Hynes/Void-Homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): capability enforcement on writes

Browse Source 
Add lib/api/cap.js: requireWrite(entity_type) maps HTTP method to
action, runs canAct, and tags req.capTier as allow|suggest|deny→403.
Mutating routes (pages, projects, tasks, refs, resources, source_docs)
now check req.capTier and either run the repo (allow) or divert to
pending_changes returning 202 (suggest). Owner and worker actors stay
on the allow path. requireOwner helper added for Task 11.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
root
2026-05-31 21:03:52 +10:00
parent 7862d22a03
commit 56805053f0
8 changed files with 225 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/api/routes/pages.js
View File

@@ -5,6 +5,7 @@ import * as links from '../../db/repos/links.js';
import { pool } from '../../db/pool.js';
import { validate } from '../validate.js';
import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const createSchema = z.object({
slug: z.string().min(1).max(128).regex(/^[a-z0-9-]+$/),
@@ -34,10 +35,15 @@ spacesScopedRouter.get('/',
);
spacesScopedRouter.post('/',
requireWrite('page'),
validate({ params: spaceParams, body: createSchema }),
asyncWrap(async (req, res) => {
const payload = { ...req.body, space_id: req.params.space_id };
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'page', action: 'create', payload });
}
try {
const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
const row = await repo.create(payload, req.actor);
res.status(201).json(row);
} catch (e) {
if (e.code === '23503') throw new ValidationError('invalid space or parent', {
@@ -68,20 +74,32 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('page'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('page not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'page', entity_id: req.params.id, action: 'update', payload: req.body
});
}
const row = await repo.update(req.params.id, req.body, req.actor);
res.json(row);
})
);
router.delete('/:id',
requireWrite('page'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('page not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'page', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})

20
lib/api/routes/projects.js
View File

@@ -3,6 +3,7 @@ import { z } from 'zod';
import * as repo from '../../db/repos/projects.js';
import { validate } from '../validate.js';
import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const STATUSES = ['idea', 'active', 'paused', 'done', 'abandoned'];
@@ -37,10 +38,15 @@ spacesScopedRouter.get('/',
);
spacesScopedRouter.post('/',
requireWrite('project'),
validate({ params: spaceParams, body: createSchema }),
asyncWrap(async (req, res) => {
const payload = { ...req.body, space_id: req.params.space_id };
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'project', action: 'create', payload });
}
try {
const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
const row = await repo.create(payload, req.actor);
res.status(201).json(row);
} catch (e) {
if (e.code === '23503') throw new ValidationError('invalid space', { space_id: req.params.space_id });
@@ -59,20 +65,32 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('project'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('project not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'project', entity_id: req.params.id, action: 'update', payload: req.body
});
}
const row = await repo.update(req.params.id, req.body, req.actor);
res.json(row);
})
);
router.delete('/:id',
requireWrite('project'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('project not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'project', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})

21
lib/api/routes/refs.js
View File

@@ -4,6 +4,7 @@ import * as repo from '../../db/repos/refs.js';
import { validate } from '../validate.js';
import { parsePagination } from '../pagination.js';
import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const KINDS = ['url', 'video', 'pdf', 'image', 'file'];
@@ -56,8 +57,12 @@ router.get('/',
);
router.post('/',
requireWrite('ref'),
validate({ body: createSchema }),
asyncWrap(async (req, res) => {
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'ref', action: 'create', payload: req.body });
}
try {
const row = await repo.create(req.body, req.actor);
res.status(201).json(row);
@@ -69,8 +74,12 @@ router.post('/',
);
router.post('/upsert',
requireWrite('ref'),
validate({ body: upsertSchema }),
asyncWrap(async (req, res) => {
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'ref', action: 'upsert', payload: req.body });
}
try {
const row = await repo.upsertByExternal(req.body, req.actor);
res.json(row);
@@ -91,20 +100,32 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('ref'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('ref not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'ref', entity_id: req.params.id, action: 'update', payload: req.body
});
}
const row = await repo.update(req.params.id, req.body, req.actor);
res.json(row);
})
);
router.delete('/:id',
requireWrite('ref'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('ref not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'ref', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})

33
lib/api/routes/resources.js
View File

@@ -5,6 +5,7 @@ import * as sourceDocs from '../../db/repos/source_docs.js';
import * as audit from '../../db/repos/audit.js';
import { validate } from '../validate.js';
import { NotFoundError, ValidationError, ConflictError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const RUNTIME = ['lxc', 'vm', 'docker', 'bare-metal'];
const STATUSES = ['running', 'stopped', 'down', 'unknown'];
@@ -45,10 +46,15 @@ spacesScopedRouter.get('/',
);
spacesScopedRouter.post('/',
requireWrite('resource'),
validate({ params: spaceParams, body: createSchema }),
asyncWrap(async (req, res) => {
const payload = { ...req.body, space_id: req.params.space_id };
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'resource', action: 'create', payload });
}
try {
const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
const row = await repo.create(payload, req.actor);
res.status(201).json(row);
} catch (e) {
if (e.code === '23503') throw new ValidationError('invalid space', { space_id: req.params.space_id });
@@ -67,30 +73,48 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('resource'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('resource not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'resource', entity_id: req.params.id, action: 'update', payload: req.body
});
}
res.json(await repo.update(req.params.id, req.body, req.actor));
})
);
router.delete('/:id',
requireWrite('resource'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('resource not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'resource', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})
);
router.post('/:id/dependencies',
requireWrite('resource'),
validate({ params: idParams, body: depBody }),
asyncWrap(async (req, res) => {
if (req.params.id === req.body.depends_on) {
throw new ValidationError('resource cannot depend on itself');
}
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'resource', entity_id: req.params.id, action: 'add_dependency', payload: req.body
});
}
try {
await repo.addDependency(req.params.id, req.body.depends_on, req.body.kind);
res.status(201).json({ resource_id: req.params.id, depends_on: req.body.depends_on });
@@ -111,8 +135,15 @@ router.get('/:id/dependencies',
);
router.delete('/:id/dependencies/:dep_id',
requireWrite('resource'),
validate({ params: depParams }),
asyncWrap(async (req, res) => {
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'resource', entity_id: req.params.id, action: 'remove_dependency',
payload: { depends_on: req.params.dep_id }
});
}
await repo.removeDependency(req.params.id, req.params.dep_id);
res.status(204).end();
})

20
lib/api/routes/source_docs.js
View File

@@ -3,6 +3,7 @@ import { z } from 'zod';
import * as repo from '../../db/repos/source_docs.js';
import { validate } from '../validate.js';
import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const baseFields = {
name: z.string().min(1).max(200),
@@ -28,10 +29,15 @@ export const router = Router();
export const resourcesScopedRouter = Router({ mergeParams: true });
resourcesScopedRouter.post('/',
requireWrite('source_doc'),
validate({ params: resourceParams, body: createSchema }),
asyncWrap(async (req, res) => {
const payload = { ...req.body, resource_id: req.params.resource_id };
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'source_doc', action: 'create', payload });
}
try {
const row = await repo.create({ ...req.body, resource_id: req.params.resource_id }, req.actor);
const row = await repo.create(payload, req.actor);
res.status(201).json(row);
} catch (e) {
if (e.code === '23503') throw new ValidationError('invalid resource', {
@@ -52,19 +58,31 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('source_doc'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('source doc not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'source_doc', entity_id: req.params.id, action: 'update', payload: req.body
});
}
res.json(await repo.update(req.params.id, req.body, req.actor));
})
);
router.delete('/:id',
requireWrite('source_doc'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('source doc not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'source_doc', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})

20
lib/api/routes/tasks.js
View File

@@ -3,6 +3,7 @@ import { z } from 'zod';
import * as repo from '../../db/repos/tasks.js';
import { validate } from '../validate.js';
import { NotFoundError, ValidationError, asyncWrap } from '../errors.js';
import { requireWrite, divertToPending } from '../cap.js';
const STATUSES = ['todo', 'doing', 'blocked', 'done'];
@@ -41,10 +42,15 @@ spacesScopedRouter.get('/',
);
spacesScopedRouter.post('/',
requireWrite('task'),
validate({ params: spaceParams, body: createSchema }),
asyncWrap(async (req, res) => {
const payload = { ...req.body, space_id: req.params.space_id };
if (req.capTier === 'suggest') {
return divertToPending(req, res, { entity_type: 'task', action: 'create', payload });
}
try {
const row = await repo.create({ ...req.body, space_id: req.params.space_id }, req.actor);
const row = await repo.create(payload, req.actor);
res.status(201).json(row);
} catch (e) {
if (e.code === '23503') throw new ValidationError('invalid space or project', {
@@ -72,20 +78,32 @@ router.get('/:id',
);
router.patch('/:id',
requireWrite('task'),
validate({ params: idParams, body: patchSchema }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('task not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'task', entity_id: req.params.id, action: 'update', payload: req.body
});
}
const row = await repo.update(req.params.id, req.body, req.actor);
res.json(row);
})
);
router.delete('/:id',
requireWrite('task'),
validate({ params: idParams }),
asyncWrap(async (req, res) => {
const existing = await repo.getById(req.params.id);
if (!existing) throw new NotFoundError('task not found');
if (req.capTier === 'suggest') {
return divertToPending(req, res, {
entity_type: 'task', entity_id: req.params.id, action: 'delete', payload: {}
});
}
await repo.del(req.params.id, req.actor);
res.status(204).end();
})