feat: include permissions and teamName in login/session responses

apps/api/src/plugins/auth.ts

@@ -5,6 +5,7 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { env } from "../config.js";
 import { db, schema } from "../db/index.js";
 import { auditLog } from "../lib/audit.js";
+import { getPermissions } from "../permissions.js";
 
 const scryptAsync = promisify(scrypt);
 
@@ -103,6 +104,18 @@ function createSessionToken(): string {
   return randomUUID();
 }
 
+// ── Team name resolution ──────────────────────────────────────────
+
+/** Resolve a user's team column to a display name.
+ *  The column may hold a team UUID (normal users) or the literal "Default"
+ *  (legacy / initial admin). */
+function resolveTeamName(teamValue: string): string {
+  const teamById = db.select().from(schema.teams).where(eq(schema.teams.id, teamValue)).get();
+  if (teamById) return teamById.name;
+  // Legacy default — the column contains the literal name
+  return teamValue;
+}
+
 // ── Default admin creation ─────────────────────────────────────────
 
 export async function ensureDefaultAdmin(): Promise<void> {
@@ -204,6 +217,8 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
           id: user.id,
           username: user.username,
           role: user.role,
+          teamName: resolveTeamName(user.team),
+          permissions: getPermissions(user.role as "admin" | "user"),
           mustChangePassword: user.mustChangePassword,
         },
         expiresAt: expiresAt.toISOString(),
@@ -250,6 +265,8 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
         id: user.id,
         username: user.username,
         role: user.role,
+        teamName: resolveTeamName(user.team),
+        permissions: getPermissions(user.role as "admin" | "user"),
         mustChangePassword: user.mustChangePassword,
       },
       expiresAt: session.expiresAt.toISOString(),

tests/integration/permissions.test.ts

@@ -0,0 +1,78 @@
+import { eq } from "drizzle-orm";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { db, schema } from "../../apps/api/src/db/index.js";
+import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
+
+describe("permissions in auth responses", () => {
+  let testApp: TestApp;
+  let adminToken: string;
+
+  beforeAll(async () => {
+    testApp = await buildTestApp();
+    adminToken = await loginAsAdmin(testApp.app);
+  }, 30_000);
+
+  afterAll(async () => {
+    await testApp.cleanup();
+  }, 10_000);
+
+  it("login response includes permissions array for admin", async () => {
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "admin", password: "Adminpass1" },
+    });
+    const body = JSON.parse(res.body);
+    expect(body.user.permissions).toBeDefined();
+    expect(body.user.permissions).toContain("users:manage");
+    expect(body.user.permissions).toContain("tools:use");
+    expect(body.user.permissions).toContain("files:all");
+  });
+
+  it("login response includes permissions array for user role", async () => {
+    // Create a non-admin user
+    await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { username: "permtest", password: "TestPass1", role: "user" },
+    });
+    db.update(schema.users)
+      .set({ mustChangePassword: false })
+      .where(eq(schema.users.username, "permtest"))
+      .run();
+
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "permtest", password: "TestPass1" },
+    });
+    const body = JSON.parse(res.body);
+    expect(body.user.permissions).toContain("tools:use");
+    expect(body.user.permissions).toContain("files:own");
+    expect(body.user.permissions).not.toContain("users:manage");
+    expect(body.user.permissions).not.toContain("files:all");
+  });
+
+  it("session response includes permissions array", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/auth/session",
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    const body = JSON.parse(res.body);
+    expect(body.user.permissions).toBeDefined();
+    expect(body.user.permissions).toContain("users:manage");
+  });
+
+  it("login response includes teamName", async () => {
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "admin", password: "Adminpass1" },
+    });
+    const body = JSON.parse(res.body);
+    expect(body.user.teamName).toBeDefined();
+    expect(typeof body.user.teamName).toBe("string");
+  });
+});