feat: add tools:use permission check to tool, batch, pipeline, and upload routes

apps/api/src/routes/batch.ts

@@ -16,6 +16,7 @@ import { autoOrient } from "../lib/auto-orient.js";
 import { validateImageBuffer } from "../lib/file-validation.js";
 import { sanitizeFilename } from "../lib/filename.js";
 import { decodeHeic } from "../lib/heic-converter.js";
+import { requirePermission } from "../permissions.js";
 import { type JobProgress, updateJobProgress } from "./progress.js";
 import { getToolConfig } from "./tool-factory.js";
 
@@ -28,6 +29,9 @@ export async function registerBatchRoutes(app: FastifyInstance): Promise<void> {
   app.post(
     "/api/v1/tools/:toolId/batch",
     async (request: FastifyRequest<{ Params: { toolId: string } }>, reply: FastifyReply) => {
+      const user = requirePermission("tools:use")(request, reply);
+      if (!user) return;
+
       const { toolId } = request.params;
 
       // Look up the tool config from the registry

apps/api/src/routes/files.ts

@@ -5,6 +5,7 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { validateImageBuffer } from "../lib/file-validation.js";
 import { sanitizeFilename } from "../lib/filename.js";
 import { createWorkspace, getWorkspacePath } from "../lib/workspace.js";
+import { requirePermission } from "../permissions.js";
 
 /**
  * Guard against path traversal in URL params.
@@ -21,6 +22,9 @@ function isPathTraversal(segment: string): boolean {
 export async function fileRoutes(app: FastifyInstance): Promise<void> {
   // ── POST /api/v1/upload ────────────────────────────────────────
   app.post("/api/v1/upload", async (request: FastifyRequest, reply: FastifyReply) => {
+    const user = requirePermission("tools:use")(request, reply);
+    if (!user) return;
+
     const jobId = randomUUID();
     const workspacePath = await createWorkspace(jobId);
     const inputDir = join(workspacePath, "input");

apps/api/src/routes/pipeline.ts

@@ -17,6 +17,7 @@ import { validateImageBuffer } from "../lib/file-validation.js";
 import { sanitizeFilename } from "../lib/filename.js";
 import { decodeHeic } from "../lib/heic-converter.js";
 import { createWorkspace } from "../lib/workspace.js";
+import { requirePermission } from "../permissions.js";
 import { requireAuth } from "../plugins/auth.js";
 import { getRegisteredToolIds, getToolConfig } from "./tool-factory.js";
 
@@ -57,6 +58,9 @@ export async function registerPipelineRoutes(app: FastifyInstance): Promise<void
    * Returns the final processed image for download.
    */
   app.post("/api/v1/pipeline/execute", async (request: FastifyRequest, reply: FastifyReply) => {
+    const user = requirePermission("tools:use")(request, reply);
+    if (!user) return;
+
     let fileBuffer: Buffer | null = null;
     let filename = "image";
     let pipelineRaw: string | null = null;

apps/api/src/routes/tool-factory.ts

@@ -14,6 +14,7 @@ import type { WorkerInput, WorkerOutput } from "../lib/image-worker.js";
 import { sanitizeSvg } from "../lib/svg-sanitize.js";
 import { getWorkerPool } from "../lib/worker-pool.js";
 import { createWorkspace } from "../lib/workspace.js";
+import { requirePermission } from "../permissions.js";
 
 export interface ToolRouteConfig<T> {
   /** Unique tool identifier, used as the URL path segment. */
@@ -102,6 +103,9 @@ export function createToolRoute<T>(app: FastifyInstance, config: ToolRouteConfig
   app.post(
     `/api/v1/tools/${config.toolId}`,
     async (request: FastifyRequest, reply: FastifyReply) => {
+      const user = requirePermission("tools:use")(request, reply);
+      if (!user) return;
+
       let fileBuffer: Buffer | null = null;
       let filename = "image";
       let settingsRaw: string | null = null;

tests/integration/permissions.test.ts

@@ -1,21 +1,23 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { eq } from "drizzle-orm";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { db, schema } from "../../apps/api/src/db/index.js";
-import { buildTestApp, loginAsAdmin, type TestApp } from "./test-server.js";
+import { buildTestApp, createMultipartPayload, loginAsAdmin, type TestApp } from "./test-server.js";
+
+let testApp: TestApp;
+let adminToken: string;
+
+beforeAll(async () => {
+  testApp = await buildTestApp();
+  adminToken = await loginAsAdmin(testApp.app);
+}, 30_000);
+
+afterAll(async () => {
+  await testApp.cleanup();
+}, 10_000);
 
 describe("permissions in auth responses", () => {
-  let testApp: TestApp;
-  let adminToken: string;
-
-  beforeAll(async () => {
-    testApp = await buildTestApp();
-    adminToken = await loginAsAdmin(testApp.app);
-  }, 30_000);
-
-  afterAll(async () => {
-    await testApp.cleanup();
-  }, 10_000);
-
   it("login response includes permissions array for admin", async () => {
     const res = await testApp.app.inject({
       method: "POST",
@@ -76,3 +78,226 @@ describe("permissions in auth responses", () => {
     expect(typeof body.user.teamName).toBe("string");
   });
 });
+
+describe("permission enforcement on routes", () => {
+  let userToken: string;
+
+  beforeAll(async () => {
+    // Create a regular "user" role account
+    const regRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { username: "regularuser", password: "UserPass1", role: "user" },
+    });
+    // If user already exists from a prior run, that's fine
+    if (regRes.statusCode !== 201 && regRes.statusCode !== 409) {
+      throw new Error(`Failed to create test user: ${regRes.body}`);
+    }
+
+    // Clear mustChangePassword so the user can access routes
+    db.update(schema.users)
+      .set({ mustChangePassword: false })
+      .where(eq(schema.users.username, "regularuser"))
+      .run();
+
+    // Login as the regular user
+    const loginRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "regularuser", password: "UserPass1" },
+    });
+    const loginBody = JSON.parse(loginRes.body);
+    if (!loginBody.token) {
+      throw new Error(`User login failed: ${loginRes.body}`);
+    }
+    userToken = loginBody.token;
+  }, 15_000);
+
+  // -- User cannot access admin-only routes (403) --
+
+  it("user cannot list users (GET /api/auth/users)", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/auth/users",
+      headers: { authorization: `Bearer ${userToken}` },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("user cannot register new users (POST /api/auth/register)", async () => {
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/register",
+      headers: { authorization: `Bearer ${userToken}` },
+      payload: { username: "sneaky", password: "SneakyPass1", role: "user" },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("user cannot update settings (PUT /api/v1/settings)", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/settings",
+      headers: { authorization: `Bearer ${userToken}` },
+      payload: { appTitle: "Hacked" },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("user cannot create teams (POST /api/v1/teams)", async () => {
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/v1/teams",
+      headers: { authorization: `Bearer ${userToken}` },
+      payload: { name: "Evil Team" },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("user cannot list teams (GET /api/v1/teams)", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/teams",
+      headers: { authorization: `Bearer ${userToken}` },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  // -- User CAN access allowed routes (200) --
+
+  it("user can read settings (GET /api/v1/settings)", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/settings",
+      headers: { authorization: `Bearer ${userToken}` },
+    });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it("user can change own password (POST /api/auth/change-password)", async () => {
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/change-password",
+      headers: { authorization: `Bearer ${userToken}` },
+      payload: { currentPassword: "UserPass1", newPassword: "UserPass2" },
+    });
+    expect(res.statusCode).toBe(200);
+
+    // Login with new password to get a fresh token for remaining tests
+    const loginRes = await testApp.app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      payload: { username: "regularuser", password: "UserPass2" },
+    });
+    const loginBody = JSON.parse(loginRes.body);
+    if (loginBody.token) {
+      userToken = loginBody.token;
+    }
+  });
+
+  // -- Admin CAN access admin routes (200) --
+
+  it("admin can list users (GET /api/auth/users)", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/auth/users",
+      headers: { authorization: `Bearer ${adminToken}` },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.body);
+    expect(body.users).toBeDefined();
+    expect(Array.isArray(body.users)).toBe(true);
+  });
+
+  it("admin can update settings (PUT /api/v1/settings)", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/settings",
+      headers: { authorization: `Bearer ${adminToken}` },
+      payload: { appTitle: "Test Title" },
+    });
+    expect(res.statusCode).toBe(200);
+  });
+
+  // -- Unauthenticated gets 401 --
+
+  it("unauthenticated request gets 401 on GET /api/auth/users", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/auth/users",
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("unauthenticated request gets 401 on PUT /api/v1/settings", async () => {
+    const res = await testApp.app.inject({
+      method: "PUT",
+      url: "/api/v1/settings",
+      payload: { appTitle: "Hacked" },
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("unauthenticated request gets 401 on GET /api/v1/settings", async () => {
+    const res = await testApp.app.inject({
+      method: "GET",
+      url: "/api/v1/settings",
+    });
+    expect(res.statusCode).toBe(401);
+  });
+});
+
+describe("tool and pipeline permission enforcement", () => {
+  const fixturePath = join(import.meta.dirname, "..", "fixtures", "test-200x150.png");
+  const fixtureBuffer = readFileSync(fixturePath);
+
+  it("unauthenticated user cannot use tools", async () => {
+    const { body, contentType } = createMultipartPayload([
+      {
+        name: "file",
+        filename: "test.png",
+        contentType: "image/png",
+        content: fixtureBuffer,
+      },
+      {
+        name: "settings",
+        content: JSON.stringify({ angle: 90 }),
+      },
+    ]);
+
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/v1/tools/rotate",
+      headers: { "content-type": contentType },
+      body,
+    });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it("authenticated user can use tools", async () => {
+    const { body, contentType } = createMultipartPayload([
+      {
+        name: "file",
+        filename: "test.png",
+        contentType: "image/png",
+        content: fixtureBuffer,
+      },
+      {
+        name: "settings",
+        content: JSON.stringify({ angle: 90 }),
+      },
+    ]);
+
+    const res = await testApp.app.inject({
+      method: "POST",
+      url: "/api/v1/tools/rotate",
+      headers: {
+        "content-type": contentType,
+        authorization: `Bearer ${adminToken}`,
+      },
+      body,
+    });
+    expect(res.statusCode).toBe(200);
+  });
+});