Siddharth Kumar Sah
59f40dbfd4
feat: add permission checks and admin override to pipeline routes
...
Replace requireAuth with requirePermission("pipelines:own") on pipeline
save/list/delete routes. Admin users with pipelines:all can see and
delete all pipelines. Unauthorized delete returns 404 to avoid leaking
resource existence.
2026-04-10 21:25:30 +08:00
Siddharth Kumar Sah
86ba69825a
feat: add permission checks and ownership scoping to user-files routes
...
Replace getAuthUser (optional auth) with requirePermission("files:own") on all
user-files routes, enforcing mandatory authentication and ownership checks.
Admin users with files:all permission bypass ownership restrictions. Returns 404
(not 403) for ownership failures to avoid leaking resource existence.
2026-04-10 21:25:30 +08:00
Siddharth Kumar Sah
d776680f2d
feat: add permission checks and admin override to API key routes
...
Replace requireAuth with requirePermission(apikeys:own). Admin users
with apikeys:all can see and delete any user's keys.
2026-04-10 21:25:30 +08:00
Siddharth Kumar Sah
885ace54f0
feat: add tools:use permission check to tool, batch, pipeline, and upload routes
2026-04-10 21:25:30 +08:00
Siddharth Kumar Sah
49431772ec
feat: include permissions and teamName in login/session responses
2026-04-10 21:25:30 +08:00
Siddharth Kumar Sah