@teamscala/service-boot 0.23.284

package/src/attach-proposal-magic.ts

@@ -0,0 +1,55 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The proposal MAGIC-LINK endpoint — the proposal twin of attach-agreement-magic.
+ * A recipient who clicks an emailed "View your proposal" link (carrying a signed,
+ * per-recipient prop_token) lands here: the token is verified for the proposal,
+ * the prop_token cookie is set, and the browser is 302-redirected straight into
+ * the proposal page. No email-entry gate, no OTP. An invalid/expired token sets
+ * no cookie and the page falls through to the normal email gate.
+ *
+ * The prop_token is host-scoped (proposals are served on the proposals host only),
+ * unlike the agreement ag_token which spans .scala.business for the proposal→sign
+ * hand-off. GET so it is a plain clickable link in an email.
+ */
+
+import type { Hono } from "hono";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { verifyAccessToken } from "./content-gate/token.ts";
+import { propTtlMs } from "./gate-ttls.ts";
+
+const PROP_COOKIE = "prop_token";
+
+export async function attachProposalMagic(
+	app: Hono,
+	serviceSlug: string,
+): Promise<void> {
+	const log = getAppLogger();
+
+	app.get("/api/proposal-magic", (c) => {
+		const token = c.req.query("t") ?? "";
+		const proposalId = c.req.query("p") ?? "";
+		const toRaw = c.req.query("to") ?? "/";
+		const dest =
+			toRaw.startsWith("/") && !toRaw.startsWith("//") ? toRaw : "/";
+
+		const email = verifyAccessToken(token, PROP_COOKIE, proposalId, Date.now());
+		if (email) {
+			const maxAge = Math.floor(propTtlMs() / 1000);
+			c.header(
+				"Set-Cookie",
+				`${PROP_COOKIE}=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`,
+			);
+			log.info(
+				`[proposal-magic] ${proposalId} → authorised ${email}; redirecting to ${dest}`,
+			);
+		}
+		return c.redirect(dest, 302);
+	});
+
+	log.info(
+		`[scala-install:${serviceSlug}] proposal magic-link endpoint mounted: /api/proposal-magic`,
+	);
+}

package/src/attach-transfers-upload.ts

@@ -0,0 +1,100 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Authenticated asset upload — POST /api/transfers/upload. Restores the
+ * handler deleted with @teamscala/server-files (commit ca5643ef); avatar/logo
+ * upload had 404'd on every service since. Writes to S3 via
+ * @teamscala/aws/create/write-ops and returns the STORED-form URL
+ * (`/api/files/<key>`) the client persists into avatar_url/logo_url — the
+ * display path rewrites it to the public `/api/assets/<encoded-key>` proxy
+ * via `toAssetPath` (@teamscala/formatters/asset-url). Self-authenticates
+ * (getSession) so it mounts BEFORE the auth gate.
+ *
+ * Key scheme is USER-scoped (`users/<userId>/<type>/<file>-<ts>.<ext>`) per
+ * the operator ruling: a profile picture belongs to the individual, not any
+ * org (the prior handler's org-scoped `<orgId>/avatars/...` encoded the
+ * uploading org into a personal asset). Spec + history:
+ * `reference/asset-upload-system.md`.
+ *
+ * `thumbUrl` mirrors `url` — the full image is served for both; a separate
+ * generated thumbnail is a future refinement (the prior handler generated
+ * one, but the image-resize dependency is not wired here yet and a missing
+ * thumb must not block the upload restoring).
+ */
+import type { Hono } from "hono";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { upload } from "@teamscala/aws/create/write-ops";
+import { getSession } from "@teamscala/auth/get-session";
+import { buildErrorReport } from "@teamscala/os/errors/error-report";
+
+const MAX_FILE_SIZE = 25 * 1024 * 1024; // 25MB
+const ALLOWED_TYPES = new Set([
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"image/svg+xml",
+	"application/pdf",
+	"video/mp4",
+	"video/webm",
+	"text/csv",
+	"text/plain",
+]);
+// `type` (FormData) → S3 key sub-directory. Unknown/absent → "uploads".
+const TYPE_DIR: Record<string, string> = {
+	avatars: "avatars",
+	logos: "logos",
+	uploads: "uploads",
+};
+
+function extOf(filename: string, fallback = "bin"): string {
+	const m = filename.match(/\.([a-z0-9]+)$/i);
+	return (m?.[1] ?? fallback).toLowerCase();
+}
+
+export async function attachTransfersUpload(app: Hono): Promise<void> {
+	const log = getAppLogger();
+
+	app.post("/api/transfers/upload", async (c) => {
+		const session = await getSession(c.req.raw.headers);
+		const userId = session?.user?.id;
+		if (!userId) return c.json({ error: "Not authenticated" }, 401);
+
+		const form = await c.req.formData();
+		const file = form.get("file");
+		const type = String(form.get("type") ?? "uploads");
+		if (!(file instanceof File)) return c.json({ error: "'file' field required" }, 400);
+		if (file.size <= 0) return c.json({ error: "empty file" }, 400);
+		if (file.size > MAX_FILE_SIZE) return c.json({ error: "file too large (max 25MB)" }, 413);
+		if (file.type && !ALLOWED_TYPES.has(file.type)) {
+			return c.json({ error: `file type '${file.type}' not allowed` }, 415);
+		}
+
+		const dir = TYPE_DIR[type] ?? "uploads";
+		const ext = extOf(file.name);
+		const key = `users/${userId}/${dir}/${dir.slice(0, -1)}-${Date.now()}.${ext}`;
+
+		const body = new Uint8Array(await file.arrayBuffer());
+		const result = await upload({
+			key,
+			body,
+			contentType: file.type || "application/octet-stream",
+		});
+		if (!result.success) {
+			log.error("attach-transfers-upload", { error: result.error, key });
+			const report = buildErrorReport(new Error(result.error ?? "upload failed"), {
+				service: "transfers-upload",
+				url: c.req.url,
+			});
+			return new Response(JSON.stringify(report.http.body), {
+				status: report.http.status,
+				headers: report.http.headers,
+			});
+		}
+
+		const storedUrl = `/api/files/${key}`;
+		return c.json({ url: storedUrl, thumbUrl: storedUrl });
+	});
+}

package/src/auth-gate.ts

@@ -0,0 +1,385 @@
+/**
+ * @system server-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Auth middleware factory. Three modes, same BetterAuth email-OTP mechanism:
+ *
+ *   service_install.auth values:
+ *   - omitted | "none"            → no gate, no handler (scala-public, scala-sign)
+ *   - "better-auth-cookie"        → full session auth: mount handler + session gate
+ *   - "email-otp-only"            → mount handler (OTP send/verify), no session gate
+ *
+ *   The sign-in block determines the UX per mode:
+ *   - "full"         → email → OTP → session → portal selection (portal, agents, docs, gpt)
+ *   - "email-gate"   → email → OTP → verify-only, no session (forms, proposals, quiz)
+ *   - "capture-only" → email field only, no OTP (sign)
+ *
+ *   There is NO localhost bypass: 127.0.0.1 is gated identically to the tunnel
+ *   (no session → /sign-in). Tools needing an authed view sign in
+ *   (getSuperAdminSessionCookie); the dev OTP is DB-readable.
+ *
+ *   When SCALA_OTP_URL is set, /api/auth/* forwards to the centralised
+ *   scala-otp service (per otp-centralised-via-otp-service). Otherwise
+ *   the local better-auth handler is used (dev-host fallback).
+ */
+
+import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
+import { getPrisma } from "@teamscala/db/prisma-registry";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { resolveAccess } from "@teamscala/auth/resolve-access";
+import * as v from "valibot";
+import { configure as configureEventLog } from "@teamscala/event-log/configure";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import type { Hono } from "hono";
+
+const SIGN_IN_PATHS = new Set([
+	"/login",
+	"/sign-in",
+	"/sign-up",
+	"/forgot-password",
+	"/reset-password",
+	"/email-otp",
+	"/magic-link",
+]);
+
+const PUBLIC_INFRA_PREFIXES = [
+	"/assets/",
+	"/api/assets/",
+	"/api/auth/",
+	// fn.signInFlow procedures serve the unauthenticated sign-in flow (config
+	// load, session check, portal list) — anonymous-allowed by design (return {}
+	// for no session). They replaced the former /api/data/sign-in-flow-config,
+	// /check-session, /portals HANDLER_MAP entries (handler-map-retirement).
+	"/api/rpc/fn/signInFlow/",
+	// fn.taskSync procedures (lane task-list <-> work_items). Exempt so a
+	// localhost hook/plugin (Claude PostToolUse curl, OpenCode scala-hooks
+	// fetch) reaches the ORPC router, where mount-orpc-router's resolveUser
+	// grants localhost -> super_admin (the documented internal caller model) and
+	// a non-localhost caller still needs a session (resolveUser returns null ->
+	// authed throws 401). Safety rests on Host:127.0.0.1 being unforgeable
+	// through the Cloudflare tunnel (the edge sets Host to the public hostname)
+	// — verified by the negative case (a non-localhost caller is rejected).
+	// Tighter than signInFlow: NOT anonymous-allowed (signInFlow returns {} for
+	// no session; taskSync writes require super-admin or a real session).
+	"/api/rpc/fn/taskSync/",
+	// scala-enroll device-onboarding: the machine-facing installer + register
+	// routes are TOKEN-authenticated (a single-use enrollment token issued by a
+	// logged-in, dev_access-approved operator), fetched by the onboardee via
+	// `irm`/`curl` with NO session cookie — so they must skip the page login
+	// gate, exactly like /mcp (Bearer) and /api/rpc/ws self-authenticate. The
+	// TOKEN is the delegated capability; issuance (/issue) stays login-gated.
+	"/provision/",
+];
+
+const PUBLIC_INFRA_PATHS = new Set([
+	"/health",
+	"/favicon.ico",
+	"/favicon.svg",
+	"/api/session",
+	"/api/rpc/ws",
+	// The MCP endpoint is a service-to-service surface with its OWN Bearer auth
+	// (the gateway sends `Authorization: Bearer SCALA_DEV_KEY`, validated by the
+	// MCP route handler). It must never be session-page-gated: on a kind:ui
+	// service that also mounts an MCP server (scala-agents — the fleet
+	// orchestration + cross-pane channel), the auth-gate would 302 /mcp to
+	// /sign-in, so the gateway sees toolCount=0 and the whole channel goes
+	// degraded. Backend-only MCP hosts have no auth-gate, so this only bit the
+	// one UI MCP host once the localhost super-admin bypass was removed
+	// (the bypass had been masking it). Exempt alongside /api/rpc/ws and
+	// /api/auth/, which self-authenticate the same way.
+	"/mcp",
+	// build-id is polled by the client self-heal; it must always return JSON
+	// (a tiny bundle hash) regardless of session, never a /sign-in redirect —
+	// otherwise an expired-session tab would compare a redirect body to its
+	// booted build and never heal.
+	"/api/build-id",
+	// /_heap is the localhost-gated heap-attribution probe (register-static-assets);
+	// like /health it is infra, not a page, so it must never 302 to /sign-in on an
+	// auth-gated service. The probe's own localhost Host check is the real gate.
+	"/_heap",
+	// /api/fleet/events is the SSE fleet event stream consumed self-contained by
+	// the generated opencode scala-hooks plugin (and any future client without
+	// an @orpc/client dep) for native cross-pane channel delivery. The plugin
+	// runs in the opencode process with no scala-agents session cookie, so the
+	// route must be public; the stream is keyed by the orchestratorSessionId
+	// query param (the subscriber's own tmux pane id) and carries no sensitive
+	// data, and dispatch only emits events targeted at that identity.
+	"/api/fleet/events",
+	// /api/fleet/claude-sessions is a non-sensitive lane-identity read (active
+	// Claude lane sessionIDs + cwds) consumed by the session-picker daemon to
+	// RESTORE transcript tails after its own restart. The picker runs with no
+	// scala-agents session cookie; the data is less sensitive than the
+	// /api/fleet/events stream above (no message content), so it is public like
+	// the other dev-host infra reads.
+	"/api/fleet/claude-sessions",
+	// /api/fleet/ingest-event receives parsed lane-action events
+	// (message.part.updated etc.) from the cli-session Claude transcript-tail — a
+	// dev-host INTERNAL machine caller that POSTs with no session cookie, exactly
+	// like the lane-event hook. Without this exemption the page auth-gate 302s
+	// every POST and the lane's tool/text action stream never reaches the
+	// ingestEvent pipeline (fleet_run_events stays empty → the dashboard console
+	// shows only lifecycle lines, never the per-tab action feed). A first-class
+	// api_route (sibling to lane-event); security is the handler's loopback gate
+	// on the platform's x-caller-remote-address (set by register-api-routes).
+	"/api/fleet/ingest-event",
+	// /api/fleet/lane-event receives Claude Code http lifecycle hooks
+	// (Stop/UserPromptSubmit/Pre*ToolUse) for live-lane visibility. Like /mcp it
+	// is a service-to-service surface with its OWN Bearer auth (the hook sends
+	// `Authorization: Bearer SCALA_DEV_KEY`, validated by the handler); the hook
+	// runs in the Claude process with no scala-agents session cookie, so it must
+	// not be session-page-gated. The handler filters to fleet lanes by workspace
+	// cwd + resolves the lane via the session-picker, so an unauth'd caller
+	// writes no lane state.
+	"/api/fleet/lane-event",
+	// /api/fleet/sweep-executor receives the loga monitor engine's sweep dispatch
+	// (POST {slug}) -- a service-to-service surface like /api/fleet/lane-event /
+	// /api/fleet/ingest-event (loga -> scala-agents, localhost). Security is the
+	// handler's loopback gate (x-caller-remote-address), identical to its siblings.
+	"/api/fleet/sweep-executor",
+	// /api/terminal-ws is the in-browser terminal WebSocket bridge (a real PTY
+	// login shell). It is a dev-tool surface analogous to /api/fleet/events:
+	// the operator's own shell, no sensitive data beyond what the operator
+	// already has in their terminal. Must not be session-gated — the test
+	// harness and the terminal block both connect without a session cookie.
+	"/api/terminal-ws",
+	// /unauthorised is the access-gate's rejection target (the PageGuard access
+	// page). It MUST be exempt: an authed-but-not-allowed viewer is redirected
+	// here, so gating it would re-reject and loop. It renders no sensitive data.
+	"/unauthorised",
+]);
+
+export async function attachAuthGate(
+	app: Hono,
+	config: ServiceInstallConfig,
+	serviceSlug: string,
+): Promise<void> {
+	const authMode = (config as { auth?: string }).auth ?? "none";
+	if (authMode === "none") return;
+
+	const log = getAppLogger();
+	// Driver-agnostic `write` callback backed by the process's Prisma singleton
+	// (one-db-surface — no second postgres). Lazy + takes precedence over any
+	// `prisma:` configure, so this writer is authoritative for authed services.
+	// The previous form passed the ORPC server client (`getServerClient()`) cast
+	// `as never` as `prisma:` — no `$executeRaw`, so recordEvent silently failed.
+	// Retention is owned by the event-log-sweep pg-boss job.
+	configureEventLog({ prisma: getPrisma() });
+	const { registerAuthFactory, getAuth } = await import(
+		"@teamscala/auth/auth-registry.ts"
+	);
+	const { createAuth } = await import("@teamscala/auth/auth-factory.ts");
+	registerAuthFactory(createAuth);
+
+	// Bridge the SAME factory into @teamscala/orpc's configure surface so the ORPC
+	// session-auth middleware (which resolves the caller's user for RLS) validates
+	// sessions through the identical BetterAuth instance the page gate uses. orpc
+	// is primitives-tier and cannot import the auth package; it reads getAuth() off
+	// its injected provider (configured-primitives), exactly as it reads getLogger.
+	// Without this the middleware throws "auth not configured" and every cookie-
+	// authenticated ORPC call falls back to no-user (RLS then skips scoping).
+	const { configure: orpcConfigure } = await import("@teamscala/orpc/configure");
+	orpcConfigure({ auth: { getAuth: () => getAuth() } });
+
+	const otpUrl = process.env.SCALA_OTP_URL;
+
+	// Eager-warm the local BetterAuth runtime at boot whenever a request path
+	// will build it: the session-READ path (getSession, better-auth-cookie mode)
+	// always uses the local instance — even when /api/auth/* forwards to
+	// scala-otp — and the local /api/auth handler uses it when no otpUrl is set.
+	// Building lazily on the first such request races a node_modules rebuild
+	// window: Bun transpiles better-auth on demand, and against a half-written
+	// tree that throws ENOENT → 500 on every auth + session check while /health
+	// stays green (nothing restarts it) — the 2026-06-12 login outage. Building
+	// here resolves the better-auth module graph once while node_modules is
+	// stable, and getAuth() memoizes it for the process lifetime. Best-effort and
+	// non-fatal: getAuth() never caches a failed build, so if this warm fails
+	// (e.g. mid-install) the first successful request rebuilds and caches — the
+	// service is never left wedged, and never boot-loops on a transient.
+	if (authMode === "better-auth-cookie" || !otpUrl) {
+		try {
+			await getAuth();
+			log.info(`[scala-install:${serviceSlug}] auth: local BetterAuth runtime warmed at boot`);
+		} catch (err) {
+			log.error(
+				`[scala-install:${serviceSlug}] auth: boot warm failed — will rebuild on first request`,
+				{ error: err instanceof Error ? err.message : String(err) },
+			);
+		}
+	}
+
+	// Register the specific clear-stale-cookies route BEFORE the /api/auth/*
+	// wildcard below. Hono matches in registration order, so a wildcard
+	// registered first SHADOWS this exact path — and when SCALA_OTP_URL is set
+	// the wildcard forwards it to scala-otp, which has no such route, so the
+	// call 404s (silently: the sign-in flow fires it fire-and-forget before
+	// every verify to drop stale pre-__Secure session cookies that would
+	// otherwise shadow the new session, and a swallowed 404 left them in place).
+	// Only better-auth-cookie mode manages session cookies.
+	if (authMode === "better-auth-cookie") {
+		app.all("/api/auth/clear-stale-cookies", async (c) => {
+			const cookieNames = [
+				"better-auth.session_token",
+				"better-auth.session_token_legacy",
+				"better-auth.csrf_token",
+			];
+			for (const name of cookieNames) {
+				c.header(
+					"Set-Cookie",
+					`${name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+					{ append: true },
+				);
+			}
+			return c.json({ ok: true });
+		});
+	}
+
+	if (otpUrl) {
+		const otpBase = otpUrl.replace(/\/+$/, "");
+		log.info(`[scala-install:${serviceSlug}] auth: forwarding /api/auth/* → ${otpBase}`);
+
+		app.all("/api/auth/*", async (c) => {
+			const url = new URL(c.req.url);
+			const target = `${otpBase}${url.pathname}${url.search}`;
+			try {
+				const headers = new Headers(c.req.raw.headers);
+				headers.set("host", new URL(otpBase).host);
+				const init: RequestInit = {
+					method: c.req.method,
+					headers,
+				};
+				if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+					init.body = c.req.raw.body;
+					if (c.req.raw.headers.has("content-type")) {
+						headers.set("content-type", c.req.raw.headers.get("content-type")!);
+					}
+				}
+				const upstream = await fetch(target, init);
+				const resHeaders = new Headers(upstream.headers);
+				resHeaders.set("X-Auth-Forwarded", "scala-otp");
+				resHeaders.delete("Content-Encoding");
+				resHeaders.delete("Content-Length");
+				for (const sc of upstream.headers.getSetCookie()) {
+					resHeaders.append("Set-Cookie", sc);
+				}
+				return new Response(upstream.body, {
+					status: upstream.status,
+					statusText: upstream.statusText,
+					headers: resHeaders,
+				});
+			} catch (err) {
+				log.error(`[auth-forward] failed to reach scala-otp`, {
+					target,
+					error: err instanceof Error ? err.message : String(err),
+				});
+				return Response.json(
+					{ error: "auth service unavailable" },
+					{ status: 502 },
+				);
+			}
+		});
+	} else {
+		app.all("/api/auth/*", async (c) => {
+			const auth = await getAuth();
+			return auth.handler(c.req.raw);
+		});
+	}
+
+	if (authMode === "email-otp-only") {
+		log.info(`[scala-install:${serviceSlug}] auth: email-otp-only (OTP handler, no session gate)`);
+		return;
+	}
+
+	const { getSession } = await import("@teamscala/auth/get-session.ts");
+
+	app.use("*", async (c, next) => {
+		const url = new URL(c.req.url);
+		const isInfra =
+			PUBLIC_INFRA_PATHS.has(url.pathname) ||
+			PUBLIC_INFRA_PREFIXES.some((p) => url.pathname.startsWith(p));
+		if (isInfra) return next();
+
+		// NO localhost bypass: a 127.0.0.1 page request is gated EXACTLY like a
+		// tunnel request (no session → redirect to /sign-in). The old
+		// `if (isLocalhost) return next()` let any tool — and the agent's own
+		// chrome-devtools/curl — see authed pages on localhost WITHOUT a session,
+		// so verification on 127.0.0.1 diverged from what a signed-in user sees
+		// through the domain (the CSS regression that hid for three runs,
+		// 2026-06-13). The bypass is redundant: anything needing an authed view
+		// signs in (the OTP is DB-readable on the dev host) — host-side harnesses
+		// use getSuperAdminSessionCookie (scala-tools/lib). Internal
+		// service-to-service auth still flows through the cookie/secret on the
+		// request, never the source IP.
+		const host = c.req.header("host") ?? "";
+		const cookie = c.req.header("cookie") ?? "";
+		const tokenMatch = cookie.match(/better-auth\.session_token=([^;]+)/);
+		const session = await getSession(c.req.raw.headers);
+		log.info(`[auth-gate] session resolution`, {
+			host,
+			path: url.pathname,
+			hasUser: !!session?.user,
+			userEmail: session?.user?.email,
+			cookiePresent: cookie.length > 0,
+			sessionTokenPresent: !!tokenMatch,
+			tokenPrefix: tokenMatch?.[1]?.slice(0, 8) ?? null,
+		});
+
+		const onSignInPath = SIGN_IN_PATHS.has(url.pathname);
+
+		if (session?.user && onSignInPath) {
+			const cb = url.searchParams.get("callbackURL");
+			return c.redirect(cb?.startsWith("/") ? cb : "/", 302);
+		}
+		if (!session?.user && !onSignInPath) {
+			const callbackURL = encodeURIComponent(url.pathname + url.search);
+			return c.redirect(`/sign-in?callbackURL=${callbackURL}`, 302);
+		}
+		// Optional org-allowlist gate (service_install.config.access.allowlist_config_slug):
+		// a service that declares an allowlist admits a signed-in viewer who is EITHER a
+		// platform super_admin (user.role='super_admin' — platform owner, sees every org;
+		// security.md `role-axes-platform-and-org`) OR a member of at least one allowed
+		// organisation (better_auth_member). No-op for every service without `access`
+		// (only scala-roadmap today), so this cannot affect existing authed services. The
+		// data-owner org is NOT the viewer's org: the session authenticates, the role +
+		// allowlist authorise. A signed-in viewer who is NEITHER is redirected to
+		// /unauthorised — never /sign-in (they are already authenticated; /sign-in
+		// bounces authed users back to the callback, so redirecting there loops forever).
+		const accessCfg = (config as { access?: { allowlist_config_slug?: string } })
+			.access;
+		if (accessCfg?.allowlist_config_slug && session?.user && !onSignInPath) {
+			const allowRow = await loadRegistryConfig(
+				"config",
+				accessCfg.allowlist_config_slug,
+				v.looseObject({}),
+			);
+			const allowed =
+				(allowRow?.allowed_organisation_ids as string[] | undefined) ?? [];
+			if (allowed.length > 0) {
+				// One access decision via the unified resolver (@teamscala/auth/resolve-access):
+				// platform super_admin OR allowlisted-org member. The gate is now a thin
+				// caller of the single permission decision point (unified permission system
+				// foundation, work_items 019f7d6b) — replaces the bespoke inline query.
+				const decision = await resolveAccess({
+					prisma: getPrisma() as never,
+					userId: session.user.id,
+					allowedOrganisationIds: allowed,
+				});
+				if (!decision.admitted) {
+					return c.redirect(`/unauthorised`, 302);
+				}
+			}
+		}
+		// Optional home redirect (service_install.config.home_path): an authenticated
+		// viewer who lands on "/" is redirected to the service's home path — scala-roadmap
+		// uses this to send "/" → "/<GBG Indo orgId>" (the roadmap's data owner). No-op for
+		// every service without a home_path. Runs after the access gate so a denied viewer
+		// is still sent to /sign-in.
+		const homePath = (config as { home_path?: string }).home_path;
+		if (homePath && session?.user && url.pathname === "/") {
+			return c.redirect(homePath, 302);
+		}
+		return next();
+	});
+
+	log.info(`[scala-install:${serviceSlug}] auth: better-auth-cookie wired`);
+}