tools and skills, etc in the containers

src/servers/api/skills/skills.ts

@@ -40,6 +40,10 @@ export async function readSkillDirs(dir: string): Promise<Map<string, string>> {
 
 type Scope = 'native' | 'global' | 'user';
 
+function isPrivileged(role: string) {
+  return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
+}
+
 function resolveScope(dirName: string, native: Map<string, string>, global: Map<string, string>, user: Map<string, string>): Scope {
   if (user.has(dirName)) return 'user';
   if (global.has(dirName)) return 'global';
@@ -134,6 +138,8 @@ skillsRouter.put('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeSkills, globalSkills, userSkills);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   const { sessionId, messages } = await ctx.req.json<{ sessionId: string; messages: unknown[] }>();
 
@@ -155,6 +161,8 @@ skillsRouter.delete('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeSkills, globalSkills, userSkills);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   await rm(chatDir, { recursive: true, force: true });
 
@@ -162,13 +170,18 @@ skillsRouter.delete('/:name/chat', async (ctx) => {
 });
 
 skillsRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
   const { name } = await ctx.req.json<{ name: string }>();
   if (!name?.trim()) return ctx.text('Name is required', 400);
 
   const dirName = name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
   if (!dirName) return ctx.text('Invalid name', 400);
 
-  const dir = join(getGlobalSkillsDir(), dirName);
+  // Members save to their own scope; Admins and above save to global
+  const targetDir = isPrivileged(user.role) ? getGlobalSkillsDir() : getUserSkillsDir(user.email);
+  const scope: Scope = isPrivileged(user.role) ? 'global' : 'user';
+
+  const dir = join(targetDir, dirName);
   const filePath = join(dir, 'SKILL.md');
 
   if (await Bun.file(filePath).exists()) {
@@ -178,18 +191,24 @@ skillsRouter.post('/', async (ctx) => {
   await mkdir(dir, { recursive: true });
   await Bun.write(filePath, `---\nname: ${name.trim()}\ndescription: \n---\n`);
 
-  return ctx.json({ name: name.trim(), dirName, filePath });
+  return ctx.json({ name: name.trim(), dirName, filePath, scope });
 });
 
 skillsRouter.delete('/:name', async (ctx) => {
+  const user = ctx.get('user');
   const name = ctx.req.param('name');
-  const globalDir = join(getGlobalSkillsDir(), name);
-  const globalFile = join(globalDir, 'SKILL.md');
 
-  if (!(await Bun.file(globalFile).exists())) {
-    return ctx.text('Not found', 404);
-  }
+  const nativeSkills = await readSkillDirs(getNativeSkillsDir());
+  const globalSkills = await readSkillDirs(getGlobalSkillsDir());
+  const userSkills = await readSkillDirs(getUserSkillsDir(user.email));
 
-  await rm(globalDir, { recursive: true });
+  const resolved = resolveFile(name, nativeSkills, globalSkills, userSkills);
+  if (!resolved) return ctx.text('Not found', 404);
+
+  // Members can only delete their own skills
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const dir = dirname(resolved.filePath);
+  await rm(dir, { recursive: true });
   return ctx.json({ ok: true });
 });