@kindgi/api 0.1.4 → 0.1.5-rc.0

package/src/routes/event-triggers.ts

@@ -7,6 +7,7 @@ import type { Context } from 'hono';
 import type { Cursor, TenantId, TriggerId } from '@kindgi/types';
 
 import { statusFor, toWireError } from '../errors.js';
+import type { Authorizer } from '../middleware/authorize.js';
 import type {
   EventTriggerRecord,
   RegisterEventTriggerInput,
@@ -15,6 +16,7 @@ import type {
 } from '../trigger-binding.js';
 import type { AppEnv } from '../types.js';
 import { clampLimit } from './pagination.js';
+import { triggerAccess } from './trigger-access.js';
 
 /**
  * Event triggers — fire a flow run when a matching event arrives on
@@ -22,9 +24,16 @@ import { clampLimit } from './pagination.js';
  *
  * Seven routes, mirroring the schedules surface. This surface registers
  * triggers; it does not publish events.
+ *
+ * With an authorizer (T243 A), the trigger's flow decides who may see or
+ * change it (`trigger-access.ts`).
  */
-export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEnv> {
+export function eventTriggersRouter(
+  binding: TriggerRegistryBinding,
+  authorizer?: Authorizer,
+): Hono<AppEnv> {
   const r = new Hono<AppEnv>();
+  const access = triggerAccess(binding, 'event', authorizer);
 
   // ---------- POST / (register) ----------
   r.post('/', async (c) => {
@@ -37,11 +46,14 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
 
     const flowId = requireString(body, 'flowId');
     const flowVersion = requireString(body, 'flowVersion');
-    const eventKind = requireString(body.config, 'config.eventKind');
+    const eventKind = requireString(body, 'config.eventKind');
     if (flowId.kind === 'err') return bad(c, requestId, flowId.message);
     if (flowVersion.kind === 'err') return bad(c, requestId, flowVersion.message);
     if (eventKind.kind === 'err') return bad(c, requestId, eventKind.message);
 
+    const refused = await access.onRegister(c, flowId.value);
+    if (refused !== undefined) return refused;
+
     const rawConfig = (body.config ?? {}) as Record<string, unknown>;
     const registerInput: RegisterEventTriggerInput = {
       kind: 'event',
@@ -84,7 +96,9 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
       ...(statusFilter !== undefined && { status: statusFilter }),
     });
     return c.json({
-      data: page.data.map((row) => serializeEventTrigger(row as EventTriggerRecord)),
+      data: (await access.visible(c, page.data as readonly EventTriggerRecord[])).map(
+        serializeEventTrigger,
+      ),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -95,6 +109,8 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const triggerId = c.req.param('triggerId') as TriggerId;
+    const refused = await access.onTrigger(c, triggerId, ['read']);
+    if (refused !== undefined) return refused;
 
     const rec = await binding.get({ tenantId, triggerId });
     if (rec === null || rec.kind !== 'event') return notFound(c, requestId, triggerId);
@@ -106,6 +122,8 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const triggerId = c.req.param('triggerId') as TriggerId;
+    const refused = await access.onTrigger(c, triggerId, ['write', 'execute']);
+    if (refused !== undefined) return refused;
 
     const parsed = await parseJsonObject(c, requestId);
     if (parsed.kind === 'err') return parsed.response;
@@ -149,6 +167,8 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const triggerId = c.req.param('triggerId') as TriggerId;
+    const refused = await access.onTrigger(c, triggerId, ['write']);
+    if (refused !== undefined) return refused;
     const result = await binding.pause({ tenantId, triggerId });
     if (result.kind === 'err') return lifecycleError(c, requestId, result.error, triggerId);
     return c.json(serializeEventTrigger(result.value as EventTriggerRecord));
@@ -159,6 +179,8 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
     const requestId = c.get('requestId');
     const tenantId = c.get('tenantId') as TenantId;
     const triggerId = c.req.param('triggerId') as TriggerId;
+    const refused = await access.onTrigger(c, triggerId, ['write']);
+    if (refused !== undefined) return refused;
     const result = await binding.resume({ tenantId, triggerId });
     if (result.kind === 'err') return lifecycleError(c, requestId, result.error, triggerId);
     return c.json(serializeEventTrigger(result.value as EventTriggerRecord));
@@ -168,6 +190,8 @@ export function eventTriggersRouter(binding: TriggerRegistryBinding): Hono<AppEn
   r.post('/:triggerId/unregister', async (c) => {
     const tenantId = c.get('tenantId') as TenantId;
     const triggerId = c.req.param('triggerId') as TriggerId;
+    const refused = await access.onTrigger(c, triggerId, ['write']);
+    if (refused !== undefined) return refused;
     const outcome = await binding.unregister({ tenantId, triggerId });
     return c.json({
       eventTriggerId: triggerId as unknown as string,

package/src/routes/export-signing-keys.ts

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+import { Hono } from 'hono';
+
+import type { ExportSigningBinding } from '@kindgi/crypto';
+
+import type { AppEnv } from '../types.js';
+
+/**
+ * `GET /v1/export-signing-keys`: the public keys this deployment signs
+ * its exports with, active first. A verifier pins them: an export's own
+ * embedded `publicKey` only proves it wasn't changed, these say who
+ * signed it. Empty when the deployment doesn't sign exports. Any
+ * authenticated caller may read them; they're public keys.
+ */
+export function exportSigningKeysRouter(signer: ExportSigningBinding | undefined): Hono<AppEnv> {
+  const r = new Hono<AppEnv>();
+  r.get('/', (c) =>
+    c.json({
+      data: (signer?.listKeys() ?? []).map((key, index) => ({
+        keyId: key.keyId,
+        algorithm: key.algorithm,
+        publicKeyPem: key.publicKeyPem,
+        fingerprint: key.fingerprint,
+        active: index === 0,
+      })),
+    }),
+  );
+  return r;
+}

package/src/routes/flows.ts

@@ -18,6 +18,7 @@ import { refuseWritesWhenReadOnly } from '../registry-read-only.js';
 import type { ToolRegistryBinding } from '../tool-binding.js';
 import type { AppEnv } from '../types.js';
 import { clampLimit } from './pagination.js';
+import { projectMismatch } from './project-mismatch.js';
 import { parseScopeParams } from './scope-params.js';
 
 /**
@@ -132,8 +133,15 @@ export function flowsRouter(
       ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
       ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
     });
+    // Only what the caller may read (T243 A), as `GET …/:id` asks.
+    const visible =
+      authorizer === undefined
+        ? page.data
+        : await authorizer.filterByCan(c, 'read', page.data, (a) =>
+            ref('flow', a.id as unknown as string),
+          );
     return c.json({
-      data: page.data.map(serializeGraph),
+      data: visible.map(serializeGraph),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -334,6 +342,9 @@ export function flowsRouter(
         ),
       );
     }
+    if (outcome.kind === 'project-mismatch') {
+      return projectMismatch(c, 'flow', outcome.flowId as unknown as string, outcome.projectId);
+    }
     if (outcome.kind === 'project-not-found') {
       // Caller supplied a `projectId` that does not resolve within
       // this tenant. Distinct signal from `already-registered` so the

package/src/routes/gate-policies.ts

@@ -4,7 +4,7 @@
 import { type Context, Hono } from 'hono';
 
 import { ref } from '@kindgi/authz';
-import type { Cursor, TenantId } from '@kindgi/types';
+import type { Cursor, LiveScope, TenantId } from '@kindgi/types';
 
 import { statusFor, toWireError } from '../errors.js';
 import type { GatePolicyBinding, GatePolicyError } from '../gate-policy-binding.js';
@@ -30,7 +30,10 @@ const ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
  *   POST /:policyId/versions/:version/unregister|reinstate
  *
  * Writes need `admin` on the tenant: whoever may promote mustn't be able
- * to loosen the gate on their own promotion.
+ * to loosen the gate on their own promotion. Reads need `read` on the
+ * policy's scope (a segment's: its project), as judge classes do: one the
+ * caller can't read answers 404, as if it weren't there, and the list
+ * shows only those they can.
  */
 export function gatePoliciesRouter(
   binding: GatePolicyBinding,
@@ -46,6 +49,11 @@ export function gatePoliciesRouter(
     });
   }
 
+  /** Whether the caller may read a policy: `read` on its scope. */
+  const canRead = async (c: Ctx, policy: { readonly scope: LiveScope }): Promise<boolean> =>
+    authorizer === undefined ||
+    authorizer.can(c, 'read', scopeRef(c.get('tenantId') as TenantId, policy.scope));
+
   r.get('/', async (c) => {
     const requestId = c.get('requestId');
     const scope = scopeFromQuery((n) => c.req.query(n), c.req.queries('segment') ?? []);
@@ -59,8 +67,14 @@ export function gatePoliciesRouter(
       ...(scope.scope !== undefined && { scope: scope.scope }),
       ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor as Cursor }),
     });
+    const visible =
+      authorizer === undefined
+        ? page.data
+        : await authorizer.filterByCan(c, 'read', page.data, (p) =>
+            scopeRef(c.get('tenantId') as TenantId, p.scope),
+          );
     return c.json({
-      data: page.data.map(serializeGatePolicy),
+      data: visible.map(serializeGatePolicy),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -71,7 +85,7 @@ export function gatePoliciesRouter(
       tenantId: c.get('tenantId') as TenantId,
       id: c.req.param('policyId'),
     });
-    if (found === null) return notFound(c, c.req.param('policyId'));
+    if (found === null || !(await canRead(c, found))) return notFound(c, c.req.param('policyId'));
     return c.json(serializeGatePolicy(found));
   });
 
@@ -80,7 +94,11 @@ export function gatePoliciesRouter(
       tenantId: c.get('tenantId') as TenantId,
       id: c.req.param('policyId'),
     });
-    if (versions.length === 0) return notFound(c, c.req.param('policyId'));
+    // A policy's versions share its scope (`gate-policy-scope-changed`).
+    const first = versions[0];
+    if (first === undefined || !(await canRead(c, first))) {
+      return notFound(c, c.req.param('policyId'));
+    }
     return c.json({ data: versions.map(serializeGatePolicy), hasMore: false });
   });
 
@@ -90,7 +108,7 @@ export function gatePoliciesRouter(
       id: c.req.param('policyId'),
       version: c.req.param('version'),
     });
-    if (found === null) {
+    if (found === null || !(await canRead(c, found))) {
       return notFound(c, c.req.param('policyId'), c.req.param('version'));
     }
     return c.json(serializeGatePolicy(found));
@@ -144,6 +162,19 @@ export function gatePoliciesRouter(
 
 type Ctx = Context<AppEnv>;
 
+/** The resource a gate policy's scope is: what reading it needs `read` on. */
+function scopeRef(tenantId: TenantId, scope: LiveScope) {
+  switch (scope.kind) {
+    case 'tenant':
+      return ref('tenant', tenantId as unknown as string);
+    case 'org':
+      return ref('org', scope.orgId as unknown as string);
+    case 'project':
+    case 'segment':
+      return ref('project', scope.projectId as unknown as string);
+  }
+}
+
 function badInput(c: Ctx, requestId: string, message: string) {
   c.status(statusFor('bad-input') as never);
   return c.json(toWireError({ code: 'bad-input', message }, requestId));

package/src/routes/guardrails.ts

@@ -4,7 +4,13 @@
 import { Hono } from 'hono';
 
 import { type Principal, ref, tuplesForCreate } from '@kindgi/authz';
-import { type Guardrail, validateGuardrailSpec } from '@kindgi/guardrails';
+import {
+  type Guardrail,
+  type GuardrailConfigProblem,
+  createCheckRegistry,
+  describeGuardrailConfigProblems,
+  validateGuardrailSpec,
+} from '@kindgi/guardrails';
 import type { Cursor, GuardrailId, ProjectId, TenantId, UserId } from '@kindgi/types';
 
 import { statusFor, toWireError } from '../errors.js';
@@ -28,6 +34,9 @@ import { parseScopeParams } from './scope-params.js';
  * guardrails whose check code is already bundled server-side. Check
  * code is not uploaded over this surface.
  */
+/** The built-in checks, for the config of a guardrail naming one. */
+const builtInChecks = createCheckRegistry();
+
 /**
  * Optional side-effect callback fired after a successful write
  * (register, unregister) to a guardrail. Lets an in-process
@@ -42,10 +51,26 @@ export type GuardrailWriteHook = (params: {
   readonly kind: 'register' | 'unregister';
 }) => void | Promise<void>;
 
+/**
+ * Checks a guardrail being registered against the check it names: every
+ * way its `config` breaks that check's `configSchema` (a pack check's,
+ * from its deployment), via `guardrailConfigProblems`. Any problem
+ * refuses the registration with `422 guardrail-config-invalid`
+ * (`details.issues`). Absent, or nothing to check against (an unknown
+ * check, a check without a schema): no problems. A guardrail naming a
+ * built-in check is checked by the route itself, against the built-in's
+ * schema, whatever the runtime passes here.
+ */
+export type GuardrailConfigCheck = (input: {
+  readonly tenantId: TenantId;
+  readonly guardrail: Guardrail;
+}) => Promise<readonly GuardrailConfigProblem[]>;
+
 export function guardrailsRouter(
   binding: GuardrailRegistryBinding,
   authorizer?: Authorizer,
   onWrite?: GuardrailWriteHook,
+  checkConfig?: GuardrailConfigCheck,
 ): Hono<AppEnv> {
   const r = new Hono<AppEnv>();
   // A read-only registry (under `kindgi dev`, the pack's files) refuses
@@ -127,8 +152,15 @@ export function guardrailsRouter(
       ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
       ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
     });
+    // Only what the caller may read (T243 A), as `GET …/:id` asks.
+    const visible =
+      authorizer === undefined
+        ? page.data
+        : await authorizer.filterByCan(c, 'read', page.data, (a) =>
+            ref('guardrail', a.id as unknown as string),
+          );
     return c.json({
-      data: page.data.map(serializeGuardrail),
+      data: visible.map(serializeGuardrail),
       hasMore: page.nextCursor !== undefined,
       ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor as unknown as string }),
     });
@@ -210,6 +242,33 @@ export function guardrailsRouter(
       );
     }
 
+    // A built-in check's config is the route's to check (its schema ships with
+    // `@kindgi/guardrails`); any other check's, the runtime's.
+    const builtIn = builtInChecks.get(validated.value.check);
+    const problems =
+      builtIn?.configProblems !== undefined
+        ? builtIn.configProblems(validated.value.config)
+        : await checkConfig?.({ tenantId, guardrail: validated.value });
+    if (problems !== undefined && problems.length > 0) {
+      c.status(statusFor('guardrail-config-invalid') as never);
+      return c.json(
+        toWireError(
+          {
+            code: 'guardrail-config-invalid',
+            message: describeGuardrailConfigProblems(
+              {
+                guardrailId: validated.value.id as unknown as string,
+                check: validated.value.check,
+              },
+              problems,
+            ),
+            issues: problems as unknown as Record<string, unknown>[],
+          },
+          requestId,
+        ),
+      );
+    }
+
     const principal = c.get('principal') as Principal | undefined;
     const creatorUserId =
       principal?.actor.kind === 'user' ? (principal.actor.id as UserId) : undefined;