dineway 0.1.4 → 0.1.6

package/src/astro/routes/api/admin/oauth-clients/[id].ts

@@ -10,6 +10,7 @@ import { Role } from "@dineway-ai/auth";
 import type { APIRoute } from "astro";
 import { z } from "zod";
 
+import { rejectApiTokenAuthControlWrite } from "#api/auth-control-guard.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
 import {
 	handleOAuthClientDelete,
@@ -17,6 +18,11 @@ import {
 	handleOAuthClientUpdate,
 } from "#api/handlers/oauth-clients.js";
 import { isParseError, parseBody } from "#api/parse.js";
+import { ALL_VALID_SCOPES } from "#auth/api-tokens.js";
+import {
+	disabledExperimentalSiteContextWorkflowScopes,
+	getExperimentalSiteContextWorkflowScopesDisabledMessage,
+} from "#site-context/experimental-workflows.js";
 
 export const prerender = false;
 
@@ -26,7 +32,7 @@ const updateClientSchema = z.object({
 		.array(z.string().url("Each redirect URI must be a valid URL"))
 		.min(1, "At least one redirect URI is required")
 		.optional(),
-	scopes: z.array(z.string()).nullable().optional(),
+	scopes: z.array(z.enum(ALL_VALID_SCOPES)).nullable().optional(),
 });
 
 /**
@@ -43,6 +49,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		return apiError("FORBIDDEN", "Admin privileges required", 403);
 	}
 
+	const credentialGuard = rejectApiTokenAuthControlWrite(locals, "oauth_clients");
+	if (credentialGuard) return credentialGuard;
+
 	const clientId = params.id;
 	if (!clientId) {
 		return apiError("VALIDATION_ERROR", "Client ID is required", 400);
@@ -66,6 +75,9 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		return apiError("FORBIDDEN", "Admin privileges required", 403);
 	}
 
+	const credentialGuard = rejectApiTokenAuthControlWrite(locals, "oauth_clients");
+	if (credentialGuard) return credentialGuard;
+
 	const clientId = params.id;
 	if (!clientId) {
 		return apiError("VALIDATION_ERROR", "Client ID is required", 400);
@@ -74,6 +86,21 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	try {
 		const body = await parseBody(request, updateClientSchema);
 		if (isParseError(body)) return body;
+		const requestedWorkflowScopes = disabledExperimentalSiteContextWorkflowScopes(
+			body.scopes ?? [],
+		);
+		if (requestedWorkflowScopes.length > 0) {
+			return apiError(
+				"NOT_IMPLEMENTED",
+				getExperimentalSiteContextWorkflowScopesDisabledMessage(),
+				501,
+				{
+					status: "workflow_oauth_client_scopes_disabled",
+					reason: "workflow_oauth_client_scopes_disabled",
+					scopes: requestedWorkflowScopes,
+				},
+			);
+		}
 
 		const result = await handleOAuthClientUpdate(dineway.db, clientId, body);
 		return unwrapResult(result);

package/src/astro/routes/api/admin/oauth-clients/index.ts

@@ -9,9 +9,15 @@ import { Role } from "@dineway-ai/auth";
 import type { APIRoute } from "astro";
 import { z } from "zod";
 
+import { rejectApiTokenAuthControlWrite } from "#api/auth-control-guard.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleOAuthClientCreate, handleOAuthClientList } from "#api/handlers/oauth-clients.js";
 import { isParseError, parseBody } from "#api/parse.js";
+import { ALL_VALID_SCOPES } from "#auth/api-tokens.js";
+import {
+	disabledExperimentalSiteContextWorkflowScopes,
+	getExperimentalSiteContextWorkflowScopesDisabledMessage,
+} from "#site-context/experimental-workflows.js";
 
 export const prerender = false;
 
@@ -24,7 +30,7 @@ const createClientSchema = z.object({
 	redirectUris: z
 		.array(z.string().url("Each redirect URI must be a valid URL"))
 		.min(1, "At least one redirect URI is required"),
-	scopes: z.array(z.string()).optional(),
+	scopes: z.array(z.enum(ALL_VALID_SCOPES)).optional(),
 });
 
 /**
@@ -59,9 +65,27 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		return apiError("FORBIDDEN", "Admin privileges required", 403);
 	}
 
+	const credentialGuard = rejectApiTokenAuthControlWrite(locals, "oauth_clients");
+	if (credentialGuard) return credentialGuard;
+
 	try {
 		const body = await parseBody(request, createClientSchema);
 		if (isParseError(body)) return body;
+		const requestedWorkflowScopes = disabledExperimentalSiteContextWorkflowScopes(
+			body.scopes ?? [],
+		);
+		if (requestedWorkflowScopes.length > 0) {
+			return apiError(
+				"NOT_IMPLEMENTED",
+				getExperimentalSiteContextWorkflowScopesDisabledMessage(),
+				501,
+				{
+					status: "workflow_oauth_client_scopes_disabled",
+					reason: "workflow_oauth_client_scopes_disabled",
+					scopes: requestedWorkflowScopes,
+				},
+			);
+		}
 
 		const result = await handleOAuthClientCreate(dineway.db, body);
 		return unwrapResult(result, 201);

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -5,15 +5,32 @@
  */
 
 import type { APIRoute } from "astro";
+import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handlePluginDisable } from "#api/index.js";
+import {
+	ensureWorkflowHitlRouteRequest,
+	hitlRequiredRouteError,
+	resolveHitlRouteActor,
+} from "#api/hitl-route-helpers.js";
+import { handlePluginDisable, handlePluginGet } from "#api/index.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { setCronTasksEnabled } from "#plugins/cron.js";
+import {
+	logPluginActivity,
+	pluginApiRouteSource,
+	PluginHitlPayloadBuilder,
+	RiskPolicyEvaluator,
+} from "#site-context/index.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals }) => {
+const hitlBodySchema = z.object({
+	hitlRequestId: z.string().min(1).optional(),
+});
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { dineway, user } = locals;
 	const { id } = params;
 
@@ -28,12 +45,47 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
+	const body = await parseOptionalBody(request, hitlBodySchema, {});
+	if (isParseError(body)) return body;
+
+	const current = await handlePluginGet(
+		dineway.db,
+		dineway.configuredPlugins,
+		id,
+		dineway.config.marketplace,
+	);
+	if (!current.success) return unwrapResult(current);
+
+	const actor = resolveHitlRouteActor(locals);
+	const action = await new PluginHitlPayloadBuilder().buildDisableRequest(current.data.item);
+	const decision = await new RiskPolicyEvaluator({
+		db: dineway.db,
+		handlers: dineway,
+	}).evaluateWorkflowHitl({
+		actor: actor.identity,
+		hitlRequestId: body.hitlRequestId,
+		action,
+	});
+	if (!decision.allowed) {
+		const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
+		return hitlRequiredRouteError(decision, ensured);
+	}
+
 	const result = await handlePluginDisable(dineway.db, dineway.configuredPlugins, id);
 
 	if (!result.success) return unwrapResult(result);
 
 	await dineway.setPluginStatus(id, "inactive");
 	await setCronTasksEnabled(dineway.db, id, false);
+	await logPluginActivity(dineway.db, locals, {
+		action: "disabled",
+		pluginId: id,
+		...pluginApiRouteSource("disabled"),
+		summary: `Disabled plugin ${id}`,
+		detail: {
+			hitlRequestId: decision.required ? decision.hitlRequest.id : null,
+		},
+	});
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -5,15 +5,32 @@
  */
 
 import type { APIRoute } from "astro";
+import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handlePluginEnable } from "#api/index.js";
+import {
+	ensureWorkflowHitlRouteRequest,
+	hitlRequiredRouteError,
+	resolveHitlRouteActor,
+} from "#api/hitl-route-helpers.js";
+import { handlePluginEnable, handlePluginGet } from "#api/index.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { setCronTasksEnabled } from "#plugins/cron.js";
+import {
+	logPluginActivity,
+	pluginApiRouteSource,
+	PluginHitlPayloadBuilder,
+	RiskPolicyEvaluator,
+} from "#site-context/index.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals }) => {
+const hitlBodySchema = z.object({
+	hitlRequestId: z.string().min(1).optional(),
+});
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { dineway, user } = locals;
 	const { id } = params;
 
@@ -28,12 +45,47 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
+	const body = await parseOptionalBody(request, hitlBodySchema, {});
+	if (isParseError(body)) return body;
+
+	const current = await handlePluginGet(
+		dineway.db,
+		dineway.configuredPlugins,
+		id,
+		dineway.config.marketplace,
+	);
+	if (!current.success) return unwrapResult(current);
+
+	const actor = resolveHitlRouteActor(locals);
+	const action = await new PluginHitlPayloadBuilder().buildEnableRequest(current.data.item);
+	const decision = await new RiskPolicyEvaluator({
+		db: dineway.db,
+		handlers: dineway,
+	}).evaluateWorkflowHitl({
+		actor: actor.identity,
+		hitlRequestId: body.hitlRequestId,
+		action,
+	});
+	if (!decision.allowed) {
+		const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
+		return hitlRequiredRouteError(decision, ensured);
+	}
+
 	const result = await handlePluginEnable(dineway.db, dineway.configuredPlugins, id);
 
 	if (!result.success) return unwrapResult(result);
 
 	await dineway.setPluginStatus(id, "active");
 	await setCronTasksEnabled(dineway.db, id, true);
+	await logPluginActivity(dineway.db, locals, {
+		action: "enabled",
+		pluginId: id,
+		...pluginApiRouteSource("enabled"),
+		summary: `Enabled plugin ${id}`,
+		detail: {
+			hitlRequestId: decision.required ? decision.hitlRequest.id : null,
+		},
+	});
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/[id]/uninstall.ts

@@ -9,13 +9,25 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handleMarketplaceUninstall } from "#api/index.js";
+import {
+	ensureWorkflowHitlRouteRequest,
+	hitlRequiredRouteError,
+	resolveHitlRouteActor,
+} from "#api/hitl-route-helpers.js";
+import { handleMarketplaceUninstall, handlePluginList } from "#api/index.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import {
+	logPluginActivity,
+	pluginApiRouteSource,
+	PluginHitlPayloadBuilder,
+	RiskPolicyEvaluator,
+} from "#site-context/index.js";
 
 export const prerender = false;
 
 const uninstallBodySchema = z.object({
 	deleteData: z.boolean().optional(),
+	hitlRequestId: z.string().min(1).optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -36,6 +48,34 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const body = await parseOptionalBody(request, uninstallBodySchema, {});
 	if (isParseError(body)) return body;
 
+	const actor = resolveHitlRouteActor(locals);
+	let approvedHitlRequestId: string | null = null;
+	const current = await handlePluginList(
+		dineway.db,
+		dineway.configuredPlugins,
+		dineway.config.marketplace,
+	);
+	if (!current.success) return unwrapResult(current);
+	const plugin = current.data.items.find((item) => item.id === id && item.source === "marketplace");
+	if (plugin) {
+		const action = await new PluginHitlPayloadBuilder().buildUninstallRequest(plugin, {
+			deleteData: body.deleteData ?? false,
+		});
+		const decision = await new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway,
+		}).evaluateWorkflowHitl({
+			actor: actor.identity,
+			hitlRequestId: body.hitlRequestId,
+			action,
+		});
+		if (!decision.allowed) {
+			const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
+			return hitlRequiredRouteError(decision, ensured);
+		}
+		approvedHitlRequestId = decision.required ? decision.hitlRequest.id : null;
+	}
+
 	const result = await handleMarketplaceUninstall(dineway.db, dineway.storage, id, {
 		deleteData: body.deleteData ?? false,
 	});
@@ -43,6 +83,16 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	if (!result.success) return unwrapResult(result);
 
 	await dineway.syncMarketplacePlugins();
+	await logPluginActivity(dineway.db, locals, {
+		action: "uninstalled",
+		pluginId: id,
+		...pluginApiRouteSource("uninstalled"),
+		summary: `Uninstalled plugin ${id}`,
+		detail: {
+			deleteData: body.deleteData ?? false,
+			hitlRequestId: approvedHitlRequestId,
+		},
+	});
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -9,8 +9,19 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handleMarketplaceUpdate } from "#api/index.js";
+import {
+	ensureWorkflowHitlRouteRequest,
+	hitlRequiredRouteError,
+	resolveHitlRouteActor,
+} from "#api/hitl-route-helpers.js";
+import { handleMarketplaceUpdate, handleMarketplaceUpdatePreview } from "#api/index.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import {
+	logPluginActivity,
+	pluginApiRouteSource,
+	PluginHitlPayloadBuilder,
+	RiskPolicyEvaluator,
+} from "#site-context/index.js";
 
 export const prerender = false;
 
@@ -18,6 +29,7 @@ const updateBodySchema = z.object({
 	version: z.string().min(1).optional(),
 	confirmCapabilityChanges: z.boolean().optional(),
 	confirmRouteVisibilityChanges: z.boolean().optional(),
+	hitlRequestId: z.string().min(1).optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -37,6 +49,68 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const body = await parseOptionalBody(request, updateBodySchema, {});
 	if (isParseError(body)) return body;
+	const actor = resolveHitlRouteActor(locals);
+	const evaluator = new RiskPolicyEvaluator({
+		db: dineway.db,
+		handlers: dineway,
+	});
+	let approvedHitlRequestId: string | null = null;
+	let previewDiffs: { hasCapabilityChanges: boolean; hasNewPublicRoutes: boolean } | null = null;
+
+	if (evaluator.requiresWorkflowHitl(actor.identity)) {
+		if (!body.version) {
+			return apiError(
+				"VALIDATION_ERROR",
+				"API-token marketplace updates require an explicit version so the reviewed target is immutable.",
+				400,
+			);
+		}
+
+		const preview = await handleMarketplaceUpdatePreview(
+			dineway.db,
+			dineway.storage,
+			dineway.config.marketplace,
+			id,
+			{ version: body.version },
+		);
+		if (!preview.success) return unwrapResult(preview);
+
+		const action = await new PluginHitlPayloadBuilder().buildMarketplaceUpdateRequest({
+			id: preview.data.pluginId,
+			name: preview.data.name,
+			description: preview.data.description,
+			authorName: preview.data.authorName,
+			version: preview.data.version,
+			minDinewayVersion: preview.data.minDinewayVersion,
+			bundleSize: preview.data.bundleSize,
+			checksum: preview.data.checksum,
+			changelog: preview.data.changelog,
+			capabilities: preview.data.capabilities,
+			status: preview.data.status,
+			auditVerdict: preview.data.auditVerdict,
+			imageAuditVerdict: preview.data.imageAuditVerdict,
+			publishedAt: preview.data.publishedAt,
+			oldVersion: preview.data.oldVersion,
+			capabilityChanges: preview.data.capabilityChanges,
+			routeVisibilityChanges: preview.data.routeVisibilityChanges,
+		});
+		const decision = await evaluator.evaluateWorkflowHitl({
+			actor: actor.identity,
+			hitlRequestId: body.hitlRequestId,
+			action,
+		});
+		if (!decision.allowed) {
+			const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
+			return hitlRequiredRouteError(decision, ensured);
+		}
+		approvedHitlRequestId = decision.hitlRequest.id;
+		previewDiffs = {
+			hasCapabilityChanges:
+				preview.data.capabilityChanges.added.length > 0 ||
+				preview.data.capabilityChanges.removed.length > 0,
+			hasNewPublicRoutes: preview.data.routeVisibilityChanges.newlyPublic.length > 0,
+		};
+	}
 
 	const result = await handleMarketplaceUpdate(
 		dineway.db,
@@ -46,14 +120,35 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		id,
 		{
 			version: body.version,
-			confirmCapabilityChanges: body.confirmCapabilityChanges,
-			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			confirmCapabilityChanges: previewDiffs
+				? previewDiffs.hasCapabilityChanges || body.confirmCapabilityChanges === true
+				: body.confirmCapabilityChanges,
+			confirmRouteVisibilityChanges: previewDiffs
+				? previewDiffs.hasNewPublicRoutes || body.confirmRouteVisibilityChanges === true
+				: body.confirmRouteVisibilityChanges,
 		},
 	);
 
 	if (!result.success) return unwrapResult(result);
 
 	await dineway.syncMarketplacePlugins();
+	await logPluginActivity(dineway.db, locals, {
+		action: "updated",
+		pluginId: id,
+		...pluginApiRouteSource("updated"),
+		summary: `Updated plugin ${id}`,
+		detail: {
+			version: result.data.newVersion,
+			oldVersion: result.data.oldVersion,
+			confirmedCapabilityChanges: previewDiffs
+				? previewDiffs.hasCapabilityChanges
+				: (body.confirmCapabilityChanges ?? false),
+			confirmedRouteVisibilityChanges: previewDiffs
+				? previewDiffs.hasNewPublicRoutes
+				: (body.confirmRouteVisibilityChanges ?? false),
+			hitlRequestId: approvedHitlRequestId,
+		},
+	});
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -9,13 +9,25 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleMarketplaceInstall } from "#api/index.js";
+import {
+	ensureWorkflowHitlRouteRequest,
+	hitlRequiredRouteError,
+	resolveHitlRouteActor,
+} from "#api/hitl-route-helpers.js";
+import { handleMarketplaceInstall, handleMarketplaceInstallPreview } from "#api/index.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import {
+	logPluginActivity,
+	pluginApiRouteSource,
+	PluginHitlPayloadBuilder,
+	RiskPolicyEvaluator,
+} from "#site-context/index.js";
 
 export const prerender = false;
 
 const installBodySchema = z.object({
 	version: z.string().min(1).optional(),
+	hitlRequestId: z.string().min(1).optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -36,6 +48,55 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 		const body = await parseOptionalBody(request, installBodySchema, {});
 		if (isParseError(body)) return body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway,
+		});
+		let approvedHitlRequestId: string | null = null;
+
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			if (!body.version) {
+				return apiError(
+					"VALIDATION_ERROR",
+					"API-token marketplace installs require an explicit version so the reviewed target is immutable.",
+					400,
+				);
+			}
+
+			const preview = await handleMarketplaceInstallPreview(dineway.config.marketplace, id, {
+				version: body.version,
+				siteOrigin: new URL(request.url).origin,
+			});
+			if (!preview.success) return unwrapResult(preview);
+
+			const action = await new PluginHitlPayloadBuilder().buildInstallRequest({
+				id: preview.data.pluginId,
+				name: preview.data.name,
+				description: preview.data.description,
+				authorName: preview.data.authorName,
+				version: preview.data.version,
+				minDinewayVersion: preview.data.minDinewayVersion,
+				bundleSize: preview.data.bundleSize,
+				checksum: preview.data.checksum,
+				changelog: preview.data.changelog,
+				capabilities: preview.data.capabilities,
+				status: preview.data.status,
+				auditVerdict: preview.data.auditVerdict,
+				imageAuditVerdict: preview.data.imageAuditVerdict,
+				publishedAt: preview.data.publishedAt,
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId: body.hitlRequestId,
+				action,
+			});
+			if (!decision.allowed) {
+				const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
+				return hitlRequiredRouteError(decision, ensured);
+			}
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
 
 		const configuredPluginIds = new Set<string>(
 			dineway.configuredPlugins.map((p: { id: string }) => p.id),
@@ -55,6 +116,16 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		if (!result.success) return unwrapResult(result);
 
 		await dineway.syncMarketplacePlugins();
+		await logPluginActivity(dineway.db, locals, {
+			action: "installed",
+			pluginId: id,
+			...pluginApiRouteSource("installed"),
+			summary: `Installed plugin ${id}`,
+			detail: {
+				version: result.data.version,
+				hitlRequestId: approvedHitlRequestId,
+			},
+		});
 
 		return unwrapResult(result, 201);
 	} catch (error) {

package/src/astro/routes/api/admin/review-requests/[id]/index.ts

@@ -0,0 +1,35 @@
+/**
+ * Admin review request detail
+ *
+ * GET /_dineway/api/admin/review-requests/:id - Get a review request
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReviewRequestGet } from "#api/handlers/review-requests.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+
+	if (!id) {
+		return apiError("VALIDATION_ERROR", "Review request ID required", 400);
+	}
+
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "content:edit_any");
+	if (denied) return denied;
+
+	try {
+		const result = await handleReviewRequestGet(dineway.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to fetch review request", "REVIEW_REQUEST_GET_ERROR");
+	}
+};

package/src/astro/routes/api/admin/review-requests/[id]/resolve.ts

@@ -0,0 +1,52 @@
+/**
+ * Admin review request resolution
+ *
+ * POST /_dineway/api/admin/review-requests/:id/resolve - Approve or reject a review request
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReviewRequestResolve } from "#api/handlers/review-requests.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { logReviewRouteActivity, resolveReviewRouteActor } from "#api/review-route-helpers.js";
+import { reviewRequestResolveBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { id } = params;
+
+	if (!id) {
+		return apiError("VALIDATION_ERROR", "Review request ID required", 400);
+	}
+
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "content:edit_any");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, reviewRequestResolveBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleReviewRequestResolve(dineway.db, id, {
+			decision: body.decision,
+			reviewNote: body.reviewNote,
+			actor: resolveReviewRouteActor(locals),
+		});
+		if (!result.success) return unwrapResult(result);
+
+		await logReviewRouteActivity(dineway.db, locals, {
+			actionType: body.decision === "approved" ? "review.approved" : "review.rejected",
+			item: result.data.item,
+		});
+
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to resolve review request", "REVIEW_REQUEST_RESOLVE_ERROR");
+	}
+};