studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/server/routes/secrets-api.js

@@ -0,0 +1,308 @@
+/**
+ * Secrets API routes — Phase 7 of the secrets refactor.
+ *
+ * Write-only-from-the-outside contract for secret-classified registry
+ * keys. The value never leaves the server via these endpoints: GET
+ * returns metadata only (label, provider, last_tested_at, …), and the
+ * test-connection probe runs server-side without echoing the value.
+ *
+ *   GET    /api/secrets                       — list metadata
+ *   PUT    /api/secrets/:key                  — set or overwrite (audited)
+ *   DELETE /api/secrets/:key                  — delete (audited)
+ *   POST   /api/secrets/:key/test             — dispatch registry probe
+ *
+ * Owner-only. Bootstrap-classified keys (jwt.secret, master.key, …)
+ * reject with 400 — those live in env-vars only and are not store-
+ * settable. User-secret keys also reject — those live in auth.db per
+ * Phase 8.
+ *
+ * The test endpoint dispatches `def.testConnection(value)` from the
+ * registry. The returned shape is `{ ok: bool, message?: string }` —
+ * server-derived, no upstream error body echoed. Tests are audited
+ * (success + duration), no upstream message in the audit row either.
+ *
+ * After the scope-collapse refactor, requests carry no `scope` /
+ * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
+ * `scope` query param or body field is silently ignored.
+ */
+import { isWorkspaceOwner } from '../../services/auth-service.js';
+import { getKeyDef, getSecretStore, hasSecretStore, notifySecretMutation, } from '../../core/secrets/index.js';
+/**
+ * Test-connection cache.
+ *
+ * Probes are expensive (real network roundtrip) and operators may click
+ * "Test" repeatedly while debugging. We cache the result by key for 60s
+ * and return the cached `{ ok, message, cached: true }` envelope. The
+ * UI surfaces this as a greyed-out "test again in Ns" button.
+ *
+ * Cache lives in-process — fine for v1; per-process Railway services
+ * each carry their own cache, which is the right trade-off (Test =
+ * audit event, so a separate-instance probe still produces an audit
+ * row).
+ */
+const TEST_CACHE_TTL_MS = 60_000;
+const testCache = new Map();
+/**
+ * Test-only hook: clear the process-wide cache. Vitest setups that swap
+ * the store between cases need to call this so a prior test's result
+ * doesn't leak into the next. Underscored to mark it as non-public.
+ */
+export function _resetSecretsTestCache() {
+    testCache.clear();
+}
+function requireOwner(req, authService) {
+    if (!authService.hasUsers())
+        return true;
+    const user = req.user;
+    if (!user)
+        return true; // API key — admin-equivalent (matches connectors-api / config-api)
+    return isWorkspaceOwner(user.role);
+}
+function actorFromReq(req) {
+    const user = req.user;
+    const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        || req.ip;
+    const userAgent = req.headers['user-agent'];
+    if (user)
+        return { type: 'user', userId: String(user.id), ip, userAgent };
+    return { type: 'system', systemId: 'api-token', ip, userAgent };
+}
+/**
+ * Reject classifications that should never go through this API:
+ *   - `bootstrap` — env-only by design
+ *   - `user-*` — handled by auth.db routes (Phase 8)
+ * The remaining secret classification (workspace-secret) is the valid
+ * target.
+ */
+function rejectIfNonStoreSecret(classification) {
+    if (!classification)
+        return 'Unknown classification';
+    if (classification === 'bootstrap')
+        return 'Bootstrap-class keys are set via environment variables, not API';
+    if (classification.startsWith('user-'))
+        return 'User-scope secrets are managed via /api/preferences/settings';
+    if (!classification.endsWith('-secret'))
+        return 'Key is not classified as a secret — use /api/settings instead';
+    return null;
+}
+export async function registerSecretsApiRoutes(fastify, authService) {
+    // ── GET /api/secrets ─────────────────────────────────────────────────────
+    // List metadata. NEVER returns plaintext. The UI uses this to render
+    // the secret list with the actual values masked behind a "set |
+    // overwrite" widget.
+    fastify.get('/api/secrets', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Secrets store not initialized' });
+        }
+        const store = getSecretStore();
+        const rows = store.listSecrets(actorFromReq(req));
+        return reply.send({
+            items: rows.map((r) => ({
+                key: r.key,
+                classification: r.classification,
+                label: r.label,
+                provider: r.provider,
+                last_tested_at: r.lastTestedAt,
+                last_test_result: r.lastTestResult,
+                updated_at: r.updatedAt,
+                updated_by: r.updatedBy,
+                key_version: r.keyVersion,
+            })),
+        });
+    });
+    // ── PUT /api/secrets/:key ────────────────────────────────────────────────
+    // Set or overwrite a secret. Audited. Value validated via registry zod.
+    fastify.put('/api/secrets/:key', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Secrets store not initialized' });
+        }
+        const { key } = req.params;
+        const body = req.body ?? {};
+        const { value, label, provider } = body;
+        if (typeof value !== 'string' || value.length === 0) {
+            return reply.status(400).send({ error: 'body.value must be a non-empty string' });
+        }
+        const def = getKeyDef(key);
+        if (!def)
+            return reply.status(404).send({ error: `Unknown key "${key}"` });
+        const rejection = rejectIfNonStoreSecret(def.classification);
+        if (rejection)
+            return reply.status(400).send({ error: rejection });
+        const parsed = def.validate.safeParse(value);
+        if (!parsed.success) {
+            return reply.status(400).send({
+                error: 'Validation failed',
+                details: parsed.error.issues.map((i) => i.message),
+            });
+        }
+        const store = getSecretStore();
+        const meta = await store.set({ key, value: String(parsed.data), label, provider }, actorFromReq(req));
+        // Invalidate any cached test-result for this key — a fresh value
+        // deserves a fresh probe on the next click.
+        testCache.delete(key);
+        // Notify subscribers (e.g., the agent pool) so cached agents that
+        // captured the prior value can evict and re-create on next chat.
+        notifySecretMutation(key);
+        // Don't echo the value back — we deliberately treat secrets as
+        // write-only-from-the-outside. The UI confirms the write via the
+        // metadata-only response.
+        return reply.send({
+            ok: true,
+            meta: {
+                key: meta.key,
+                classification: meta.classification,
+                label: meta.label,
+                provider: meta.provider,
+                last_tested_at: meta.lastTestedAt,
+                last_test_result: meta.lastTestResult,
+                updated_at: meta.updatedAt,
+                updated_by: meta.updatedBy,
+                key_version: meta.keyVersion,
+            },
+        });
+    });
+    // ── DELETE /api/secrets/:key ─────────────────────────────────────────────
+    fastify.delete('/api/secrets/:key', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Secrets store not initialized' });
+        }
+        const { key } = req.params;
+        const store = getSecretStore();
+        const removed = await store.delete(key, actorFromReq(req));
+        testCache.delete(key);
+        if (removed)
+            notifySecretMutation(key);
+        return reply.send({ removed });
+    });
+    // ── POST /api/secrets/:key/test ──────────────────────────────────────────
+    // Dispatch the registry's testConnection probe. The probe reads the
+    // current value from the store (so the caller doesn't have to send
+    // the value again) and pings the upstream. Result is { ok, message }
+    // — no upstream body echoed. Audited via the store.audit logger so
+    // a failed probe is observable.
+    fastify.post('/api/secrets/:key/test', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Secrets store not initialized' });
+        }
+        const { key } = req.params;
+        const def = getKeyDef(key);
+        if (!def)
+            return reply.status(404).send({ error: `Unknown key "${key}"` });
+        if (!def.testConnection) {
+            return reply.status(400).send({ error: `No test-connection probe registered for "${key}"` });
+        }
+        // Confirm a value exists BEFORE consulting the cache — a deleted /
+        // unset key must always 404, even if a prior test populated the
+        // cache. (Cache invalidation handles the common deletion path, but
+        // some test/CLI flows may bypass it.)
+        const store = getSecretStore();
+        const value = store.unsafeGetForResolver(key);
+        if (!value) {
+            // Defensive: drop any stale cache entry too.
+            testCache.delete(key);
+            return reply.status(404).send({ error: `No value set for "${key}"` });
+        }
+        // Cache hit (within TTL) — return the prior result without re-probing
+        // upstream. UI greys out the button until the cached entry expires.
+        // Cache is per key; setting a new value invalidates it (PUT clears
+        // the cache above via testCache.delete).
+        const cached = testCache.get(key);
+        if (cached && Date.now() - cached.cachedAt < TEST_CACHE_TTL_MS) {
+            return reply.send({
+                ok: cached.ok,
+                message: cached.message,
+                duration_ms: cached.duration_ms,
+                cached: true,
+                last_tested_at: cached.cachedAt,
+                ttl_ms: TEST_CACHE_TTL_MS - (Date.now() - cached.cachedAt),
+                stages: cached.stages,
+                advisory: cached.advisory,
+            });
+        }
+        // Phase 10.5: hand the probe extra context. Today only the Anthropic
+        // probe consumes `model_id` (stage 4: model_in_list). Stub probes
+        // ignore the second arg — TypeScript-wise the registry calls
+        // `def.testConnection(value)` so we widen the call here via `any`.
+        // The probe signature is `(value, ctx?, fetch?) => TestResult`.
+        //
+        // Any model key (`model.<provider>.api_key`) opts into the model.id
+        // context so the probe can check whether the configured model is in
+        // the provider's catalog. Non-model keys (r2.*, search.*) get
+        // undefined context.
+        let contextModelId;
+        if (/^model\.[^.]+\.api_key$/.test(key)) {
+            try {
+                contextModelId = store.unsafeGetForResolver('model.id');
+            }
+            catch { /* no model.id set — probe skips stage 4 */ }
+        }
+        const startedAt = Date.now();
+        let ok = false;
+        let message;
+        let stages;
+        let advisory;
+        try {
+            const probeFn = def.testConnection;
+            const result = await probeFn(value, { model_id: contextModelId });
+            ok = !!result?.ok;
+            message = result?.message;
+            stages = result?.stages;
+            advisory = result?.advisory;
+        }
+        catch (err) {
+            ok = false;
+            // Surface a generic message — never echo the upstream error text;
+            // the upstream may include the auth header in its body.
+            message = err instanceof Error ? err.message.slice(0, 200) : 'probe failed';
+        }
+        const duration = Date.now() - startedAt;
+        // Capture cachedAt once so the response and the cache entry agree —
+        // tests assert that a follow-up cached lookup returns the same
+        // last_tested_at value the first call reported.
+        const cachedAt = Date.now();
+        // Populate the cache before the audit/UPDATE side effects so a
+        // follow-up click within TTL hits the cache regardless of write-side
+        // failures.
+        testCache.set(key, { ok, message, duration_ms: duration, cachedAt, stages, advisory });
+        // Persist the last_test_result on the row so the UI's badge stays
+        // consistent across refreshes. Use a direct UPDATE rather than a
+        // setSecret() roundtrip — we don't want to re-encrypt the row.
+        try {
+            store.db
+                .prepare(`UPDATE secrets SET last_tested_at=?, last_test_result=?
+             WHERE key=?`)
+                .run(Date.now(), ok ? 'ok' : 'fail', key);
+        }
+        catch { /* non-fatal — audit captures the test event below */ }
+        store.audit.write({
+            action: 'test',
+            actor: actorFromReq(req),
+            key,
+            success: ok,
+            detail: { duration_ms: duration },
+        });
+        return reply.send({
+            ok,
+            message,
+            duration_ms: duration,
+            cached: false,
+            last_tested_at: cachedAt,
+            ttl_ms: TEST_CACHE_TTL_MS,
+            stages,
+            advisory,
+        });
+    });
+}
+//# sourceMappingURL=secrets-api.js.map

package/dist/server/routes/secrets-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-api.js","sourceRoot":"","sources":["../../../src/server/routes/secrets-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,gCAAgC,CAAC;AACnG,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAajC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,WAAwB;IACjE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,mEAAmE;IAC3F,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAwB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;WAClF,GAAW,CAAC,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;IAClE,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,cAAkC;IAChE,IAAI,CAAC,cAAc;QAAE,OAAO,wBAAwB,CAAC;IACrD,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,iEAAiE,CAAC;IAC7G,IAAI,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,8DAA8D,CAAC;IAC9G,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,+DAA+D,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwB,EACxB,WAAwB;IAExB,4EAA4E;IAC5E,qEAAqE;IACrE,gEAAgE;IAChE,qBAAqB;IACrB,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,YAAY;gBAC9B,gBAAgB,EAAE,CAAC,CAAC,cAAc;gBAClC,UAAU,EAAE,CAAC,CAAC,SAAS;gBACvB,UAAU,EAAE,CAAC,CAAC,SAAS;gBACvB,WAAW,EAAE,CAAC,CAAC,UAAU;aAC1B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,CAAC,GAAG,CAGR,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAK,EAAU,CAAC;QACrC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EACpD,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;QACF,iEAAiE;QACjE,4CAA4C;QAC5C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,kEAAkE;QAClE,iEAAiE;QACjE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,+DAA+D;QAC/D,iEAAiE;QACjE,0BAA0B;QAC1B,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,YAAY;gBACjC,gBAAgB,EAAE,IAAI,CAAC,cAAc;gBACrC,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;gBAC1B,WAAW,EAAE,IAAI,CAAC,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAEX,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO;YAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,gCAAgC;IAChC,OAAO,CAAC,IAAI,CAET,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,GAAG,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,sCAAsC;QACtC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,6CAA6C;YAC7C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,GAAG,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,yCAAyC;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,iBAAiB,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,IAAI;gBACZ,cAAc,EAAE,MAAM,CAAC,QAAQ;gBAC/B,MAAM,EAAE,iBAAiB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,6DAA6D;QAC7D,mEAAmE;QACnE,gEAAgE;QAChE,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,8DAA8D;QAC9D,qBAAqB;QACrB,IAAI,cAAkC,CAAC;QACvC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,cAAc,GAAG,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC,CAAC,2CAA2C,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,IAAI,OAA2B,CAAC;QAChC,IAAI,MAAe,CAAC;QACpB,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,cAGkE,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAgB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;YAC7E,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;YAC1B,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;YACxB,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,GAAG,KAAK,CAAC;YACX,kEAAkE;YAClE,wDAAwD;YACxD,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,oEAAoE;QACpE,+DAA+D;QAC/D,gDAAgD;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,+DAA+D;QAC/D,qEAAqE;QACrE,YAAY;QACZ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvF,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,IAAI,CAAC;YACF,KAAa,CAAC,EAAE;iBACd,OAAO,CACN;yBACe,CAChB;iBACA,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QACjE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;YAChB,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;YACxB,GAAG;YACH,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;SAClC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,EAAE;YACF,OAAO;YACP,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,KAAK;YACb,cAAc,EAAE,QAAQ;YACxB,MAAM,EAAE,iBAAiB;YACzB,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/settings-api.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Settings API routes — Phase 7 of the secrets refactor.
+ *
+ * Exposes the non-secret half of the encrypted store: registry-classified
+ * `*-setting` keys (model.id, model.provider, r2.bucket, search.google.cx,
+ * etc.). Secret keys are NOT served here — they live behind `/api/secrets`,
+ * which never returns plaintext values.
+ *
+ * Owner-only via the existing `isWorkspaceOwner()` helper. Matches the
+ * authorization matrix in plan §3: workspace settings are
+ * workspace-owner-only; members get 403.
+ *
+ * The routes register unconditionally now that Phase 6 has shipped.
+ * Historically they were gated on `STUDIOGRAPH_NEW_STORE === '1'`; that
+ * flag was removed once the encrypted store became the unconditional
+ * source of truth. Handlers still return 503 if the store singleton
+ * isn't initialized for some reason (test harness, early boot).
+ *
+ * Every mutation goes through the underlying SettingsStore, which audits
+ * `set`/`delete` automatically. Audit reads land via the `/api/audit`
+ * endpoint in audit-api.ts.
+ *
+ * After the scope-collapse refactor, requests carry no `scope` /
+ * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
+ * `scope` query param or body field is silently ignored.
+ */
+import type { FastifyInstance } from 'fastify';
+import { type AuthService } from '../../services/auth-service.js';
+export declare function registerSettingsApiRoutes(fastify: FastifyInstance, authService: AuthService): Promise<void>;

package/dist/server/routes/settings-api.js

@@ -0,0 +1,180 @@
+/**
+ * Settings API routes — Phase 7 of the secrets refactor.
+ *
+ * Exposes the non-secret half of the encrypted store: registry-classified
+ * `*-setting` keys (model.id, model.provider, r2.bucket, search.google.cx,
+ * etc.). Secret keys are NOT served here — they live behind `/api/secrets`,
+ * which never returns plaintext values.
+ *
+ * Owner-only via the existing `isWorkspaceOwner()` helper. Matches the
+ * authorization matrix in plan §3: workspace settings are
+ * workspace-owner-only; members get 403.
+ *
+ * The routes register unconditionally now that Phase 6 has shipped.
+ * Historically they were gated on `STUDIOGRAPH_NEW_STORE === '1'`; that
+ * flag was removed once the encrypted store became the unconditional
+ * source of truth. Handlers still return 503 if the store singleton
+ * isn't initialized for some reason (test harness, early boot).
+ *
+ * Every mutation goes through the underlying SettingsStore, which audits
+ * `set`/`delete` automatically. Audit reads land via the `/api/audit`
+ * endpoint in audit-api.ts.
+ *
+ * After the scope-collapse refactor, requests carry no `scope` /
+ * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
+ * `scope` query param or body field is silently ignored.
+ */
+import { isWorkspaceOwner } from '../../services/auth-service.js';
+import { getAllConsoleUrls, getKeyDef, getSecretStore, hasSecretStore, listWorkspaceSettingsSchema, notifySecretMutation, } from '../../core/secrets/index.js';
+/**
+ * Owner-only gate. Mirrors `requireAdmin()` in config-api.ts but is
+ * stricter: API-key callers without a `req.user` are accepted (matches
+ * existing pattern — Bearer token = admin-equivalent), so the only
+ * rejection path is "logged-in non-owner user".
+ */
+function requireOwner(req, authService) {
+    if (!authService.hasUsers())
+        return true;
+    const user = req.user;
+    if (!user)
+        return true; // API key — admin-equivalent
+    return isWorkspaceOwner(user.role);
+}
+function actorFromReq(req) {
+    const user = req.user;
+    const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
+        || req.ip;
+    const userAgent = req.headers['user-agent'];
+    if (user) {
+        return {
+            type: 'user',
+            userId: String(user.id),
+            ip,
+            userAgent,
+        };
+    }
+    return {
+        type: 'system',
+        systemId: 'api-token',
+        ip,
+        userAgent,
+    };
+}
+export async function registerSettingsApiRoutes(fastify, authService) {
+    // ── GET /api/settings ────────────────────────────────────────────────────
+    // List current setting values. Returns the parsed value as JSON (plain
+    // text — settings are non-secret by classification).
+    fastify.get('/api/settings', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Settings store not initialized' });
+        }
+        const store = getSecretStore();
+        const rows = store.list();
+        // Hydrate JSON values + decorate with registry metadata so the UI
+        // knows what redaction mode applies. Phase 12d (2026-05-12) removed
+        // the `source`/`env_alias` fields — env-shadow no longer exists for
+        // workspace-* keys (resolver is store-only), so they were dead weight.
+        const items = rows.map((r) => {
+            const def = getKeyDef(r.key);
+            let value;
+            try {
+                value = JSON.parse(r.valueJson);
+            }
+            catch {
+                value = r.valueJson;
+            }
+            return {
+                key: r.key,
+                value,
+                classification: def?.classification,
+                redact: def?.redact,
+                updated_at: r.updatedAt,
+                updated_by: r.updatedBy,
+            };
+        });
+        return reply.send({ items });
+    });
+    // ── GET /api/settings/schema ─────────────────────────────────────────────
+    // Static schema for every registered workspace-setting. Drives dropdowns
+    // and other constraint-aware inputs in the settings panels — single
+    // source of truth, so adding a provider to the registry's zod enum
+    // automatically updates the UI without a second edit.
+    //
+    // Separate from GET /api/settings (which returns *stored values*) because
+    // the schema is registry-shape, not store-shape: it lists every key the
+    // user CAN set, including ones with no row in the store yet.
+    fastify.get('/api/settings/schema', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        return reply.send({
+            items: listWorkspaceSettingsSchema(),
+            consoleUrls: getAllConsoleUrls(),
+        });
+    });
+    // ── PUT /api/settings/:key ───────────────────────────────────────────────
+    // Write a setting. Registry-validated: the key must be registered AND
+    // classified as a workspace-setting. Secret keys reject with 400 —
+    // they must go through /api/secrets.
+    fastify.put('/api/settings/:key', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Settings store not initialized' });
+        }
+        const { key } = req.params;
+        const { value } = req.body ?? {};
+        if (value === undefined) {
+            return reply.status(400).send({ error: 'body.value is required' });
+        }
+        const def = getKeyDef(key);
+        if (!def) {
+            return reply.status(404).send({ error: `Unknown key "${key}"` });
+        }
+        if (def.classification.endsWith('-secret')) {
+            return reply.status(400).send({
+                error: `Key "${key}" is classified as a secret — use PUT /api/secrets/${encodeURIComponent(key)}`,
+            });
+        }
+        if (def.classification === 'bootstrap') {
+            return reply.status(400).send({
+                error: `Key "${key}" is bootstrap-class — set via environment variable, not API`,
+            });
+        }
+        // Registry validator catches malformed shapes (e.g. invalid enum for
+        // model.provider). Surfaces a 400 with the zod message.
+        const parsed = def.validate.safeParse(value);
+        if (!parsed.success) {
+            return reply.status(400).send({
+                error: 'Validation failed',
+                details: parsed.error.issues.map((i) => i.message),
+            });
+        }
+        const store = getSecretStore();
+        const meta = await store.set({ key, value: parsed.data }, actorFromReq(req));
+        notifySecretMutation(key);
+        return reply.send({ ok: true, meta });
+    });
+    // ── DELETE /api/settings/:key ────────────────────────────────────────────
+    // Remove a setting. Audit row written. Returns { removed: bool } so
+    // the UI can show "already absent" without an error path.
+    fastify.delete('/api/settings/:key', async (req, reply) => {
+        if (!requireOwner(req, authService)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
+        }
+        if (!hasSecretStore()) {
+            return reply.status(503).send({ error: 'Settings store not initialized' });
+        }
+        const { key } = req.params;
+        const store = getSecretStore();
+        const removed = await store.delete(key, actorFromReq(req));
+        if (removed)
+            notifySecretMutation(key);
+        return reply.send({ removed });
+    });
+}
+//# sourceMappingURL=settings-api.js.map

package/dist/server/routes/settings-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-api.js","sourceRoot":"","sources":["../../../src/server/routes/settings-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,gCAAgC,CAAC;AACnG,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAErC;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAmB,EAAE,WAAwB;IACjE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACrD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAwB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;WAClF,GAAW,CAAC,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;IAClE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,EAAE;YACF,SAAS;SACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,WAAW;QACrB,EAAE;QACF,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,WAAwB;IAExB,4EAA4E;IAC5E,uEAAuE;IACvE,qDAAqD;IACrD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;YAAC,CAAC;YACvE,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK;gBACL,cAAc,EAAE,GAAG,EAAE,cAAc;gBACnC,MAAM,EAAE,GAAG,EAAE,MAAM;gBACnB,UAAU,EAAE,CAAC,CAAC,SAAS;gBACvB,UAAU,EAAE,CAAC,CAAC,SAAS;aACxB,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,mEAAmE;IACnE,sDAAsD;IACtD,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,6DAA6D;IAC7D,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,2BAA2B,EAAE;YACpC,WAAW,EAAE,iBAAiB,EAAE;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,mEAAmE;IACnE,qCAAqC;IACrC,OAAO,CAAC,GAAG,CAGR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,IAAK,EAAU,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,QAAQ,GAAG,sDAAsD,kBAAkB,CAAC,GAAG,CAAC,EAAE;aAClG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,QAAQ,GAAG,8DAA8D;aACjF,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAC3B,YAAY,CAAC,GAAG,CAAC,CAClB,CAAC;QACF,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,oEAAoE;IACpE,0DAA0D;IAC1D,OAAO,CAAC,MAAM,CAEX,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,OAAO;YAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/share-api.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Public read-only share links.
+ *
+ * The app's first anonymous surface. Three routes:
+ *
+ *   POST /api/repos/:repo/entities/:type/:id/share-link   (AUTHED)  — mint/reuse
+ *   GET  /api/share/:token                                (PUBLIC)  — read body
+ *   GET  /api/share/:token/asset/:assetId/:filename       (PUBLIC)  — embedded asset
+ *
+ * Authorization model:
+ *  - Mint is write-gated (mirrors revoke). Personal folders ARE publishable by
+ *    their owner — the publish right is orthogonal to teammate visibility, and
+ *    the single mint caller is already owner-gated. Today read ⟺ write for
+ *    shared folders, so write-gating is a no-op now but keeps publish/unpublish
+ *    coherent and pre-empts a future read-only role from minting a link it
+ *    couldn't revoke.
+ *  - The two PUBLIC routes are bypassed in the global auth hook; the opaque
+ *    token (looked up in share_links, fail-closed on missing/revoked) IS the
+ *    authorization. A revoked token stops resolving for BOTH the body and its
+ *    assets immediately.
+ *  - The public read returns ONLY { title, entityType, content } — frontmatter
+ *    and metadata never cross the boundary (test-enforced). Asset URLs in the
+ *    body are rewritten to token-scoped /api/share/:token/asset/... links.
+ *  - A public asset must be EMBEDDED in the shared entry (and so belong to the
+ *    same repo), so a crafted body can't republish another entry's, another
+ *    repo's, or an un-embedded asset.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { WorkspaceManager } from '../../core/workspace-manager.js';
+import { AuthService } from '../../services/auth-service.js';
+import type { ShareLinkService } from '../../services/share-link-service.js';
+export declare function registerShareApiRoutes(fastify: FastifyInstance, workspaceManager: WorkspaceManager, authService: AuthService, shareLinkService: ShareLinkService): Promise<void>;