 @@ async function validateGitHubWorkappTool(db, tenantId, projectId, toolId) {
 		message: "GitHub access can only be configured for GitHub MCP tools"
 	});
 }
-app.use("/", requireProjectPermission("edit"));
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "Get MCP tool GitHub repository access",
 	operationId: "get-mcp-tool-github-access",
 	tags: ["Tools"],
 	description: "Returns the current GitHub repository access configuration for an MCP tool. If mode is \"all\", the tool has access to all repositories the project can access. If mode is \"selected\", the tool is scoped to specific repositories. ",
+	permission: requireProjectPermission("edit"),
 	request: { params: TenantProjectToolParamsSchema },
 	responses: {
 		200: {
@@ -97,13 +98,14 @@ app.openapi(createRoute({
 		}))
 	}, 200);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/",
 	summary: "Set MCP tool GitHub repository access",
 	operationId: "set-mcp-tool-github-access",
 	tags: ["Tools"],
 	description: "Configures which GitHub repositories an MCP tool can access. When mode is \"all\", the tool has access to all repositories the project can access. When mode is \"selected\", the tool is scoped to specific repositories (repositoryIds required). This replaces any existing access configuration. This endpoint only works for GitHub workapp MCP tools (isWorkApp=true and URL contains /github).",
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectToolParamsSchema,
 		body: { content: { "application/json": { schema: SetGitHubAccessRequestSchema } } }

package/dist/domains/manage/routes/oauth.js

@@ -2,8 +2,9 @@ import { getLogger as getLogger$1 } from "../../../logger.js";
 import manageDbClient_default from "../../../data/db/manageDbClient.js";
 import manageDbPool_default from "../../../data/db/manageDbPool.js";
 import { oauthService, retrievePKCEVerifier } from "../../../utils/oauthService.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
-import { CredentialReferenceApiSelectSchema, CredentialStoreType, OAuthCallbackQuerySchema, OAuthLoginQuerySchema, createCredentialReference, generateId, getCredentialReferenceWithResources, getProjectMainResolvedRef, getToolById, updateTool, withRef } from "@inkeep/agents-core";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
+import { CredentialReferenceApiSelectSchema, CredentialStoreType, OAuthCallbackQuerySchema, createCredentialReference, generateId, getCredentialReferenceWithResources, getProjectMainResolvedRef, getToolById, updateTool, withRef } from "@inkeep/agents-core";
+import { createProtectedRoute, noAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/oauth.ts
 /**
@@ -124,75 +125,14 @@ function generateOAuthCallbackPage(params) {
     </html>
   `;
 }
-app.openapi(createRoute({
-	method: "get",
-	path: "/login",
-	summary: "Initiate OAuth login for MCP tool",
-	description: "Detects OAuth requirements and redirects to authorization server (public endpoint)",
-	operationId: "initiate-oauth-login-public",
-	tags: ["OAuth"],
-	request: { query: OAuthLoginQuerySchema },
-	responses: {
-		302: { description: "Redirect to OAuth authorization server" },
-		400: {
-			description: "OAuth not supported or configuration error",
-			content: { "text/html": { schema: z.string() } }
-		},
-		404: {
-			description: "Tool not found",
-			content: { "text/html": { schema: z.string() } }
-		},
-		500: {
-			description: "Internal server error",
-			content: { "text/html": { schema: z.string() } }
-		}
-	}
-}), async (c) => {
-	const { tenantId, projectId, toolId } = c.req.valid("query");
-	const db = c.get("db");
-	try {
-		const tool = await getToolById(db)({
-			scopes: {
-				tenantId,
-				projectId
-			},
-			toolId
-		});
-		if (!tool) {
-			logger.error({
-				toolId,
-				tenantId,
-				projectId
-			}, "Tool not found for OAuth login");
-			return c.text("Tool not found", 404);
-		}
-		const baseUrl = getBaseUrlFromRequest(c);
-		const { redirectUrl } = await oauthService.initiateOAuthFlow({
-			tenantId,
-			projectId,
-			toolId,
-			mcpServerUrl: tool.config.mcp.server.url,
-			baseUrl
-		});
-		return c.redirect(redirectUrl, 302);
-	} catch (error) {
-		logger.error({
-			toolId,
-			tenantId,
-			projectId,
-			error
-		}, "OAuth login failed");
-		const errorMessage = error instanceof Error ? error.message : "Failed to initiate OAuth login";
-		return c.text(`OAuth Error: ${errorMessage}`, 500);
-	}
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/callback",
 	summary: "MCP OAuth authorization callback",
-	description: "Handles OAuth authorization codes for MCP tools and completes the authentication flow",
+	description: "Handles OAuth authorization codes for MCP tools and completes the authentication flow. Secured via PKCE state parameter (not HTTP authentication) since this is an external redirect from an OAuth provider.",
 	operationId: "mcp-oauth-callback",
 	tags: ["OAuth"],
+	permission: noAuth(),
 	request: { query: OAuthCallbackQuerySchema },
 	responses: {
 		302: { description: "Redirect to frontend after successful OAuth" },

package/dist/domains/manage/routes/passwordResetLinks.d.ts

@@ -1,10 +1,10 @@
 import { ManageAppVariables } from "../../../types/app.js";
 import { Hono } from "hono";
-import * as hono_types12 from "hono/types";
+import * as hono_types5 from "hono/types";
 
 //#region src/domains/manage/routes/passwordResetLinks.d.ts
 declare const passwordResetLinksRoutes: Hono<{
   Variables: ManageAppVariables;
-}, hono_types12.BlankSchema, "/">;
+}, hono_types5.BlankSchema, "/">;
 //#endregion
 export { passwordResetLinksRoutes as default };

package/dist/domains/manage/routes/playgroundToken.js

@@ -1,7 +1,8 @@
 import { getLogger as getLogger$1 } from "../../../logger.js";
 import { env } from "../../../env.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { ErrorResponseSchema, TenantParamsSchema, canUseProject, createApiError, getAgentById, projectExists, signTempToken } from "@inkeep/agents-core";
+import { createProtectedRoute, inheritedManageTenantAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/playgroundToken.ts
 const logger = getLogger$1("playgroundToken");
@@ -14,7 +15,7 @@ const PlaygroundTokenResponseSchema = z.object({
 	apiKey: z.string().describe("Temporary API key for playground use"),
 	expiresAt: z.string().describe("ISO 8601 timestamp when the key expires")
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Generate temporary API key for playground",
@@ -22,6 +23,7 @@ app.openapi(createRoute({
 	tags: ["API Keys"],
 	description: "Generates a short-lived API key (1 hour expiry) for authenticated users to access the run-api from the playground",
 	security: [{ cookieAuth: [] }],
+	permission: inheritedManageTenantAuth(),
 	request: {
 		params: TenantParamsSchema,
 		body: { content: { "application/json": { schema: PlaygroundTokenRequestSchema } } }

package/dist/domains/manage/routes/projectFull.js

@@ -4,24 +4,13 @@ import runDbClient_default from "../../../data/db/runDbClient.js";
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
 import { onTriggerCreated, onTriggerDeleted, onTriggerUpdated } from "../../run/services/ScheduledTriggerService.js";
 import { requirePermission } from "../../../middleware/requirePermission.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { ErrorResponseSchema, FullProjectDefinitionSchema, FullProjectSelectResponse, FullProjectSelectWithRelationIdsResponse, TenantParamsSchema, TenantProjectParamsSchema, cascadeDeleteByProject, checkoutBranch, commonGetErrorResponses, createApiError, createFullProjectServerSide, createProjectMetadataAndBranch, deleteFullProject, deleteProjectWithBranch, doltCheckout, getFullProject, getFullProjectWithRelationIds, getProjectMainBranchName, getProjectMetadata, listScheduledTriggers, removeProjectFromSpiceDb, syncProjectToSpiceDb, updateFullProjectServerSide } from "@inkeep/agents-core";
+import { createProtectedRoute, registerAuthzMeta } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/projectFull.ts
 const logger = getLogger$1("projectFull");
 const app = new OpenAPIHono();
-app.use("/project-full", async (c, next) => {
-	if (c.req.method === "POST") return requirePermission({ project: ["create"] })(c, next);
-	return next();
-});
-app.use("/project-full/:projectId", async (c, next) => {
-	if (c.req.method === "GET") return requireProjectPermission("view")(c, next);
-	return next();
-});
-app.use("/project-full/:projectId/with-relation-ids", async (c, next) => {
-	if (c.req.method === "GET") return requireProjectPermission("view")(c, next);
-	return next();
-});
 const requireProjectUpsertPermission = async (c, next) => {
 	const tenantId = c.get("tenantId");
 	const projectId = c.req.param("projectId");
@@ -36,13 +25,15 @@ const requireProjectUpsertPermission = async (c, next) => {
 	c.set("isProjectCreate", !exists);
 	return exists ? requireProjectPermission("edit")(c, next) : requirePermission({ project: ["create"] })(c, next);
 };
-app.openapi(createRoute({
+registerAuthzMeta(requireProjectUpsertPermission, { description: "Dynamic: requires organization admin for new projects, or project edit permission for existing projects." });
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/project-full",
 	summary: "Create Full Project",
 	operationId: "create-full-project",
 	tags: ["Projects"],
 	description: "Create a complete project with all Agents, Sub Agents, tools, and relationships from JSON definition",
+	permission: requirePermission({ project: ["create"] }),
 	request: {
 		params: TenantParamsSchema,
 		body: { content: { "application/json": { schema: FullProjectDefinitionSchema } } }
@@ -130,13 +121,14 @@ app.openapi(createRoute({
 		throw error;
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/project-full/{projectId}",
 	summary: "Get Full Project",
 	operationId: "get-full-project",
 	tags: ["Projects"],
 	description: "Retrieve a complete project definition with all Agents, Sub Agents, tools, and relationships",
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {
@@ -169,13 +161,14 @@ app.openapi(createRoute({
 		});
 	}
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/project-full/{projectId}/with-relation-ids",
 	summary: "Get Full Project with Relation IDs",
 	operationId: "get-full-project-with-relation-ids",
 	tags: ["Projects"],
 	description: "Retrieve a complete project definition with all Agents, Sub Agents, tools, and relationships",
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {
@@ -208,17 +201,14 @@ app.openapi(createRoute({
 		});
 	}
 });
-app.use("/project-full/:projectId", async (c, next) => {
-	if (c.req.method === "PUT") return requireProjectUpsertPermission(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/project-full/{projectId}",
 	summary: "Update Full Project",
 	operationId: "update-full-project",
 	tags: ["Projects"],
 	description: "Update or create a complete project with all Agents, Sub Agents, tools, and relationships from JSON definition",
+	permission: requireProjectUpsertPermission,
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: FullProjectDefinitionSchema } } }
@@ -416,17 +406,14 @@ app.openapi(createRoute({
 		});
 	}
 });
-app.use("/project-full/:projectId", async (c, next) => {
-	if (c.req.method === "DELETE") return requirePermission({ project: ["delete"] })(c, next);
-	return next();
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/project-full/{projectId}",
 	summary: "Delete Full Project",
 	operationId: "delete-full-project",
 	tags: ["Projects"],
 	description: "Delete a complete project and cascade to all related entities (Agents, Sub Agents, tools, relationships)",
+	permission: requirePermission({ project: ["delete"] }),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		204: { description: "Project deleted successfully" },

package/dist/domains/manage/routes/projectGithubAccess.js

@@ -1,7 +1,9 @@
 import { getLogger as getLogger$1 } from "../../../logger.js";
 import runDbClient_default from "../../../data/db/runDbClient.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { requireProjectPermission } from "../../../middleware/projectAccess.js";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { TenantProjectParamsSchema, WorkAppGitHubAccessGetResponseSchema, WorkAppGitHubAccessModeSchema, WorkAppGitHubAccessSetRequestSchema, WorkAppGitHubAccessSetResponseSchema, commonGetErrorResponses, commonUpdateErrorResponses, createApiError, getProjectAccessMode, getProjectRepositoryAccessWithDetails, setProjectAccessMode, setProjectRepositoryAccess, validateRepositoryOwnership } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/projectGithubAccess.ts
 const logger = getLogger$1("project-github-access");
@@ -13,13 +15,14 @@ const SetGitHubAccessResponseSchema = WorkAppGitHubAccessSetResponseSchema.exten
 	mode: ProjectGitHubAccessModeSchema,
 	repositoryCount: z.number().describe("Number of repositories the project now has access to (0 when mode=\"all\")")
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "Get project GitHub repository access",
 	operationId: "get-project-github-access",
 	tags: ["Projects"],
 	description: "Returns the current GitHub repository access configuration for a project. If mode is \"all\", the project has access to all repositories from tenant GitHub installations. If mode is \"selected\", the project is scoped to specific repositories.",
+	permission: requireProjectPermission("view"),
 	request: { params: TenantProjectParamsSchema },
 	responses: {
 		200: {
@@ -70,13 +73,14 @@ app.openapi(createRoute({
 		}))
 	}, 200);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "put",
 	path: "/",
 	summary: "Set project GitHub repository access",
 	operationId: "set-project-github-access",
 	tags: ["Projects"],
 	description: "Configures which GitHub repositories a project can access. When mode is \"all\", the project has access to all repositories from tenant GitHub installations. When mode is \"selected\", the project is scoped to specific repositories (repositoryIds required). This replaces any existing access configuration.",
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: TenantProjectParamsSchema,
 		body: { content: { "application/json": { schema: SetGitHubAccessRequestSchema } } }

package/dist/domains/manage/routes/projectMembers.js

@@ -1,6 +1,7 @@
 import { requireProjectPermission } from "../../../middleware/projectAccess.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { ProjectRoles, changeProjectRole, commonGetErrorResponses, createApiError, grantProjectAccess, listProjectMembers, revokeProjectAccess } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/projectMembers.ts
 const app = new OpenAPIHono();
@@ -31,13 +32,14 @@ const UpdateRoleSchema = z.object({
 	role: projectRoleEnum,
 	previousRole: projectRoleEnum.optional()
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "List Project Members",
-	description: "List all users with explicit project access. Requires authz to be enabled.",
+	description: "List all users with explicit project access.",
 	operationId: "list-project-members",
 	tags: ["Project Members"],
+	permission: requireProjectPermission("view"),
 	request: { params: ProjectMemberParamsSchema },
 	responses: {
 		200: {
@@ -57,17 +59,14 @@ app.openapi(createRoute({
 	});
 	return c.json({ data: members });
 });
-app.use("/*", async (c, next) => {
-	if (c.req.method === "GET") return next();
-	return requireProjectPermission("edit")(c, next);
-});
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "post",
 	path: "/",
 	summary: "Add Project Member",
-	description: "Add a user to a project with a specified role. Requires authz to be enabled.",
+	description: "Add a user to a project with a specified role.",
 	operationId: "add-project-member",
 	tags: ["Project Members"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: ProjectMemberParamsSchema,
 		body: { content: { "application/json": { schema: ProjectMemberSchema } } }
@@ -94,13 +93,14 @@ app.openapi(createRoute({
 		projectId
 	} }, 201);
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "patch",
 	path: "/{userId}",
 	summary: "Update Project Member Role",
-	description: "Update a project member's role. Requires authz to be enabled. Include previousRole to specify which role to revoke.",
+	description: "Update a project member's role. Include previousRole to specify which role to revoke.",
 	operationId: "update-project-member",
 	tags: ["Project Members"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: ProjectMemberUserParamsSchema,
 		body: { content: { "application/json": { schema: UpdateRoleSchema } } }
@@ -137,13 +137,14 @@ app.openapi(createRoute({
 		projectId
 	} });
 });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "delete",
 	path: "/{userId}",
 	summary: "Remove Project Member",
-	description: "Remove a user from a project. Requires authz to be enabled. Pass role as query param to specify which role to revoke.",
+	description: "Remove a user from a project. Pass role as query param to specify which role to revoke.",
 	operationId: "remove-project-member",
 	tags: ["Project Members"],
+	permission: requireProjectPermission("edit"),
 	request: {
 		params: ProjectMemberUserParamsSchema,
 		query: z.object({ role: projectRoleEnum })

package/dist/domains/manage/routes/projectPermissions.js

@@ -1,5 +1,7 @@
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { requireProjectPermission } from "../../../middleware/projectAccess.js";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
 import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes, checkBulkPermissions, commonGetErrorResponses, createApiError } from "@inkeep/agents-core";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
 
 //#region src/domains/manage/routes/projectPermissions.ts
 const app = new OpenAPIHono();
@@ -12,13 +14,14 @@ const ProjectPermissionsResponseSchema = z.object({ data: z.object({
 	canUse: z.boolean(),
 	canEdit: z.boolean()
 }) });
-app.openapi(createRoute({
+app.openapi(createProtectedRoute({
 	method: "get",
 	path: "/",
 	summary: "Get Project Permissions",
 	description: "Get the current user's permissions for a project. Returns which actions the user can perform.",
 	operationId: "get-project-permissions",
 	tags: ["Project Permissions"],
+	permission: requireProjectPermission("view"),
 	request: { params: ProjectPermissionsParamsSchema },
 	responses: {
 		200: {