libre-webui 0.25.0 → 0.26.0

package/backend/dist/routes/tools.js

@@ -0,0 +1,359 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import express from 'express';
+import { authenticate, requireAdmin, } from '../middleware/auth.js';
+import { ResourcePolicyError } from '../utils/resourceLimits.js';
+import { ToolEgressError } from '../utils/toolEgress.js';
+import { AuthorizationError, } from '../services/authorizationService.js';
+import { McpClientError } from '../services/mcpClientService.js';
+import { OpenApiSpecError } from '../services/openApiToolService.js';
+import { getToolAccessMode, isToolAccessMode, setToolAccessMode, toolAccessModeLockedByEnv, } from '../services/toolAccessService.js';
+import { decideApproval, listPendingApprovals, listStandingApprovals, revokeApproval, } from '../services/toolApprovalService.js';
+import { actorCanUseTools, buildToolCatalog, } from '../services/toolGatewayService.js';
+import { actorCanUseServer, deleteToolServer, deleteToolServerCredential, getToolServer, hasToolServerCredential, listServerTools, listToolServers, listVisibleToolServers, overrideServerTool, refreshToolServer, registerToolServer, setToolServerCredential, updateToolServer, } from '../services/toolServerService.js';
+const router = express.Router();
+router.use(authenticate);
+const userIdOf = (req) => req.user?.userId || 'default';
+const actorOf = (req) => ({
+    userId: userIdOf(req),
+    role: req.user?.role,
+});
+function sendToolError(res, error, fallback) {
+    if (error instanceof ResourcePolicyError) {
+        res.status(error.statusCode).json({ success: false, error: error.message });
+        return;
+    }
+    if (error instanceof AuthorizationError) {
+        res.status(403).json({ success: false, error: error.message });
+        return;
+    }
+    if (error instanceof ToolEgressError ||
+        error instanceof McpClientError ||
+        error instanceof OpenApiSpecError) {
+        res.status(400).json({ success: false, error: error.message });
+        return;
+    }
+    res.status(500).json({
+        success: false,
+        error: error instanceof Error ? error.message : fallback,
+    });
+}
+const notFound = (res) => {
+    res.status(404).json({ success: false, error: 'Not found' });
+};
+/** The reduced server view a non-admin needs to use and authenticate a server. */
+const publicServerView = (server, hasCredential) => ({
+    id: server.id,
+    name: server.name,
+    ...(server.description ? { description: server.description } : {}),
+    kind: server.kind,
+    authMode: server.authMode,
+    enabled: server.enabled,
+    specRevision: server.specRevision,
+    hasCredential,
+});
+const adminServerView = (server, hasCredential) => ({
+    ...publicServerView(server, hasCredential),
+    baseUrl: server.baseUrl,
+    ...(server.specDigest ? { specDigest: server.specDigest } : {}),
+    ...(server.authHeader ? { authHeader: server.authHeader } : {}),
+    accessMode: server.accessMode,
+    timeoutMs: server.timeoutMs,
+    maxResponseBytes: server.maxResponseBytes,
+    createdAt: server.createdAt,
+    updatedAt: server.updatedAt,
+});
+router.get('/access', requireAdmin, async (_req, res) => {
+    try {
+        res.json({
+            success: true,
+            data: {
+                mode: await getToolAccessMode(),
+                lockedByEnv: toolAccessModeLockedByEnv(),
+            },
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to read the tool access mode');
+    }
+});
+router.put('/access', requireAdmin, async (req, res) => {
+    try {
+        if (toolAccessModeLockedByEnv()) {
+            res.status(409).json({
+                success: false,
+                error: 'TOOLS_ACCESS_MODE pins this setting',
+            });
+            return;
+        }
+        const mode = req.body?.mode;
+        if (!isToolAccessMode(mode)) {
+            res
+                .status(400)
+                .json({ success: false, error: 'Invalid tool access mode' });
+            return;
+        }
+        await setToolAccessMode(mode);
+        res.json({ success: true, data: { mode } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to update the tool access mode');
+    }
+});
+router.get('/servers', async (req, res) => {
+    try {
+        const actor = actorOf(req);
+        const isAdmin = actor.role === 'admin';
+        const servers = isAdmin
+            ? await listToolServers()
+            : await listVisibleToolServers(actor);
+        const data = [];
+        for (const server of servers) {
+            const hasCredential = server.authMode === 'none'
+                ? true
+                : await hasToolServerCredential(actor.userId, server.id);
+            data.push(isAdmin
+                ? adminServerView(server, hasCredential)
+                : publicServerView(server, hasCredential));
+        }
+        res.json({ success: true, data });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to list tool servers');
+    }
+});
+router.post('/servers', requireAdmin, async (req, res) => {
+    try {
+        const body = (req.body ?? {});
+        const server = await registerToolServer(userIdOf(req), body);
+        res.status(201).json({
+            success: true,
+            data: adminServerView(server, false),
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to register the tool server');
+    }
+});
+router.get('/servers/:id', async (req, res) => {
+    try {
+        const actor = actorOf(req);
+        const server = await getToolServer(req.params.id);
+        if (!server)
+            return notFound(res);
+        const isAdmin = actor.role === 'admin';
+        if (!isAdmin && !(await actorCanUseServer(actor, server))) {
+            return notFound(res);
+        }
+        const hasCredential = server.authMode === 'none'
+            ? true
+            : await hasToolServerCredential(actor.userId, server.id);
+        const tools = await listServerTools(server.id);
+        res.json({
+            success: true,
+            data: {
+                server: isAdmin
+                    ? adminServerView(server, hasCredential)
+                    : publicServerView(server, hasCredential),
+                tools: tools.map(tool => ({
+                    name: tool.name,
+                    ...(tool.description ? { description: tool.description } : {}),
+                    sideEffect: tool.sideEffect,
+                    enabled: tool.enabled,
+                })),
+            },
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to read the tool server');
+    }
+});
+router.put('/servers/:id', requireAdmin, async (req, res) => {
+    try {
+        const server = await updateToolServer(userIdOf(req), req.params.id, (req.body ?? {}));
+        if (!server)
+            return notFound(res);
+        res.json({
+            success: true,
+            data: adminServerView(server, false),
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to update the tool server');
+    }
+});
+router.delete('/servers/:id', requireAdmin, async (req, res) => {
+    try {
+        const deleted = await deleteToolServer(userIdOf(req), req.params.id);
+        if (!deleted)
+            return notFound(res);
+        res.json({ success: true, data: { deleted: true } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to delete the tool server');
+    }
+});
+router.post('/servers/:id/refresh', requireAdmin, async (req, res) => {
+    try {
+        const server = await refreshToolServer(userIdOf(req), req.params.id);
+        if (!server)
+            return notFound(res);
+        res.json({
+            success: true,
+            data: adminServerView(server, false),
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to refresh the tool server');
+    }
+});
+router.put('/servers/:id/tools/:toolName', requireAdmin, async (req, res) => {
+    try {
+        const body = (req.body ?? {});
+        const tool = await overrideServerTool(userIdOf(req), req.params.id, req.params.toolName, {
+            ...(typeof body.enabled === 'boolean'
+                ? { enabled: body.enabled }
+                : {}),
+            ...(typeof body.sideEffect === 'boolean'
+                ? { sideEffect: body.sideEffect }
+                : {}),
+        });
+        if (!tool)
+            return notFound(res);
+        res.json({
+            success: true,
+            data: {
+                name: tool.name,
+                sideEffect: tool.sideEffect,
+                enabled: tool.enabled,
+            },
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to update the tool');
+    }
+});
+router.put('/servers/:id/credential', async (req, res) => {
+    try {
+        const actor = actorOf(req);
+        const server = await getToolServer(req.params.id);
+        if (!server || !(await actorCanUseServer(actor, server))) {
+            return notFound(res);
+        }
+        const secret = req.body?.secret;
+        if (typeof secret !== 'string') {
+            res
+                .status(400)
+                .json({ success: false, error: 'A credential secret is required' });
+            return;
+        }
+        await setToolServerCredential(actor.userId, server.id, secret);
+        res.json({ success: true, data: { stored: true } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to store the credential');
+    }
+});
+router.delete('/servers/:id/credential', async (req, res) => {
+    try {
+        const deleted = await deleteToolServerCredential(userIdOf(req), req.params.id);
+        if (!deleted)
+            return notFound(res);
+        res.json({ success: true, data: { deleted: true } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to delete the credential');
+    }
+});
+router.get('/approvals', async (req, res) => {
+    try {
+        const userId = userIdOf(req);
+        const [pending, standing] = await Promise.all([
+            listPendingApprovals(userId),
+            listStandingApprovals(userId),
+        ]);
+        res.json({ success: true, data: { pending, standing } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to list approvals');
+    }
+});
+router.post('/approvals/:id', async (req, res) => {
+    try {
+        const body = (req.body ?? {});
+        if (typeof body.approve !== 'boolean') {
+            res
+                .status(400)
+                .json({ success: false, error: 'An approve boolean is required' });
+            return;
+        }
+        const scope = body.scope === 'session' || body.scope === 'always' ? body.scope : 'once';
+        const approval = await decideApproval(userIdOf(req), req.params.id, {
+            approve: body.approve,
+            scope,
+        });
+        if (!approval)
+            return notFound(res);
+        res.json({ success: true, data: approval });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to record the decision');
+    }
+});
+router.delete('/approvals/:id', async (req, res) => {
+    try {
+        const deleted = await revokeApproval(userIdOf(req), req.params.id);
+        if (!deleted)
+            return notFound(res);
+        res.json({ success: true, data: { deleted: true } });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to revoke the approval');
+    }
+});
+router.get('/catalog', async (req, res) => {
+    try {
+        const actor = actorOf(req);
+        if (!(await actorCanUseTools(actor))) {
+            res.json({
+                success: true,
+                data: { available: false, tools: [] },
+            });
+            return;
+        }
+        const catalog = await buildToolCatalog(actor, {});
+        res.json({
+            success: true,
+            data: {
+                available: true,
+                tools: catalog.tools.map(tool => ({
+                    name: tool.name,
+                    ...(tool.description ? { description: tool.description } : {}),
+                    sideEffect: tool.sideEffect,
+                    source: tool.source,
+                    ...(tool.serverId ? { serverId: tool.serverId } : {}),
+                    ...(tool.serverName ? { serverName: tool.serverName } : {}),
+                })),
+            },
+        });
+    }
+    catch (error) {
+        sendToolError(res, error, 'Failed to build the tool catalog');
+    }
+});
+export default router;
+//# sourceMappingURL=tools.js.map

package/backend/dist/routes/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/routes/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,YAAY,EACZ,YAAY,GAEb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,kBAAkB,GAEnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,0BAA0B,EAC1B,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,kCAAkC,CAAC;AAG1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAChC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEzB,MAAM,QAAQ,GAAG,CAAC,GAAyB,EAAU,EAAE,CACrD,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;AAEhC,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAc,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC;IACrB,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,GAAqB,EACrB,KAAc,EACd,QAAgB;IAEhB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IACE,KAAK,YAAY,eAAe;QAChC,KAAK,YAAY,cAAc;QAC/B,KAAK,YAAY,gBAAgB,EACjC,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAC1C,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAE,EAAE;IACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAiB,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,CAAC,MAAkB,EAAE,aAAsB,EAAE,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,YAAY,EAAE,MAAM,CAAC,YAAY;IACjC,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,MAAkB,EAAE,aAAsB,EAAE,EAAE,CAAC,CAAC;IACvE,GAAG,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC,UAAU;IAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;IACzC,SAAS,EAAE,MAAM,CAAC,SAAS;IAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACtD,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,iBAAiB,EAAE;gBAC/B,WAAW,EAAE,yBAAyB,EAAE;aACzC;SACa,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,qCAAqC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC3E,IAAI,CAAC;QACH,IAAI,yBAAyB,EAAE,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qCAAqC;aAC9B,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAI,GAAG,CAAC,IAA2B,EAAE,IAAI,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAiB,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,uCAAuC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO;YACrB,CAAC,CAAC,MAAM,eAAe,EAAE;YACzB,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,aAAa,GACjB,MAAM,CAAC,QAAQ,KAAK,MAAM;gBACxB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CACP,OAAO;gBACL,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC;gBACxC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,CAC5C,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAiB,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CACT,UAAU,EACV,YAAY,EACZ,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,QAAQ,CAAC,GAAG,CAAC,EACb,IAAkC,CACnC,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,aAAa,GACjB,MAAM,CAAC,QAAQ,KAAK,MAAM;YACxB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,MAAM,EAAE,OAAO;oBACb,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC;oBACxC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC;gBAC3C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;aACJ;SACa,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CACR,cAAc,EACd,YAAY,EACZ,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAqB,CACrC,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,CACX,cAAc,EACd,YAAY,EACZ,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,CACxB,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAiB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,YAAY,EACZ,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,CACxB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CACR,8BAA8B,EAC9B,YAAY,EACZ,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAG3B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB,GAAG,CAAC,MAAM,CAAC,QAAkB,EAC7B;YACE,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;SACR,CACF,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACa,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAI,GAAG,CAAC,IAA6B,EAAE,MAAM,CAAC;QAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAiB,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,CACX,yBAAyB,EACzB,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,CACxB,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAiB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,iCAAiC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,oBAAoB,CAAC,MAAM,CAAC;YAC5B,qBAAqB,CAAC,MAAM,CAAC;SAC9B,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAiB,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2C,CAAC;QACxE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,EACvB;YACE,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;SACN,CACF,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAiB,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,CAAC,MAAM,CAAC,EAAY,CACxB,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAiB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;aACvB,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D,CAAC,CAAC;aACJ;SACa,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/backend/dist/routes/tts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tts.d.ts","sourceRoot":"","sources":["../../src/routes/tts.ts"],"names":[],"mappings":"AA+CA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAkjCjB,MAAM"}
+{"version":3,"file":"tts.d.ts","sourceRoot":"","sources":["../../src/routes/tts.ts"],"names":[],"mappings":"AAqDA,QAAA,MAAM,MAAM,4CAAmB,CAAC;eAinCjB,MAAM"}

package/backend/dist/routes/tts.js

@@ -18,15 +18,18 @@ import express from 'express';
 import multer from 'multer';
 import rateLimit from '../middleware/sharedRateLimit.js';
 import pluginService from '../services/pluginService.js';
-import { authenticate } from '../middleware/auth.js';
+import { authenticate, requireFeature, } from '../middleware/auth.js';
+import { budgetGuard } from '../middleware/index.js';
 import { createLogger } from '../utils/logger.js';
 import { parseTTSVoiceCloneUpload, reserveTTSVoiceCloneUpload, TTS_VOICE_CLONE_GLOBAL_MAX_AUDIO_BYTES, TTSVoiceCloneConcurrencyError, TTSVoiceCloneUploadError, validateTTSVoiceCloneAudio, } from '../utils/ttsVoiceCloneUpload.js';
 import { TTSConcurrencyError, TTSProviderResponseError, } from '../services/pluginTTSService.js';
 import voiceProfileService from '../services/voiceProfileService.js';
+import { recordAuditEvent } from '../services/securityAuditService.js';
 import { acquireSharedCapacity, combineAbortSignals, SharedCapacityExceededError, SharedCapacityUnavailableError, } from '../platform/coordination/sharedAdmission.js';
 const logger = createLogger('routes:tts');
 const router = express.Router();
 router.use(authenticate);
+router.use(requireFeature('tts'));
 const TTS_RESPONSE_FORMATS = [
     'mp3',
     'opus',
@@ -165,6 +168,8 @@ async function assertProfileRoutingIsCurrent(profile, plugin, userId) {
     }
 }
 function profileRequestStatus(message) {
+    if (/consent for this saved voice/i.test(message))
+        return 403;
     if (/not found/i.test(message))
         return 404;
     if (/Database is not available/i.test(message))
@@ -175,7 +180,7 @@ function profileRequestStatus(message) {
     return 500;
 }
 /** Metadata only: reference recordings and transcripts are never returned. */
-router.get('/voice-profiles', async (req, res) => {
+router.get('/voice-profiles', requireFeature('voice-cloning'), async (req, res) => {
     try {
         const pluginId = requestString(req.query.pluginId);
         const model = requestString(req.query.model);
@@ -188,12 +193,50 @@ router.get('/voice-profiles', async (req, res) => {
         });
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : 'Failed to list voice profiles';
+        const message = error instanceof Error
+            ? error.message
+            : 'Failed to list voice profiles';
         logger.error('Failed to list voice profiles:', error);
-        res.status(profileRequestStatus(message)).json({ success: false, message });
+        res
+            .status(profileRequestStatus(message))
+            .json({ success: false, message });
+    }
+});
+/** Withdraw consent for a saved voice; the profile row stays as a receipt. */
+router.post('/voice-profiles/:profileId/revoke', requireFeature('voice-cloning'), async (req, res) => {
+    try {
+        const profileId = Array.isArray(req.params.profileId)
+            ? req.params.profileId[0]
+            : req.params.profileId;
+        const userId = authenticatedUserId(req);
+        if (!(await voiceProfileService.revoke(profileId, userId))) {
+            res.status(404).json({
+                success: false,
+                message: 'Voice profile not found or already revoked',
+            });
+            return;
+        }
+        recordAuditEvent({
+            actorUserId: userId,
+            action: 'voice-profile.consent.revoke',
+            targetType: 'voice-profile',
+            targetId: profileId,
+            result: 'success',
+        });
+        res.json({
+            success: true,
+            data: await voiceProfileService.getMetadata(profileId, userId),
+        });
+    }
+    catch (error) {
+        logger.error('Failed to revoke voice profile consent:', error);
+        res.status(500).json({
+            success: false,
+            message: 'Failed to revoke voice profile consent',
+        });
     }
 });
-router.delete('/voice-profiles/:profileId', async (req, res) => {
+router.delete('/voice-profiles/:profileId', requireFeature('voice-cloning'), async (req, res) => {
     try {
         const profileId = Array.isArray(req.params.profileId)
             ? req.params.profileId[0]
@@ -277,7 +320,7 @@ router.get('/voices/:pluginId', async (req, res) => {
  * POST /api/tts/generate
  * Generate speech from text using a TTS plugin
  */
-router.post('/generate', ttsRateLimiter, async (req, res) => {
+router.post('/generate', budgetGuard, ttsRateLimiter, async (req, res) => {
     const requestAbort = requestAbortSignal(req, res);
     try {
         const { model, pluginId, input, voice, voiceProfileId, response_format, speed, } = req.body;
@@ -373,6 +416,9 @@ router.post('/generate', ttsRateLimiter, async (req, res) => {
                 if (!profile)
                     throw new Error('Voice profile not found');
                 await assertProfileRoutingIsCurrent(profile, plugin, userId);
+                // Transfer receipt: the encrypted reference audio is about to be
+                // resent to the provider for this generation.
+                await voiceProfileService.recordTransfer(voiceProfileId, userId);
                 return pluginService.executeVoiceCloneRequest(model, input, profile.referenceAudio, {
                     referenceText: profile.referenceText,
                     response_format: format,
@@ -453,6 +499,9 @@ router.post('/generate', ttsRateLimiter, async (req, res) => {
         else if (errorMessage.includes('Voice profile not found')) {
             statusCode = 404;
         }
+        else if (errorMessage.includes('Consent for this saved voice')) {
+            statusCode = 403;
+        }
         else if (errorMessage.includes('API key not found')) {
             statusCode = 503; // Service unavailable
         }
@@ -478,7 +527,7 @@ router.post('/generate', ttsRateLimiter, async (req, res) => {
  * Generate speech using an ephemeral reference-audio sample. The sample is
  * held in memory only and is never written to storage.
  */
-router.post('/voice-clone', voiceCloneRateLimiter, async (req, res) => {
+router.post('/voice-clone', requireFeature('voice-cloning'), budgetGuard, voiceCloneRateLimiter, async (req, res) => {
     const requestAbort = requestAbortSignal(req, res);
     let uploadSlot;
     try {
@@ -650,7 +699,7 @@ router.post('/voice-clone', voiceCloneRateLimiter, async (req, res) => {
  * Generate speech from text and return as base64 encoded string
  * Useful for frontend playback without streaming
  */
-router.post('/generate-base64', ttsRateLimiter, async (req, res) => {
+router.post('/generate-base64', budgetGuard, ttsRateLimiter, async (req, res) => {
     const requestAbort = requestAbortSignal(req, res);
     try {
         const { model, pluginId, input, voice, voiceProfileId, response_format, speed, } = req.body;
@@ -746,6 +795,9 @@ router.post('/generate-base64', ttsRateLimiter, async (req, res) => {
                 if (!profile)
                     throw new Error('Voice profile not found');
                 await assertProfileRoutingIsCurrent(profile, plugin, userId);
+                // Transfer receipt: the encrypted reference audio is about to be
+                // resent to the provider for this generation.
+                await voiceProfileService.recordTransfer(voiceProfileId, userId);
                 return pluginService.executeVoiceCloneRequest(model, input, profile.referenceAudio, {
                     referenceText: profile.referenceText,
                     response_format: requestedFormat,
@@ -846,6 +898,9 @@ router.post('/generate-base64', ttsRateLimiter, async (req, res) => {
         else if (errorMessage.includes('Voice profile not found')) {
             statusCode = 404;
         }
+        else if (errorMessage.includes('Consent for this saved voice')) {
+            statusCode = 403;
+        }
         else if (errorMessage.includes('API key not found')) {
             statusCode = 503;
         }