harper-kb 0.2.2 → 0.3.0

package/dist/resources/KnowledgeEntryResource.js

@@ -14,6 +14,7 @@
  */
 import { createEntry, getEntry, updateEntry, deprecateEntry, stripEmbedding } from "../core/entries.js";
 import { search, listEntries } from "../core/search.js";
+import { checkAccess } from "../hooks.js";
 function getResourceClass() {
     return globalThis.Resource;
 }
@@ -35,6 +36,16 @@ export class KnowledgeEntryResource extends getResourceClass() {
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user: this.getCurrentUser(),
+            kbId,
+            resource: 'Knowledge',
+            operation: 'read',
+            channel: 'rest',
+        });
+        if (accessResult && !accessResult.allow) {
+            return { status: 403, data: { error: accessResult.reason || 'Access denied' } };
+        }
         const id = this.getId();
         if (id) {
             const entry = await getEntry(String(id));
@@ -84,13 +95,25 @@ export class KnowledgeEntryResource extends getResourceClass() {
      */
     async post(target, data) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
         const kbId = extractKbId(target) || data?.kbId;
         if (!kbId) {
             return { status: 400, data: { error: 'kbId is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'Knowledge',
+            operation: 'write',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else if (!user) {
+            return { status: 401, data: { error: 'Authentication required' } };
+        }
         if (!data?.title || !data?.content) {
             return { status: 400, data: { error: 'title and content are required' } };
         }
@@ -115,9 +138,6 @@ export class KnowledgeEntryResource extends getResourceClass() {
      */
     async put(target, data) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
         const id = this.getId();
         if (!id) {
             return { status: 400, data: { error: 'Entry ID required' } };
@@ -126,6 +146,21 @@ export class KnowledgeEntryResource extends getResourceClass() {
         if (!kbId) {
             return { status: 400, data: { error: 'kbId is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'Knowledge',
+            operation: 'write',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else if (!user) {
+            return { status: 401, data: { error: 'Authentication required' } };
+        }
         if (user.role === 'ai-agent') {
             data.confidence = 'ai-generated';
         }
@@ -157,12 +192,6 @@ export class KnowledgeEntryResource extends getResourceClass() {
      */
     async delete(target) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
-        if (user.role !== 'team') {
-            return { status: 403, data: { error: 'Team role required' } };
-        }
         const id = this.getId();
         if (!id) {
             return { status: 400, data: { error: 'Entry ID required' } };
@@ -171,6 +200,27 @@ export class KnowledgeEntryResource extends getResourceClass() {
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'Knowledge',
+            operation: 'write',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else {
+            // Default behavior: auth + team role
+            if (!user) {
+                return { status: 401, data: { error: 'Authentication required' } };
+            }
+            if (user.role !== 'team') {
+                return { status: 403, data: { error: 'Team role required' } };
+            }
+        }
         // Verify entry belongs to this KB
         const existing = await getEntry(String(id));
         if (!existing || existing.kbId !== kbId) {

package/dist/resources/KnowledgeEntryResource.js.map

@@ -1 +1 @@
-{"version":3,"file":"KnowledgeEntryResource.js","sourceRoot":"","sources":["../../src/resources/KnowledgeEntryResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGxD,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB,EAAE;IAC7D,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,kEAAkE;QAClE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC;QAExD,IAAI,OAAO,CAAC;QACZ,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,OAAO,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO;oBACN,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE;iBAChE,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAiB;YAC5B,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,IAAI;YACJ,KAAK;YACL,OAAO;YACP,IAAI,EAAE,SAA6C;SACnD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAAW,EAAE,IAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC9D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,gDAAgD,EAAE;aACjE,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;QACtD,CAAC;QAED,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,MAAW,EAAE,IAAS;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;QACtD,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,oEAAoE;gBACpE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;gBAC5D,CAAC;gBACD,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC"}
+{"version":3,"file":"KnowledgeEntryResource.js","sourceRoot":"","sources":["../../src/resources/KnowledgeEntryResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB,EAAE;IAC7D,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE;YAC3B,IAAI;YACJ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,kEAAkE;QAClE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC;QAExD,IAAI,OAAO,CAAC;QACZ,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,OAAO,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO;oBACN,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE;iBAChE,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAiB;YAC5B,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,IAAI;YACJ,KAAK;YACL,OAAO;YACP,IAAI,EAAE,SAA6C;SACnD,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAAW,EAAE,IAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;YAC9D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,gDAAgD,EAAE;aACjE,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;QACtD,CAAC;QAED,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,MAAW,EAAE,IAAS;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;QACtD,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,oEAAoE;gBACpE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;gBAC5D,CAAC;gBACD,OAAO,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,qCAAqC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC"}

package/dist/resources/QueryLogResource.d.ts

@@ -14,7 +14,7 @@ export declare class QueryLogResource extends QueryLogResource_base {
     /**
      * GET /QueryLog/?kbId=.. — list query logs, optionally filtered.
      * GET /QueryLog/<id>?kbId=.. — get a single query log entry.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     get(target?: any): Promise<Record<string, unknown> | Record<string, unknown>[]>;
 }

package/dist/resources/QueryLogResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"QueryLogResource.d.ts","sourceRoot":"","sources":["../../src/resources/QueryLogResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;AAUH,qBAAa,gBAAiB,SAAQ,qBAAkB;IACvD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;CAmDtB"}
+{"version":3,"file":"QueryLogResource.d.ts","sourceRoot":"","sources":["../../src/resources/QueryLogResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;AAYH,qBAAa,gBAAiB,SAAQ,qBAAkB;IACvD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;CAgEtB"}

package/dist/resources/QueryLogResource.js

@@ -8,6 +8,7 @@
  *   GET /QueryLog/?kbId=..        — list recent query logs (team role required)
  *   GET /QueryLog/<id>?kbId=..    — get a single query log entry (team role required)
  */
+import { checkAccess } from "../hooks.js";
 function getResourceClass() {
     return globalThis.Resource;
 }
@@ -19,20 +20,34 @@ export class QueryLogResource extends getResourceClass() {
     /**
      * GET /QueryLog/?kbId=.. — list query logs, optionally filtered.
      * GET /QueryLog/<id>?kbId=.. — get a single query log entry.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     async get(target) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
-        if (user.role !== 'team') {
-            return { status: 403, data: { error: 'Team role required' } };
-        }
         const kbId = extractKbId(target);
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'QueryLog',
+            operation: 'read',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else {
+            if (!user) {
+                return { status: 401, data: { error: 'Authentication required' } };
+            }
+            if (user.role !== 'team') {
+                return { status: 403, data: { error: 'Team role required' } };
+            }
+        }
         const id = this.getId();
         if (id) {
             const entry = await databases.kb.QueryLog.get(String(id));

package/dist/resources/QueryLogResource.js.map

@@ -1 +1 @@
-{"version":3,"file":"QueryLogResource.js","sourceRoot":"","sources":["../../src/resources/QueryLogResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB,EAAE;IACvD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,IAAK,KAAa,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjE,MAAM,UAAU,GAIX,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACf,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,UAAU;gBACtB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrD,UAAU;YACV,KAAK;SACL,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC"}
+{"version":3,"file":"QueryLogResource.js","sourceRoot":"","sources":["../../src/resources/QueryLogResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB,EAAE;IACvD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,IAAK,KAAa,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjE,MAAM,UAAU,GAIX,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC;gBACf,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,UAAU;gBACtB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;aAC1B,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrD,UAAU;YACV,KAAK;SACL,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC"}

package/dist/resources/ServiceKeyResource.d.ts

@@ -16,12 +16,12 @@ export declare class ServiceKeyResource extends ServiceKeyResource_base {
     /**
      * GET /ServiceKey/?kbId=.. — list all service keys (keyHash excluded).
      * GET /ServiceKey/<id>?kbId=.. — get a single key (keyHash excluded).
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     get(target?: any): Promise<Record<string, unknown> | Record<string, unknown>[]>;
     /**
      * POST /ServiceKey/?kbId=.. — create a new API key.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      *
      * Body: { name: string, role: "service_account" | "ai_agent", permissions?: object }
      *
@@ -39,7 +39,7 @@ export declare class ServiceKeyResource extends ServiceKeyResource_base {
     }>;
     /**
      * DELETE /ServiceKey/<id>?kbId=.. — delete a service key.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     delete(target?: any): Promise<true | {
         status: number;

package/dist/resources/ServiceKeyResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceKeyResource.d.ts","sourceRoot":"","sources":["../../src/resources/ServiceKeyResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;AA4BH,qBAAa,kBAAmB,SAAQ,uBAAkB;IACzD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;IAsCtB;;;;;;;OAOG;IACG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;;;;;IAiDjC;;;OAGG;IACG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;CA2BzB"}
+{"version":3,"file":"ServiceKeyResource.d.ts","sourceRoot":"","sources":["../../src/resources/ServiceKeyResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;AA6BH,qBAAa,kBAAmB,SAAQ,uBAAkB;IACzD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;IAmDtB;;;;;;;OAOG;IACG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;;;;;IA8DjC;;;OAGG;IACG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;CAwCzB"}

package/dist/resources/ServiceKeyResource.js

@@ -11,6 +11,7 @@
  *   DELETE /ServiceKey/<id>?kbId=..   — delete a key (team role)
  */
 import crypto from 'node:crypto';
+import { checkAccess } from "../hooks.js";
 function getResourceClass() {
     return globalThis.Resource;
 }
@@ -36,20 +37,34 @@ export class ServiceKeyResource extends getResourceClass() {
     /**
      * GET /ServiceKey/?kbId=.. — list all service keys (keyHash excluded).
      * GET /ServiceKey/<id>?kbId=.. — get a single key (keyHash excluded).
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     async get(target) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
-        if (user.role !== 'team') {
-            return { status: 403, data: { error: 'Team role required' } };
-        }
         const kbId = extractKbId(target);
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'ServiceKey',
+            operation: 'read',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else {
+            if (!user) {
+                return { status: 401, data: { error: 'Authentication required' } };
+            }
+            if (user.role !== 'team') {
+                return { status: 403, data: { error: 'Team role required' } };
+            }
+        }
         const id = this.getId();
         if (id) {
             const record = await databases.kb.ServiceKey.get(String(id));
@@ -72,7 +87,7 @@ export class ServiceKeyResource extends getResourceClass() {
     }
     /**
      * POST /ServiceKey/?kbId=.. — create a new API key.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      *
      * Body: { name: string, role: "service_account" | "ai_agent", permissions?: object }
      *
@@ -80,16 +95,30 @@ export class ServiceKeyResource extends getResourceClass() {
      */
     async post(target, data) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
-        if (user.role !== 'team') {
-            return { status: 403, data: { error: 'Team role required' } };
-        }
         const kbId = extractKbId(target) || data?.kbId;
         if (!kbId) {
             return { status: 400, data: { error: 'kbId is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'ServiceKey',
+            operation: 'write',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else {
+            if (!user) {
+                return { status: 401, data: { error: 'Authentication required' } };
+            }
+            if (user.role !== 'team') {
+                return { status: 403, data: { error: 'Team role required' } };
+            }
+        }
         if (!data?.name) {
             return { status: 400, data: { error: 'name is required' } };
         }
@@ -111,7 +140,7 @@ export class ServiceKeyResource extends getResourceClass() {
             keyHash: `${salt}:${hash}`,
             role: data.role,
             permissions: data.permissions || null,
-            createdBy: user.username || user.id || 'unknown',
+            createdBy: user?.username || user?.id || 'unknown',
         };
         await databases.kb.ServiceKey.put(record);
         // Return the record without keyHash, plus the plaintext key (shown only once)
@@ -122,16 +151,10 @@ export class ServiceKeyResource extends getResourceClass() {
     }
     /**
      * DELETE /ServiceKey/<id>?kbId=.. — delete a service key.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     async delete(target) {
         const user = this.getCurrentUser();
-        if (!user) {
-            return { status: 401, data: { error: 'Authentication required' } };
-        }
-        if (user.role !== 'team') {
-            return { status: 403, data: { error: 'Team role required' } };
-        }
         const id = this.getId();
         if (!id) {
             return { status: 400, data: { error: 'Service key ID required' } };
@@ -140,6 +163,26 @@ export class ServiceKeyResource extends getResourceClass() {
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user,
+            kbId,
+            resource: 'ServiceKey',
+            operation: 'write',
+            channel: 'rest',
+        });
+        if (accessResult) {
+            if (!accessResult.allow) {
+                return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+            }
+        }
+        else {
+            if (!user) {
+                return { status: 401, data: { error: 'Authentication required' } };
+            }
+            if (user.role !== 'team') {
+                return { status: 403, data: { error: 'Team role required' } };
+            }
+        }
         const existing = await databases.kb.ServiceKey.get(String(id));
         if (!existing || existing.kbId !== kbId) {
             return { status: 404, data: { error: 'Service key not found' } };

package/dist/resources/ServiceKeyResource.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceKeyResource.js","sourceRoot":"","sources":["../../src/resources/ServiceKeyResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAA+B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC9C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB,EAAE;IACzD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,IAAK,MAAc,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,YAAY;QACZ,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAElE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YACvD,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACtE,KAAK;SACL,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,MAAW,EAAE,IAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE;aAC/D,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAA4B;YACvC,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS;SAChD,CAAC;QAEF,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,8EAA8E;QAC9E,OAAO;YACN,GAAG,WAAW,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,YAAY;SACjB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,IAAK,QAAgB,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC"}
+{"version":3,"file":"ServiceKeyResource.js","sourceRoot":"","sources":["../../src/resources/ServiceKeyResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAA+B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC9C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB,EAAE;IACzD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,IAAK,MAAc,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,YAAY;QACZ,MAAM,UAAU,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,KAAK,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAElE,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YACvD,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACtE,KAAK;SACL,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,MAAW,EAAE,IAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE;aAC/D,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAA4B;YACvC,EAAE;YACF,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,SAAS,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,EAAE,IAAI,SAAS;SAClD,CAAC;QAEF,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE1C,8EAA8E;QAC9E,OAAO;YACN,GAAG,WAAW,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,YAAY;SACjB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;YAC9F,CAAC;QACF,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,IAAK,QAAgB,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC"}

package/dist/resources/TagResource.d.ts

@@ -14,7 +14,7 @@ export declare class TagResource extends TagResource_base {
     /**
      * GET /KnowledgeTag/?kbId=.. — list all tags.
      * GET /KnowledgeTag/<id>?kbId=.. — get a single tag by name.
-     * PUBLIC — no auth required. kbId required.
+     * Default: public. Hook can restrict.
      */
     get(target?: any): Promise<import("../types.ts").KnowledgeTag | import("../types.ts").KnowledgeTag[] | {
         status: number;

package/dist/resources/TagResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TagResource.d.ts","sourceRoot":"","sources":["../../src/resources/TagResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;AAYH,qBAAa,WAAY,SAAQ,gBAAkB;IAClD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;CAiBtB"}
+{"version":3,"file":"TagResource.d.ts","sourceRoot":"","sources":["../../src/resources/TagResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;AAaH,qBAAa,WAAY,SAAQ,gBAAkB;IAClD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;;OAIG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;CA6BtB"}

package/dist/resources/TagResource.js

@@ -9,6 +9,7 @@
  *   GET /KnowledgeTag/<id>?kbId=..   — get a single tag by name (public)
  */
 import { listTags, getTag } from "../core/tags.js";
+import { checkAccess } from "../hooks.js";
 function getResourceClass() {
     return globalThis.Resource;
 }
@@ -20,13 +21,24 @@ export class TagResource extends getResourceClass() {
     /**
      * GET /KnowledgeTag/?kbId=.. — list all tags.
      * GET /KnowledgeTag/<id>?kbId=.. — get a single tag by name.
-     * PUBLIC — no auth required. kbId required.
+     * Default: public. Hook can restrict.
      */
     async get(target) {
         const kbId = extractKbId(target);
         if (!kbId) {
             return { status: 400, data: { error: 'kbId query parameter is required' } };
         }
+        const accessResult = await checkAccess({
+            user: this.getCurrentUser(),
+            kbId,
+            resource: 'KnowledgeTag',
+            operation: 'read',
+            channel: 'rest',
+        });
+        if (accessResult && !accessResult.allow) {
+            const user = this.getCurrentUser();
+            return { status: user ? 403 : 401, data: { error: accessResult.reason || 'Access denied' } };
+        }
         const id = this.getId();
         if (id) {
             const tag = await getTag(kbId, String(id));

package/dist/resources/TagResource.js.map

@@ -1 +1 @@
-{"version":3,"file":"TagResource.js","sourceRoot":"","sources":["../../src/resources/TagResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEnD,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,gBAAgB,EAAE;IAClD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;YAC1D,CAAC;YACD,OAAO,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC"}
+{"version":3,"file":"TagResource.js","sourceRoot":"","sources":["../../src/resources/TagResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,SAAS,gBAAgB;IACxB,OAAQ,UAAkB,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAY;IAChC,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,gBAAgB,EAAE;IAClD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;IAE9B;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAY;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC;YACtC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE;YAC3B,IAAI;YACJ,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC;YAC1D,CAAC;YACD,OAAO,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC"}

package/dist/resources/TriageResource.d.ts

@@ -14,7 +14,7 @@ export declare class TriageResource extends TriageResource_base {
     static loadAsInstance: boolean;
     /**
      * GET /Triage/?kbId=.. — list pending triage items.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      */
     get(target?: any): Promise<import("../types.ts").TriageItem[] | {
         status: number;
@@ -24,7 +24,7 @@ export declare class TriageResource extends TriageResource_base {
     }>;
     /**
      * POST /Triage/?kbId=.. — submit a new triage item.
-     * AUTH REQUIRED: service_account or ai_agent role.
+     * Default: service_account or ai_agent role. Hook can override.
      */
     post(target: any, data: any): Promise<import("../types.ts").TriageItem | {
         status: number;
@@ -34,7 +34,7 @@ export declare class TriageResource extends TriageResource_base {
     }>;
     /**
      * PUT /Triage/<id> — process a triage item.
-     * AUTH REQUIRED: team role only.
+     * Default: team role required. Hook can override.
      *
      * Body should include:
      *   { action: "accepted" | "dismissed" | "linked",

package/dist/resources/TriageResource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TriageResource.d.ts","sourceRoot":"","sources":["../../src/resources/TriageResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;AAaH,qBAAa,cAAe,SAAQ,mBAAkB;IACrD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;OAGG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;IAiBtB;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;IA2BjC;;;;;;;;;OASG;IACG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;CA+CjC"}
+{"version":3,"file":"TriageResource.d.ts","sourceRoot":"","sources":["../../src/resources/TriageResource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;AAcH,qBAAa,cAAe,SAAQ,mBAAkB;IACrD,MAAM,CAAC,cAAc,UAAS;IAE9B;;;OAGG;IACG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG;;;;;;IA8BtB;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;IAwCjC;;;;;;;;;OASG;IACG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;;;;;;CA4DjC"}