@k2b/cloud 0.43.0 → 0.45.0

package/src/ai/projects-authorization.ts

@@ -0,0 +1,53 @@
+import type { AccessSubject, RequestActor } from "../server";
+import { hasPermission, type PermissionLevel } from "../server/services/access";
+
+/** Resource operations retain the actor's credential alongside the grant subject. */
+export type AiResourceContext = { actor: RequestActor; accessSubject: AccessSubject };
+
+export const aiResourceAccessSubject = (subject: AiResourceContext | null): AccessSubject | null => subject?.accessSubject ?? null;
+
+/** Projects and Skills have no supported resource-bound credential contract. */
+export const aiResourcePermissionCap = (subject: AiResourceContext | null): PermissionLevel => {
+  if (!subject?.actor || !subject.accessSubject) return "none";
+  const { actor, accessSubject } = subject;
+  if (actor.kind === "user") {
+    return accessSubject.type === "user" && accessSubject.userId === actor.user.id ? "admin" : "none";
+  }
+  if (actor.serviceAccount.kind === "resource_bound") return "none";
+  if (actor.delegatedUser) {
+    return actor.serviceAccount.kind === "user_delegated" &&
+      accessSubject.type === "user" &&
+      accessSubject.userId === actor.delegatedUser.id
+      ? "admin"
+      : "none";
+  }
+  if (
+    (actor.serviceAccount.kind !== "standalone" && actor.serviceAccount.kind !== "agent") ||
+    accessSubject.type !== "service_account" ||
+    accessSubject.serviceAccountId !== actor.serviceAccount.id
+  )
+    return "none";
+  return actor.scopes.includes("admin")
+    ? "admin"
+    : actor.scopes.includes("write")
+      ? "write"
+      : actor.scopes.includes("read")
+        ? "read"
+        : "none";
+};
+
+export const capAiResourcePermission = (granted: PermissionLevel, subject: AiResourceContext | null): PermissionLevel => {
+  const cap = aiResourcePermissionCap(subject);
+  return hasPermission(granted, cap) ? cap : granted;
+};
+
+export class AiResourceCredentialError extends Error {
+  constructor() {
+    super("The credential does not permit creating Projects or Skills.");
+    this.name = "AiResourceCredentialError";
+  }
+}
+
+export const requireAiResourceCreation = (subject: AiResourceContext): void => {
+  if (!hasPermission(aiResourcePermissionCap(subject), "write")) throw new AiResourceCredentialError();
+};

package/src/ai/projects-routes.ts

@@ -1,4 +1,5 @@
-import { Hono, type MiddlewareHandler } from "hono";
+import { type Context, Hono, type MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { getCapability } from "../_internal/registry";
 import { CloudResourceRefSchema, cloudResourceRefAppId, resolveCapabilityResourceReader } from "../contracts/capabilities";
@@ -6,6 +7,7 @@ import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, getLocale, ok, rateLimit, respond, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { ImageMetadataError } from "../services/image-metadata";
+import { AiModelRequestSchema } from "../shared/ai-models";
 import { aiChatMessages } from "./chat/messages";
 import { decodeAiFileContent } from "./files-store";
 import {
@@ -21,16 +23,23 @@ import {
   type AiProjectReference,
   aiProjects,
 } from "./projects";
+import { AiResourceCredentialError } from "./projects-authorization";
 
 const ProjectFieldsSchema = z.object({
   name: z.string().trim().min(1).max(AI_PROJECT_NAME_MAX_CHARS),
   description: z.string().trim().max(AI_PROJECT_DESCRIPTION_MAX_CHARS).default(""),
   icon: z.string().trim().min(1).max(80).default("ti ti-folders"),
   instructions: z.string().trim().max(AI_PROJECT_INSTRUCTIONS_MAX_CHARS).default(""),
-  defaultModelProfileId: z.string().trim().min(1).max(120).nullable().optional(),
+  defaultModel: AiModelRequestSchema.nullable().optional(),
 });
 
-const UpdateProjectSchema = ProjectFieldsSchema.partial().refine((input) => Object.keys(input).length > 0, "No changes supplied.");
+const UpdateProjectSchema = ProjectFieldsSchema.extend({
+  description: ProjectFieldsSchema.shape.description.removeDefault(),
+  icon: ProjectFieldsSchema.shape.icon.removeDefault(),
+  instructions: ProjectFieldsSchema.shape.instructions.removeDefault(),
+})
+  .partial()
+  .refine((input) => Object.keys(input).length > 0, "No changes supplied.");
 const ProjectAccessSchema = z.object({ principal: AuthenticatedPrincipalSchema, permission: z.enum(["read", "write", "admin"]) });
 const ProjectAccessUpdateSchema = z.object({ permission: z.enum(["read", "write", "admin"]) });
 const KnowledgeSchema = z.object({
@@ -64,6 +73,11 @@ const publicReference = (reference: AiProjectReference, projectId: string): AiPr
   projectId,
 });
 
+const resourceSubject = (c: Context<AuthContext>) => ({
+  actor: c.get("actor"),
+  accessSubject: c.get("accessSubject"),
+});
+
 type AiProjectsRouteDependencies = {
   limit?: MiddlewareHandler<AuthContext>;
   authenticate?: MiddlewareHandler<AuthContext>;
@@ -72,56 +86,54 @@ type AiProjectsRouteDependencies = {
 
 const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =>
   new Hono<AuthContext>()
+    .onError((error, c) => {
+      if (error instanceof AiResourceCredentialError) return respond(c, fail(err.forbidden(error.message)));
+      if (error instanceof HTTPException) return error.getResponse();
+      throw error;
+    })
     // The list combines projects from separate grants; the writer of one can rename it next to another project's instructions.
     .use("*", noTransform())
     .use(dependencies.limit ?? rateLimit())
     .use("*", dependencies.authenticate ?? auth.requireRole("authenticated"))
-    .get("/", async (c) => respond(c, ok({ projects: (await aiProjects.list(c.get("accessSubject") ?? null)).map(publicProject) })))
+    .get("/", async (c) => respond(c, ok({ projects: (await aiProjects.list(resourceSubject(c))).map(publicProject) })))
     .post("/", dependencies.authenticate ?? auth.requireRole("authenticated"), v("json", ProjectFieldsSchema), async (c) =>
       respond(
         c,
         ok({
-          project: publicProject(await aiProjects.create({ subject: c.get("accessSubject"), ...c.req.valid("json") })),
+          project: publicProject(await aiProjects.create({ subject: resourceSubject(c), ...c.req.valid("json") })),
         }),
         201,
       ),
     )
     .get("/:projectId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       return project ? respond(c, ok({ project: publicProject(project) })) : notFound(c);
     })
     .patch("/:projectId", v("json", UpdateProjectSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
       if (!project) return notFound(c);
-      const updated = await aiProjects.update(project.id, c.get("accessSubject") ?? null, c.req.valid("json"));
+      const updated = await aiProjects.update(project.id, resourceSubject(c), c.req.valid("json"));
       return updated ? respond(c, ok({ project: publicProject(updated) })) : notFound(c);
     })
     .delete("/:projectId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      return project && (await aiProjects.delete(project.id, c.get("accessSubject") ?? null))
-        ? respond(c, ok({ deleted: true }))
-        : notFound(c);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      return project && (await aiProjects.delete(project.id, resourceSubject(c))) ? respond(c, ok({ deleted: true })) : notFound(c);
     })
     .get("/:projectId/access", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      const access = project ? await aiProjects.listAccess(project.id, c.get("accessSubject") ?? null) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      const access = project ? await aiProjects.listAccess(project.id, resourceSubject(c)) : null;
       return access ? respond(c, ok({ access })) : notFound(c);
     })
     .post("/:projectId/access", v("json", ProjectAccessSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      const access = project ? await aiProjects.grantAccess(project.id, c.get("accessSubject") ?? null, c.req.valid("json")) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      const access = project ? await aiProjects.grantAccess(project.id, resourceSubject(c), c.req.valid("json")) : null;
       return access ? respond(c, ok({ access }), 201) : notFound(c);
     })
     .patch("/:projectId/access/:accessId", v("json", ProjectAccessUpdateSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
       try {
         return project &&
-          (await aiProjects.updateAccess(
-            project.id,
-            c.req.param("accessId")!,
-            c.get("accessSubject") ?? null,
-            c.req.valid("json").permission,
-          ))
+          (await aiProjects.updateAccess(project.id, c.req.param("accessId")!, resourceSubject(c), c.req.valid("json").permission))
           ? respond(c, ok({ updated: true }))
           : notFound(c, "Access entry");
       } catch (error) {
@@ -130,9 +142,9 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .delete("/:projectId/access/:accessId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
       try {
-        return project && (await aiProjects.revokeAccess(project.id, c.req.param("accessId")!, c.get("accessSubject") ?? null))
+        return project && (await aiProjects.revokeAccess(project.id, c.req.param("accessId")!, resourceSubject(c)))
           ? respond(c, ok({ deleted: true }))
           : notFound(c, "Access entry");
       } catch (error) {
@@ -141,51 +153,50 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .get("/:projectId/knowledge", v("query", KnowledgeQuerySchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          knowledge: (await aiProjects.listKnowledge(project.id, c.get("accessSubject") ?? null, c.req.valid("query").q)).map((item) =>
+          knowledge: (await aiProjects.listKnowledge(project.id, resourceSubject(c), c.req.valid("query").q)).map((item) =>
             publicKnowledge(item, project.shortId),
           ),
         }),
       );
     })
     .post("/:projectId/knowledge", v("json", KnowledgeSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      const knowledge = project ? await aiProjects.createKnowledge(project.id, c.get("accessSubject") ?? null, c.req.valid("json")) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      const knowledge = project ? await aiProjects.createKnowledge(project.id, resourceSubject(c), c.req.valid("json")) : null;
       return knowledge ? respond(c, ok({ knowledge: publicKnowledge(knowledge, project!.shortId) }), 201) : notFound(c);
     })
     .patch("/:projectId/knowledge/:knowledgeId", v("json", UpdateKnowledgeSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
       const knowledge =
-        project &&
-        (await aiProjects.updateKnowledge(project.id, c.req.param("knowledgeId")!, c.get("accessSubject") ?? null, c.req.valid("json")));
+        project && (await aiProjects.updateKnowledge(project.id, c.req.param("knowledgeId")!, resourceSubject(c), c.req.valid("json")));
       return knowledge ? respond(c, ok({ knowledge: publicKnowledge(knowledge, project!.shortId) })) : notFound(c, "Knowledge entry");
     })
     .delete("/:projectId/knowledge/:knowledgeId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteKnowledge(project.id, c.req.param("knowledgeId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteKnowledge(project.id, c.req.param("knowledgeId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Knowledge entry");
     })
     .get("/:projectId/files", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          files: (await aiProjects.listFiles(project.id, c.get("accessSubject") ?? null)).map((file) => publicFile(file, project.shortId)),
+          files: (await aiProjects.listFiles(project.id, resourceSubject(c))).map((file) => publicFile(file, project.shortId)),
         }),
       );
     })
     .post("/:projectId/files", v("json", ProjectFileSchema), async (c) => {
       const body = c.req.valid("json");
       try {
-        const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+        const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
         const file = project
-          ? await aiProjects.writeFile(project.id, c.get("accessSubject") ?? null, {
+          ? await aiProjects.writeFile(project.id, resourceSubject(c), {
               path: body.path,
               mediaType: body.mediaType,
               bytes: decodeAiFileContent(body.content, body.encoding),
@@ -199,8 +210,8 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .get("/:projectId/files/:fileId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
-      const file = project ? await aiProjects.readFile(project.id, c.req.param("fileId")!, c.get("accessSubject") ?? null) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
+      const file = project ? await aiProjects.readFile(project.id, c.req.param("fileId")!, resourceSubject(c)) : null;
       if (!file) return notFound(c, "Project file");
       return respond(
         c,
@@ -212,18 +223,18 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       );
     })
     .delete("/:projectId/files/:fileId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteFile(project.id, c.req.param("fileId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteFile(project.id, c.req.param("fileId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Project file");
     })
     .get("/:projectId/references", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          references: (await aiProjects.listReferences(project.id, c.get("accessSubject") ?? null)).map((reference) =>
+          references: (await aiProjects.listReferences(project.id, resourceSubject(c))).map((reference) =>
             publicReference(reference, project.shortId),
           ),
         }),
@@ -231,7 +242,7 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
     })
     .post("/:projectId/references", v("json", ReferenceSchema), async (c) => {
       const body = c.req.valid("json");
-      const subject = c.get("accessSubject") ?? null;
+      const subject = resourceSubject(c);
       const project = await aiProjects.getByShortId(c.req.param("projectId")!, subject, "write");
       if (!project) return notFound(c);
       let entry: Awaited<ReturnType<typeof getCapability>>;
@@ -247,8 +258,8 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       return reference ? respond(c, ok({ reference: publicReference(reference, project.shortId) }), 201) : notFound(c);
     })
     .delete("/:projectId/references/:referenceId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteReference(project.id, c.req.param("referenceId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteReference(project.id, c.req.param("referenceId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Project reference");
     });