tools and skills, etc in the containers

src/servers/api/tasks/tasks.ts

@@ -24,7 +24,6 @@ export function parseFrontmatter(raw: string): { frontmatter: Frontmatter; body:
   const triggers: TriggerConfig[] = [];
   const triggerMatch = yaml.match(/^trigger:\s*\n((?:[ \t]+.+\n?)*)/m);
   if (triggerMatch) {
-    // Split on top-level list items (lines starting with "  - type:")
     const items = triggerMatch[1]!.split(/(?=^\s+-\s*type:)/m);
     for (const item of items) {
       const type = item.match(/type:\s*(.+)/)?.[1]?.trim();
@@ -73,6 +72,10 @@ function resolveFile(name: string, native: Map<string, string>, global: Map<stri
   return null;
 }
 
+function isPrivileged(role: string) {
+  return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
+}
+
 export const tasksRouter = createRouter();
 
 tasksRouter.get('/', async (ctx) => {
@@ -161,6 +164,8 @@ tasksRouter.put('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeTasks, globalTasks, userTasks);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   const { sessionId, messages } = await ctx.req.json<{ sessionId: string; messages: unknown[] }>();
 
@@ -182,6 +187,8 @@ tasksRouter.delete('/:name/chat', async (ctx) => {
   const resolved = resolveFile(name, nativeTasks, globalTasks, userTasks);
   if (!resolved) return ctx.text('Not found', 404);
 
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
   const chatDir = join(dirname(resolved.filePath), 'chat');
   await rm(chatDir, { recursive: true, force: true });
 
@@ -189,13 +196,17 @@ tasksRouter.delete('/:name/chat', async (ctx) => {
 });
 
 tasksRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
   const { name } = await ctx.req.json<{ name: string }>();
   if (!name?.trim()) return ctx.text('Name is required', 400);
 
   const dirName = name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
   if (!dirName) return ctx.text('Invalid name', 400);
 
-  const dir = join(getGlobalTasksDir(), dirName);
+  const targetDir = isPrivileged(user.role) ? getGlobalTasksDir() : getUserTasksDir(user.email);
+  const scope: Scope = isPrivileged(user.role) ? 'global' : 'user';
+
+  const dir = join(targetDir, dirName);
   const filePath = join(dir, 'TASK.md');
 
   if (await Bun.file(filePath).exists()) {
@@ -205,18 +216,22 @@ tasksRouter.post('/', async (ctx) => {
   await mkdir(dir, { recursive: true });
   await Bun.write(filePath, `---\nname: ${name.trim()}\ndescription: \n---\n`);
 
-  return ctx.json({ name: name.trim(), dirName, filePath });
+  return ctx.json({ name: name.trim(), dirName, filePath, scope });
 });
 
 tasksRouter.delete('/:name', async (ctx) => {
+  const user = ctx.get('user');
   const name = ctx.req.param('name');
-  const globalDir = join(getGlobalTasksDir(), name);
-  const globalFile = join(globalDir, 'TASK.md');
 
-  if (!(await Bun.file(globalFile).exists())) {
-    return ctx.text('Not found', 404);
-  }
+  const nativeTasks = await readTaskDirs(getNativeTasksDir());
+  const globalTasks = await readTaskDirs(getGlobalTasksDir());
+  const userTasks = await readTaskDirs(getUserTasksDir(user.email));
 
-  await rm(globalDir, { recursive: true });
+  const resolved = resolveFile(name, nativeTasks, globalTasks, userTasks);
+  if (!resolved) return ctx.text('Not found', 404);
+
+  if (resolved.scope !== 'user' && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  await rm(dirname(resolved.filePath), { recursive: true });
   return ctx.json({ ok: true });
 });