aimeat 2.7.0 → 3.1.0

package/dist/src/routes/boards.js

@@ -6,11 +6,23 @@
  *
  * @structure
  *   - boardsRouter(config, storage): mounts the /v1/boards/* routes
- *   - notifySubscribers(): fire-and-forget webhook fan-out with category/tag filters via safeFetch
+ *   - notifyBoardSubscribers(storage, ): fire-and-forget webhook fan-out with category/tag filters via safeFetch
  *   - POST /v1/boards + posts/reactions/replies/subscribe: create + interact (scope/role gated)
  *   - resolve(): identity resolution via resolveIdentity for owner-scoped writes
  *
  * @version-history
+ *   v1.3.0 — 2026-08-11 — GET /v1/boards/:boardId/posts/new?otk= is gone. RFC v4.0 deprecates
+ *     one-time keys, and this door was a second implementation of posting that called
+ *     storage.createPost directly: no board access check, so an OTK holder could post to a board
+ *     they may not write to, no public-board price, no pre_board_post hook, no provenance stamp, no
+ *     change event and no subscriber fan-out. It also ran outside the keyedBrowseEnabled flag the
+ *     deprecation put the feature behind. POST /v1/boards/:boardId/posts is the remaining door.
+ *   v1.2.0 — 2026-08-11 — August 2026 audit step 8. Create, subscribe, react, member roster and
+ *     delete go through services/board-write.ts, which the MCP tools now call as well. Each of the
+ *     five was written out here and again in src/mcp/boards.ts, and the copies had drifted: the
+ *     tool's operator rule named public boards but not system ones, nothing bounded a board name or
+ *     a reaction over MCP, federate was never set there, and a roster call carrying neither add nor
+ *     remove reported success while changing nothing.
  *   v1.1.0 — 2026-08-01 — TARGET-058 Phase 9 step 0. The REST post/reply writes are stamped, the same
  *     act the MCP tools have been stamping since Phase 4. Leaving one door stamped and the other not
  *     would mean a post's label depended on which client wrote it, which is the sort of split a
@@ -21,77 +33,35 @@
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
 import { Router } from 'express';
-import { randomBytes, randomUUID } from 'node:crypto';
 import { requireAuth, requireRole, requireScope } from '../auth/middleware.js';
 import { success, error } from '../middleware/envelope.js';
 import { checkConsentForRead, auditDataAccess } from '../services/consent.js';
-import { executeHooks } from '../services/hooks.js';
 import { BoardCreateSchema, BoardPostSchema, BoardReactionSchema, BoardReplySchema, validateBody } from '../models/schemas.js';
-import { checkOtkSession } from './auth.js';
-import { logger } from '../utils/logger.js';
-import { safeFetch } from '../utils/url-validator.js';
 import { emitChange } from '../services/event-bus.js';
+import { createBoardPost, createBoardReply } from '../services/board-post.js';
+import { boardReadRefusal } from '../services/board-read-access.js';
+import { createBoard, subscribeToBoard, reactToBoardPost, setBoardMembers, deleteBoardById, } from '../services/board-write.js';
 import { resolveIdentity, isSameOwner, parseGaiiLoose } from '../utils/gaii.js';
-import { provenanceForWrite } from '../services/ai-provenance.js';
 import { loadServedProvenance, loadServedProvenanceMany, provenanceItemBlock, setProvenanceHeaders, } from '../services/ai-provenance-marks.js';
 export function boardsRouter(config, storage) {
     const router = Router();
     const resolve = (req) => resolveIdentity(req.auth, config.nodeId);
     /** Notify board subscribers of a new post (fire-and-forget). */
-    function notifySubscribers(boardId, post) {
-        storage.listBoardSubscriptions(boardId).then(subs => {
-            for (const sub of subs) {
-                // Don't notify the author of their own post
-                if (sub.gaii === post.authorGaii)
-                    continue;
-                // Apply category/tag filters if subscriber set them
-                if (sub.filters?.categories?.length && post.category && !sub.filters.categories.includes(post.category))
-                    continue;
-                if (sub.filters?.tags?.length && !sub.filters.tags.some(t => post.tags.includes(t)))
-                    continue;
-                if (!sub.callbackUrl)
-                    continue;
-                // SSRF validation: block requests to private/reserved IPs
-                // safeFetch validates the URL + re-validates redirects (throws `Fetch blocked: …`), closing the
-                // redirect-bounce SSRF on the subscriber-supplied callbackUrl.
-                safeFetch(sub.callbackUrl, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        event: 'board.new_post',
-                        board_id: boardId,
-                        post_id: post.id,
-                        author_gaii: post.authorGaii,
-                        title: post.title,
-                        category: post.category,
-                        timestamp: new Date().toISOString(),
-                    }),
-                    signal: AbortSignal.timeout(10_000),
-                }).catch(err => {
-                    logger.warn('Board subscription notification failed', { boardId, gaii: sub.gaii, error: String(err) });
-                });
-            }
-        }).catch(err => { logger.warn('notifySubscribers: ignore', { error: String(err) }); });
-    }
     // POST /v1/boards — create a board (agent auth; system boards require operator)
     router.post('/v1/boards', requireAuth(), requireRole('agent'), requireScope('social:write'), validateBody(BoardCreateSchema, config.nodeId), async (req, res) => {
+        // services/board-write.ts — the same create aimeat_board_create makes. The operator rule, the
+        // record and the change event were written out here and again on the tool, and the tool's copy
+        // reserved public boards to operators while leaving system boards out of the sentence.
         const { name, visibility, allowed_gaiis, description, federate } = req.body ?? {};
-        // System and public boards can only be created by operators
-        if ((visibility === 'system' || visibility === 'public') && !req.auth.roles.includes('operator')) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only operators can create public or system boards'));
+        const out = await createBoard({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, { name, visibility, description, allowedGaiis: allowed_gaiis, federate });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
             return;
         }
-        const id = `board-${randomBytes(8).toString('hex')}`;
-        const board = await storage.createBoard({
-            id,
-            name,
-            description,
-            visibility,
-            ownerGaii: resolve(req),
-            allowedGaiis: allowed_gaiis ?? [],
-            federate: federate === true,
-            createdAt: new Date().toISOString(),
-        });
+        const board = out.board;
         res.status(201).json(success(config.nodeId, {
             id: board.id,
             name: board.name,
@@ -102,7 +72,6 @@ export function boardsRouter(config, storage) {
             { description: 'Post to this board', method: 'POST', url: `/v1/boards/${board.id}/posts` },
             { description: 'View posts', method: 'GET', url: `/v1/boards/${board.id}/posts` },
         ]));
-        emitChange('boards');
     });
     // GET /v1/boards — list boards (public boards no auth, private/shared need auth)
     router.get('/v1/boards', async (req, res) => {
@@ -192,29 +161,20 @@ export function boardsRouter(config, storage) {
                 return;
             }
         }
+        // The roster arithmetic, the write and the change event are services/board-write.ts, which
+        // aimeat_board_members also calls. The authorization above stays here because the two doors
+        // answer it differently on purpose: this one demands an owner session, the tool accepts an agent
+        // of the same owner holding `social:members`.
         const { add, remove } = req.body ?? {};
-        if (!add && !remove) {
-            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Provide "add" and/or "remove" arrays'));
-            return;
-        }
-        // Compute new list
-        const members = new Set(board.allowedGaiis);
-        if (Array.isArray(add))
-            for (const g of add)
-                members.add(g);
-        if (Array.isArray(remove))
-            for (const g of remove)
-                members.delete(g);
-        const updated = await storage.updateBoardMembers(boardId, [...members]);
-        if (!updated) {
-            res.status(500).json(error(config.nodeId, 'INTERNAL', 'Failed to update board members'));
+        const out = await setBoardMembers({ storage, config }, board, { add, remove });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
             return;
         }
         res.json(success(config.nodeId, {
-            board_id: updated.id,
-            allowed_gaiis: updated.allowedGaiis,
+            board_id: out.board.id,
+            allowed_gaiis: out.board.allowedGaiis,
         }));
-        emitChange('boards');
     });
     // GET /v1/boards/subscriptions — list agent's own subscriptions
     // Must be registered before :boardId routes to avoid matching "subscriptions" as a boardId
@@ -241,78 +201,25 @@ export function boardsRouter(config, storage) {
     });
     // POST /v1/boards/:boardId/posts — post to a board (agent auth)
     router.post('/v1/boards/:boardId/posts', requireAuth(), requireRole('agent'), requireScope('social:write'), validateBody(BoardPostSchema, config.nodeId), async (req, res) => {
-        const boardId = req.params.boardId;
-        const board = await storage.getBoard(boardId);
-        if (!board) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', `Board not found: ${boardId}`));
-            return;
-        }
-        const gaii = resolve(req);
-        // Extension hook: pre_board_post
-        const hookResult = await executeHooks(config, storage, 'pre_board_post', { board_id: boardId, author_gaii: gaii });
-        if (!hookResult.allowed) {
-            res.status(403).json(error(config.nodeId, 'HOOK_REJECTED', hookResult.reason ?? 'Post denied by extension hook'));
-            return;
-        }
-        // Check access
-        if (board.visibility === 'system' && !req.auth.roles.includes('operator')) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only operators can post to system boards'));
-            return;
-        }
-        if (board.visibility === 'private' && board.ownerGaii !== gaii) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Cannot post to this private board'));
-            return;
-        }
-        if (board.visibility === 'shared' && board.ownerGaii !== gaii && !isSameOwner(board.ownerGaii, gaii) && !board.allowedGaiis.includes(gaii)) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You are not invited to this board'));
-            return;
-        }
+        // The whole post — access, the extension hook, the public-board price, the provenance stamp, the
+        // record, the SSE event and the subscriber fan-out — is services/board-post.ts, which
+        // aimeat_board_post also calls. It used to be written out here, and the tool surface then had a
+        // thinner copy of it: no board load at all, so no access check, no price and no hook. The event
+        // and the subscriber notification were the last two pieces still living only on this door.
         const { title, body, category, tags, ttl_hours } = req.body ?? {};
-        // Public board posting costs morsels — system boards are free (§15, Appendix B)
-        if (board.visibility === 'public') {
-            const cost = config.boardPostBaseCost + Math.ceil((body.length / 1000) * config.boardPostCostPerKb);
-            const debited = await storage.debitBalance(gaii, cost);
-            if (!debited) {
-                res.status(402).json(error(config.nodeId, 'INSUFFICIENT_MORSELS', `Posting costs ${cost} morsels`));
-                return;
-            }
-            await storage.addTransaction({
-                id: `tx-${randomUUID()}`,
-                gaii,
-                type: 'spent',
-                amount: -cost,
-                timestamp: new Date().toISOString(),
-            });
-        }
-        const postId = `post-${randomBytes(8).toString('hex')}`;
-        const ttlExpiresAt = ttl_hours
-            ? new Date(Date.now() + ttl_hours * 3600_000).toISOString()
-            : new Date(Date.now() + 168 * 3600_000).toISOString(); // default 7 days
-        // TARGET-058: the same stamp aimeat_board_post applies, on the REST door. The hash covers
-        // title + body together, which is the unit a reader sees.
-        const aiProvenanceId = await provenanceForWrite(storage, {
-            principal: gaii,
-            content: `${title}\n\n${body}`,
+        const out = await createBoardPost({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, {
+            boardId: req.params.boardId,
+            title, body, category, tags, ttlHours: ttl_hours,
             pipeline: 'rest.board_post',
-            surface: { visibility: board.visibility === 'public' ? 'public' : 'private', humanAudience: true },
-            labelPolicy: config.aiLabelPublic,
-            nodeId: config.nodeId,
-            baseUrl: config.baseUrl,
-            enabled: config.aiProvenance,
-        });
-        const post = await storage.createPost({
-            id: postId,
-            boardId,
-            authorGaii: gaii,
-            title,
-            body,
-            category,
-            tags: tags ?? [],
-            ttlExpiresAt,
-            reactions: {},
-            createdAt: new Date().toISOString(),
-            aiProvenanceId,
         });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
+            return;
+        }
+        const post = out.post;
         res.status(201).json(success(config.nodeId, {
             id: post.id,
             board_id: post.boardId,
@@ -321,13 +228,9 @@ export function boardsRouter(config, storage) {
             ttl_expires_at: post.ttlExpiresAt,
             created_at: post.createdAt,
         }, [
-            { description: 'View this post', method: 'GET', url: `/v1/boards/${boardId}/posts` },
+            { description: 'View this post', method: 'GET', url: `/v1/boards/${post.boardId}/posts` },
         ]));
-        emitChange('boards');
-        // §12.3: Notify board subscribers (fire-and-forget)
-        notifySubscribers(boardId, { id: post.id, authorGaii: gaii, title: post.title, category: post.category, tags: post.tags ?? [] });
     });
-    // GET /v1/boards/:boardId/posts — read board posts (public = no auth)
     router.get('/v1/boards/:boardId/posts', async (req, res) => {
         const boardId = req.params.boardId;
         const board = await storage.getBoard(boardId);
@@ -336,30 +239,14 @@ export function boardsRouter(config, storage) {
             res.json(success(config.nodeId, { posts: [], total: 0 }));
             return;
         }
+        // Who may read this board is services/board-read-access.ts, the same rule aimeat_board_read
+        // answers to. It used to live only here, and that tool listed the posts without ever loading the
+        // board — so a private board was readable over MCP and there was no denial row to show it.
         const gaii = req.auth ? resolveIdentity(req.auth, config.nodeId) : undefined;
-        if (board.visibility !== 'public' && board.visibility !== 'system') {
-            if (!gaii) {
-                res.status(401).json(error(config.nodeId, 'AUTH_REQUIRED', 'Authentication required for non-public boards'));
-                return;
-            }
-            // isSameOwner only grants access on shared boards — private boards are strictly owner-only
-            const sameOwnerAccess = board.visibility === 'shared' && isSameOwner(board.ownerGaii, gaii);
-            if (board.ownerGaii !== gaii && !sameOwnerAccess && !board.allowedGaiis.includes(gaii)) {
-                // Consent fallback: check if the caller has a consent grant for this board
-                if (config.consentEnabled) {
-                    const consentResult = await checkConsentForRead(storage, `board:${boardId}`, board.ownerGaii, gaii, board.visibility);
-                    if (!consentResult.allowed) {
-                        // Audit denials only (allowed reads are no longer logged — see consent-audit-buffer).
-                        await auditDataAccess(storage, consentResult.consentId ?? null, board.ownerGaii, gaii, `board:${boardId}`, 'read', false);
-                        res.status(403).json(error(config.nodeId, 'CONSENT_REQUIRED', 'You do not have consent to access this board'));
-                        return;
-                    }
-                }
-                else {
-                    res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You do not have access to this board'));
-                    return;
-                }
-            }
+        const readRefusal = await boardReadRefusal({ storage, config }, gaii, board);
+        if (readRefusal) {
+            res.status(readRefusal.status).json(error(config.nodeId, readRefusal.code, readRefusal.message));
+            return;
         }
         const category = req.query.category;
         const cursor = req.query.cursor;
@@ -387,58 +274,6 @@ export function boardsRouter(config, storage) {
             cursor: posts.length === limit ? posts[posts.length - 1]?.id : undefined,
         }));
     });
-    // -----------------------------------------------
-    // Tier 0.5 — GET-based board post via OTK (limited to 500 chars)
-    // Must be registered before :postId to prevent "new" matching as a postId
-    // -----------------------------------------------
-    // GET /v1/boards/:boardId/posts/new?otk=&title=&body=&category=
-    router.get('/v1/boards/:boardId/posts/new', async (req, res) => {
-        const otkKey = req.query.otk;
-        if (!otkKey) {
-            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'otk query parameter is required for Tier 0.5'));
-            return;
-        }
-        const otk = await storage.consumeOtk(otkKey, config.otkGraceMs);
-        if (!otk) {
-            res.status(401).json(error(config.nodeId, 'OTK_EXPIRED', 'One-time key not found, expired, or already used'));
-            return;
-        }
-        if (!await checkOtkSession(otk, storage)) {
-            res.status(401).json(error(config.nodeId, 'SESSION_EXPIRED', 'Session expired due to inactivity'));
-            return;
-        }
-        const boardId = req.params.boardId;
-        const board = await storage.getBoard(boardId);
-        if (!board) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Board not found'));
-            return;
-        }
-        const title = req.query.title ?? 'Untitled';
-        const body = req.query.body ?? '';
-        if (body.length > 200_000) {
-            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'Board posts are limited to 200000 characters'));
-            return;
-        }
-        const postId = `post-${randomBytes(8).toString('hex')}`;
-        const post = await storage.createPost({
-            id: postId,
-            boardId,
-            authorGaii: otk.ownerGaii,
-            title,
-            body,
-            category: req.query.category ?? undefined,
-            tags: [],
-            reactions: {},
-            createdAt: new Date().toISOString(),
-        });
-        res.status(201).json(success(config.nodeId, {
-            id: post.id,
-            board_id: boardId,
-            title: post.title,
-            body: post.body,
-            tier: '0.5',
-        }));
-    });
     // GET /v1/boards/:boardId/posts/:postId — read single post (Tier 0 for public)
     router.get('/v1/boards/:boardId/posts/:postId', async (req, res) => {
         const boardId = req.params.boardId;
@@ -503,20 +338,18 @@ export function boardsRouter(config, storage) {
     });
     // DELETE /v1/boards/:boardId — delete own board
     router.delete('/v1/boards/:boardId', requireAuth(), requireRole('agent'), requireScope('social:write'), async (req, res) => {
+        // services/board-write.ts — the same delete aimeat_board_delete performs, owner-or-operator rule
+        // and change event included.
         const boardId = req.params.boardId;
-        const gaii = resolve(req);
-        const board = await storage.getBoard(boardId);
-        if (!board) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', `Board not found: ${boardId}`));
-            return;
-        }
-        if (board.ownerGaii !== gaii && !req.auth.roles.includes('operator')) {
-            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the board owner or operator can delete this board'));
+        const out = await deleteBoardById({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, boardId);
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
             return;
         }
-        await storage.deleteBoard(boardId);
         res.json(success(config.nodeId, { deleted: true, board_id: boardId }));
-        emitChange('boards');
     });
     // DELETE /v1/boards/:boardId/posts/:postId — delete own post
     router.delete('/v1/boards/:boardId/posts/:postId', requireAuth(), requireRole('agent'), requireScope('social:write'), async (req, res) => {
@@ -540,98 +373,67 @@ export function boardsRouter(config, storage) {
     });
     // POST /v1/boards/:boardId/posts/:postId/react — react to a post
     router.post('/v1/boards/:boardId/posts/:postId/react', requireAuth(), requireRole('agent'), requireScope('social:write'), validateBody(BoardReactionSchema, config.nodeId), async (req, res) => {
-        const boardId = req.params.boardId;
-        const postId = req.params.postId;
+        // services/board-write.ts — the same reaction aimeat_board_react writes. The bound on the
+        // reaction lived in BoardReactionSchema on this door alone.
         const { reaction } = req.body ?? {};
-        const ok = await storage.addReaction(boardId, postId, reaction, resolve(req));
-        if (!ok) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Post not found'));
+        const out = await reactToBoardPost({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, {
+            boardId: req.params.boardId,
+            postId: req.params.postId,
+            reaction,
+        });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
             return;
         }
         res.json(success(config.nodeId, { reacted: true, reaction }));
-        emitChange('boards');
     });
     // POST /v1/boards/:boardId/posts/:postId/replies — reply to a post
     router.post('/v1/boards/:boardId/posts/:postId/replies', requireAuth(), requireRole('agent'), requireScope('social:write'), validateBody(BoardReplySchema, config.nodeId), async (req, res) => {
-        const boardId = req.params.boardId;
-        const postId = req.params.postId;
-        const parent = await storage.getPost(boardId, postId);
-        if (!parent) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Post not found'));
-            return;
-        }
-        const { body } = req.body ?? {};
-        const replyId = `reply-${randomBytes(8).toString('hex')}`;
-        const replyAuthor = resolve(req);
-        // TARGET-058: the BODY alone — the "Re: …" title is generated here, and hashing our own prefix
-        // would describe bytes the author never wrote.
-        const board = await storage.getBoard(boardId);
-        const aiProvenanceId = await provenanceForWrite(storage, {
-            principal: replyAuthor,
-            content: body,
+        // services/board-post.ts — the same reply aimeat_board_reply makes. It carries the board's
+        // ACCESS rule, which this handler did not apply to a reply: it checked only that the parent post
+        // existed, so a reply could land on a board the replier may not post to.
+        const out = await createBoardReply({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, {
+            boardId: req.params.boardId,
+            postId: req.params.postId,
+            body: (req.body ?? {}).body,
             pipeline: 'rest.board_reply',
-            surface: { visibility: board?.visibility === 'public' ? 'public' : 'private', humanAudience: true },
-            labelPolicy: config.aiLabelPublic,
-            nodeId: config.nodeId,
-            baseUrl: config.baseUrl,
-            enabled: config.aiProvenance,
-        });
-        const reply = await storage.createPost({
-            id: replyId,
-            boardId,
-            authorGaii: replyAuthor,
-            title: `Re: ${parent.title}`,
-            body,
-            tags: [],
-            reactions: {},
-            replyTo: postId,
-            createdAt: new Date().toISOString(),
-            aiProvenanceId,
         });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
+            return;
+        }
+        const reply = out.reply;
         res.status(201).json(success(config.nodeId, {
             id: reply.id,
             reply_to: reply.replyTo,
             body: reply.body,
             created_at: reply.createdAt,
         }));
-        emitChange('boards');
     });
     // ───────────────────────────────────────────────
     // Board Subscriptions (§12.3)
     // ───────────────────────────────────────────────
     // POST /v1/boards/:boardId/subscribe — subscribe to a board
     router.post('/v1/boards/:boardId/subscribe', requireAuth(), requireRole('agent'), requireScope('social:read'), async (req, res) => {
+        // services/board-write.ts — the same subscription aimeat_board_subscribe writes, with the
+        // visibility rule, the duplicate refusal and the change event in one place.
         const boardId = req.params.boardId;
-        const board = await storage.getBoard(boardId);
-        if (!board) {
-            res.status(404).json(error(config.nodeId, 'NOT_FOUND', `Board not found: ${boardId}`));
-            return;
-        }
-        const gaii = resolve(req);
-        // Check access for non-public boards (system boards are publicly accessible)
-        // isSameOwner only grants access on shared boards — private boards are strictly owner-only
-        if (board.visibility !== 'public' && board.visibility !== 'system') {
-            const sameOwnerSub = board.visibility === 'shared' && isSameOwner(board.ownerGaii, gaii);
-            if (board.ownerGaii !== gaii && !sameOwnerSub && !board.allowedGaiis.includes(gaii)) {
-                res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'You do not have access to this board'));
-                return;
-            }
-        }
-        // Check if already subscribed
-        const existing = await storage.getBoardSubscription(boardId, gaii);
-        if (existing) {
-            res.status(409).json(error(config.nodeId, 'CONFLICT', 'Already subscribed to this board'));
+        const { callback_url, filters } = req.body ?? {};
+        const out = await subscribeToBoard({ storage, config }, {
+            gaii: resolve(req),
+            roles: req.auth.roles ?? [],
+        }, { boardId, callbackUrl: callback_url, filters });
+        if (!out.ok) {
+            res.status(out.status).json(error(config.nodeId, out.code, out.message));
             return;
         }
-        const { callback_url, filters } = req.body ?? {};
-        const sub = await storage.createBoardSubscription({
-            id: `sub-${randomBytes(8).toString('hex')}`,
-            boardId,
-            gaii,
-            callbackUrl: callback_url,
-            filters,
-            createdAt: new Date().toISOString(),
-        });
+        const sub = out.subscription;
         res.status(201).json(success(config.nodeId, {
             id: sub.id,
             board_id: sub.boardId,
@@ -642,7 +444,6 @@ export function boardsRouter(config, storage) {
             { description: 'Unsubscribe', method: 'DELETE', url: `/v1/boards/${boardId}/subscribe` },
             { description: 'View board posts', method: 'GET', url: `/v1/boards/${boardId}/posts` },
         ]));
-        emitChange('boards');
     });
     // DELETE /v1/boards/:boardId/subscribe — unsubscribe from a board
     router.delete('/v1/boards/:boardId/subscribe', requireAuth(), requireRole('agent'), requireScope('social:read'), async (req, res) => {