@k2b/cloud 0.44.0 → 0.46.0

package/src/ai/projects-routes.ts

@@ -1,4 +1,5 @@
-import { Hono, type MiddlewareHandler } from "hono";
+import { type Context, Hono, type MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { getCapability } from "../_internal/registry";
 import { CloudResourceRefSchema, cloudResourceRefAppId, resolveCapabilityResourceReader } from "../contracts/capabilities";
@@ -22,6 +23,7 @@ import {
   type AiProjectReference,
   aiProjects,
 } from "./projects";
+import { AiResourceCredentialError } from "./projects-authorization";
 
 const ProjectFieldsSchema = z.object({
   name: z.string().trim().min(1).max(AI_PROJECT_NAME_MAX_CHARS),
@@ -31,7 +33,13 @@ const ProjectFieldsSchema = z.object({
   defaultModel: AiModelRequestSchema.nullable().optional(),
 });
 
-const UpdateProjectSchema = ProjectFieldsSchema.partial().refine((input) => Object.keys(input).length > 0, "No changes supplied.");
+const UpdateProjectSchema = ProjectFieldsSchema.extend({
+  description: ProjectFieldsSchema.shape.description.removeDefault(),
+  icon: ProjectFieldsSchema.shape.icon.removeDefault(),
+  instructions: ProjectFieldsSchema.shape.instructions.removeDefault(),
+})
+  .partial()
+  .refine((input) => Object.keys(input).length > 0, "No changes supplied.");
 const ProjectAccessSchema = z.object({ principal: AuthenticatedPrincipalSchema, permission: z.enum(["read", "write", "admin"]) });
 const ProjectAccessUpdateSchema = z.object({ permission: z.enum(["read", "write", "admin"]) });
 const KnowledgeSchema = z.object({
@@ -65,6 +73,11 @@ const publicReference = (reference: AiProjectReference, projectId: string): AiPr
   projectId,
 });
 
+const resourceSubject = (c: Context<AuthContext>) => ({
+  actor: c.get("actor"),
+  accessSubject: c.get("accessSubject"),
+});
+
 type AiProjectsRouteDependencies = {
   limit?: MiddlewareHandler<AuthContext>;
   authenticate?: MiddlewareHandler<AuthContext>;
@@ -73,56 +86,54 @@ type AiProjectsRouteDependencies = {
 
 const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =>
   new Hono<AuthContext>()
+    .onError((error, c) => {
+      if (error instanceof AiResourceCredentialError) return respond(c, fail(err.forbidden(error.message)));
+      if (error instanceof HTTPException) return error.getResponse();
+      throw error;
+    })
     // The list combines projects from separate grants; the writer of one can rename it next to another project's instructions.
     .use("*", noTransform())
     .use(dependencies.limit ?? rateLimit())
     .use("*", dependencies.authenticate ?? auth.requireRole("authenticated"))
-    .get("/", async (c) => respond(c, ok({ projects: (await aiProjects.list(c.get("accessSubject") ?? null)).map(publicProject) })))
+    .get("/", async (c) => respond(c, ok({ projects: (await aiProjects.list(resourceSubject(c))).map(publicProject) })))
     .post("/", dependencies.authenticate ?? auth.requireRole("authenticated"), v("json", ProjectFieldsSchema), async (c) =>
       respond(
         c,
         ok({
-          project: publicProject(await aiProjects.create({ subject: c.get("accessSubject"), ...c.req.valid("json") })),
+          project: publicProject(await aiProjects.create({ subject: resourceSubject(c), ...c.req.valid("json") })),
         }),
         201,
       ),
     )
     .get("/:projectId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       return project ? respond(c, ok({ project: publicProject(project) })) : notFound(c);
     })
     .patch("/:projectId", v("json", UpdateProjectSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
       if (!project) return notFound(c);
-      const updated = await aiProjects.update(project.id, c.get("accessSubject") ?? null, c.req.valid("json"));
+      const updated = await aiProjects.update(project.id, resourceSubject(c), c.req.valid("json"));
       return updated ? respond(c, ok({ project: publicProject(updated) })) : notFound(c);
     })
     .delete("/:projectId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      return project && (await aiProjects.delete(project.id, c.get("accessSubject") ?? null))
-        ? respond(c, ok({ deleted: true }))
-        : notFound(c);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      return project && (await aiProjects.delete(project.id, resourceSubject(c))) ? respond(c, ok({ deleted: true })) : notFound(c);
     })
     .get("/:projectId/access", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      const access = project ? await aiProjects.listAccess(project.id, c.get("accessSubject") ?? null) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      const access = project ? await aiProjects.listAccess(project.id, resourceSubject(c)) : null;
       return access ? respond(c, ok({ access })) : notFound(c);
     })
     .post("/:projectId/access", v("json", ProjectAccessSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
-      const access = project ? await aiProjects.grantAccess(project.id, c.get("accessSubject") ?? null, c.req.valid("json")) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
+      const access = project ? await aiProjects.grantAccess(project.id, resourceSubject(c), c.req.valid("json")) : null;
       return access ? respond(c, ok({ access }), 201) : notFound(c);
     })
     .patch("/:projectId/access/:accessId", v("json", ProjectAccessUpdateSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
       try {
         return project &&
-          (await aiProjects.updateAccess(
-            project.id,
-            c.req.param("accessId")!,
-            c.get("accessSubject") ?? null,
-            c.req.valid("json").permission,
-          ))
+          (await aiProjects.updateAccess(project.id, c.req.param("accessId")!, resourceSubject(c), c.req.valid("json").permission))
           ? respond(c, ok({ updated: true }))
           : notFound(c, "Access entry");
       } catch (error) {
@@ -131,9 +142,9 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .delete("/:projectId/access/:accessId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "admin");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "admin");
       try {
-        return project && (await aiProjects.revokeAccess(project.id, c.req.param("accessId")!, c.get("accessSubject") ?? null))
+        return project && (await aiProjects.revokeAccess(project.id, c.req.param("accessId")!, resourceSubject(c)))
           ? respond(c, ok({ deleted: true }))
           : notFound(c, "Access entry");
       } catch (error) {
@@ -142,51 +153,50 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .get("/:projectId/knowledge", v("query", KnowledgeQuerySchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          knowledge: (await aiProjects.listKnowledge(project.id, c.get("accessSubject") ?? null, c.req.valid("query").q)).map((item) =>
+          knowledge: (await aiProjects.listKnowledge(project.id, resourceSubject(c), c.req.valid("query").q)).map((item) =>
             publicKnowledge(item, project.shortId),
           ),
         }),
       );
     })
     .post("/:projectId/knowledge", v("json", KnowledgeSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      const knowledge = project ? await aiProjects.createKnowledge(project.id, c.get("accessSubject") ?? null, c.req.valid("json")) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      const knowledge = project ? await aiProjects.createKnowledge(project.id, resourceSubject(c), c.req.valid("json")) : null;
       return knowledge ? respond(c, ok({ knowledge: publicKnowledge(knowledge, project!.shortId) }), 201) : notFound(c);
     })
     .patch("/:projectId/knowledge/:knowledgeId", v("json", UpdateKnowledgeSchema), async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
       const knowledge =
-        project &&
-        (await aiProjects.updateKnowledge(project.id, c.req.param("knowledgeId")!, c.get("accessSubject") ?? null, c.req.valid("json")));
+        project && (await aiProjects.updateKnowledge(project.id, c.req.param("knowledgeId")!, resourceSubject(c), c.req.valid("json")));
       return knowledge ? respond(c, ok({ knowledge: publicKnowledge(knowledge, project!.shortId) })) : notFound(c, "Knowledge entry");
     })
     .delete("/:projectId/knowledge/:knowledgeId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteKnowledge(project.id, c.req.param("knowledgeId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteKnowledge(project.id, c.req.param("knowledgeId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Knowledge entry");
     })
     .get("/:projectId/files", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          files: (await aiProjects.listFiles(project.id, c.get("accessSubject") ?? null)).map((file) => publicFile(file, project.shortId)),
+          files: (await aiProjects.listFiles(project.id, resourceSubject(c))).map((file) => publicFile(file, project.shortId)),
         }),
       );
     })
     .post("/:projectId/files", v("json", ProjectFileSchema), async (c) => {
       const body = c.req.valid("json");
       try {
-        const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
+        const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
         const file = project
-          ? await aiProjects.writeFile(project.id, c.get("accessSubject") ?? null, {
+          ? await aiProjects.writeFile(project.id, resourceSubject(c), {
               path: body.path,
               mediaType: body.mediaType,
               bytes: decodeAiFileContent(body.content, body.encoding),
@@ -200,8 +210,8 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       }
     })
     .get("/:projectId/files/:fileId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
-      const file = project ? await aiProjects.readFile(project.id, c.req.param("fileId")!, c.get("accessSubject") ?? null) : null;
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
+      const file = project ? await aiProjects.readFile(project.id, c.req.param("fileId")!, resourceSubject(c)) : null;
       if (!file) return notFound(c, "Project file");
       return respond(
         c,
@@ -213,18 +223,18 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       );
     })
     .delete("/:projectId/files/:fileId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteFile(project.id, c.req.param("fileId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteFile(project.id, c.req.param("fileId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Project file");
     })
     .get("/:projectId/references", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null);
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c));
       if (!project) return notFound(c);
       return respond(
         c,
         ok({
-          references: (await aiProjects.listReferences(project.id, c.get("accessSubject") ?? null)).map((reference) =>
+          references: (await aiProjects.listReferences(project.id, resourceSubject(c))).map((reference) =>
             publicReference(reference, project.shortId),
           ),
         }),
@@ -232,7 +242,7 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
     })
     .post("/:projectId/references", v("json", ReferenceSchema), async (c) => {
       const body = c.req.valid("json");
-      const subject = c.get("accessSubject") ?? null;
+      const subject = resourceSubject(c);
       const project = await aiProjects.getByShortId(c.req.param("projectId")!, subject, "write");
       if (!project) return notFound(c);
       let entry: Awaited<ReturnType<typeof getCapability>>;
@@ -248,8 +258,8 @@ const buildAiProjectsRoutes = (dependencies: AiProjectsRouteDependencies = {}) =
       return reference ? respond(c, ok({ reference: publicReference(reference, project.shortId) }), 201) : notFound(c);
     })
     .delete("/:projectId/references/:referenceId", async (c) => {
-      const project = await aiProjects.getByShortId(c.req.param("projectId")!, c.get("accessSubject") ?? null, "write");
-      return project && (await aiProjects.deleteReference(project.id, c.req.param("referenceId")!, c.get("accessSubject") ?? null))
+      const project = await aiProjects.getByShortId(c.req.param("projectId")!, resourceSubject(c), "write");
+      return project && (await aiProjects.deleteReference(project.id, c.req.param("referenceId")!, resourceSubject(c)))
         ? respond(c, ok({ deleted: true }))
         : notFound(c, "Project reference");
     });