ec96e4e2e3
Owner-only routes wired with an applyPendingChange dispatch helper covering page/project/task/ref/resource/source_doc create/update/delete. Approve and reject emit their own audit_log entries (actions already in the CHECK vocab) so the audit trail is self-contained. Documents a latent bug in security-followups.md: pending_changes.action CHECK constraint blocks 'upsert' / 'add_dependency' / 'remove_dependency' divertToPending paths in refs/resources routes when an agent at suggest tier hits them. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
56 lines
2.7 KiB
JavaScript
56 lines
2.7 KiB
JavaScript
import { Router } from 'express';
|
|
import { agentOrOwner } from './middleware/agent_auth.js';
|
|
import { errorMiddleware, NotFoundError } from './errors.js';
|
|
import { router as spacesRouter } from './routes/spaces.js';
|
|
import { router as projectsRouter, spacesScopedRouter as projectsBySpaceRouter } from './routes/projects.js';
|
|
import {
|
|
router as tasksRouter,
|
|
spacesScopedRouter as tasksBySpaceRouter,
|
|
projectsScopedRouter as tasksByProjectRouter
|
|
} from './routes/tasks.js';
|
|
import { router as pagesRouter, spacesScopedRouter as pagesBySpaceRouter } from './routes/pages.js';
|
|
import { router as refsRouter } from './routes/refs.js';
|
|
import { router as resourcesRouter, spacesScopedRouter as resourcesBySpaceRouter } from './routes/resources.js';
|
|
import { router as sourceDocsRouter, resourcesScopedRouter as sourceDocsByResourceRouter } from './routes/source_docs.js';
|
|
import { router as agentsRouter, tokensRouter as agentTokensRouter } from './routes/agents.js';
|
|
import { router as conversationsRouter } from './routes/conversations.js';
|
|
import { conversationsScopedRouter as messagesByConvRouter } from './routes/messages.js';
|
|
import { router as tagsRouter, entityScopedRouter as tagsByEntityRouter } from './routes/tags.js';
|
|
import { router as linksRouter } from './routes/links.js';
|
|
import { router as pendingChangesRouter } from './routes/pending_changes.js';
|
|
import { router as auditRouter } from './routes/audit.js';
|
|
|
|
export function mountApi(app) {
|
|
const api = Router();
|
|
api.use(agentOrOwner);
|
|
|
|
api.use('/spaces', spacesRouter);
|
|
api.use('/spaces/:space_id/projects', projectsBySpaceRouter);
|
|
api.use('/spaces/:space_id/tasks', tasksBySpaceRouter);
|
|
api.use('/spaces/:space_id/pages', pagesBySpaceRouter);
|
|
api.use('/spaces/:space_id/resources', resourcesBySpaceRouter);
|
|
api.use('/projects', projectsRouter);
|
|
api.use('/projects/:project_id/tasks', tasksByProjectRouter);
|
|
api.use('/tasks', tasksRouter);
|
|
api.use('/pages', pagesRouter);
|
|
api.use('/refs', refsRouter);
|
|
api.use('/resources', resourcesRouter);
|
|
api.use('/resources/:resource_id/source-docs', sourceDocsByResourceRouter);
|
|
api.use('/source-docs', sourceDocsRouter);
|
|
api.use('/agents', agentsRouter);
|
|
api.use('/agent-tokens', agentTokensRouter);
|
|
api.use('/conversations', conversationsRouter);
|
|
api.use('/conversations/:conversation_id/messages', messagesByConvRouter);
|
|
api.use('/tags', tagsRouter);
|
|
api.use('/links', linksRouter);
|
|
api.use('/pending-changes', pendingChangesRouter);
|
|
api.use('/audit', auditRouter);
|
|
api.use('/:entity_type/:entity_id/tags', tagsByEntityRouter);
|
|
|
|
api.use((_req, _res, next) => next(new NotFoundError('route not found')));
|
|
|
|
api.use(errorMiddleware);
|
|
app.use('/api', api);
|
|
return api;
|
|
}
|