@k2b/cloud 0.44.0 → 0.45.0

package/src/ai/routes.ts

@@ -8,7 +8,6 @@ import { ErrorResponseSchema } from "../contracts";
 import { APPROVAL_CLIENT_HEADER } from "../contracts/approvals";
 import { capabilityActionPolicy } from "../contracts/capabilities";
 import {
-  type AccessSubject,
   type AuthContext,
   auth,
   err,
@@ -80,6 +79,7 @@ import {
 } from "./message-queue";
 import { aiActorUser, aiPrefsUserId, aiUserPrefs } from "./prefs";
 import { aiProjects } from "./projects";
+import type { AiResourceContext } from "./projects-authorization";
 import { projectPublicAiStoredMessages, publicAiStoredMessages } from "./public-projection";
 import { AiRecentResourceSchema, listAiRecentResources } from "./recent-resources";
 import { RECENT_SENT_REF_LIMIT } from "./recent-sent-refs";
@@ -224,6 +224,8 @@ const MemoryCreateSchema = z.object({
 const MemoryUpdateSchema = MemoryCreateSchema.partial().refine((value) => Object.keys(value).length > 0, "Pass a changed field.");
 const MemoryIdSchema = z.string().regex(AI_SHORT_ID_PATTERN);
 
+const resourceContext = (c: Context<AuthContext>): AiResourceContext => ({ actor: c.get("actor"), accessSubject: c.get("accessSubject") });
+
 const notFound = (c: Context<AuthContext>) => respond(c, fail(err.notFound("Conversation")));
 const fileNotFound = (c: Context<AuthContext>) => respond(c, fail(err.notFound("File")));
 
@@ -232,14 +234,14 @@ const publicConversation = (conversation: AiConversation, projectId: string | nu
   id: conversation.shortId,
   projectId: conversation.projectId ? projectId : null,
 });
-const publicConversations = async (conversations: AiConversation[], subject: AccessSubject) => {
+const publicConversations = async (conversations: AiConversation[], subject: AiResourceContext) => {
   const projectIds = conversations.flatMap((conversation) => (conversation.projectId ? [conversation.projectId] : []));
   const shortIds = await aiProjects.resolveShortIds(projectIds, subject);
   return conversations.map((conversation) =>
     publicConversation(conversation, conversation.projectId ? (shortIds.get(conversation.projectId) ?? null) : null),
   );
 };
-const publicConversationFor = async (conversation: AiConversation, subject: AccessSubject) =>
+const publicConversationFor = async (conversation: AiConversation, subject: AiResourceContext) =>
   (await publicConversations([conversation], subject))[0]!;
 const publicMemories = async (userId: string, memories: Awaited<ReturnType<typeof aiMemories.list>>) => {
   const sourceIds = memories.flatMap((memory) => (memory.sourceConversationId ? [memory.sourceConversationId] : []));
@@ -260,7 +262,7 @@ const rememberLastUsedModel = (actor: RequestActor, model: import("../shared/ai-
   void aiUserPrefs.update(userId, { selection: model }).catch(() => undefined);
 };
 
-const conversationDetail = async (conversation: AiConversation, subject: AccessSubject) => {
+const conversationDetail = async (conversation: AiConversation, subject: AiResourceContext) => {
   const [state, timeline, publicView] = await Promise.all([
     loadAiStreamState(conversation),
     aiConversations.listConversationTimeline({ conversationId: conversation.id }),
@@ -297,7 +299,7 @@ const prepareConversationForMessageRetry = async (conversationId: string): Promi
 
 const prepareLaunchDraft = async (
   body: z.infer<typeof AiCreateConversationInputSchema>,
-  subject: AccessSubject | null,
+  subject: AiResourceContext | null,
   authority: import("../server").RequestAuthority | null = null,
 ) => {
   const content = [...(body.draft?.content ?? [])];
@@ -446,7 +448,7 @@ export const aiRoutes = (() => {
         }
         const toolsSupported = Boolean(previewProfile?.capabilities.includes("tools"));
         const availableSkills = toolsSupported
-          ? (await aiSkills.list(c.get("accessSubject"), { authority: appAccessAuthority(c) })).filter((skill) => skill.enabled)
+          ? (await aiSkills.list(resourceContext(c), { authority: appAccessAuthority(c) })).filter((skill) => skill.enabled)
           : [];
         const skillCatalog = selectAiSkillCatalog(
           availableSkills.filter((skill) => !skill.manualOnly).map(({ name, description }) => ({ name, description })),
@@ -461,8 +463,8 @@ export const aiRoutes = (() => {
               })),
               ...(client?.localTools === "ask" ? [createCloudAiLocalBashTool(), ...createCloudAiLocalTools()] : []),
               ...(memoryEnabled ? [createCloudAiMemoryTool()] : []),
-              ...(availableSkills.length ? [createCloudAiLoadSkillTool(c.get("accessSubject"), appAccessAuthority(c))] : []),
-              ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(c.get("accessSubject"), [], appAccessAuthority(c))] : []),
+              ...(availableSkills.length ? [createCloudAiLoadSkillTool(resourceContext(c), appAccessAuthority(c))] : []),
+              ...(skillCatalog.omitted > 0 ? [createCloudAiSearchSkillsTool(resourceContext(c), [], appAccessAuthority(c))] : []),
             ]
           : [];
         const memoryToolEnabled = tools.some((tool) => tool.def.name === "memory");
@@ -545,7 +547,7 @@ export const aiRoutes = (() => {
         const ctx = await resolveContext(c);
         if (ctx instanceof Response) return ctx;
         const query = c.req.valid("query");
-        const project = query.projectId ? await aiProjects.getByShortId(query.projectId, c.get("accessSubject"), "read") : null;
+        const project = query.projectId ? await aiProjects.getByShortId(query.projectId, resourceContext(c), "read") : null;
         if (query.projectId && !project) return respond(c, fail(err.notFound("Project")));
         return respond(
           c,
@@ -561,7 +563,7 @@ export const aiRoutes = (() => {
                 unassigned: query.unassigned,
                 limit: query.limit,
               }),
-              c.get("accessSubject"),
+              resourceContext(c),
             ),
           ),
         );
@@ -570,7 +572,7 @@ export const aiRoutes = (() => {
         const ctx = await resolveContext(c);
         if (ctx instanceof Response) return ctx;
         const query = c.req.valid("query");
-        const project = query.projectId ? await aiProjects.getByShortId(query.projectId, c.get("accessSubject"), "read") : null;
+        const project = query.projectId ? await aiProjects.getByShortId(query.projectId, resourceContext(c), "read") : null;
         if (query.projectId && !project) return respond(c, fail(err.notFound("Project")));
         const page = await aiConversations.listConversationsPage({
           ownerUserId: ctx.ownerUserId,
@@ -583,15 +585,15 @@ export const aiRoutes = (() => {
           page: query.page ?? 1,
           perPage: query.perPage ?? 20,
         });
-        return respond(c, ok({ ...page, items: await publicConversations(page.items, c.get("accessSubject")) }));
+        return respond(c, ok({ ...page, items: await publicConversations(page.items, resourceContext(c)) }));
       })
       .post("/conversations", v("json", AiCreateConversationInputSchema), async (c) => {
         const ctx = await resolveContext(c);
         if (ctx instanceof Response) return ctx;
         const body = c.req.valid("json");
-        const project = body.projectId ? await aiProjects.getByShortId(body.projectId, c.get("accessSubject"), "read") : null;
+        const project = body.projectId ? await aiProjects.getByShortId(body.projectId, resourceContext(c), "read") : null;
         if (body.projectId && !project) return respond(c, fail(err.notFound("Project")));
-        const draft = await prepareLaunchDraft(body, c.get("accessSubject"), appAccessAuthority(c));
+        const draft = await prepareLaunchDraft(body, resourceContext(c), appAccessAuthority(c));
         if (!draft.ok) return respond(c, draft);
         const requestedCapabilityTools = (body.preloadTools ?? []).filter(
           (requested): requested is { appId: string; kind: "query" | "action"; id: string } => "appId" in requested,
@@ -642,9 +644,7 @@ export const aiRoutes = (() => {
             launchedByAppId: body.launchedByAppId,
           });
           // A replay may return a conversation assigned to a Project since creation.
-          const currentProject = conversation.projectId
-            ? await aiProjects.get(conversation.projectId, c.get("accessSubject"), "read")
-            : null;
+          const currentProject = conversation.projectId ? await aiProjects.get(conversation.projectId, resourceContext(c), "read") : null;
           if (conversation.projectId && !currentProject) return respond(c, fail(err.notFound("Project")));
           return respond(c, ok(publicConversation(conversation, currentProject?.shortId ?? null)), 201);
         } catch (error) {
@@ -659,7 +659,7 @@ export const aiRoutes = (() => {
         if (ctx instanceof Response) return ctx;
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
-        return respond(c, ok(await conversationDetail(conversation, c.get("accessSubject"))));
+        return respond(c, ok(await conversationDetail(conversation, resourceContext(c))));
       })
       .get(
         "/conversations/:conversationId/submission/:draftRevision",
@@ -669,7 +669,7 @@ export const aiRoutes = (() => {
           if (ctx instanceof Response) return ctx;
           const conversation = await loadConversation(c, ctx);
           if (!conversation) return notFound(c);
-          if (conversation.projectId && !(await aiProjects.get(conversation.projectId, c.get("accessSubject"), "read"))) return notFound(c);
+          if (conversation.projectId && !(await aiProjects.get(conversation.projectId, resourceContext(c), "read"))) return notFound(c);
           const submission = await aiConversations.getDraftSubmission({
             conversationId: conversation.id,
             ownerUserId: ctx.ownerUserId,
@@ -797,7 +797,7 @@ export const aiRoutes = (() => {
           pinned: body.pinned,
         });
         if (!updated) return notFound(c);
-        return respond(c, ok(await publicConversationFor(updated, c.get("accessSubject"))));
+        return respond(c, ok(await publicConversationFor(updated, resourceContext(c))));
       })
       .put("/conversations/:conversationId/project", v("json", ConversationProjectInputSchema), async (c) => {
         const ctx = await resolveContext(c);
@@ -805,7 +805,7 @@ export const aiRoutes = (() => {
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
         const body = c.req.valid("json");
-        const project = body.projectId ? await aiProjects.getByShortId(body.projectId, c.get("accessSubject"), "read") : null;
+        const project = body.projectId ? await aiProjects.getByShortId(body.projectId, resourceContext(c), "read") : null;
         if (body.projectId && !project) return respond(c, fail(err.notFound("Project")));
         const result = await aiConversations.setConversationProject({
           conversationId: conversation.id,
@@ -820,7 +820,7 @@ export const aiRoutes = (() => {
           }
           return notFound(c);
         }
-        return respond(c, ok(await publicConversationFor(result.conversation, c.get("accessSubject"))));
+        return respond(c, ok(await publicConversationFor(result.conversation, resourceContext(c))));
       })
       .post("/conversations/:conversationId/pin", async (c) => {
         const ctx = await resolveContext(c);
@@ -832,7 +832,7 @@ export const aiRoutes = (() => {
           ownerUserId: ctx.ownerUserId,
           pinned: true,
         });
-        return updated ? respond(c, ok(await publicConversationFor(updated, c.get("accessSubject")))) : notFound(c);
+        return updated ? respond(c, ok(await publicConversationFor(updated, resourceContext(c)))) : notFound(c);
       })
       .delete("/conversations/:conversationId/pin", async (c) => {
         const ctx = await resolveContext(c);
@@ -844,7 +844,7 @@ export const aiRoutes = (() => {
           ownerUserId: ctx.ownerUserId,
           pinned: false,
         });
-        return updated ? respond(c, ok(await publicConversationFor(updated, c.get("accessSubject")))) : notFound(c);
+        return updated ? respond(c, ok(await publicConversationFor(updated, resourceContext(c)))) : notFound(c);
       })
       .put("/conversations/:conversationId/done", v("json", z.object({ done: z.boolean().nullable() })), async (c) => {
         const ctx = await resolveContext(c);
@@ -860,7 +860,7 @@ export const aiRoutes = (() => {
           return result.reason === "active_turn"
             ? respond(c, fail(err.conflict("Stop the current response before marking this chat done.")))
             : notFound(c);
-        return respond(c, ok(await publicConversationFor(result.conversation, c.get("accessSubject"))));
+        return respond(c, ok(await publicConversationFor(result.conversation, resourceContext(c))));
       })
       .post("/conversations/:conversationId/archive", async (c) => {
         const ctx = await resolveContext(c);
@@ -910,7 +910,7 @@ export const aiRoutes = (() => {
                 error: error instanceof Error ? error.message : String(error),
               }),
             );
-        return restored ? respond(c, ok(await publicConversationFor(restored, c.get("accessSubject")))) : notFound(c);
+        return restored ? respond(c, ok(await publicConversationFor(restored, resourceContext(c)))) : notFound(c);
       })
       .post("/conversations/:conversationId/viewed", async (c) => {
         const ctx = await resolveContext(c);
@@ -1007,7 +1007,7 @@ export const aiRoutes = (() => {
           };
         });
         const { input, message } = aiInputToUserMessage(aiTurnInputToContent({ content: turnContent }));
-        const project = conversation.projectId ? await aiProjects.snapshot(conversation.projectId, c.get("accessSubject")) : null;
+        const project = conversation.projectId ? await aiProjects.snapshot(conversation.projectId, resourceContext(c)) : null;
         if (conversation.projectId && !project) return respond(c, fail(err.notFound("Project")));
         try {
           const submission = {
@@ -1110,7 +1110,7 @@ export const aiRoutes = (() => {
           ? await aiConversations.getTurnRunConfig({ conversationId: conversation.id, turnId: target.loopId })
           : null;
         const originalProject = originalRunConfig?.kind !== "compact" ? originalRunConfig?.project : undefined;
-        const currentProject = originalProject?.id ? await aiProjects.getByShortId(originalProject.id, c.get("accessSubject")) : null;
+        const currentProject = originalProject?.id ? await aiProjects.getByShortId(originalProject.id, resourceContext(c)) : null;
         if (originalProject && !currentProject) return respond(c, fail(err.notFound("Project")));
 
         try {
@@ -1189,7 +1189,7 @@ export const aiRoutes = (() => {
         }
 
         const body = c.req.valid("json");
-        if (conversation.projectId && !(await aiProjects.get(conversation.projectId, c.get("accessSubject"), "read"))) {
+        if (conversation.projectId && !(await aiProjects.get(conversation.projectId, resourceContext(c), "read"))) {
           return respond(c, fail(err.notFound("Project")));
         }
         const forked = await aiConversations.forkConversation({
@@ -1198,7 +1198,7 @@ export const aiRoutes = (() => {
           ownerUserId: ctx.ownerUserId,
           title: body.title ?? conversation.title,
         });
-        return respond(c, ok(await conversationDetail(forked, c.get("accessSubject"))));
+        return respond(c, ok(await conversationDetail(forked, resourceContext(c))));
       })
       .get("/conversations/:conversationId/enrichment", async (c) => {
         const ctx = await resolveContext(c);

package/src/ai/skill-tool.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import type { AccessSubject } from "../server";
 import type { RequestAuthority } from "../server/middleware/auth";
 import { AI_SKILL_FILE_MOUNT } from "./file-mount";
+import type { AiResourceContext } from "./projects-authorization";
 import { AI_SHORT_ID_PATTERN } from "./short-id";
 import { type AiSkillCatalogEntry, mergeAiSkillCatalog, rankAiSkillCatalog, searchAiSkillCatalog } from "./skill-catalog";
 import { AI_SKILL_NAME_MAX_CHARS, AI_SKILL_NAME_PATTERN } from "./skill-format";
@@ -12,7 +12,7 @@ import { defineAiTool } from "./tools";
 export async function loadSelectedAiSkills(
   ids: readonly string[],
   turnId: string,
-  subject: AccessSubject | null,
+  subject: AiResourceContext | null,
   allowed: boolean,
   authority: RequestAuthority | null = null,
 ) {
@@ -58,7 +58,7 @@ export const CloudAiLoadSkillOutputSchema = z.object({
   files: z.array(z.string()),
 });
 
-export const createCloudAiLoadSkillTool = (subject: AccessSubject, authority: RequestAuthority | null = null) =>
+export const createCloudAiLoadSkillTool = (subject: AiResourceContext, authority: RequestAuthority | null = null) =>
   defineAiTool({
     name: "load_skill",
     description:
@@ -92,7 +92,7 @@ export const CloudAiSearchSkillsOutputSchema = z.object({
 });
 
 export const createCloudAiSearchSkillsTool = (
-  subject: AccessSubject | null,
+  subject: AiResourceContext | null,
   localSkills: readonly AiSkillCatalogEntry[] = [],
   authority: RequestAuthority | null = null,
 ) =>

package/src/ai/skills-routes.ts

@@ -1,4 +1,4 @@
-import { Hono, type MiddlewareHandler } from "hono";
+import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { getApp } from "../_internal/registry";
@@ -10,6 +10,7 @@ import { appAccessAuthority, canUseApp } from "../services/app-access";
 import { recordAppAccessDenied } from "../services/app-access-metrics";
 import { localizedAppName } from "../ssr/runtime";
 import { aiProjects } from "./projects";
+import { AiResourceCredentialError } from "./projects-authorization";
 import {
   AI_SKILL_DESCRIPTION_MAX_CHARS,
   AI_SKILL_EXTRA_FRONTMATTER_MAX_CHARS,
@@ -61,6 +62,11 @@ const publicSkill = (c: RouteContext, skill: AiSkill): AiSkill => ({ ...skill, i
 const isUniqueViolation = (error: unknown): boolean =>
   typeof error === "object" && error !== null && "code" in error && (error as { code?: unknown }).code === "23505";
 
+const resourceSubject = (c: Context<AuthContext>) => ({
+  actor: c.get("actor"),
+  accessSubject: c.get("accessSubject"),
+});
+
 type AiSkillsRouteDependencies = {
   limit?: MiddlewareHandler<AuthContext>;
   authenticate?: MiddlewareHandler<AuthContext>;
@@ -85,6 +91,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
     // The list combines skills from separate grants; the writer of one can rename it next to another skill's text.
     .use("*", noTransform())
     .onError((error, c) => {
+      if (error instanceof AiResourceCredentialError) return respond(c, fail(err.forbidden(error.message)));
       if (error instanceof AiSkillAppForbiddenError) return respond(c, fail(err.forbidden(error.message)));
       if (error instanceof HTTPException) return error.getResponse();
       throw error;
@@ -100,7 +107,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
           .refine(({ q, name }) => q === undefined || name === undefined, "Use either q or name, not both."),
       ),
       async (c) => {
-        const subject = c.get("accessSubject") ?? null;
+        const subject = resourceSubject(c);
         const { q, name } = c.req.valid("query");
         const skills =
           name !== undefined
@@ -112,7 +119,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
       },
     )
     .get("/:skillId", async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "read", appAccessAuthority(c));
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "read", appAccessAuthority(c));
       return skill ? respond(c, ok({ skill: publicSkill(c, skill) })) : respond(c, fail(err.notFound("Skill")));
     })
     .use("*", requireCoreAccess)
@@ -128,7 +135,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
         }),
       ),
       async (c) => {
-        const subject = c.get("accessSubject") ?? null,
+        const subject = resourceSubject(c),
           query = c.req.valid("query");
         const project = await aiProjects.getByShortId(c.req.param("projectId")!, subject, query.available === "true" ? "admin" : "read");
         const result = project
@@ -145,7 +152,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
       },
     )
     .get("/:skillId/projects", async (c) => {
-      const subject = c.get("accessSubject") ?? null;
+      const subject = resourceSubject(c);
       const skill = await aiSkills.getByShortId(c.req.param("skillId")!, subject, "admin", appAccessAuthority(c));
       const projects = skill ? await aiSkills.linkedProjects(skill.id, subject, appAccessAuthority(c)) : null;
       return projects
@@ -153,7 +160,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
         : respond(c, fail(err.notFound("Skill")));
     })
     .put("/:skillId/projects/:projectId", v("json", z.object({ linked: z.boolean() }).strict()), async (c) => {
-      const subject = c.get("accessSubject") ?? null;
+      const subject = resourceSubject(c);
       const [skill, project] = await Promise.all([
         aiSkills.getByShortId(c.req.param("skillId")!, subject, "admin", appAccessAuthority(c)),
         aiProjects.getByShortId(c.req.param("projectId")!, subject, "admin"),
@@ -164,7 +171,7 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
         : respond(c, fail(err.notFound("Skill or Project")));
     })
     .post("/", dependencies.authenticate ?? auth.requireRole("authenticated"), v("json", SkillFieldsSchema), async (c) => {
-      const subject = c.get("accessSubject");
+      const subject = resourceSubject(c);
       if (!subject) return respond(c, fail(err.forbidden("Skills require an authenticated access subject.")));
       try {
         return respond(
@@ -179,10 +186,10 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
       }
     })
     .put("/:skillId", v("json", UpdateSkillSchema), async (c) => {
-      const existing = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "write", appAccessAuthority(c));
+      const existing = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "write", appAccessAuthority(c));
       if (!existing) return respond(c, fail(err.notFound("Skill")));
       try {
-        const skill = await aiSkills.update(existing.id, c.get("accessSubject") ?? null, c.req.valid("json"), appAccessAuthority(c));
+        const skill = await aiSkills.update(existing.id, resourceSubject(c), c.req.valid("json"), appAccessAuthority(c));
         return skill ? respond(c, ok({ skill: publicSkill(c, skill) })) : respond(c, fail(err.notFound("Skill")));
       } catch (error) {
         if (isUniqueViolation(error)) return respond(c, fail(err.conflict("A skill with this name already exists.")));
@@ -192,37 +199,37 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
       }
     })
     .delete("/:skillId", async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "admin", appAccessAuthority(c));
-      return skill && (await aiSkills.delete(skill.id, c.get("accessSubject") ?? null, appAccessAuthority(c)))
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "admin", appAccessAuthority(c));
+      return skill && (await aiSkills.delete(skill.id, resourceSubject(c), appAccessAuthority(c)))
         ? respond(c, ok({ deleted: true }))
         : respond(c, fail(err.notFound("Skill")));
     })
     .put("/:skillId/enabled", dependencies.authenticate ?? auth.requireRole("authenticated"), v("json", SkillEnabledSchema), async (c) => {
-      const subject = c.get("accessSubject") ?? null;
+      const subject = resourceSubject(c);
       const skill = await aiSkills.getByShortId(c.req.param("skillId")!, subject, "read", appAccessAuthority(c));
       const enabled = skill ? await aiSkills.setEnabled(skill.id, subject, c.req.valid("json").enabled, appAccessAuthority(c)) : null;
       return enabled === null ? respond(c, fail(err.notFound("Skill"))) : respond(c, ok({ enabled }));
     })
     .get("/:skillId/access", async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "admin", appAccessAuthority(c));
-      const access = skill ? await aiSkills.listAccess(skill.id, c.get("accessSubject") ?? null, appAccessAuthority(c)) : null;
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "admin", appAccessAuthority(c));
+      const access = skill ? await aiSkills.listAccess(skill.id, resourceSubject(c), appAccessAuthority(c)) : null;
       return access ? respond(c, ok({ access })) : respond(c, fail(err.notFound("Skill")));
     })
     .post("/:skillId/access", v("json", SkillAccessSchema), async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "admin", appAccessAuthority(c));
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "admin", appAccessAuthority(c));
       const access = skill
-        ? await aiSkills.grantAccess(skill.id, c.get("accessSubject") ?? null, c.req.valid("json"), undefined, appAccessAuthority(c))
+        ? await aiSkills.grantAccess(skill.id, resourceSubject(c), c.req.valid("json"), undefined, appAccessAuthority(c))
         : null;
       return access ? respond(c, ok({ access }), 201) : respond(c, fail(err.notFound("Skill")));
     })
     .patch("/:skillId/access/:accessId", v("json", SkillAccessUpdateSchema), async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "admin", appAccessAuthority(c));
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "admin", appAccessAuthority(c));
       try {
         return skill &&
           (await aiSkills.updateAccess(
             skill.id,
             c.req.param("accessId")!,
-            c.get("accessSubject") ?? null,
+            resourceSubject(c),
             c.req.valid("json").permission,
             undefined,
             appAccessAuthority(c),
@@ -235,16 +242,10 @@ const buildAiSkillsRoutes = (dependencies: AiSkillsRouteDependencies = {}) =>
       }
     })
     .delete("/:skillId/access/:accessId", async (c) => {
-      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, c.get("accessSubject") ?? null, "admin", appAccessAuthority(c));
+      const skill = await aiSkills.getByShortId(c.req.param("skillId")!, resourceSubject(c), "admin", appAccessAuthority(c));
       try {
         return skill &&
-          (await aiSkills.revokeAccess(
-            skill.id,
-            c.req.param("accessId")!,
-            c.get("accessSubject") ?? null,
-            undefined,
-            appAccessAuthority(c),
-          ))
+          (await aiSkills.revokeAccess(skill.id, c.req.param("accessId")!, resourceSubject(c), undefined, appAccessAuthority(c)))
           ? respond(c, ok({ deleted: true }))
           : respond(c, fail(err.notFound("Access entry")));
       } catch (error) {