@modesto_ma/dsh-channels 0.5.0 → 0.7.0

package/src/settings/routes.ts

@@ -1,35 +1,38 @@
 /**
- * Web 设置面板的 HTTP 路由：status / panel / catalog / config(PUT,DELETE) /
- * credentials(PUT,DELETE) / reconnect / access。
+ * Web 设置面板的 HTTP 路由：DSH `/api` 下的精确 Fetch 路由
+ * `/api/dsh-channels.<方法>`（读用 GET，写一律 POST）。
  *
- * 路由注册进宿主可选的 `webServer` 服务（headless profile 没有它时面板自然
- * 不存在，飞书通道不受影响）。每个路由（读写都算）先交给宿主 `connection`
- * 服务的 `requestRejection`：与 DSH 自己的 `/api` 同一套 Host/Origin 校验和
- * 浏览器登录 cookie 鉴权，未通过返回 403 / 401，请求体不会被读取。没有
- * `connection` 服务的组合不挂载这些路由。写操作另保留同源校验。凭据值
- * 只走写路径，响应永远不包含它们。`catalog` 只读宿主 LLM / preset roster 的
- * 枚举结果，用于面板的 provider → model → 推理档位级联选择。`access` 提供
- * 准入快照与白名单/授权申请的写入口（与飞书卡片共用同一结算函数）。
+ * 路由注册进宿主 `connection.fetch`（headless profile 没有它时面板自然不存在，
+ * 飞书通道不受影响）。DSH 的 `/api` 路由先做 Host/Origin 校验和浏览器登录
+ * cookie 鉴权，只有通过的 owner 请求才会到达这里，未通过时由 DSH 直接返回
+ * 401 / 403。凭据值只走写路径，响应永远不包含它们。`catalog` 只读宿主
+ * LLM / preset roster 的枚举结果，用于面板的 provider → model → 推理档位
+ * 级联选择。`access` 提供准入快照与白名单/授权申请的写入口（与飞书卡片共用
+ * 同一结算函数）。
  *
  * @module dsh-channels/settings/routes
  */
 
-import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { HostContext } from '../dsh-types.ts'
 import {
-  ACCESS_GROUPS_ROUTE,
-  ACCESS_REQUESTS_ROUTE,
   ACCESS_ROUTE,
-  ACCESS_USERS_ROUTE,
-  ACCESS_WIKI_USERS_ROUTE,
+  ADD_ACCESS_GROUP_ROUTE,
+  ADD_ACCESS_USER_ROUTE,
+  ADD_WIKI_USER_ROUTE,
   CATALOG_ROUTE,
-  CONFIG_ROUTE,
-  CREDENTIALS_ROUTE,
+  CLEAR_CONFIG_ROUTE,
+  CLEAR_CREDENTIAL_ROUTE,
   PANEL_ROUTE,
   PICK_DIRECTORY_ROUTE,
   PROFILES_MAX_IDS,
   PROFILES_ROUTE,
   RECONNECT_ROUTE,
+  REMOVE_ACCESS_GROUP_ROUTE,
+  REMOVE_ACCESS_USER_ROUTE,
+  REMOVE_WIKI_USER_ROUTE,
+  RESOLVE_ACCESS_REQUEST_ROUTE,
+  SAVE_CONFIG_ROUTE,
+  SAVE_CREDENTIALS_ROUTE,
   SESSION_ORIGIN_ROUTE,
   STATUS_ROUTE,
 } from './contract.ts'
@@ -41,29 +44,28 @@ import type {
 } from './contract.ts'
 import type { SettingsSurface } from './surface.ts'
 
-/** The narrow `ctx.webServer` surface this module registers into. */
-export interface HostWebServer {
-  register(route: {
-    kind: 'exact'
-    path: string
-    handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>
-  }): () => void
+/** One exact route on DSH's authenticated `/api` channel. */
+export interface HostFetchRoute {
+  readonly path: string
+  readonly methods: readonly ('GET' | 'POST')[]
+  readonly requestBody: 'buffered'
+  readonly fetch: (request: Request) => Promise<Response>
 }
 
 /**
- * The narrow `ctx.connection` surface this module consumes: DSH's own
- * Host/Origin fence plus browser (login cookie) or API authentication.
+ * The narrow `ctx.connection` surface this module registers into. DSH applies
+ * its Host/Origin fence and login-cookie authentication before `fetch` runs.
  */
-export interface HostRequestGate {
-  /**
-   * @param request - incoming request headers.
-   * @returns 403 (untrusted Host/Origin), 401 (unauthenticated), or undefined when allowed.
-   */
-  requestRejection(request: { readonly headers: IncomingMessage['headers'] }): 401 | 403 | undefined
+export interface HostConnection {
+  readonly fetch: {
+    /**
+     * @param route - exact path, methods, and handler.
+     * @returns asynchronous disposer removing the route.
+     */
+    register(route: HostFetchRoute): () => Promise<void>
+  }
 }
 
-type WebHandler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>
-
 /** Request body cap: the panel payload is a handful of primitives. */
 const MAX_BODY_BYTES = 64 * 1024
 
@@ -77,71 +79,30 @@ class HttpError extends Error {
   }
 }
 
-function methodOf(req: IncomingMessage): string {
-  return (req.method ?? 'GET').toUpperCase()
-}
-
-function sendJson(res: ServerResponse, status: number, payload: unknown): void {
-  const body = JSON.stringify(payload)
-  res.writeHead(status, {
-    'content-type': 'application/json; charset=utf-8',
-    'cache-control': 'no-store',
-    'content-length': Buffer.byteLength(body),
-  })
-  res.end(body)
-}
-
-/** Reject non-allowed methods with 405 + Allow, returning false. */
-function allowOnly(req: IncomingMessage, res: ServerResponse, allowed: readonly string[]): boolean {
-  const method = methodOf(req)
-  if (allowed.includes(method)) return true
-  const body = JSON.stringify({ ok: false, error: `方法 ${method} 不受支持` })
-  res.writeHead(405, {
-    allow: allowed.join(', '),
-    'content-type': 'application/json; charset=utf-8',
-    'cache-control': 'no-store',
-    'content-length': Buffer.byteLength(body),
+function json(status: number, payload: unknown): Response {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
   })
-  res.end(body)
-  return false
 }
 
-/**
- * Mutating requests must come from this same origin. Missing Origin is allowed
- * (non-browser local clients, e.g. curl); a present-but-mismatched Origin is
- * a cross-site write and is refused.
- */
-export function isSameOriginRequest(req: IncomingMessage): boolean {
-  const origin = req.headers.origin
-  if (origin === undefined || origin === '') return true
-  const host = req.headers.host
-  if (host === undefined) return false
-  try {
-    return new URL(origin).host === host
-  } catch {
-    return false
-  }
-}
-
-async function readJsonBody(req: IncomingMessage): Promise<unknown> {
-  const contentType = (req.headers['content-type'] ?? '').split(';')[0]?.trim().toLowerCase()
-  if (contentType !== 'application/json') {
-    throw new HttpError(415, '请求体必须是 application/json')
-  }
-  const chunks: Buffer[] = []
-  let size = 0
-  for await (const chunk of req) {
-    const buffer = typeof chunk === 'string' ? Buffer.from(chunk) : chunk as Buffer
-    size += buffer.length
-    if (size > MAX_BODY_BYTES) throw new HttpError(413, '请求体过大')
-    chunks.push(buffer)
-  }
-  if (size === 0) throw new HttpError(400, '请求体为空')
+/** Parse a JSON-object body; malformed bodies throw {@link HttpError} (415/413/400). */
+async function readJsonObject(request: Request): Promise<Record<string, unknown>> {
+  const contentType = (request.headers.get('content-type') ?? '').split(';')[0]?.trim().toLowerCase()
+  if (contentType !== 'application/json') throw new HttpError(415, '请求体必须是 application/json')
+  const text = await request.text()
+  if (Buffer.byteLength(text) > MAX_BODY_BYTES) throw new HttpError(413, '请求体过大')
+  if (text === '') throw new HttpError(400, '请求体为空')
+  let body: unknown
   try {
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+    body = JSON.parse(text)
   } catch {
     throw new HttpError(400, '请求体不是合法 JSON')
   }
+  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+    throw new HttpError(400, '请求体必须是 JSON 对象')
+  }
+  return body as Record<string, unknown>
 }
 
 /** Distinct non-empty entries of one comma-separated id query parameter. */
@@ -150,383 +111,138 @@ function idList(raw: string | null): string[] {
   return [...new Set(raw.split(',').map(id => id.trim()).filter(id => id !== ''))]
 }
 
-/**
- * Parse one JSON-object body for an access write. HttpErrors are answered
- * here (415/413/400); `undefined` means "already responded, stop".
- */
-async function readAccessBody(
-  req: IncomingMessage,
-  res: ServerResponse,
-): Promise<Record<string, unknown> | undefined> {
-  let body: unknown
-  try {
-    body = await readJsonBody(req)
-  } catch (error) {
-    if (error instanceof HttpError) {
-      sendJson(res, error.status, { ok: false, error: error.message })
-      return undefined
-    }
-    throw error
-  }
-  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-    sendJson(res, 400, { ok: false, error: '请求体必须是 JSON 对象' })
-    return undefined
-  }
-  return body as Record<string, unknown>
+/** A write's answer: 200 on success, 400 for a refusal the body explains. */
+function result(outcome: { ok: boolean }): Response {
+  return json(outcome.ok ? 200 : 400, outcome)
 }
 
-/**
- * Wrap a handler so the host gate runs before anything else and thrown
- * errors become JSON instead of a dropped socket.
- */
-function guardedBy(gate: HostRequestGate, handler: WebHandler): WebHandler {
-  return async (req, res) => {
-    const rejection = gate.requestRejection(req)
-    if (rejection !== undefined) {
-      sendJson(res, rejection, {
-        ok: false,
-        error: rejection === 401 ? '未登录 DSH，请从 DSH 启动链接打开页面' : '请求来源不受信任',
-      })
-      return
-    }
+/** Turn thrown errors into JSON answers instead of a dropped request. */
+function answered(handler: (request: Request) => Promise<Response>): (request: Request) => Promise<Response> {
+  return async (request) => {
     try {
-      await handler(req, res)
+      return await handler(request)
     } catch (error) {
-      if (res.headersSent) {
-        res.end()
-        return
-      }
-      const status = error instanceof HttpError ? error.status : 500
-      sendJson(res, status, {
-        ok: false,
-        error: error instanceof HttpError ? error.message : `内部错误：${messageOf(error)}`,
-      })
+      if (error instanceof HttpError) return json(error.status, { ok: false, error: error.message })
+      return json(500, { ok: false, error: `内部错误：${messageOf(error)}` })
     }
   }
 }
 
-function forbiddenWrite(res: ServerResponse): void {
-  sendJson(res, 403, { ok: false, error: '跨站写入被拒绝（Origin 与 Host 不一致）' })
-}
-
-/** Register the panel routes; the returned disposer removes all of them. */
-export function registerSettingsRoutes(
-  server: HostWebServer,
-  gate: HostRequestGate,
-  surface: SettingsSurface,
-): () => void {
-  const guarded = (handler: WebHandler): WebHandler => guardedBy(gate, handler)
-  const disposers = [
-    server.register({
-      kind: 'exact',
-      path: STATUS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        sendJson(res, 200, await surface.status())
-      }),
-    }),
-    server.register({
-      kind: 'exact',
-      path: PANEL_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        sendJson(res, 200, await surface.panel())
-      }),
-    }),
-    server.register({
-      kind: 'exact',
-      path: CATALOG_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        const url = new URL(req.url ?? '/', 'http://dsh.local')
-        sendJson(res, 200, await surface.catalogFor(
-          url.searchParams.get('provider') ?? undefined,
-          url.searchParams.get('model') ?? undefined,
-        ))
-      }),
-    }),
-    server.register({
-      kind: 'exact',
-      path: SESSION_ORIGIN_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        const sessionId = new URL(req.url ?? '/', 'http://dsh.local').searchParams.get('sessionId')?.trim()
-        if (sessionId === undefined || sessionId === '') {
-          sendJson(res, 400, { ok: false, error: '缺少 sessionId 参数' })
-          return
-        }
-        sendJson(res, 200, await surface.sessionOrigin(sessionId))
-      }),
+/**
+ * Register the panel routes.
+ * @param connection - the host `connection` service.
+ * @param surface - the panel's business side.
+ * @returns disposer removing every route.
+ */
+export function registerSettingsRoutes(connection: HostConnection, surface: SettingsSurface): () => void {
+  const get = (path: string, handler: (url: URL) => Promise<Response>): HostFetchRoute => ({
+    path, methods: ['GET'], requestBody: 'buffered', fetch: answered(request => handler(new URL(request.url))),
+  })
+  const post = (path: string, handler: (request: Request) => Promise<Response>): HostFetchRoute => ({
+    path, methods: ['POST'], requestBody: 'buffered', fetch: answered(handler),
+  })
+  const routes: HostFetchRoute[] = [
+    get(STATUS_ROUTE, async () => json(200, await surface.status())),
+    get(PANEL_ROUTE, async () => json(200, await surface.panel())),
+    get(CATALOG_ROUTE, async url => json(200, await surface.catalogFor(
+      url.searchParams.get('provider') ?? undefined,
+      url.searchParams.get('model') ?? undefined,
+    ))),
+    get(SESSION_ORIGIN_ROUTE, async (url) => {
+      const sessionId = url.searchParams.get('sessionId')?.trim()
+      if (sessionId === undefined || sessionId === '') return json(400, { ok: false, error: '缺少 sessionId 参数' })
+      return json(200, await surface.sessionOrigin(sessionId))
     }),
-    server.register({
-      kind: 'exact',
-      path: PROFILES_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        const params = new URL(req.url ?? '/', 'http://dsh.local').searchParams
-        const userIds = idList(params.get('users'))
-        const chatIds = idList(params.get('chats'))
-        if (userIds.length > PROFILES_MAX_IDS || chatIds.length > PROFILES_MAX_IDS) {
-          sendJson(res, 400, { ok: false, error: `每次最多查询 ${PROFILES_MAX_IDS} 个用户和 ${PROFILES_MAX_IDS} 个群` })
-          return
-        }
-        sendJson(res, 200, await surface.feishuProfiles(userIds, chatIds))
-      }),
+    get(PROFILES_ROUTE, async (url) => {
+      const userIds = idList(url.searchParams.get('users'))
+      const chatIds = idList(url.searchParams.get('chats'))
+      if (userIds.length > PROFILES_MAX_IDS || chatIds.length > PROFILES_MAX_IDS) {
+        return json(400, { ok: false, error: `每次最多查询 ${PROFILES_MAX_IDS} 个用户和 ${PROFILES_MAX_IDS} 个群` })
+      }
+      return json(200, await surface.feishuProfiles(userIds, chatIds))
     }),
-    server.register({
-      kind: 'exact',
-      path: CONFIG_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['PUT', 'DELETE'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        if (methodOf(req) === 'DELETE') {
-          const result = await surface.clear()
-          sendJson(res, result.ok ? 200 : 400, result)
-          return
-        }
-        let body: unknown
-        try {
-          body = await readJsonBody(req)
-        } catch (error) {
-          if (error instanceof HttpError) {
-            sendJson(res, error.status, { ok: false, error: error.message })
-            return
-          }
-          throw error
-        }
-        const values = (body as { values?: unknown } | null)?.values
-        if (typeof values !== 'object' || values === null || Array.isArray(values)) {
-          sendJson(res, 400, { ok: false, error: '请求体缺少 values 对象' })
-          return
-        }
-        const result = await surface.save(values as EditableValues)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    get(ACCESS_ROUTE, async () => json(200, await surface.access())),
+    post(SAVE_CONFIG_ROUTE, async (request) => {
+      const values = (await readJsonObject(request)).values
+      if (typeof values !== 'object' || values === null || Array.isArray(values)) {
+        return json(400, { ok: false, error: '请求体缺少 values 对象' })
+      }
+      return result(await surface.save(values as EditableValues))
     }),
-    server.register({
-      kind: 'exact',
-      path: CREDENTIALS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['PUT', 'DELETE'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        let body: unknown
-        try {
-          body = await readJsonBody(req)
-        } catch (error) {
-          if (error instanceof HttpError) {
-            sendJson(res, error.status, { ok: false, error: error.message })
-            return
-          }
-          throw error
-        }
-        const payload = body as { appId?: unknown; appSecret?: unknown; analyzeToken?: unknown; field?: unknown } | null
-        if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
-          sendJson(res, 400, { ok: false, error: '请求体必须是 JSON 对象' })
-          return
-        }
-        if (methodOf(req) === 'DELETE') {
-          const field = payload.field
-          if (field !== 'appId' && field !== 'appSecret' && field !== 'analyzeToken') {
-            sendJson(res, 400, { ok: false, error: 'field 必须是 appId、appSecret 或 analyzeToken' })
-            return
-          }
-          const result = await surface.clearCredential(field as CredentialField)
-          sendJson(res, result.ok ? 200 : 400, result)
-          return
-        }
-        const values: SaveCredentialsRequest = {}
-        if (payload.appId !== undefined) values.appId = payload.appId as string
-        if (payload.appSecret !== undefined) values.appSecret = payload.appSecret as string
-        if (payload.analyzeToken !== undefined) values.analyzeToken = payload.analyzeToken as string
-        const result = await surface.saveCredentials(values)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    post(CLEAR_CONFIG_ROUTE, async () => result(await surface.clear())),
+    post(SAVE_CREDENTIALS_ROUTE, async (request) => {
+      const payload = await readJsonObject(request)
+      const values: SaveCredentialsRequest = {}
+      if (payload.appId !== undefined) values.appId = payload.appId as string
+      if (payload.appSecret !== undefined) values.appSecret = payload.appSecret as string
+      if (payload.analyzeToken !== undefined) values.analyzeToken = payload.analyzeToken as string
+      return result(await surface.saveCredentials(values))
     }),
-    server.register({
-      kind: 'exact',
-      path: RECONNECT_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        const result = await surface.reconnect()
-        // An incomplete configuration is a client-side state (the panel routes
-        // the user to the credentials form), not a server failure.
-        sendJson(res, result.ok ? 200 : (result.unconfigured === true ? 400 : 500), result)
-      }),
+    post(CLEAR_CREDENTIAL_ROUTE, async (request) => {
+      const field = (await readJsonObject(request)).field
+      if (field !== 'appId' && field !== 'appSecret' && field !== 'analyzeToken') {
+        return json(400, { ok: false, error: 'field 必须是 appId、appSecret 或 analyzeToken' })
+      }
+      return result(await surface.clearCredential(field as CredentialField))
     }),
-    server.register({
-      kind: 'exact',
-      path: PICK_DIRECTORY_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        // The chooser is a local desktop modal: it can stay open far longer
-        // than a normal request, and the operator may close the page instead
-        // of the dialog. Abort the host picker when the response socket goes
-        // away so no orphaned modal outlives its panel.
-        const controller = new AbortController()
-        let answered = false
-        if (typeof res.on === 'function') {
-          res.on('close', () => {
-            if (!answered) controller.abort()
-          })
-        }
-        let path: string | null
-        try {
-          path = await surface.pickDirectory(controller.signal)
-        } catch (error) {
-          answered = true
-          // A request the browser already dropped has nobody left to answer.
-          if (controller.signal.aborted) {
-            res.end()
-            return
-          }
-          throw error
-        }
-        answered = true
-        const payload: PickDirectoryResponse = path === null
-          ? { ok: true, canceled: true }
-          : { ok: true, path }
-        sendJson(res, 200, payload)
-      }),
+    post(RECONNECT_ROUTE, async () => {
+      const outcome = await surface.reconnect()
+      // An incomplete configuration is a client-side state (the panel routes
+      // the user to the credentials form), not a server failure.
+      return json(outcome.ok ? 200 : (outcome.unconfigured === true ? 400 : 500), outcome)
     }),
-    server.register({
-      kind: 'exact',
-      path: ACCESS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['GET', 'HEAD'])) return
-        if (methodOf(req) === 'HEAD') {
-          res.writeHead(200, { 'cache-control': 'no-store' })
-          res.end()
-          return
-        }
-        sendJson(res, 200, await surface.access())
-      }),
+    post(PICK_DIRECTORY_ROUTE, async (request) => {
+      // The chooser is a local desktop modal that can stay open far longer
+      // than a normal request; DSH aborts `request.signal` when the browser
+      // drops the request, which closes the host picker with it.
+      const path = await surface.pickDirectory(request.signal)
+      const payload: PickDirectoryResponse = path === null ? { ok: true, canceled: true } : { ok: true, path }
+      return json(200, payload)
     }),
-    server.register({
-      kind: 'exact',
-      path: ACCESS_GROUPS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST', 'DELETE'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        const payload = await readAccessBody(req, res)
-        if (payload === undefined) return
-        const result = methodOf(req) === 'DELETE'
-          ? await surface.removeAccessGroup(payload.chatId)
-          : await surface.saveAccessGroup(payload.chatId, payload.name)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    post(ADD_ACCESS_GROUP_ROUTE, async (request) => {
+      const payload = await readJsonObject(request)
+      return result(await surface.saveAccessGroup(payload.chatId, payload.name))
     }),
-    server.register({
-      kind: 'exact',
-      path: ACCESS_USERS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST', 'DELETE'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        const payload = await readAccessBody(req, res)
-        if (payload === undefined) return
-        const result = methodOf(req) === 'DELETE'
-          ? await surface.removeAccessUser(payload.userId)
-          : await surface.saveAccessUser(payload.userId, payload.name)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    post(REMOVE_ACCESS_GROUP_ROUTE, async request => result(await surface.removeAccessGroup((await readJsonObject(request)).chatId))),
+    post(ADD_ACCESS_USER_ROUTE, async (request) => {
+      const payload = await readJsonObject(request)
+      return result(await surface.saveAccessUser(payload.userId, payload.name))
     }),
-    server.register({
-      kind: 'exact',
-      path: ACCESS_WIKI_USERS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST', 'DELETE'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        const payload = await readAccessBody(req, res)
-        if (payload === undefined) return
-        const result = methodOf(req) === 'DELETE'
-          ? await surface.removeWikiUser(payload.userId)
-          : await surface.saveWikiUser(payload.userId, payload.name)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    post(REMOVE_ACCESS_USER_ROUTE, async request => result(await surface.removeAccessUser((await readJsonObject(request)).userId))),
+    post(ADD_WIKI_USER_ROUTE, async (request) => {
+      const payload = await readJsonObject(request)
+      return result(await surface.saveWikiUser(payload.userId, payload.name))
     }),
-    server.register({
-      kind: 'exact',
-      path: ACCESS_REQUESTS_ROUTE,
-      handler: guarded(async (req, res) => {
-        if (!allowOnly(req, res, ['POST'])) return
-        if (!isSameOriginRequest(req)) {
-          forbiddenWrite(res)
-          return
-        }
-        const payload = await readAccessBody(req, res)
-        if (payload === undefined) return
-        const result = await surface.resolveAccessRequest(payload.token, payload.decision)
-        sendJson(res, result.ok ? 200 : 400, result)
-      }),
+    post(REMOVE_WIKI_USER_ROUTE, async request => result(await surface.removeWikiUser((await readJsonObject(request)).userId))),
+    post(RESOLVE_ACCESS_REQUEST_ROUTE, async (request) => {
+      const payload = await readJsonObject(request)
+      return result(await surface.resolveAccessRequest(payload.token, payload.decision))
     }),
   ]
+  const disposers = routes.map(route => connection.fetch.register(route))
   return () => {
-    for (const dispose of disposers) dispose()
+    for (const dispose of disposers) {
+      void dispose().catch(() => {
+        // The route is already gone when the host connection was disposed first.
+      })
+    }
   }
 }
 
 /**
- * Mount the routes once the host carries both a Web server and the
- * `connection` service that authenticates its browser requests. The optional
- * `ctx.inject` keeps headless profiles from waiting on services they will
- * never have; embedded/test hosts that resolve services synchronously fall
- * back to the direct attach path. Without `connection` nothing is mounted, so
- * the panel never serves unauthenticated requests.
+ * Mount the routes once the host carries the `connection` service. The
+ * optional `ctx.inject` keeps headless profiles from waiting on a service
+ * they will never have; embedded/test hosts that resolve services
+ * synchronously fall back to the direct attach path.
+ * @param ctx - the plugin context.
+ * @param surface - the panel's business side.
  */
 export function mountSettingsRoutes(ctx: HostContext, surface: SettingsSurface): void {
-  const attach = (webCtx: HostContext): void => {
-    const server = webCtx.get?.('webServer') as HostWebServer | undefined
-    const gate = webCtx.get?.('connection') as HostRequestGate | undefined
-    if (server === undefined || gate === undefined) return
-    webCtx.effect(
-      () => registerSettingsRoutes(server, gate, surface),
+  const attach = (connectionCtx: HostContext): void => {
+    const connection = connectionCtx.get?.('connection') as HostConnection | undefined
+    if (connection?.fetch === undefined) return
+    connectionCtx.effect(
+      () => registerSettingsRoutes(connection, surface),
       'dsh-channels: settings panel routes',
     )
   }
@@ -534,7 +250,7 @@ export function mountSettingsRoutes(ctx: HostContext, surface: SettingsSurface):
     inject?: (dependencies: string[], callback: (child: HostContext) => void) => unknown
   }).inject
   if (typeof inject === 'function') {
-    inject.call(ctx, ['webServer', 'connection'], attach)
+    inject.call(ctx, ['connection'], attach)
     return
   }
   attach(ctx)