tools and skills, etc in the containers

src/servers/api/processes/processes.ts

@@ -53,6 +53,10 @@ function resolveFile(name: string, native: Map<string, string>, global: Map<stri
   return null;
 }
 
+function isPrivileged(role: string) {
+  return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
+}
+
 export const processesRouter = createRouter();
 
 processesRouter.get('/', async (ctx) => {
@@ -134,6 +138,8 @@ processesRouter.put('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeProcesses, globalProcesses, userProcesses);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   const { sessionId, messages } = await ctx.req.json<{ sessionId: string; messages: unknown[] }>();
 
@@ -155,6 +161,8 @@ processesRouter.delete('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeProcesses, globalProcesses, userProcesses);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   await rm(chatDir, { recursive: true, force: true });
 
@@ -162,13 +170,17 @@ processesRouter.delete('/:name/chat', async (ctx) => {
 });
 
 processesRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
   const { name } = await ctx.req.json<{ name: string }>();
   if (!name?.trim()) return ctx.text('Name is required', 400);
 
   const dirName = name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
   if (!dirName) return ctx.text('Invalid name', 400);
 
-  const dir = join(getGlobalProcessesDir(), dirName);
+  const targetDir = isPrivileged(user.role) ? getGlobalProcessesDir() : getUserProcessesDir(user.email);
+  const scope: Scope = isPrivileged(user.role) ? 'global' : 'user';
+
+  const dir = join(targetDir, dirName);
   const filePath = join(dir, 'PROCESS.md');
 
   if (await Bun.file(filePath).exists()) {
@@ -178,18 +190,22 @@ processesRouter.post('/', async (ctx) => {
   await mkdir(dir, { recursive: true });
   await Bun.write(filePath, `---\nname: ${name.trim()}\ndescription: \n---\n`);
 
-  return ctx.json({ name: name.trim(), dirName, filePath });
+  return ctx.json({ name: name.trim(), dirName, filePath, scope });
 });
 
 processesRouter.delete('/:name', async (ctx) => {
+  const user = ctx.get('user');
   const name = ctx.req.param('name');
-  const globalDir = join(getGlobalProcessesDir(), name);
-  const globalFile = join(globalDir, 'PROCESS.md');
 
-  if (!(await Bun.file(globalFile).exists())) {
-    return ctx.text('Not found', 404);
-  }
+  const nativeProcesses = await readProcessDirs(getNativeProcessesDir());
+  const globalProcesses = await readProcessDirs(getGlobalProcessesDir());
+  const userProcesses = await readProcessDirs(getUserProcessesDir(user.email));
 
-  await rm(globalDir, { recursive: true });
+  const resolved = resolveFile(name, nativeProcesses, globalProcesses, userProcesses);
+  if (!resolved) return ctx.text('Not found', 404);
+
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  await rm(dirname(resolved.filePath), { recursive: true });
   return ctx.json({ ok: true });
 });