@slaw-ai/server 2026.611.0

package/dist/routes/assets.js

@@ -0,0 +1,309 @@
+import { Router } from "express";
+import multer from "multer";
+import createDOMPurify from "dompurify";
+import { JSDOM } from "jsdom";
+import { createAssetImageMetadataSchema } from "@slaw-ai/shared";
+import { assetService, logActivity } from "../services/index.js";
+import { isAllowedContentType, MAX_ATTACHMENT_BYTES } from "../attachment-types.js";
+import { assertSquadAccess, getActorInfo } from "./authz.js";
+const SVG_CONTENT_TYPE = "image/svg+xml";
+const ALLOWED_SQUAD_LOGO_CONTENT_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/jpg",
+    "image/webp",
+    "image/gif",
+    SVG_CONTENT_TYPE,
+]);
+function sanitizeSvgBuffer(input) {
+    const raw = input.toString("utf8").trim();
+    if (!raw)
+        return null;
+    const baseDom = new JSDOM("");
+    const domPurify = createDOMPurify(baseDom.window);
+    domPurify.addHook("uponSanitizeAttribute", (_node, data) => {
+        const attrName = data.attrName.toLowerCase();
+        const attrValue = (data.attrValue ?? "").trim();
+        if (attrName.startsWith("on")) {
+            data.keepAttr = false;
+            return;
+        }
+        if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
+            data.keepAttr = false;
+        }
+    });
+    let parsedDom = null;
+    try {
+        const sanitized = domPurify.sanitize(raw, {
+            USE_PROFILES: { svg: true, svgFilters: true, html: false },
+            FORBID_TAGS: ["script", "foreignObject"],
+            FORBID_CONTENTS: ["script", "foreignObject"],
+            RETURN_TRUSTED_TYPE: false,
+        });
+        parsedDom = new JSDOM(sanitized, { contentType: SVG_CONTENT_TYPE });
+        const document = parsedDom.window.document;
+        const root = document.documentElement;
+        if (!root || root.tagName.toLowerCase() !== "svg")
+            return null;
+        for (const el of Array.from(root.querySelectorAll("script, foreignObject"))) {
+            el.remove();
+        }
+        for (const el of Array.from(root.querySelectorAll("*"))) {
+            for (const attr of Array.from(el.attributes)) {
+                const attrName = attr.name.toLowerCase();
+                const attrValue = attr.value.trim();
+                if (attrName.startsWith("on")) {
+                    el.removeAttribute(attr.name);
+                    continue;
+                }
+                if ((attrName === "href" || attrName === "xlink:href") && attrValue && !attrValue.startsWith("#")) {
+                    el.removeAttribute(attr.name);
+                }
+            }
+        }
+        const output = root.outerHTML.trim();
+        if (!output || !/^<svg[\s>]/i.test(output))
+            return null;
+        return Buffer.from(output, "utf8");
+    }
+    catch {
+        return null;
+    }
+    finally {
+        parsedDom?.window.close();
+        baseDom.window.close();
+    }
+}
+export function assetRoutes(db, storage) {
+    const router = Router();
+    const svc = assetService(db);
+    const assetUpload = multer({
+        storage: multer.memoryStorage(),
+        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
+    });
+    const squadLogoUpload = multer({
+        storage: multer.memoryStorage(),
+        limits: { fileSize: MAX_ATTACHMENT_BYTES, files: 1 },
+    });
+    async function runSingleFileUpload(upload, req, res) {
+        await new Promise((resolve, reject) => {
+            upload.single("file")(req, res, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+    }
+    router.post("/squads/:squadId/assets/images", async (req, res) => {
+        const squadId = req.params.squadId;
+        assertSquadAccess(req, squadId);
+        try {
+            await runSingleFileUpload(assetUpload, req, res);
+        }
+        catch (err) {
+            if (err instanceof multer.MulterError) {
+                if (err.code === "LIMIT_FILE_SIZE") {
+                    res.status(422).json({ error: `File exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    return;
+                }
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            throw err;
+        }
+        const file = req.file;
+        if (!file) {
+            res.status(400).json({ error: "Missing file field 'file'" });
+            return;
+        }
+        const parsedMeta = createAssetImageMetadataSchema.safeParse(req.body ?? {});
+        if (!parsedMeta.success) {
+            res.status(400).json({ error: "Invalid image metadata", details: parsedMeta.error.issues });
+            return;
+        }
+        const namespaceSuffix = parsedMeta.data.namespace ?? "general";
+        const contentType = (file.mimetype || "").toLowerCase();
+        if (contentType !== SVG_CONTENT_TYPE && !isAllowedContentType(contentType)) {
+            res.status(422).json({ error: `Unsupported file type: ${contentType || "unknown"}` });
+            return;
+        }
+        let fileBody = file.buffer;
+        if (contentType === SVG_CONTENT_TYPE) {
+            const sanitized = sanitizeSvgBuffer(file.buffer);
+            if (!sanitized || sanitized.length <= 0) {
+                res.status(422).json({ error: "SVG could not be sanitized" });
+                return;
+            }
+            fileBody = sanitized;
+        }
+        if (fileBody.length <= 0) {
+            res.status(422).json({ error: "Image is empty" });
+            return;
+        }
+        const actor = getActorInfo(req);
+        const stored = await storage.putFile({
+            squadId,
+            namespace: `assets/${namespaceSuffix}`,
+            originalFilename: file.originalname || null,
+            contentType,
+            body: fileBody,
+        });
+        const asset = await svc.create(squadId, {
+            provider: stored.provider,
+            objectKey: stored.objectKey,
+            contentType: stored.contentType,
+            byteSize: stored.byteSize,
+            sha256: stored.sha256,
+            originalFilename: stored.originalFilename,
+            createdByAgentId: actor.agentId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            squadId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "asset.created",
+            entityType: "asset",
+            entityId: asset.id,
+            details: {
+                originalFilename: asset.originalFilename,
+                contentType: asset.contentType,
+                byteSize: asset.byteSize,
+            },
+        });
+        res.status(201).json({
+            assetId: asset.id,
+            squadId: asset.squadId,
+            provider: asset.provider,
+            objectKey: asset.objectKey,
+            contentType: asset.contentType,
+            byteSize: asset.byteSize,
+            sha256: asset.sha256,
+            originalFilename: asset.originalFilename,
+            createdByAgentId: asset.createdByAgentId,
+            createdByUserId: asset.createdByUserId,
+            createdAt: asset.createdAt,
+            updatedAt: asset.updatedAt,
+            contentPath: `/api/assets/${asset.id}/content`,
+        });
+    });
+    router.post("/squads/:squadId/logo", async (req, res) => {
+        const squadId = req.params.squadId;
+        assertSquadAccess(req, squadId);
+        try {
+            await runSingleFileUpload(squadLogoUpload, req, res);
+        }
+        catch (err) {
+            if (err instanceof multer.MulterError) {
+                if (err.code === "LIMIT_FILE_SIZE") {
+                    res.status(422).json({ error: `Image exceeds ${MAX_ATTACHMENT_BYTES} bytes` });
+                    return;
+                }
+                res.status(400).json({ error: err.message });
+                return;
+            }
+            throw err;
+        }
+        const file = req.file;
+        if (!file) {
+            res.status(400).json({ error: "Missing file field 'file'" });
+            return;
+        }
+        const contentType = (file.mimetype || "").toLowerCase();
+        if (!ALLOWED_SQUAD_LOGO_CONTENT_TYPES.has(contentType)) {
+            res.status(422).json({ error: `Unsupported image type: ${contentType || "unknown"}` });
+            return;
+        }
+        let fileBody = file.buffer;
+        if (contentType === SVG_CONTENT_TYPE) {
+            const sanitized = sanitizeSvgBuffer(file.buffer);
+            if (!sanitized || sanitized.length <= 0) {
+                res.status(422).json({ error: "SVG could not be sanitized" });
+                return;
+            }
+            fileBody = sanitized;
+        }
+        if (fileBody.length <= 0) {
+            res.status(422).json({ error: "Image is empty" });
+            return;
+        }
+        const actor = getActorInfo(req);
+        const stored = await storage.putFile({
+            squadId,
+            namespace: "assets/squads",
+            originalFilename: file.originalname || null,
+            contentType,
+            body: fileBody,
+        });
+        const asset = await svc.create(squadId, {
+            provider: stored.provider,
+            objectKey: stored.objectKey,
+            contentType: stored.contentType,
+            byteSize: stored.byteSize,
+            sha256: stored.sha256,
+            originalFilename: stored.originalFilename,
+            createdByAgentId: actor.agentId,
+            createdByUserId: actor.actorType === "user" ? actor.actorId : null,
+        });
+        await logActivity(db, {
+            squadId,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            agentId: actor.agentId,
+            runId: actor.runId,
+            action: "asset.created",
+            entityType: "asset",
+            entityId: asset.id,
+            details: {
+                originalFilename: asset.originalFilename,
+                contentType: asset.contentType,
+                byteSize: asset.byteSize,
+                namespace: "assets/squads",
+            },
+        });
+        res.status(201).json({
+            assetId: asset.id,
+            squadId: asset.squadId,
+            provider: asset.provider,
+            objectKey: asset.objectKey,
+            contentType: asset.contentType,
+            byteSize: asset.byteSize,
+            sha256: asset.sha256,
+            originalFilename: asset.originalFilename,
+            createdByAgentId: asset.createdByAgentId,
+            createdByUserId: asset.createdByUserId,
+            createdAt: asset.createdAt,
+            updatedAt: asset.updatedAt,
+            contentPath: `/api/assets/${asset.id}/content`,
+        });
+    });
+    router.get("/assets/:assetId/content", async (req, res, next) => {
+        const assetId = req.params.assetId;
+        const asset = await svc.getById(assetId);
+        if (!asset) {
+            res.status(404).json({ error: "Asset not found" });
+            return;
+        }
+        assertSquadAccess(req, asset.squadId);
+        const object = await storage.getObject(asset.squadId, asset.objectKey);
+        const responseContentType = asset.contentType || object.contentType || "application/octet-stream";
+        res.setHeader("Content-Type", responseContentType);
+        res.setHeader("Content-Length", String(asset.byteSize || object.contentLength || 0));
+        res.setHeader("Cache-Control", "private, max-age=60");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        if (responseContentType === SVG_CONTENT_TYPE) {
+            res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'");
+        }
+        const filename = asset.originalFilename ?? "asset";
+        res.setHeader("Content-Disposition", `inline; filename=\"${filename.replaceAll("\"", "")}\"`);
+        object.stream.on("error", (err) => {
+            next(err);
+        });
+        object.stream.pipe(res);
+    });
+    return router;
+}
+//# sourceMappingURL=assets.js.map

package/dist/routes/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,eAAe,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7D,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,eAAe,CAC/B,OAAO,CAAC,MAA0D,CACnE,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;YACxC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1D,WAAW,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YACxC,eAAe,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;YAC5C,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;QAEH,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE/D,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;YAC5E,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,CAAC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAM,EAAE,OAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD,CAAC,CAAC;IAEH,KAAK,UAAU,mBAAmB,CAChC,MAAiC,EACjC,GAAY,EACZ,GAAa;QAEb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAY,EAAE,EAAE;gBAC/C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC9E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,WAAW,KAAK,gBAAgB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,OAAO;YACP,SAAS,EAAE,UAAU,eAAe,EAAE;YACtC,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAI,GAAuF,CAAC,IAAI,CAAC;QAC3G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,WAAW,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,WAAW,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACnC,OAAO;YACP,SAAS,EAAE,eAAe;YAC1B,gBAAgB,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3C,WAAW;YACX,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,eAAe,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC,EAAE,EAAE;YACpB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,eAAe;YACvB,UAAU,EAAE,OAAO;YACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,OAAO,EAAE;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,eAAe;aAC3B;SACF,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,eAAe,KAAK,CAAC,EAAE,UAAU;SAC/C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAiB,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAClG,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,mBAAmB,KAAK,gBAAgB,EAAE,CAAC;YAC7C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,8EAA8E,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAE9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import type { Db } from "@slaw-ai/db";
+export declare function authRoutes(db: Db): import("express-serve-static-core").Router;
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAkCtC,wBAAgB,UAAU,CAAC,EAAE,EAAE,EAAE,8CA+DhC"}

package/dist/routes/auth.js

@@ -0,0 +1,82 @@
+import { Router } from "express";
+import { eq } from "drizzle-orm";
+import { authUsers } from "@slaw-ai/db";
+import { authSessionSchema, currentUserProfileSchema, updateCurrentUserProfileSchema, } from "@slaw-ai/shared";
+import { unauthorized } from "../errors.js";
+import { validate } from "../middleware/validate.js";
+async function loadCurrentUserProfile(db, userId) {
+    const user = await db
+        .select({
+        id: authUsers.id,
+        email: authUsers.email,
+        name: authUsers.name,
+        image: authUsers.image,
+    })
+        .from(authUsers)
+        .where(eq(authUsers.id, userId))
+        .then((rows) => rows[0] ?? null);
+    if (!user) {
+        throw unauthorized("Signed-in user not found");
+    }
+    return currentUserProfileSchema.parse({
+        id: user.id,
+        email: user.email ?? null,
+        name: user.name ?? null,
+        image: user.image ?? null,
+    });
+}
+export function authRoutes(db) {
+    const router = Router();
+    router.get("/get-session", async (req, res) => {
+        if (req.actor.type !== "operator" || !req.actor.userId) {
+            throw unauthorized("Operator authentication required");
+        }
+        const user = await loadCurrentUserProfile(db, req.actor.userId);
+        res.json(authSessionSchema.parse({
+            session: {
+                id: `slaw:${req.actor.source ?? "none"}:${req.actor.userId}`,
+                userId: req.actor.userId,
+            },
+            user,
+        }));
+    });
+    router.get("/profile", async (req, res) => {
+        if (req.actor.type !== "operator" || !req.actor.userId) {
+            throw unauthorized("Operator authentication required");
+        }
+        res.json(await loadCurrentUserProfile(db, req.actor.userId));
+    });
+    router.patch("/profile", validate(updateCurrentUserProfileSchema), async (req, res) => {
+        if (req.actor.type !== "operator" || !req.actor.userId) {
+            throw unauthorized("Operator authentication required");
+        }
+        const patch = updateCurrentUserProfileSchema.parse(req.body);
+        const now = new Date();
+        const updated = await db
+            .update(authUsers)
+            .set({
+            name: patch.name,
+            ...(patch.image !== undefined ? { image: patch.image } : {}),
+            updatedAt: now,
+        })
+            .where(eq(authUsers.id, req.actor.userId))
+            .returning({
+            id: authUsers.id,
+            email: authUsers.email,
+            name: authUsers.name,
+            image: authUsers.image,
+        })
+            .then((rows) => rows[0] ?? null);
+        if (!updated) {
+            throw unauthorized("Signed-in user not found");
+        }
+        res.json(currentUserProfileSchema.parse({
+            id: updated.id,
+            email: updated.email ?? null,
+            name: updated.name ?? null,
+            image: updated.image ?? null,
+        }));
+    });
+    return router;
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,KAAK,UAAU,sBAAsB,CAAC,EAAM,EAAE,MAAc;IAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC;SACD,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAM;IAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE;gBACP,EAAE,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC5D,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;aACzB;YACD,IAAI;SACL,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpF,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,SAAS,CAAC;aACjB,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aACzC,SAAS,CAAC;YACT,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;aACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;YACtC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/authz.d.ts

@@ -0,0 +1,19 @@
+import type { Request } from "express";
+export declare function assertAuthenticated(req: Request): void;
+export declare function assertOperator(req: Request): void;
+export declare function hasOperatorOrgAccess(req: Request): boolean;
+export declare function assertOperatorOrgAccess(req: Request): void;
+export declare function assertInstanceAdmin(req: Request): void;
+export declare function assertSquadAccess(req: Request, squadId: string): void;
+export declare function getActorInfo(req: Request): {
+    actorType: "agent";
+    actorId: string;
+    agentId: string | null;
+    runId: string | null;
+} | {
+    actorType: "user";
+    actorId: string;
+    agentId: null;
+    runId: string | null;
+};
+//# sourceMappingURL=authz.d.ts.map

package/dist/routes/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,QAI/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,QAI1C;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,WAQhD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,QAMnD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,QAM/C;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,QAsB9D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;EAiBxC"}

package/dist/routes/authz.js

@@ -0,0 +1,75 @@
+import { forbidden, unauthorized } from "../errors.js";
+export function assertAuthenticated(req) {
+    if (req.actor.type === "none") {
+        throw unauthorized();
+    }
+}
+export function assertOperator(req) {
+    if (req.actor.type !== "operator") {
+        throw forbidden("Operator access required");
+    }
+}
+export function hasOperatorOrgAccess(req) {
+    if (req.actor.type !== "operator") {
+        return false;
+    }
+    if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
+        return true;
+    }
+    return Array.isArray(req.actor.squadIds) && req.actor.squadIds.length > 0;
+}
+export function assertOperatorOrgAccess(req) {
+    assertOperator(req);
+    if (hasOperatorOrgAccess(req)) {
+        return;
+    }
+    throw forbidden("Squad membership or instance admin access required");
+}
+export function assertInstanceAdmin(req) {
+    assertOperator(req);
+    if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
+        return;
+    }
+    throw forbidden("Instance admin access required");
+}
+export function assertSquadAccess(req, squadId) {
+    assertAuthenticated(req);
+    if (req.actor.type === "agent" && req.actor.squadId !== squadId) {
+        throw forbidden("Agent key cannot access another squad");
+    }
+    if (req.actor.type === "operator" && req.actor.source !== "local_implicit") {
+        const allowedSquads = req.actor.squadIds ?? [];
+        if (!allowedSquads.includes(squadId)) {
+            throw forbidden("User does not have access to this squad");
+        }
+        const method = typeof req.method === "string" ? req.method.toUpperCase() : "GET";
+        const isSafeMethod = ["GET", "HEAD", "OPTIONS"].includes(method);
+        if (!isSafeMethod && !req.actor.isInstanceAdmin && Array.isArray(req.actor.memberships)) {
+            const membership = req.actor.memberships.find((item) => item.squadId === squadId);
+            if (!membership || membership.status !== "active") {
+                throw forbidden("User does not have active squad access");
+            }
+            if (membership.membershipRole === "viewer") {
+                throw forbidden("Viewer access is read-only");
+            }
+        }
+    }
+}
+export function getActorInfo(req) {
+    assertAuthenticated(req);
+    if (req.actor.type === "agent") {
+        return {
+            actorType: "agent",
+            actorId: req.actor.agentId ?? "unknown-agent",
+            agentId: req.actor.agentId ?? null,
+            runId: req.actor.runId ?? null,
+        };
+    }
+    return {
+        actorType: "user",
+        actorId: req.actor.userId ?? "operator",
+        agentId: null,
+        runId: req.actor.runId ?? null,
+    };
+}
+//# sourceMappingURL=authz.js.map

package/dist/routes/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/routes/authz.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,oDAAoD,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,gCAAgC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,OAAe;IAC7D,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC3E,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACxF,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,SAAS,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,UAAU,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,SAAS,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,OAAgB;YAC3B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,eAAe;YAC7C,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAClC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAe;QAC1B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU;QACvC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC"}

package/dist/routes/botfather.d.ts

@@ -0,0 +1,9 @@
+import { Router } from "express";
+import type { BotfatherService } from "../services/botfather/service.js";
+/**
+ * Instance-side botfather routes that back the startup gate + Settings panel.
+ * Read-only status plus two control actions. Local-trusted by default; under
+ * authenticated deployments these would gate to operator access (future).
+ */
+export declare function botfatherRoutes(service: BotfatherService | undefined): Router;
+//# sourceMappingURL=botfather.d.ts.map

package/dist/routes/botfather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"botfather.d.ts","sourceRoot":"","sources":["../../src/routes/botfather.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,CA0H7E"}