corporateai 0.0.1

package/server/src/routes/authz.ts

@@ -0,0 +1,52 @@
+import type { Request } from "express";
+import { forbidden, unauthorized } from "../errors.js";
+
+export function assertBoard(req: Request) {
+  if (req.actor.type !== "board") {
+    throw forbidden("Board access required");
+  }
+}
+
+export function assertInstanceAdmin(req: Request) {
+  assertBoard(req);
+  if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
+    return;
+  }
+  throw forbidden("Instance admin access required");
+}
+
+export function assertCompanyAccess(req: Request, companyId: string) {
+  if (req.actor.type === "none") {
+    throw unauthorized();
+  }
+  if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
+    throw forbidden("Agent key cannot access another company");
+  }
+  if (req.actor.type === "board" && req.actor.source !== "local_implicit" && !req.actor.isInstanceAdmin) {
+    const allowedCompanies = req.actor.companyIds ?? [];
+    if (!allowedCompanies.includes(companyId)) {
+      throw forbidden("User does not have access to this company");
+    }
+  }
+}
+
+export function getActorInfo(req: Request) {
+  if (req.actor.type === "none") {
+    throw unauthorized();
+  }
+  if (req.actor.type === "agent") {
+    return {
+      actorType: "agent" as const,
+      actorId: req.actor.agentId ?? "unknown-agent",
+      agentId: req.actor.agentId ?? null,
+      runId: req.actor.runId ?? null,
+    };
+  }
+
+  return {
+    actorType: "user" as const,
+    actorId: req.actor.userId ?? "board",
+    agentId: null,
+    runId: req.actor.runId ?? null,
+  };
+}

package/server/src/routes/companies.ts

@@ -0,0 +1,343 @@
+import { Router, type Request } from "express";
+import type { Db } from "@corporateai/db";
+import {
+  companyPortabilityExportSchema,
+  companyPortabilityImportSchema,
+  companyPortabilityPreviewSchema,
+  createCompanySchema,
+  updateCompanyBrandingSchema,
+  updateCompanySchema,
+} from "@corporateai/shared";
+import { forbidden } from "../errors.js";
+import { validate } from "../middleware/validate.js";
+import {
+  accessService,
+  agentService,
+  budgetService,
+  companyPortabilityService,
+  companyService,
+  logActivity,
+} from "../services/index.js";
+import type { StorageService } from "../storage/types.js";
+import { assertBoard, assertCompanyAccess, getActorInfo } from "./authz.js";
+
+export function companyRoutes(db: Db, storage?: StorageService) {
+  const router = Router();
+  const svc = companyService(db);
+  const agents = agentService(db);
+  const portability = companyPortabilityService(db, storage);
+  const access = accessService(db);
+  const budgets = budgetService(db);
+
+  async function assertCanUpdateBranding(req: Request, companyId: string) {
+    assertCompanyAccess(req, companyId);
+    if (req.actor.type === "board") return;
+    if (!req.actor.agentId) throw forbidden("Agent authentication required");
+
+    const actorAgent = await agents.getById(req.actor.agentId);
+    if (!actorAgent || actorAgent.companyId !== companyId) {
+      throw forbidden("Agent key cannot access another company");
+    }
+    if (actorAgent.role !== "ceo") {
+      throw forbidden("Only CEO agents can update company branding");
+    }
+  }
+
+  async function assertCanManagePortability(req: Request, companyId: string, capability: "imports" | "exports") {
+    assertCompanyAccess(req, companyId);
+    if (req.actor.type === "board") return;
+    if (!req.actor.agentId) throw forbidden("Agent authentication required");
+
+    const actorAgent = await agents.getById(req.actor.agentId);
+    if (!actorAgent || actorAgent.companyId !== companyId) {
+      throw forbidden("Agent key cannot access another company");
+    }
+    if (actorAgent.role !== "ceo") {
+      throw forbidden(`Only CEO agents can manage company ${capability}`);
+    }
+  }
+
+  router.get("/", async (req, res) => {
+    assertBoard(req);
+    const result = await svc.list();
+    if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) {
+      res.json(result);
+      return;
+    }
+    const allowed = new Set(req.actor.companyIds ?? []);
+    res.json(result.filter((company) => allowed.has(company.id)));
+  });
+
+  router.get("/stats", async (req, res) => {
+    assertBoard(req);
+    const allowed = req.actor.source === "local_implicit" || req.actor.isInstanceAdmin
+      ? null
+      : new Set(req.actor.companyIds ?? []);
+    const stats = await svc.stats();
+    if (!allowed) {
+      res.json(stats);
+      return;
+    }
+    const filtered = Object.fromEntries(Object.entries(stats).filter(([companyId]) => allowed.has(companyId)));
+    res.json(filtered);
+  });
+
+  // Common malformed path when companyId is empty in "/api/companies/{companyId}/issues".
+  router.get("/issues", (_req, res) => {
+    res.status(400).json({
+      error: "Missing companyId in path. Use /api/companies/{companyId}/issues.",
+    });
+  });
+
+  router.get("/:companyId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    // Allow agents (CEO) to read their own company; board always allowed
+    if (req.actor.type !== "agent") {
+      assertBoard(req);
+    }
+    const company = await svc.getById(companyId);
+    if (!company) {
+      res.status(404).json({ error: "Company not found" });
+      return;
+    }
+    res.json(company);
+  });
+
+  router.post("/:companyId/export", validate(companyPortabilityExportSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const result = await portability.exportBundle(companyId, req.body);
+    res.json(result);
+  });
+
+  router.post("/import/preview", validate(companyPortabilityPreviewSchema), async (req, res) => {
+    assertBoard(req);
+    if (req.body.target.mode === "existing_company") {
+      assertCompanyAccess(req, req.body.target.companyId);
+    }
+    const preview = await portability.previewImport(req.body);
+    res.json(preview);
+  });
+
+  router.post("/import", validate(companyPortabilityImportSchema), async (req, res) => {
+    assertBoard(req);
+    if (req.body.target.mode === "existing_company") {
+      assertCompanyAccess(req, req.body.target.companyId);
+    }
+    const actor = getActorInfo(req);
+    const result = await portability.importBundle(req.body, req.actor.type === "board" ? req.actor.userId : null);
+    await logActivity(db, {
+      companyId: result.company.id,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      action: "company.imported",
+      entityType: "company",
+      entityId: result.company.id,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      details: {
+        include: req.body.include ?? null,
+        agentCount: result.agents.length,
+        warningCount: result.warnings.length,
+        companyAction: result.company.action,
+      },
+    });
+    res.json(result);
+  });
+
+  router.post("/:companyId/exports/preview", validate(companyPortabilityExportSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    await assertCanManagePortability(req, companyId, "exports");
+    const preview = await portability.previewExport(companyId, req.body);
+    res.json(preview);
+  });
+
+  router.post("/:companyId/exports", validate(companyPortabilityExportSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    await assertCanManagePortability(req, companyId, "exports");
+    const result = await portability.exportBundle(companyId, req.body);
+    res.json(result);
+  });
+
+  router.post("/:companyId/imports/preview", validate(companyPortabilityPreviewSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    await assertCanManagePortability(req, companyId, "imports");
+    if (req.body.target.mode === "existing_company" && req.body.target.companyId !== companyId) {
+      throw forbidden("Safe import route can only target the route company");
+    }
+    if (req.body.collisionStrategy === "replace") {
+      throw forbidden("Safe import route does not allow replace collision strategy");
+    }
+    const preview = await portability.previewImport(req.body, {
+      mode: "agent_safe",
+      sourceCompanyId: companyId,
+    });
+    res.json(preview);
+  });
+
+  router.post("/:companyId/imports/apply", validate(companyPortabilityImportSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    await assertCanManagePortability(req, companyId, "imports");
+    if (req.body.target.mode === "existing_company" && req.body.target.companyId !== companyId) {
+      throw forbidden("Safe import route can only target the route company");
+    }
+    if (req.body.collisionStrategy === "replace") {
+      throw forbidden("Safe import route does not allow replace collision strategy");
+    }
+    const actor = getActorInfo(req);
+    const result = await portability.importBundle(req.body, req.actor.type === "board" ? req.actor.userId : null, {
+      mode: "agent_safe",
+      sourceCompanyId: companyId,
+    });
+    await logActivity(db, {
+      companyId: result.company.id,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      entityType: "company",
+      entityId: result.company.id,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.imported",
+      details: {
+        include: req.body.include ?? null,
+        agentCount: result.agents.length,
+        warningCount: result.warnings.length,
+        companyAction: result.company.action,
+        importMode: "agent_safe",
+      },
+    });
+    res.json(result);
+  });
+
+  router.post("/", validate(createCompanySchema), async (req, res) => {
+    assertBoard(req);
+    if (!(req.actor.source === "local_implicit" || req.actor.isInstanceAdmin)) {
+      throw forbidden("Instance admin required");
+    }
+    const company = await svc.create(req.body);
+    await access.ensureMembership(company.id, "user", req.actor.userId ?? "local-board", "owner", "active");
+    await logActivity(db, {
+      companyId: company.id,
+      actorType: "user",
+      actorId: req.actor.userId ?? "board",
+      action: "company.created",
+      entityType: "company",
+      entityId: company.id,
+      details: { name: company.name },
+    });
+    if (company.budgetMonthlyCents > 0) {
+      await budgets.upsertPolicy(
+        company.id,
+        {
+          scopeType: "company",
+          scopeId: company.id,
+          amount: company.budgetMonthlyCents,
+          windowKind: "calendar_month_utc",
+        },
+        req.actor.userId ?? "board",
+      );
+    }
+    res.status(201).json(company);
+  });
+
+  router.patch("/:companyId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+
+    const actor = getActorInfo(req);
+    let body: Record<string, unknown>;
+
+    if (req.actor.type === "agent") {
+      // Only CEO agents may update company branding fields
+      const agentSvc = agentService(db);
+      const actorAgent = req.actor.agentId ? await agentSvc.getById(req.actor.agentId) : null;
+      if (!actorAgent || actorAgent.role !== "ceo") {
+        throw forbidden("Only CEO agents or board users may update company settings");
+      }
+      if (actorAgent.companyId !== companyId) {
+        throw forbidden("Agent key cannot access another company");
+      }
+      body = updateCompanyBrandingSchema.parse(req.body);
+    } else {
+      assertBoard(req);
+      body = updateCompanySchema.parse(req.body);
+    }
+
+    const company = await svc.update(companyId, body);
+    if (!company) {
+      res.status(404).json({ error: "Company not found" });
+      return;
+    }
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.updated",
+      entityType: "company",
+      entityId: companyId,
+      details: body,
+    });
+    res.json(company);
+  });
+
+  router.patch("/:companyId/branding", validate(updateCompanyBrandingSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    await assertCanUpdateBranding(req, companyId);
+    const company = await svc.update(companyId, req.body);
+    if (!company) {
+      res.status(404).json({ error: "Company not found" });
+      return;
+    }
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.branding_updated",
+      entityType: "company",
+      entityId: companyId,
+      details: req.body,
+    });
+    res.json(company);
+  });
+
+  router.post("/:companyId/archive", async (req, res) => {
+    assertBoard(req);
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const company = await svc.archive(companyId);
+    if (!company) {
+      res.status(404).json({ error: "Company not found" });
+      return;
+    }
+    await logActivity(db, {
+      companyId,
+      actorType: "user",
+      actorId: req.actor.userId ?? "board",
+      action: "company.archived",
+      entityType: "company",
+      entityId: companyId,
+    });
+    res.json(company);
+  });
+
+  router.delete("/:companyId", async (req, res) => {
+    assertBoard(req);
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const company = await svc.remove(companyId);
+    if (!company) {
+      res.status(404).json({ error: "Company not found" });
+      return;
+    }
+    res.json({ ok: true });
+  });
+
+  return router;
+}
+

package/server/src/routes/company-skills.ts

@@ -0,0 +1,300 @@
+import { Router, type Request } from "express";
+import type { Db } from "@corporateai/db";
+import {
+  companySkillCreateSchema,
+  companySkillFileUpdateSchema,
+  companySkillImportSchema,
+  companySkillProjectScanRequestSchema,
+} from "@corporateai/shared";
+import { z } from "zod";
+import { validate } from "../middleware/validate.js";
+import { accessService, agentService, companySkillService, logActivity } from "../services/index.js";
+import { forbidden } from "../errors.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
+
+export function companySkillRoutes(db: Db) {
+  const router = Router();
+  const agents = agentService(db);
+  const access = accessService(db);
+  const svc = companySkillService(db);
+  const companySkillCreateSchemaSafe = (companySkillCreateSchema as any)
+    ?? z.object({
+      name: z.string().min(1),
+      slug: z.string().min(1),
+      content: z.string().optional(),
+    });
+  const companySkillFileUpdateSchemaSafe = (companySkillFileUpdateSchema as any)
+    ?? z.object({
+      path: z.string().min(1),
+      content: z.string(),
+    });
+  const companySkillImportSchemaSafe = (companySkillImportSchema as any)
+    ?? z.object({ source: z.string().min(1) });
+  const companySkillProjectScanRequestSchemaSafe = (companySkillProjectScanRequestSchema as any)
+    ?? z.object({ projectId: z.string().min(1).optional() }).passthrough();
+
+  function canCreateAgents(agent: { permissions: Record<string, unknown> | null | undefined }) {
+    if (!agent.permissions || typeof agent.permissions !== "object") return false;
+    return Boolean((agent.permissions as Record<string, unknown>).canCreateAgents);
+  }
+
+  async function assertCanMutateCompanySkills(req: Request, companyId: string) {
+    assertCompanyAccess(req, companyId);
+
+    if (req.actor.type === "board") {
+      if (req.actor.source === "local_implicit" || req.actor.isInstanceAdmin) return;
+      const allowed = await access.canUser(companyId, req.actor.userId, "agents:create");
+      if (!allowed) {
+        throw forbidden("Missing permission: agents:create");
+      }
+      return;
+    }
+
+    if (!req.actor.agentId) {
+      throw forbidden("Agent authentication required");
+    }
+
+    const actorAgent = await agents.getById(req.actor.agentId);
+    if (!actorAgent || actorAgent.companyId !== companyId) {
+      throw forbidden("Agent key cannot access another company");
+    }
+
+    const allowedByGrant = await access.hasPermission(companyId, "agent", actorAgent.id, "agents:create");
+    if (allowedByGrant || canCreateAgents(actorAgent)) {
+      return;
+    }
+
+    throw forbidden("Missing permission: can create agents");
+  }
+
+  router.get("/companies/:companyId/skills", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const result = await svc.list(companyId);
+    res.json(result);
+  });
+
+  router.get("/companies/:companyId/skills/:skillId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    assertCompanyAccess(req, companyId);
+    const result = await svc.detail(companyId, skillId);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+    res.json(result);
+  });
+
+  router.get("/companies/:companyId/skills/:skillId/update-status", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    assertCompanyAccess(req, companyId);
+    const result = await svc.updateStatus(companyId, skillId);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+    res.json(result);
+  });
+
+  router.get("/companies/:companyId/skills/:skillId/files", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    const relativePath = String(req.query.path ?? "SKILL.md");
+    assertCompanyAccess(req, companyId);
+    const result = await svc.readFile(companyId, skillId, relativePath);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+    res.json(result);
+  });
+
+  router.post(
+    "/companies/:companyId/skills",
+    validate(companySkillCreateSchemaSafe),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      await assertCanMutateCompanySkills(req, companyId);
+      const result = await svc.createLocalSkill(companyId, req.body);
+
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: "company.skill_created",
+        entityType: "company_skill",
+        entityId: result.id,
+        details: {
+          slug: result.slug,
+          name: result.name,
+        },
+      });
+
+      res.status(201).json(result);
+    },
+  );
+
+  router.patch(
+    "/companies/:companyId/skills/:skillId/files",
+    validate(companySkillFileUpdateSchemaSafe),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      const skillId = req.params.skillId as string;
+      await assertCanMutateCompanySkills(req, companyId);
+      const result = await svc.updateFile(
+        companyId,
+        skillId,
+        String(req.body.path ?? ""),
+        String(req.body.content ?? ""),
+      );
+
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: "company.skill_file_updated",
+        entityType: "company_skill",
+        entityId: skillId,
+        details: {
+          path: result.path,
+          markdown: result.markdown,
+        },
+      });
+
+      res.json(result);
+    },
+  );
+
+  router.post(
+    "/companies/:companyId/skills/import",
+    validate(companySkillImportSchemaSafe),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      await assertCanMutateCompanySkills(req, companyId);
+      const source = String(req.body.source ?? "");
+      const result = await svc.importFromSource(companyId, source);
+
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: "company.skills_imported",
+        entityType: "company",
+        entityId: companyId,
+        details: {
+          source,
+          importedCount: result.imported.length,
+          importedSlugs: result.imported.map((skill) => skill.slug),
+          warningCount: result.warnings.length,
+        },
+      });
+
+      res.status(201).json(result);
+    },
+  );
+
+  router.post(
+    "/companies/:companyId/skills/scan-projects",
+    validate(companySkillProjectScanRequestSchemaSafe),
+    async (req, res) => {
+      const companyId = req.params.companyId as string;
+      await assertCanMutateCompanySkills(req, companyId);
+      const result = await svc.scanProjectWorkspaces(companyId, req.body);
+
+      const actor = getActorInfo(req);
+      await logActivity(db, {
+        companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        action: "company.skills_scanned",
+        entityType: "company",
+        entityId: companyId,
+        details: {
+          scannedProjects: result.scannedProjects,
+          scannedWorkspaces: result.scannedWorkspaces,
+          discovered: result.discovered,
+          importedCount: result.imported.length,
+          updatedCount: result.updated.length,
+          conflictCount: result.conflicts.length,
+          warningCount: result.warnings.length,
+        },
+      });
+
+      res.json(result);
+    },
+  );
+
+  router.delete("/companies/:companyId/skills/:skillId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    await assertCanMutateCompanySkills(req, companyId);
+    const result = await svc.deleteSkill(companyId, skillId);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.skill_deleted",
+      entityType: "company_skill",
+      entityId: result.id,
+      details: {
+        slug: result.slug,
+        name: result.name,
+      },
+    });
+
+    res.json(result);
+  });
+
+  router.post("/companies/:companyId/skills/:skillId/install-update", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const skillId = req.params.skillId as string;
+    await assertCanMutateCompanySkills(req, companyId);
+    const result = await svc.installUpdate(companyId, skillId);
+    if (!result) {
+      res.status(404).json({ error: "Skill not found" });
+      return;
+    }
+
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      action: "company.skill_update_installed",
+      entityType: "company_skill",
+      entityId: result.id,
+      details: {
+        slug: result.slug,
+        sourceRef: result.sourceRef,
+      },
+    });
+
+    res.json(result);
+  });
+
+  return router;
+}
+