persist model access policy to database

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/databases/officer_db/src/index.ts

@@ -18,7 +18,7 @@ export {
   cleanupExpiredTokens,
 } from './queries/auth';
 
-export { readServerSettings, writeServerSettings } from './queries/server-config';
+export { readServerSettings, writeServerSettings, readConfigValue, writeConfigValue } from './queries/server-config';
 
 export { getUserSettings, setUserSettings, getUserState, patchUserState, getDockPaths, setDockPaths } from './queries/user-data';
 

src/databases/officer_db/src/queries/server-config.ts

@@ -18,3 +18,18 @@ export async function writeServerSettings(settings: Record<string, unknown>): Pr
       set: { value: settings, updatedAt: new Date() },
     });
 }
+
+export async function readConfigValue<T>(key: string, fallback: T): Promise<T> {
+  const [row] = await db.select().from(serverConfig).where(eq(serverConfig.key, key));
+  return (row?.value as T) ?? fallback;
+}
+
+export async function writeConfigValue(key: string, value: unknown): Promise<void> {
+  await db
+    .insert(serverConfig)
+    .values({ key, value, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: serverConfig.key,
+      set: { value, updatedAt: new Date() },
+    });
+}

src/servers/api/server-settings/pi-mono.ts

@@ -3,6 +3,7 @@ import { createRouter } from '../../create-router';
 import { PI_CONFIG_DIR } from '../../data-path';
 import { invalidateModelCache } from '../pi/list-models';
 import { logger } from '../pi/logger';
+import { readConfigValue, writeConfigValue } from 'officerdb';
 
 export const piMonoRouter = createRouter();
 
@@ -387,6 +388,20 @@ piMonoRouter.put('/api-keys', async (ctx) => {
   return ctx.json({ ok: true });
 });
 
+type AccessPolicy = { allowedModels: string[] };
+const ACCESS_POLICY_KEY = 'pi-access-policy';
+
+piMonoRouter.get('/access-policy', async (ctx) => {
+  const policy = await readConfigValue<AccessPolicy>(ACCESS_POLICY_KEY, { allowedModels: [] });
+  return ctx.json(policy);
+});
+
+piMonoRouter.put('/access-policy', async (ctx) => {
+  const body = await ctx.req.json<AccessPolicy>();
+  await writeConfigValue(ACCESS_POLICY_KEY, body);
+  return ctx.json(body);
+});
+
 const REMOTE_HEALTH_CONFIG: Record<string, {
   url: string | ((key: string) => string);
   headers: (key: string) => Record<string, string>;