devchain-cli 0.23.4 → 0.24.0

package/dist/server/modules/remotes/transport/remote-discovery.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.discoverRuntime = discoverRuntime;
+const node_https_1 = require("node:https");
+const certificate_1 = require("../../../common/tls/certificate");
+const remote_tls_1 = require("./remote-tls");
+const DISCOVERY_PATH = '/api/runtime';
+const MAX_BODY_BYTES = 64 * 1024;
+function discoverRuntime(origin, timeoutMs) {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:') {
+        return Promise.reject(new TypeError('A VM is reached over https only'));
+    }
+    const target = (0, remote_tls_1.vmTlsTarget)(url.hostname, url.port);
+    return new Promise((resolve, reject) => {
+        const req = (0, node_https_1.request)({
+            hostname: target.host,
+            port: target.port,
+            path: DISCOVERY_PATH,
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            agent: false,
+            rejectUnauthorized: false,
+            timeout: timeoutMs,
+        }, (res) => {
+            const peer = res.socket.getPeerCertificate();
+            if (!peer?.raw) {
+                res.destroy();
+                reject(new Error('The peer showed no certificate'));
+                return;
+            }
+            const certificate = (0, certificate_1.normalizeCertificate)(peer.raw);
+            const chunks = [];
+            let size = 0;
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BODY_BYTES) {
+                    res.destroy(new Error('The runtime answer is too large'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on('error', reject);
+            res.on('end', () => {
+                let body = null;
+                try {
+                    body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch {
+                    body = null;
+                }
+                resolve({ status: res.statusCode ?? 0, body, certificate });
+            });
+        });
+        req.on('timeout', () => req.destroy(new Error('The runtime check timed out')));
+        req.on('error', reject);
+        req.end();
+    });
+}
+//# sourceMappingURL=remote-discovery.js.map

package/dist/server/modules/remotes/transport/remote-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-discovery.js","sourceRoot":"","sources":["../../../../src/modules/remotes/transport/remote-discovery.ts"],"names":[],"mappings":";;AAsBA,0CAqDC;AA3ED,2CAAqC;AAErC,iEAAuE;AACvE,6CAA2C;AAE3C,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBjC,SAAgB,eAAe,CAAC,MAAc,EAAE,SAAiB;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,IAAA,oBAAO,EACjB;YACE,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,KAAK,EAAE,KAAK;YAEZ,kBAAkB,EAAE,KAAK;YACzB,OAAO,EAAE,SAAS;SACnB,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,IAAI,GAAI,GAAG,CAAC,MAAoB,CAAC,kBAAkB,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,IAAA,kCAAoB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,IAAI,GAAY,IAAI,CAAC;gBACzB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAC/E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/modules/remotes/transport/remote-proxy-tls.d.ts

@@ -0,0 +1,21 @@
+import { Socket } from 'node:net';
+export type OriginCertificateLookup = (origin: string) => string | null;
+export declare function originKey(host: string, port: string | number | undefined | null): string;
+export declare function originKeyOfUrl(baseUrl: string): string;
+export declare class RemoteOriginUnknownError extends Error {
+    readonly code = "REMOTE_TLS_ORIGIN_UNKNOWN";
+    constructor(origin: string);
+}
+interface UndiciConnectOptions {
+    protocol: string;
+    hostname: string;
+    port: string;
+}
+type UndiciConnectCallback = (error: Error | null, socket: Socket | null) => void;
+export declare function pinnedUndiciConnector(lookup: OriginCertificateLookup): (options: UndiciConnectOptions, callback: UndiciConnectCallback) => void;
+interface WsConnectionOptions {
+    host?: string;
+    port?: string | number;
+}
+export declare function pinnedWsConnection(lookup: OriginCertificateLookup): (options: WsConnectionOptions) => Socket;
+export {};

package/dist/server/modules/remotes/transport/remote-proxy-tls.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteOriginUnknownError = void 0;
+exports.originKey = originKey;
+exports.originKeyOfUrl = originKeyOfUrl;
+exports.pinnedUndiciConnector = pinnedUndiciConnector;
+exports.pinnedWsConnection = pinnedWsConnection;
+const node_net_1 = require("node:net");
+const node_tls_1 = require("node:tls");
+const remote_tls_1 = require("./remote-tls");
+const CONNECT_TIMEOUT_MS = 10_000;
+function originKey(host, port) {
+    const target = (0, remote_tls_1.vmTlsTarget)(host, port);
+    return `${target.host.toLowerCase()}:${target.port}`;
+}
+function originKeyOfUrl(baseUrl) {
+    const url = new URL(baseUrl);
+    return originKey(url.hostname, url.port);
+}
+class RemoteOriginUnknownError extends Error {
+    code = 'REMOTE_TLS_ORIGIN_UNKNOWN';
+    constructor(origin) {
+        super(`No VM certificate is known for ${origin}`);
+    }
+}
+exports.RemoteOriginUnknownError = RemoteOriginUnknownError;
+function openPinned(lookup, protocol, host, port) {
+    if (protocol !== 'https:' && protocol !== 'wss:') {
+        throw new TypeError('A VM is reached over https only');
+    }
+    const origin = originKey(host, port);
+    const certificate = lookup(origin);
+    if (!certificate)
+        throw new RemoteOriginUnknownError(origin);
+    const target = (0, remote_tls_1.vmTlsTarget)(host, port);
+    return (0, node_tls_1.connect)({
+        host: target.host,
+        port: target.port,
+        servername: (0, node_net_1.isIP)(target.host) ? '' : target.host,
+        ALPNProtocols: ['http/1.1'],
+        ...(0, remote_tls_1.pinnedTlsOptions)(certificate),
+    });
+}
+function pinnedUndiciConnector(lookup) {
+    return (options, callback) => {
+        let socket;
+        try {
+            socket = openPinned(lookup, options.protocol, options.hostname, options.port);
+        }
+        catch (error) {
+            queueMicrotask(() => callback(error, null));
+            return;
+        }
+        let settled = false;
+        const settle = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.off('secureConnect', onSecure);
+            socket.off('error', settle);
+            if (error) {
+                socket.destroy();
+                callback(error, null);
+            }
+            else {
+                callback(null, socket);
+            }
+        };
+        const onSecure = () => settle(null);
+        const timer = setTimeout(() => settle(new Error('Connecting to the VM timed out')), CONNECT_TIMEOUT_MS);
+        socket.setNoDelay(true);
+        socket.once('secureConnect', onSecure);
+        socket.once('error', settle);
+    };
+}
+function pinnedWsConnection(lookup) {
+    return (options) => {
+        try {
+            return openPinned(lookup, 'wss:', options.host ?? '', options.port);
+        }
+        catch (error) {
+            const refused = new node_net_1.Socket();
+            process.nextTick(() => refused.destroy(error));
+            return refused;
+        }
+    };
+}
+//# sourceMappingURL=remote-proxy-tls.js.map

package/dist/server/modules/remotes/transport/remote-proxy-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-proxy-tls.js","sourceRoot":"","sources":["../../../../src/modules/remotes/transport/remote-proxy-tls.ts"],"names":[],"mappings":";;;AAUA,8BAGC;AAGD,wCAGC;AAgDD,sDAkCC;AAaD,gDAYC;AA9HD,uCAAwC;AACxC,uCAAiE;AACjE,6CAA6D;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAMlC,SAAgB,SAAS,CAAC,IAAY,EAAE,IAAwC;IAC9E,MAAM,MAAM,GAAG,IAAA,wBAAW,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACvD,CAAC;AAGD,SAAgB,cAAc,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,MAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,YAAY,MAAc;QACxB,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;CACF;AALD,4DAKC;AAOD,SAAS,UAAU,CACjB,MAA+B,EAC/B,QAAgB,EAChB,IAAY,EACZ,IAAiC;IAEjC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAA,wBAAW,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,IAAA,kBAAU,EAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QAEjB,UAAU,EAAE,IAAA,eAAI,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QAChD,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,GAAG,IAAA,6BAAgB,EAAC,WAAW,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAaD,SAAgB,qBAAqB,CACnC,MAA+B;IAE/B,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAc,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,EACzD,kBAAkB,CACnB,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAaD,SAAgB,kBAAkB,CAChC,MAA+B;IAE/B,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,iBAAM,EAAE,CAAC;YAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAc,CAAC,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/modules/remotes/transport/remote-tls.d.ts

@@ -0,0 +1,26 @@
+import type { PeerCertificate } from 'node:tls';
+import type { Remote } from '../../storage/models/domain.models';
+export declare const REMOTE_TLS_CERTIFICATE_MISSING = "REMOTE_TLS_CERTIFICATE_MISSING";
+export declare class RemoteCertificateMismatchError extends Error {
+    readonly code = "ERR_TLS_CERT_FINGERPRINT_MISMATCH";
+    constructor();
+}
+export interface PinnedTlsOptions {
+    readonly ca: string[];
+    readonly rejectUnauthorized: true;
+    readonly checkServerIdentity: (hostname: string, cert: PeerCertificate) => Error | undefined;
+}
+export declare function pinnedTlsOptions(certificatePem: string): PinnedTlsOptions;
+export declare function vmTlsTarget(host: string, port: string | number | undefined | null): {
+    host: string;
+    port: number;
+};
+export type RemoteFetchInit = Omit<RequestInit, 'redirect' | 'dispatcher'> & {
+    duplex?: 'half';
+};
+export declare function remoteFetch(url: string, init: RemoteFetchInit, certificatePem: string): Promise<Response>;
+export declare function requireRemoteTls(remote: Pick<Remote, 'id' | 'name' | 'baseUrl' | 'tlsCertificate'>): {
+    baseUrl: string;
+    certificate: string;
+};
+export declare function requireRemoteCertificate(remote: Pick<Remote, 'id' | 'name' | 'tlsCertificate'>): string;

package/dist/server/modules/remotes/transport/remote-tls.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteCertificateMismatchError = exports.REMOTE_TLS_CERTIFICATE_MISSING = void 0;
+exports.pinnedTlsOptions = pinnedTlsOptions;
+exports.vmTlsTarget = vmTlsTarget;
+exports.remoteFetch = remoteFetch;
+exports.requireRemoteTls = requireRemoteTls;
+exports.requireRemoteCertificate = requireRemoteCertificate;
+const undici_1 = require("undici");
+const error_types_1 = require("../../../common/errors/error-types");
+const certificate_1 = require("../../../common/tls/certificate");
+const remote_address_1 = require("../remote-address");
+exports.REMOTE_TLS_CERTIFICATE_MISSING = 'REMOTE_TLS_CERTIFICATE_MISSING';
+class RemoteCertificateMismatchError extends Error {
+    code = 'ERR_TLS_CERT_FINGERPRINT_MISMATCH';
+    constructor() {
+        super('The VM showed a certificate other than the one this PC trusts');
+    }
+}
+exports.RemoteCertificateMismatchError = RemoteCertificateMismatchError;
+function pinnedTlsOptions(certificatePem) {
+    const fingerprint = (0, certificate_1.certificateFingerprint)(certificatePem);
+    return Object.freeze({
+        ca: [certificatePem],
+        rejectUnauthorized: true,
+        checkServerIdentity: (_hostname, cert) => cert.fingerprint256 && (0, certificate_1.fingerprintHex)(cert.fingerprint256) === fingerprint
+            ? undefined
+            : new RemoteCertificateMismatchError(),
+    });
+}
+function vmTlsTarget(host, port) {
+    return {
+        host: (0, remote_address_1.stripIpv6Brackets)(host),
+        port: port === undefined || port === null || port === '' ? 443 : Number(port),
+    };
+}
+const MAX_AGENTS = 64;
+const agents = new Map();
+function agentFor(certificatePem) {
+    const fingerprint = (0, certificate_1.certificateFingerprint)(certificatePem);
+    const existing = agents.get(fingerprint);
+    if (existing) {
+        agents.delete(fingerprint);
+        agents.set(fingerprint, existing);
+        return existing;
+    }
+    const agent = new undici_1.Agent({ connect: { ...pinnedTlsOptions(certificatePem) } });
+    agents.set(fingerprint, agent);
+    if (agents.size > MAX_AGENTS) {
+        const [oldest, stale] = agents.entries().next().value;
+        agents.delete(oldest);
+        void stale.close().catch(() => undefined);
+    }
+    return agent;
+}
+async function remoteFetch(url, init, certificatePem) {
+    if (new URL(url).protocol !== 'https:') {
+        throw new TypeError('A VM is reached over https only');
+    }
+    const response = await (0, undici_1.fetch)(url, {
+        ...init,
+        redirect: 'error',
+        dispatcher: agentFor(certificatePem),
+    });
+    return response;
+}
+function requireRemoteTls(remote) {
+    return { baseUrl: (0, remote_address_1.requireRemoteAddress)(remote), certificate: requireRemoteCertificate(remote) };
+}
+function requireRemoteCertificate(remote) {
+    if (!remote.tlsCertificate) {
+        throw new error_types_1.ConflictError(`This PC has no certificate for the VM "${remote.name}", so it cannot reach it securely. Add the VM again or reset it.`, { code: exports.REMOTE_TLS_CERTIFICATE_MISSING, remoteId: remote.id });
+    }
+    return remote.tlsCertificate;
+}
+//# sourceMappingURL=remote-tls.js.map

package/dist/server/modules/remotes/transport/remote-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-tls.js","sourceRoot":"","sources":["../../../../src/modules/remotes/transport/remote-tls.ts"],"names":[],"mappings":";;;AA6BA,4CAYC;AAGD,kCAQC;AA+BD,kCAcC;AAGD,4CAIC;AAED,4DAUC;AAnHD,mCAAqD;AACrD,oEAAmE;AACnE,iEAAyF;AAEzF,sDAA4E;AAQ/D,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAE/E,MAAa,8BAA+B,SAAQ,KAAK;IAC9C,IAAI,GAAG,mCAAmC,CAAC;IACpD;QACE,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,CAAC;CACF;AALD,wEAKC;AASD,SAAgB,gBAAgB,CAAC,cAAsB;IACrD,MAAM,WAAW,GAAG,IAAA,oCAAsB,EAAC,cAAc,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,CAAC,cAAc,CAAC;QACpB,kBAAkB,EAAE,IAAa;QAGjC,mBAAmB,EAAE,CAAC,SAAiB,EAAE,IAAqB,EAAE,EAAE,CAChE,IAAI,CAAC,cAAc,IAAI,IAAA,4BAAc,EAAC,IAAI,CAAC,cAAc,CAAC,KAAK,WAAW;YACxE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,8BAA8B,EAAE;KAC3C,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,WAAW,CACzB,IAAY,EACZ,IAAwC;IAExC,OAAO;QACL,IAAI,EAAE,IAAA,kCAAiB,EAAC,IAAI,CAAC;QAC7B,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;KAC9E,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;AAExC,SAAS,QAAQ,CAAC,cAAsB;IACtC,MAAM,WAAW,GAAG,IAAA,oCAAsB,EAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,cAAK,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,gBAAgB,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,KAAwB,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASM,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,IAAqB,EACrB,cAAsB;IAEtB,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,cAAW,EAAC,GAAG,EAAE;QACtC,GAAI,IAA0C;QAC9C,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,QAA+B,CAAC;AACzC,CAAC;AAGD,SAAgB,gBAAgB,CAC9B,MAAkE;IAElE,OAAO,EAAE,OAAO,EAAE,IAAA,qCAAoB,EAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAgB,wBAAwB,CACtC,MAAsD;IAEtD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAAa,CACrB,0CAA0C,MAAM,CAAC,IAAI,kEAAkE,EACvH,EAAE,IAAI,EAAE,sCAA8B,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC"}

package/dist/server/modules/reviews/dtos/review.dto.d.ts

@@ -27,13 +27,13 @@ export declare const CreateReviewSchema: z.ZodObject<{
     createdBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<["user", "agent"]>>>;
     createdByAgentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
-    status: "draft" | "pending" | "changes_requested" | "approved" | "closed";
+    status: "pending" | "draft" | "changes_requested" | "approved" | "closed";
+    mode: "working_tree" | "commit";
     projectId: string;
+    createdBy: "user" | "agent";
     title: string;
-    mode: "commit" | "working_tree";
     baseRef: string;
     headRef: string;
-    createdBy: "agent" | "user";
     description?: string | null | undefined;
     epicId?: string | null | undefined;
     baseSha?: string | null | undefined;
@@ -44,13 +44,13 @@ export declare const CreateReviewSchema: z.ZodObject<{
     title: string;
     baseRef: string;
     headRef: string;
-    status?: "draft" | "pending" | "changes_requested" | "approved" | "closed" | undefined;
+    status?: "pending" | "draft" | "changes_requested" | "approved" | "closed" | undefined;
+    mode?: "working_tree" | "commit" | undefined;
     description?: string | null | undefined;
     epicId?: string | null | undefined;
-    mode?: "commit" | "working_tree" | undefined;
+    createdBy?: "user" | "agent" | undefined;
     baseSha?: string | null | undefined;
     headSha?: string | null | undefined;
-    createdBy?: "agent" | "user" | undefined;
     createdByAgentId?: string | null | undefined;
 }>;
 export type CreateReviewDto = z.infer<typeof CreateReviewSchema>;
@@ -62,13 +62,13 @@ export declare const UpdateReviewSchema: z.ZodObject<{
     version: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
     version: number;
-    status?: "draft" | "pending" | "changes_requested" | "approved" | "closed" | undefined;
+    status?: "pending" | "draft" | "changes_requested" | "approved" | "closed" | undefined;
     description?: string | null | undefined;
     title?: string | undefined;
     headSha?: string | undefined;
 }, {
     version: number;
-    status?: "draft" | "pending" | "changes_requested" | "approved" | "closed" | undefined;
+    status?: "pending" | "draft" | "changes_requested" | "approved" | "closed" | undefined;
     description?: string | null | undefined;
     title?: string | undefined;
     headSha?: string | undefined;
@@ -81,17 +81,17 @@ export declare const ListReviewsQuerySchema: z.ZodObject<{
     limit: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     offset: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, "strip", z.ZodTypeAny, {
+    projectId: string;
     limit: number;
     offset: number;
-    projectId: string;
-    status?: "draft" | "pending" | "changes_requested" | "approved" | "closed" | undefined;
+    status?: "pending" | "draft" | "changes_requested" | "approved" | "closed" | undefined;
     epicId?: string | undefined;
 }, {
     projectId: string;
-    status?: "draft" | "pending" | "changes_requested" | "approved" | "closed" | undefined;
+    status?: "pending" | "draft" | "changes_requested" | "approved" | "closed" | undefined;
+    epicId?: string | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
-    epicId?: string | undefined;
 }>;
 export type ListReviewsQueryDto = z.infer<typeof ListReviewsQuerySchema>;
 export declare const CreateCommentSchema: z.ZodObject<{
@@ -110,26 +110,26 @@ export declare const CreateCommentSchema: z.ZodObject<{
     status: "open" | "resolved" | "wont_fix";
     content: string;
     commentType: "comment" | "suggestion" | "issue" | "approval";
-    authorType: "agent" | "user";
+    authorType: "user" | "agent";
     parentId?: string | null | undefined;
-    authorAgentId?: string | null | undefined;
     filePath?: string | null | undefined;
     lineStart?: number | null | undefined;
     lineEnd?: number | null | undefined;
-    targetAgentIds?: string[] | undefined;
     side?: "new" | "old" | null | undefined;
+    authorAgentId?: string | null | undefined;
+    targetAgentIds?: string[] | undefined;
 }, {
     content: string;
     status?: "open" | "resolved" | "wont_fix" | undefined;
     parentId?: string | null | undefined;
-    commentType?: "comment" | "suggestion" | "issue" | "approval" | undefined;
-    authorType?: "agent" | "user" | undefined;
-    authorAgentId?: string | null | undefined;
     filePath?: string | null | undefined;
     lineStart?: number | null | undefined;
     lineEnd?: number | null | undefined;
-    targetAgentIds?: string[] | undefined;
     side?: "new" | "old" | null | undefined;
+    commentType?: "comment" | "suggestion" | "issue" | "approval" | undefined;
+    authorType?: "user" | "agent" | undefined;
+    authorAgentId?: string | null | undefined;
+    targetAgentIds?: string[] | undefined;
 }>;
 export type CreateCommentDto = z.infer<typeof CreateCommentSchema>;
 export declare const UpdateCommentSchema: z.ZodObject<{
@@ -171,10 +171,10 @@ export declare const ListCommentsQuerySchema: z.ZodObject<{
     filePath?: string | undefined;
 }, {
     status?: "open" | "resolved" | "wont_fix" | undefined;
-    limit?: number | undefined;
-    offset?: number | undefined;
     parentId?: string | null | undefined;
     filePath?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
 }>;
 export type ListCommentsQueryDto = z.infer<typeof ListCommentsQuerySchema>;
 export declare const ActiveReviewQuerySchema: z.ZodObject<{

package/dist/server/modules/reviews/reviews.module.js

@@ -17,12 +17,20 @@ const events_core_module_1 = require("../events/events-core.module");
 const git_module_1 = require("../git/git.module");
 const agent_message_delivery_module_1 = require("../agent-message-delivery/agent-message-delivery.module");
 const teams_module_1 = require("../teams/teams.module");
+const project_write_admission_module_1 = require("../remotes/admission/project-write-admission.module");
 let ReviewsModule = class ReviewsModule {
 };
 exports.ReviewsModule = ReviewsModule;
 exports.ReviewsModule = ReviewsModule = __decorate([
     (0, common_1.Module)({
-        imports: [storage_module_1.StorageModule, events_core_module_1.EventsCoreModule, git_module_1.GitModule, agent_message_delivery_module_1.AgentMessageDeliveryModule, teams_module_1.TeamsModule],
+        imports: [
+            storage_module_1.StorageModule,
+            events_core_module_1.EventsCoreModule,
+            git_module_1.GitModule,
+            agent_message_delivery_module_1.AgentMessageDeliveryModule,
+            teams_module_1.TeamsModule,
+            project_write_admission_module_1.ProjectWriteAdmissionModule,
+        ],
         controllers: [reviews_controller_1.ReviewsController],
         providers: [reviews_service_1.ReviewsService, review_suggestion_applier_service_1.ReviewSuggestionApplier, review_comment_notifier_subscriber_1.ReviewCommentNotifierSubscriber],
         exports: [reviews_service_1.ReviewsService, review_suggestion_applier_service_1.ReviewSuggestionApplier],

package/dist/server/modules/reviews/reviews.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"reviews.module.js","sourceRoot":"","sources":["../../../src/modules/reviews/reviews.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yEAAqE;AACrE,gEAA4D;AAC5D,oGAAuF;AACvF,yGAAmG;AACnG,8DAA0D;AAC1D,qEAAgE;AAChE,kDAA8C;AAC9C,2GAAqG;AACrG,wDAAoD;AAQ7C,IAAM,aAAa,GAAnB,MAAM,aAAa;CAAG,CAAA;AAAhB,sCAAa;wBAAb,aAAa;IANzB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,8BAAa,EAAE,qCAAgB,EAAE,sBAAS,EAAE,0DAA0B,EAAE,0BAAW,CAAC;QAC9F,WAAW,EAAE,CAAC,sCAAiB,CAAC;QAChC,SAAS,EAAE,CAAC,gCAAc,EAAE,2DAAuB,EAAE,oEAA+B,CAAC;QACrF,OAAO,EAAE,CAAC,gCAAc,EAAE,2DAAuB,CAAC;KACnD,CAAC;GACW,aAAa,CAAG"}
+{"version":3,"file":"reviews.module.js","sourceRoot":"","sources":["../../../src/modules/reviews/reviews.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yEAAqE;AACrE,gEAA4D;AAC5D,oGAAuF;AACvF,yGAAmG;AACnG,8DAA0D;AAC1D,qEAAgE;AAChE,kDAA8C;AAC9C,2GAAqG;AACrG,wDAAoD;AACpD,wGAAkG;AAe3F,IAAM,aAAa,GAAnB,MAAM,aAAa;CAAG,CAAA;AAAhB,sCAAa;wBAAb,aAAa;IAbzB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,8BAAa;YACb,qCAAgB;YAChB,sBAAS;YACT,0DAA0B;YAC1B,0BAAW;YACX,4DAA2B;SAC5B;QACD,WAAW,EAAE,CAAC,sCAAiB,CAAC;QAChC,SAAS,EAAE,CAAC,gCAAc,EAAE,2DAAuB,EAAE,oEAA+B,CAAC;QACrF,OAAO,EAAE,CAAC,gCAAc,EAAE,2DAAuB,CAAC;KACnD,CAAC;GACW,aAAa,CAAG"}

package/dist/server/modules/reviews/services/review-suggestion-applier.service.d.ts

@@ -1,6 +1,7 @@
 import { type StorageService } from '../../storage/interfaces/storage.interface';
 import type { ReviewComment } from '../../storage/models/domain.models';
 import { ReviewsService } from './reviews.service';
+import { ProjectWriteAdmissionService } from '../../remotes/admission/project-write-admission.service';
 export type SuggestionErrorCode = 'COMMENT_NOT_IN_PROJECT' | 'INVALID_SUGGESTION' | 'NO_SUGGESTION' | 'PATH_TRAVERSAL_BLOCKED' | 'SYMLINK_ESCAPE_BLOCKED' | 'INVALID_LINE_BOUNDS' | 'VERSION_CONFLICT';
 export declare class SuggestionApplicationError extends Error {
     readonly code: SuggestionErrorCode;
@@ -23,7 +24,8 @@ export interface ApplySuggestionResult {
 export declare class ReviewSuggestionApplier {
     private readonly storage;
     private readonly reviewsService;
+    private readonly admission;
     private readonly logger;
-    constructor(storage: StorageService, reviewsService: ReviewsService);
+    constructor(storage: StorageService, reviewsService: ReviewsService, admission: ProjectWriteAdmissionService);
     apply(input: ApplySuggestionInput): Promise<ApplySuggestionResult>;
 }

package/dist/server/modules/reviews/services/review-suggestion-applier.service.js

@@ -20,6 +20,7 @@ const storage_interface_1 = require("../../storage/interfaces/storage.interface"
 const reviews_service_1 = require("./reviews.service");
 const error_types_1 = require("../../../common/errors/error-types");
 const path_validation_1 = require("../../../common/validation/path-validation");
+const project_write_admission_service_1 = require("../../remotes/admission/project-write-admission.service");
 class SuggestionApplicationError extends Error {
     code;
     details;
@@ -34,10 +35,12 @@ exports.SuggestionApplicationError = SuggestionApplicationError;
 let ReviewSuggestionApplier = ReviewSuggestionApplier_1 = class ReviewSuggestionApplier {
     storage;
     reviewsService;
+    admission;
     logger = new common_1.Logger(ReviewSuggestionApplier_1.name);
-    constructor(storage, reviewsService) {
+    constructor(storage, reviewsService, admission) {
         this.storage = storage;
         this.reviewsService = reviewsService;
+        this.admission = admission;
     }
     async apply(input) {
         const comment = await this.storage.getReviewComment(input.commentId);
@@ -45,6 +48,7 @@ let ReviewSuggestionApplier = ReviewSuggestionApplier_1 = class ReviewSuggestion
         if (review.projectId !== input.projectId) {
             throw new SuggestionApplicationError('COMMENT_NOT_IN_PROJECT', `Comment ${input.commentId} does not belong to this project`);
         }
+        this.admission.assertWritable(review.projectId);
         if (!comment.filePath || comment.lineStart === null) {
             throw new SuggestionApplicationError('INVALID_SUGGESTION', 'Comment does not have file path or line information');
         }
@@ -115,6 +119,7 @@ exports.ReviewSuggestionApplier = ReviewSuggestionApplier;
 exports.ReviewSuggestionApplier = ReviewSuggestionApplier = ReviewSuggestionApplier_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(storage_interface_1.STORAGE_SERVICE)),
-    __metadata("design:paramtypes", [Object, reviews_service_1.ReviewsService])
+    __metadata("design:paramtypes", [Object, reviews_service_1.ReviewsService,
+        project_write_admission_service_1.ProjectWriteAdmissionService])
 ], ReviewSuggestionApplier);
 //# sourceMappingURL=review-suggestion-applier.service.js.map

package/dist/server/modules/reviews/services/review-suggestion-applier.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-suggestion-applier.service.js","sourceRoot":"","sources":["../../../../src/modules/reviews/services/review-suggestion-applier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,0CAAkD;AAClD,kFAAkG;AAElG,uDAAmD;AACnD,oEAAqE;AACrE,gFAIoD;AAWpD,MAAa,0BAA2B,SAAQ,KAAK;IAEjC;IAEA;IAHlB,YACkB,IAAyB,EACzC,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAqB;QAEzB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AATD,gEASC;AAkBM,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAIU;IACzB;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAC4C,OAAuB,EAChD,cAA8B;QADL,YAAO,GAAP,OAAO,CAAgB;QAChD,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,WAAW,KAAK,CAAC,SAAS,kCAAkC,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAClC,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;QAErD,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,wCAAsB,EAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE;gBACpF,WAAW,EAAE,8BAA8B;aAC5C,CAAC,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,gDAA8B,EAAC,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE;gBACvF,WAAW,EAAE,2BAA2B;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,IAAA,oCAAkB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAAC,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,0BAA0B,CAClC,kBAAkB,EAClB,sCAAsC,KAAK,CAAC,OAAO,aAAa,OAAO,CAAC,OAAO,GAAG,EAClF;gBACE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,OAAO,CAAC,OAAO;aAChC,CACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC;QAExE,MAAM,IAAA,oBAAS,EAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7D,OAAO,CAAC,QAAQ,EAChB,KAAK,CAAC,SAAS,EACf,UAAU,EACV,KAAK,CAAC,OAAO,CACd,CAAC;QAEF,OAAO;YACL,cAAc;YACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa;YACb,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;CACF,CAAA;AAnHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;6CACS,gCAAc;GALtC,uBAAuB,CAmHnC"}
+{"version":3,"file":"review-suggestion-applier.service.js","sourceRoot":"","sources":["../../../../src/modules/reviews/services/review-suggestion-applier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,0CAAkD;AAClD,kFAAkG;AAElG,uDAAmD;AACnD,oEAAqE;AACrE,gFAIoD;AACpD,6GAAuG;AAWvG,MAAa,0BAA2B,SAAQ,KAAK;IAEjC;IAEA;IAHlB,YACkB,IAAyB,EACzC,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAqB;QAEzB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AATD,gEASC;AAkBM,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAIU;IACzB;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAC4C,OAAuB,EAChD,cAA8B,EAC9B,SAAuC;QAFd,YAAO,GAAP,OAAO,CAAgB;QAChD,mBAAc,GAAd,cAAc,CAAgB;QAC9B,cAAS,GAAT,SAAS,CAA8B;IACvD,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAA2B;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9D,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,WAAW,KAAK,CAAC,SAAS,kCAAkC,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEhD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,0BAA0B,CAClC,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;QAErD,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAA,wCAAsB,EAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE;gBACpF,WAAW,EAAE,8BAA8B;aAC5C,CAAC,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,gDAA8B,EAAC,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE;gBACvF,WAAW,EAAE,2BAA2B;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAClC,wBAAwB,EACxB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,OAAO,CACd,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,IAAA,oCAAkB,EAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,0BAA0B,CAAC,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,0BAA0B,CAClC,kBAAkB,EAClB,sCAAsC,KAAK,CAAC,OAAO,aAAa,OAAO,CAAC,OAAO,GAAG,EAClF;gBACE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,OAAO;gBAC9B,cAAc,EAAE,OAAO,CAAC,OAAO;aAChC,CACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC;QAExE,MAAM,IAAA,oBAAS,EAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAC7D,OAAO,CAAC,QAAQ,EAChB,KAAK,CAAC,SAAS,EACf,UAAU,EACV,KAAK,CAAC,OAAO,CACd,CAAC;QAEF,OAAO;YACL,cAAc;YACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa;YACb,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;CACF,CAAA;AArHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;6CACS,gCAAc;QACnB,8DAA4B;GAN/C,uBAAuB,CAqHnC"}

package/dist/server/modules/reviews/services/reviews.service.d.ts

@@ -2,6 +2,7 @@ import { type StorageService, type ListResult } from '../../storage/interfaces/s
 import type { Review, ReviewComment, ReviewCommentTarget, ReviewStatus, ReviewCommentStatus, ReviewMode } from '../../storage/models/domain.models';
 import { EventsService } from '../../events/services/events.service';
 import { GitService } from '../../git/services/git.service';
+import { ProjectWriteAdmissionService } from '../../remotes/admission/project-write-admission.service';
 export interface CreateReviewInput {
     projectId: string;
     epicId?: string | null;
@@ -58,8 +59,9 @@ export declare class ReviewsService {
     private readonly storage;
     private readonly eventsService;
     private readonly gitService;
+    private readonly admission;
     private readonly logger;
-    constructor(storage: StorageService, eventsService: EventsService, gitService: GitService);
+    constructor(storage: StorageService, eventsService: EventsService, gitService: GitService, admission: ProjectWriteAdmissionService);
     createReview(input: CreateReviewInput): Promise<Review>;
     getReview(reviewId: string): Promise<Review & {
         changedFiles?: Awaited<ReturnType<GitService['getChangedFiles']>>;

package/dist/server/modules/reviews/services/reviews.service.js

@@ -19,6 +19,7 @@ const storage_interface_1 = require("../../storage/interfaces/storage.interface"
 const events_service_1 = require("../../events/services/events.service");
 const git_service_1 = require("../../git/services/git.service");
 const error_types_1 = require("../../../common/errors/error-types");
+const project_write_admission_service_1 = require("../../remotes/admission/project-write-admission.service");
 function toStorageMode(mode) {
     return mode === 'working-tree' ? 'working_tree' : 'commit';
 }
@@ -26,14 +27,17 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
     storage;
     eventsService;
     gitService;
+    admission;
     logger = new common_1.Logger(ReviewsService_1.name);
-    constructor(storage, eventsService, gitService) {
+    constructor(storage, eventsService, gitService, admission) {
         this.storage = storage;
         this.eventsService = eventsService;
         this.gitService = gitService;
+        this.admission = admission;
     }
     async createReview(input) {
         const project = await this.storage.getProject(input.projectId);
+        this.admission.assertWritable(project.id);
         const mode = input.mode ?? 'working_tree';
         let baseSha = null;
         let headSha = null;
@@ -136,6 +140,7 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
     }
     async updateReview(reviewId, input, expectedVersion) {
         const before = await this.storage.getReview(reviewId);
+        this.admission.assertWritable(before.projectId);
         const updated = await this.storage.updateReview(reviewId, {
             title: input.title,
             description: input.description,
@@ -240,11 +245,12 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
         return closed;
     }
     async deleteReview(reviewId) {
-        await this.storage.getReview(reviewId);
+        this.admission.assertWritable((await this.storage.getReview(reviewId)).projectId);
         await this.storage.deleteReview(reviewId);
     }
     async createComment(reviewId, input) {
         const review = await this.storage.getReview(reviewId);
+        this.admission.assertWritable(review.projectId);
         let filePath = input.filePath ?? null;
         let lineStart = input.lineStart ?? null;
         let lineEnd = input.lineEnd ?? null;
@@ -365,6 +371,7 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
         const before = await this.verifyCommentOwnership(commentId, reviewId);
         this.verifyUserAuthored(before);
         const review = await this.storage.getReview(reviewId);
+        this.admission.assertWritable(review.projectId);
         const updated = await this.storage.updateReviewComment(commentId, input, expectedVersion);
         if (input.content !== undefined && input.content !== before.content) {
             try {
@@ -397,6 +404,7 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
     async resolveComment(reviewId, commentId, status, expectedVersion) {
         const comment = await this.verifyCommentOwnership(commentId, reviewId);
         const review = await this.storage.getReview(comment.reviewId);
+        this.admission.assertWritable(review.projectId);
         const updated = await this.storage.updateReviewComment(commentId, { status }, expectedVersion);
         try {
             let projectName;
@@ -425,6 +433,7 @@ let ReviewsService = ReviewsService_1 = class ReviewsService {
         const comment = await this.verifyCommentOwnership(commentId, reviewId);
         this.verifyUserAuthored(comment);
         const review = await this.storage.getReview(reviewId);
+        this.admission.assertWritable(review.projectId);
         await this.storage.deleteReviewComment(commentId);
         try {
             let projectName;
@@ -481,6 +490,7 @@ exports.ReviewsService = ReviewsService = ReviewsService_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(storage_interface_1.STORAGE_SERVICE)),
     __metadata("design:paramtypes", [Object, events_service_1.EventsService,
-        git_service_1.GitService])
+        git_service_1.GitService,
+        project_write_admission_service_1.ProjectWriteAdmissionService])
 ], ReviewsService);
 //# sourceMappingURL=reviews.service.js.map