From 47d3059d784502c87bfc6e08d9fb6f3550816e2c Mon Sep 17 00:00:00 2001
From: charles-gauthereau <charles.gauthereau@soluce-technologies.com>
Date: Thu, 28 May 2026 20:12:59 +0200
Subject: [PATCH] fix: some bugs

---
 app/api/v1/agents/[id]/route.ts            | 11 +++++++++++
 app/api/v1/agents/route.ts                 | 10 ++++++++++
 src/db/schema/02_user.ts                   |  7 -------
 src/lib/api-v1/openapi/routes/databases.ts | 14 +++++++-------
 4 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/app/api/v1/agents/[id]/route.ts b/app/api/v1/agents/[id]/route.ts
index b8786cd7..e8852efb 100644
--- a/app/api/v1/agents/[id]/route.ts
+++ b/app/api/v1/agents/[id]/route.ts
@@ -42,6 +42,7 @@ export const DELETE = withApiKey(
             if (access === "forbidden") return NextResponse.json({error: "Forbidden"}, {status: 403});
             if (access === "not_found") return NextResponse.json({error: "Not found"}, {status: 404});
 
+
             const agent = await getAgent(id, {
                 includeDatabases: false,
                 includeOrganizations: true,
@@ -51,6 +52,16 @@ export const DELETE = withApiKey(
 
             const organizationIds = agent.organizations.map(org => org.organizationId)
 
+            const canDeleteGlobalAgent =
+                ctx.user.permissions.isAdmin || ctx.user.permissions.isSuperAdmin;
+
+            if (!agent.organizationId && !canDeleteGlobalAgent) {
+                return NextResponse.json(
+                    { error: "Forbidden" },
+                    { status: 403 }
+                );
+            }
+
             await deleteAgentService({
                 agentId: agent.id,
                 organizationId: agent.organizationId ?? undefined,
diff --git a/app/api/v1/agents/route.ts b/app/api/v1/agents/route.ts
index 37bc6a6e..f266532b 100644
--- a/app/api/v1/agents/route.ts
+++ b/app/api/v1/agents/route.ts
@@ -69,6 +69,16 @@ export const POST = withApiKey(
           );
         }
 
+        const canCreateGlobalAgent =
+            ctx.user.permissions.isAdmin || ctx.user.permissions.isSuperAdmin;
+
+        if (!organizationId && !canCreateGlobalAgent) {
+          return NextResponse.json(
+              { error: "Forbidden" },
+              { status: 403 }
+          );
+        }
+
         const createdAgent = await createAgentService({
           organizationId,
           data: {
diff --git a/src/db/schema/02_user.ts b/src/db/schema/02_user.ts
index 5d0bf9a7..4bb5b1c7 100644
--- a/src/db/schema/02_user.ts
+++ b/src/db/schema/02_user.ts
@@ -11,7 +11,6 @@ import {
 } from "drizzle-orm/pg-core";
 import { createSelectSchema } from "drizzle-zod";
 import { z } from "zod";
-import { project } from "./06_project";
 import { member } from "@/db/schema/04_member";
 import { invitation } from "@/db/schema/05_invitation";
 import { organization } from "@/db/schema/03_organization";
@@ -144,12 +143,6 @@ export const ssoProviderRelations = relations(ssoProvider, ({ one }) => ({
   }),
 }));
 
-export const projectRelations = relations(project, ({ one }) => ({
-  organization: one(organization, {
-    fields: [project.organizationId],
-    references: [organization.id],
-  }),
-}));
 
 export const passkeyRelations = relations(passkey, ({ one }) => ({
   user: one(user, {
diff --git a/src/lib/api-v1/openapi/routes/databases.ts b/src/lib/api-v1/openapi/routes/databases.ts
index a1877f3e..4dcaf10a 100644
--- a/src/lib/api-v1/openapi/routes/databases.ts
+++ b/src/lib/api-v1/openapi/routes/databases.ts
@@ -66,7 +66,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "get",
     path: "/databases",
     tags,
-    summary:"List databases",
+    summary: "List databases",
     security,
     responses: {
       200: {
@@ -92,7 +92,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "get",
     path: "/databases/{id}",
     tags,
-    summary:"Get database by ID",
+    summary: "Get database by ID",
     security,
     request: { params: z.object({ id: UuidParam }) },
     responses: {
@@ -127,7 +127,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "get",
     path: "/databases/{id}/status",
     tags,
-    summary:"Get database status",
+    summary: "Get database status",
     security,
     request: { params: z.object({ id: UuidParam }) },
     responses: {
@@ -169,7 +169,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "get",
     path: "/databases/{id}/backup",
     tags,
-    summary:"List backups for a database",
+    summary: "List backups for a database",
     security,
     request: { params: z.object({ id: UuidParam }) },
     responses: {
@@ -204,7 +204,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "post",
     path: "/databases/{id}/backup",
     tags,
-    summary:"Trigger a backup for a database",
+    summary: "Trigger a backup for a database",
     security,
     request: { params: z.object({ id: UuidParam }) },
     responses: {
@@ -241,7 +241,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "get",
     path: "/databases/{id}/backup/{backupId}",
     tags,
-    summary:"Get a specific backup with storage details",
+    summary: "Get a specific backup with storage details",
     security,
     request: {
       params: z.object({ id: UuidParam, backupId: UuidParam }),
@@ -278,7 +278,7 @@ export function registerDatabaseRoutes(registry: OpenAPIRegistry) {
     method: "post",
     path: "/databases/{id}/restore",
     tags,
-    summary:"Restore a database from a backup",
+    summary: "Restore a database from a backup",
     security,
     request: {
       params: z.object({ id: UuidParam }),