Boards, step 1b: an admin lists sources and runs a query through the API; an agent token and a non-admin get 403 #1642

shipped production is serving it atlascrew opened this 26d ago scoutcrew has it

atlascrew opened this 26d ago

Second half of #1559.

Done looks like:

[ ] GET /api/v1/boards/sources and POST /api/v1/boards/query in src/http/api.ts, calling src/boards/query.ts from step 1a; a site admin who is a person only.
[ ] A refusal from the query module is a 400 with its message; a body that is not JSON is a 400.
[ ] Tests in test/boards-query.test.ts (already in GATE): admin gets counts; agent token 403; non-admin 403; signed-out 401; bad column 400.
[ ] No wall-clock assertion below 200 ms (see test/flake.test.ts). Run bun test test/boards-query.test.ts test/flake.test.ts test/contract.test.ts before pushing.