ea37f23 · 089d1f4 · d055463 · b36c947 · 503c6ba · 1c4f3fc
@@ -86,6 +86,19 @@
can change the forge's settings or its releases" (`not_admin` in the API).
`src/http/admin_gate.ts` is the one gate, ahead of every handler;
`/releases.json` stays public. Token scopes are a later part.
Since #11818 the gate guards every route `src/http/route_marks.ts` marks
`admin` — the admin's pages under `/settings`, `/forges`, `/system`,
`/maintenance` and the rest, not only `/admin` — and answers with one
sentence that says what to do next: "This is for the forge's admin account,
so sign in as admin to do it." An admin-only MCP tool called by name from an
everyday account gets the same sentence. Every route either router registers
is marked `admin` or `open` there; `test/route-marks.test.ts` fails on one
marked neither, and calls each admin route and tool as an everyday account
and as the admin. A head holding both kinds of route is `mixed`, so each of
its routes is listed, and a path under it that no listed route matches is
treated as `admin`: a forgotten mark fails closed. The 403 does tell an
everyday account that an admin route or tool by that name exists.
Nothing switches the refusal off: the test suite runs with it everywhere, and
a suite whose people make things promotes them first (`promote` in
`test/helpers/members.ts`). The crew's wake-up sweep, which starts a run on an
@@ -55,6 +55,9 @@
export const NOT_A_MEMBER =
/** The words a member (or guest) is refused admin settings and releases with. */
export const NOT_AN_ADMIN = "only an admin can change the forge's settings or its releases";
/** The one sentence an everyday account is refused an admin-only route or tool with: why, and what to do next (#11818). */
export const SIGN_IN_AS_ADMIN = "This is for the forge's admin account, so sign in as admin to do it.";
const lower = (s: string) => s.charAt(0).toLowerCase() + s.slice(1);
const capital = (s: string) => s.charAt(0).toUpperCase() + s.slice(1);
@@ -1,34 +1,43 @@
/**
 * The one gate in front of admin settings and releases: `/admin/*`,
 * `/api/v1/admin/*` and the `/releases` page with its rollback. A signed-in
 * person whose role lacks `administer` (`core/roles.ts`) is refused with a
 * 403 and one plain sentence, as JSON for the API and as a page for a
 * browser, before any handler runs. Anyone else meets the handler's own
 * The one gate in front of every admin-only route: those `route_marks.ts`
 * marks `admin` — `/admin/*`, `/api/v1/admin/*`, `/releases` with its
 * rollback, and the admin's pages elsewhere (`/settings/billing`, `/boards`,
 * …). A signed-in person whose role lacks `administer` (`core/roles.ts`) is
 * refused with a 403 and one plain sentence saying to sign in as admin, as
 * JSON for the API and as a page for a browser, before any handler runs. Anyone else meets the handler's own
 * rules, so an admin is unchanged. For releases the rule itself is
 * `release/gate.ts`'s, which the terminal shares; this gate only supplies the
 * 403 and its wording on the page. `/releases.json` stays public.
 */
import type { App } from "../app.ts";
import { lacks, NOT_AN_ADMIN } from "../core/roles.ts";
import { lacks, SIGN_IN_AS_ADMIN } from "../core/roles.ts";
import { forbiddenPage } from "../web/chrome.ts";
import type { Auth, Ctx } from "./context.ts";
import { json } from "./respond.ts";
import { isAdminRoute, markOf } from "./route_marks.ts";
const under = (path: string, root: string): boolean => path === root || path.startsWith(`${root}/`);
/** Whether this path is one the `administer` ability guards. */
/**
 * Whether this path is one the `administer` ability guards: its mark in
 * `route_marks.ts`. `/admin/flows` is marked open there: it answers anyone but
 * a site admin with the not-found page (#9594), its own refusal.
 */
export function isAdminPath(path: string): boolean {
  // `/admin/flows` answers anyone but a site admin with the not-found page (#9594), so it keeps its own refusal.
  if (path === "/admin/flows") return false;
  return under(path, "/admin") || under(path, "/api/v1/admin") || under(path, "/releases");
  return isAdminRoute(path);
}
/** The refusal for a person who may not administer, or undefined to carry on. */
export function adminGate(app: App, request: Request, url: URL, auth: Auth): Response | undefined {
  if (auth.user === undefined || !isAdminPath(url.pathname)) return undefined;
/**
 * The refusal for a person who may not administer, or undefined to carry on.
 * `pattern` is the route the router matched, so the mark is the one of the
 * handler that would run — `/packs/demo.git/info/refs` is the git route, not
 * a `/packs` page; without one the path's own mark decides.
 */
export function adminGate(app: App, request: Request, url: URL, auth: Auth, pattern?: string): Response | undefined {
  if (auth.user === undefined) return undefined;
  const mark = pattern === undefined ? undefined : markOf(pattern);
  if (!(mark === undefined ? isAdminPath(url.pathname) : mark === "admin")) return undefined;
  if (!lacks(app.db, auth.user, "administer")) return undefined;
  if (url.pathname.startsWith("/api/")) return json({ error: "not_admin", message: NOT_AN_ADMIN }, 403);
  if (url.pathname.startsWith("/api/")) return json({ error: "not_admin", message: SIGN_IN_AS_ADMIN }, 403);
  const ctx: Ctx = { app, request, url, params: {}, auth, theme: undefined };
  return forbiddenPage(ctx, NOT_AN_ADMIN);
  return forbiddenPage(ctx, SIGN_IN_AS_ADMIN);
}
@@ -37,7 +37,7 @@
import { REPORT_RECEIVED } from "../actions/report_words.ts";
import { BODY_MAX, REQUEST_MAX, TITLE_MAX } from "../core/reports.ts";
import { everydayOf } from "../core/everyday.ts";
import { claimDone, completeWrite, dropWrite, recordWrite } from "../core/conversation_writes.ts";
import { type Args, alreadyDone, visible, plansOnly, str, REPO_ARG, lean, fenceAnswer, heldWrite, askedFirst, readThrough } from "./mcp/shared.ts";
import { type Args, alreadyDone, notAdminTool, visible, plansOnly, str, REPO_ARG, lean, fenceAnswer, heldWrite, askedFirst, readThrough } from "./mcp/shared.ts";
import { CONVERSATION_BRIEF } from "../crew/conversation_brief.ts";
import { TOOLS } from "./mcp/tools.ts";
@@ -191,6 +191,9 @@
function rpcOne(
        typeof params["arguments"] === "object" && params["arguments"] !== null
          ? (params["arguments"] as Args)
          : {};
      // An admin's tool stays out of an everyday account's list, and a call to
      // it by name is told how to reach it before anything is held or asked (#11818).
      if (tool?.adminOnly === true && !user.isAdmin) return refuse(-32602, notAdminTool(tool.name));
      // Before the scope floor, so an admin tool the forge's agent was
      // steered to is held as a confirm too, not merely refused (#7649), and
      // one the person asked for waits for their yes (#7650).
@@ -1,3 +1,4 @@
import { SIGN_IN_AS_ADMIN } from "../../core/roles.ts";
import { mayView } from "../../core/sealed.ts";
import { getIssue, LIST_LIMIT_MAX } from "../../core/issues.ts";
import { canRead, canWrite, getRepo, type Repo } from "../../core/repos.ts";
@@ -73,6 +74,9 @@
export interface Tool {
  run(ctx: Ctx, user: User, args: Args): Promise<Answer> | Answer;
}
/** What an everyday account calling an admin's tool by name is told: not here, and the one sentence on what to do next. */
export const notAdminTool = (name: string): string => `no tool named ${name} for this account. ${SIGN_IN_AS_ADMIN}`;
/** Whether this caller is shown the tool and may call it: one rule for the manifest and dispatch. */
export const visible = (tool: Tool, ctx: Ctx, user: User): boolean =>
  (tool.adminOnly !== true || user.isAdmin) &&
@@ -125,8 +129,6 @@
function askedWork(ctx: Ctx, user: User, via: string, tool: Tool, args: Args, wo
export function heldWrite(ctx: Ctx, user: User, tool: Tool, args: Args): Record<string, unknown> | undefined {
  const via = ctx.auth.through;
  if (via === undefined || !tool.writes || plansOnly(tool, args)) return undefined;
  // An admin-only tool stays unknown to a person who is not one.
  if (tool.adminOnly === true && !user.isAdmin) return undefined;
  const words = fenceUp(ctx.app.db, via);
  if (words === undefined || named(words, tool.name, args) || askedWork(ctx, user, via, tool, args, words)) return undefined;
  if (tooBigToApprove(args)) return tooBig(tool.name);
@@ -184,7 +186,8 @@
export function askedFirst(ctx: Ctx, user: User, tool: Tool, args: Args): Record
  const via = ctx.auth.through;
  if (via === undefined) return undefined;
  // What the person may not do stays unknown to their agent.
  if ((tool.adminOnly === true || tool.needsAdminScope === true) && !user.isAdmin) return undefined;
  // An admin-only tool is refused before this, in mcp.ts (#11818).
  if (tool.needsAdminScope === true && !user.isAdmin) return undefined;
  const short = tool.needsAdminScope === true && !scopeAllows(ctx.auth.scope ?? "ro", "admin");
  if (!short && (!tool.writes || plansOnly(tool, args) || !asksFirst(tool.name, args))) return undefined;
  if (tooBigToApprove(args)) return tooBig(tool.name);
@@ -0,0 +1,415 @@
/**
 * Which routes are an admin's, as data (#11818). Every route either router
 * registers is marked `admin` or `open` here, by its head — the first path
 * segment, or `/api/v1/<segment>` on the API — or, under a head marked
 * `mixed`, by its own pattern. A head holding both kinds is `mixed`, so each
 * of its routes chooses; a path under a `mixed` head that no listed route
 * matches is treated as `admin`, so a forgotten mark fails closed.
 *
 * `admin_gate.ts` refuses a signed-in account that may not administer every
 * path marked `admin`, before any handler runs; `open` routes keep their
 * handler's own rules. `test/route-marks.test.ts` walks both routers and
 * fails on a route marked neither, so a new route must choose here.
 */
import { Router } from "./router.ts";
export type Mark = "admin" | "open";
/** Every head of a registered route: one mark for all of it, or `mixed` when each route is listed below. */
export const HEADS: Readonly<Record<string, Mark | "mixed">> = {
  "/": "open",
  "/-": "open",
  "/.well-known": "open",
  "/:owner": "open",
  "/__forge": "open",
  "/_funnel": "open",
  "/_measure": "open",
  "/_script-error": "open",
  "/admin": "mixed",
  "/agents": "open",
  "/api": "open",
  "/api/v1": "open",
  "/api/v1/": "open",
  "/api/v1/admin": "admin",
  "/api/v1/agents": "open",
  "/api/v1/app-templates": "open",
  "/api/v1/apps": "open",
  "/api/v1/asked": "open",
  "/api/v1/asks": "open",
  "/api/v1/boards": "open",
  "/api/v1/builds": "open",
  "/api/v1/changelog": "open",
  "/api/v1/cloud": "open",
  "/api/v1/codes": "open",
  "/api/v1/contribute": "open",
  "/api/v1/conversation": "open",
  "/api/v1/conversation-confirms": "open",
  "/api/v1/conversation-tokens": "open",
  "/api/v1/conversations": "open",
  "/api/v1/credit": "open",
  "/api/v1/crew": "open",
  "/api/v1/devices": "open",
  "/api/v1/drills": "open",
  "/api/v1/explore": "open",
  "/api/v1/family": "open",
  "/api/v1/features": "open",
  "/api/v1/feed": "open",
  "/api/v1/first-admin": "open",
  "/api/v1/flags": "open",
  "/api/v1/fleet": "open",
  "/api/v1/forge": "open",
  "/api/v1/forges": "open",
  "/api/v1/front": "open",
  "/api/v1/health": "open",
  "/api/v1/heartbeat": "open",
  "/api/v1/here": "open",
  "/api/v1/keeper": "open",
  "/api/v1/maintenance": "open",
  "/api/v1/map": "open",
  "/api/v1/migrate": "open",
  "/api/v1/openapi.json": "open",
  "/api/v1/orgs": "open",
  "/api/v1/packs": "open",
  "/api/v1/passport": "open",
  "/api/v1/plans": "open",
  "/api/v1/release": "open",
  "/api/v1/releases": "open",
  "/api/v1/repos": "open",
  "/api/v1/returns": "open",
  "/api/v1/search": "open",
  "/api/v1/secrets": "open",
  "/api/v1/sessions": "open",
  "/api/v1/share": "open",
  "/api/v1/start": "open",
  "/api/v1/telemetry": "open",
  "/api/v1/thoughts": "open",
  "/api/v1/timers": "open",
  "/api/v1/tokens": "open",
  "/api/v1/usage": "open",
  "/api/v1/user": "open",
  "/api/v1/users": "open",
  "/api/v1/version": "open",
  "/apple-touch-icon-precomposed.png": "open",
  "/apple-touch-icon.png": "open",
  "/apps": "open",
  "/asked": "open",
  "/asks": "open",
  "/assets": "open",
  "/audit": "open",
  "/audit.csv": "open",
  "/big": "open",
  "/board": "open",
  "/boards": "mixed",
  "/bring": "open",
  "/changelog": "open",
  "/changelog.atom": "open",
  "/claim": "open",
  "/contract": "open",
  "/contribute": "open",
  "/csp-report": "open",
  "/data": "open",
  "/deploy-to": "admin",
  "/displays": "open",
  "/docs": "open",
  "/events": "open",
  "/explore": "open",
  "/explore.atom": "open",
  "/family": "open",
  "/favicon.ico": "open",
  "/feed": "open",
  "/first-admin": "open",
  "/fleet": "open",
  "/flow": "mixed",
  "/forges": "mixed",
  "/front": "open",
  "/go": "open",
  "/home": "open",
  "/hooks": "open",
  "/icons": "open",
  "/live": "mixed",
  "/llms.txt": "open",
  "/login": "open",
  "/logout": "open",
  "/maintenance": "admin",
  "/manifest.webmanifest": "open",
  "/map": "open",
  "/mcp": "open",
  "/metrics": "open",
  "/migrate": "open",
  "/new": "open",
  "/notes": "open",
  "/now": "open",
  "/oauth": "open",
  "/og": "open",
  "/openapi.json": "open",
  "/opensearch.xml": "open",
  "/organizations": "open",
  "/origins": "open",
  "/packs": "mixed",
  "/pinned": "admin",
  "/pipeline": "open",
  "/plugins": "open",
  "/pricing": "open",
  "/privacy": "open",
  "/recover": "open",
  "/releases": "admin",
  "/releases.json": "open",
  "/repos": "open",
  "/resilience": "admin",
  "/review": "open",
  "/robots.txt": "open",
  "/runs": "open",
  "/search": "open",
  "/settings": "mixed",
  "/sign-in": "open",
  "/signin": "open",
  "/signup": "open",
  "/sitemap.xml": "open",
  "/sw.js": "open",
  "/system": "admin",
  "/talk": "open",
  "/tell": "open",
  "/theme": "open",
  "/verify": "open",
  "/welcome": "open",
};
/** Routes marked one by one: every route under a `mixed` head, and nothing else. */
export const ROUTES: Readonly<Record<string, Mark>> = {
  "/boards": "open",
  "/boards/data": "admin",
  "/boards/new": "open",
  "/boards/holds": "open",
  "/boards/pin": "open",
  "/boards/pin-panel": "open",
  "/boards/unpin-panel": "open",
  "/boards/move-pin": "open",
  "/boards/:slug": "open",
  "/boards/:slug/live": "open",
  "/boards/:slug/:op": "open",
  "/admin/flows": "open",
  "/admin/agent-start": "admin",
  "/admin/billing-links": "admin",
  "/admin/data": "admin",
  "/admin/invites": "admin",
  "/admin/invites/:id/revoke": "admin",
  "/admin/limits": "admin",
  "/admin/plans": "admin",
  "/admin/quotas": "admin",
  "/admin/signup": "admin",
  "/flow/keeper/answer": "admin",
  "/flow": "open",
  "/flow/valve": "open",
  "/flow/backup/retry": "admin",
  "/flow/suggestion": "open",
  "/forges": "admin",
  "/forges/refused": "admin",
  "/forges/name/:name": "open",
  "/forges/:name/claim-link": "admin",
  "/forges/:name/revoke-link": "admin",
  "/forges/:name/undo-link": "admin",
  "/forges/:name/stop": "admin",
  "/forges/:name/own-code": "admin",
  "/forges/:name/remove": "admin",
  "/forges/:name/ready": "open",
  "/forges/:name/waiting": "open",
  "/forges/new": "open",
  "/forges/start": "open",
  "/live/apps": "open",
  "/live/on-you": "open",
  "/live/client-apps": "open",
  "/live/feed": "open",
  "/live/milestones": "open",
  "/live/moving": "open",
  "/live/chips": "open",
  "/live/home/kpis": "admin",
  "/live/home/waiting": "open",
  "/live/home/panels": "admin",
  "/live/home/asked": "open",
  "/live/home/feed": "open",
  "/packs": "open",
  "/packs/mirror": "admin",
  "/packs/new": "admin",
  "/packs/:name/edit": "admin",
  "/packs/:name/repos": "admin",
  "/packs/:name": "open",
  "/settings/trusted": "admin",
  "/settings/trusted/stop": "admin",
  "/settings/trusted/revert": "admin",
  "/settings/trusted/:id/remove": "admin",
  "/settings/telemetry": "admin",
  "/settings": "open",
  "/settings/notify": "open",
  "/settings/dotfiles": "open",
  "/settings/edge/link": "open",
  "/settings/edge/unlink": "open",
  "/settings/parent/link": "open",
  "/settings/parent/unlink": "open",
  "/settings/email/verify": "open",
  "/settings/password": "open",
  "/settings/everyday": "open",
  "/settings/everyday/options": "admin",
  "/settings/everyday/switch": "open",
  "/settings/everyday/keep": "open",
  "/settings/shells": "open",
  "/settings/shells/stop-idle": "open",
  "/settings/shells/:id/stop": "open",
  "/settings/tokens": "open",
  "/settings/tokens/:id/delete": "open",
  "/settings/sessions/:id/delete": "open",
  "/settings/confirms": "open",
  "/settings/confirms/:id": "open",
  "/settings/passkeys": "open",
  "/settings/passkeys/options": "open",
  "/settings/passkeys/:id/delete": "open",
  "/settings/subscriptions": "admin",
  "/settings/crew/key": "admin",
  "/settings/crew/budgets": "admin",
  "/settings/subscriptions/:id/delete": "admin",
  "/settings/subscriptions/:id/wake": "admin",
  "/settings/subscriptions/:id/headroom": "admin",
  "/settings/subscriptions/:id/budget": "admin",
  "/settings/secrets": "admin",
  "/settings/secrets/delete": "admin",
  "/settings/devices": "admin",
  "/settings/devices/delete": "admin",
  "/settings/devices/grant": "admin",
  "/settings/devices/revoke": "admin",
  "/settings/devices/cap": "admin",
  "/settings/cloud": "admin",
  "/settings/cloud/verify": "admin",
  "/settings/cloud/write": "admin",
  "/settings/cloud/audit": "admin",
  "/settings/cloud/rotate": "admin",
  "/settings/cloud/rename": "admin",
  "/settings/cloud/remove": "admin",
  "/settings/access": "admin",
  "/settings/resilience": "admin",
  "/settings/capacity": "admin",
  "/settings/economics": "admin",
  "/settings/billing": "admin",
  "/settings/billing/grant": "admin",
  "/settings/billing/links": "admin",
  "/settings/billing/portal": "admin",
  "/settings/billing/stripe/connect": "admin",
  "/settings/billing/stripe/secret": "admin",
  "/settings/billing/stripe/disconnect": "admin",
  "/settings/billing/orders/retry": "admin",
  "/settings/billing/codes": "admin",
  "/settings/billing/codes/revoke": "admin",
  "/settings/flags": "admin",
  "/settings/captain": "admin",
  "/settings/packs": "admin",
  "/settings/features": "admin",
  "/settings/features/:slug": "admin",
  "/settings/features/:slug/run/:tool": "admin",
  "/settings/features/:slug/absorb": "admin",
  "/settings/features/:slug/unabsorb": "admin",
  "/settings/features/:slug/accept": "admin",
  "/settings/app-templates": "admin",
  "/settings/usage": "admin",
  "/settings/spend": "admin",
  "/settings/traffic": "admin",
  "/settings/traffic/returning": "admin",
  "/settings/traffic/sources": "admin",
  "/settings/traffic/scrapes": "admin",
  "/settings/traffic/scrapes/export": "admin",
  "/settings/traffic/scrapes/capture": "admin",
  "/settings/traffic/scrapes/stop": "admin",
  "/settings/traffic/scrapes/networks": "admin",
  "/settings/security": "admin",
  "/settings/security/controls": "admin",
  "/settings/security/shield": "admin",
  "/settings/backups": "admin",
  "/settings/backups/live": "admin",
  "/settings/backups/now": "admin",
  "/settings/backups/drill": "admin",
  "/settings/backups/destination": "admin",
  "/settings/backups/test": "admin",
  "/settings/backups/clear": "admin",
  "/settings/backups/mirror": "admin",
  "/settings/backups/mirror/clear": "admin",
  "/settings/backups/mirror/now": "admin",
  "/settings/accounts": "admin",
  "/settings/accounts/:username/allow": "admin",
  "/settings/accounts/:username/decline": "admin",
  "/settings/people": "admin",
  "/settings/people/:username/role": "admin",
  "/settings/model": "open",
  "/settings/accounts/:username/model": "admin",
  "/settings/accounts/:username/ceiling": "admin",
  "/settings/accounts/:username": "admin",
  "/settings/accounts/:username/tokens/:id/delete": "admin",
  "/settings/accounts/:username/sessions/:id/delete": "admin",
  "/settings/accounts/:username/suspend": "admin",
  "/settings/accounts/:username/unsuspend": "admin",
  "/settings/accounts/:username/remove": "admin",
  "/settings/accounts/:username/retire": "admin",
  "/settings/accounts/:username/verify": "admin",
  "/settings/accounts/:username/reset": "admin",
  "/settings/accounts/:username/end-sessions": "admin",
  "/settings/accounts/:username/way-back": "admin",
  "/settings/crew": "admin",
  "/settings/crew/knobs": "admin",
  "/settings/teams": "admin",
  "/settings/teams/stream": "admin",
  "/settings/teams/:slug": "admin",
  "/settings/crew/:username": "admin",
  "/settings/crew/:username/delete": "admin",
  "/settings/crew/model-review/:id/take": "admin",
  "/settings/crew/model-review/:id/decline": "admin",
  "/settings/origins/callback": "open",
  "/settings/origins": "open",
  "/settings/origins/token": "open",
  "/settings/origins/oauth": "open",
  "/settings/origins/apps": "open",
  "/settings/origins/trusted-hosts": "admin",
  "/settings/origins/apps/:id/delete": "open",
  "/settings/origins/flows/:id": "open",
  "/settings/origins/flows/:id/poll": "open",
  "/settings/origins/flows/:id/stream": "open",
  "/settings/origins/:id/repos": "open",
  "/settings/origins/:id/archived": "open",
  "/settings/origins/:id/mirror": "open",
  "/settings/origins/:id/mirror/:job": "open",
  "/settings/origins/:id/sync": "open",
  "/settings/origins/:id/check": "open",
  "/settings/origins/:id/delete": "open",
  "/settings/origins/:id/token": "open",
  "/settings/keys": "open",
  "/settings/keys/:id/delete": "open",
};
/** The head a pattern or a path is marked by. */
export function headOf(path: string): string {
  const parts = path.split("/");
  return path.startsWith("/api/") ? parts.slice(0, 4).join("/") : `/${parts[1] ?? ""}`;
}
/** A pattern's mark, or undefined when it has none: a route that has not chosen. */
export function markOf(pattern: string): Mark | undefined {
  const own = ROUTES[pattern];
  if (own !== undefined) return own;
  const head = HEADS[headOf(pattern)];
  return head === "mixed" ? undefined : head;
}
let listed: Router<Mark> | undefined;
/** ROUTES as a matcher, literal segments before parameters so `/packs/new` is not read as `/packs/:name`. */
function listedRoutes(): Router<Mark> {
  if (listed !== undefined) return listed;
  const params = (p: string) => p.split("/").filter((s) => s.startsWith(":") || s.startsWith("*")).length;
  const matcher = new Router<Mark>();
  for (const pattern of Object.keys(ROUTES).sort((a, b) => params(a) - params(b)))
    matcher.add("*", pattern, ROUTES[pattern] as Mark);
  return (listed = matcher);
}
/** Whether a request path falls on a route marked `admin`; unlisted under a `mixed` head counts as `admin`. */
export function isAdminRoute(path: string): boolean {
  const own = listedRoutes().match("*", path);
  if (own !== undefined) return own.handler === "admin";
  const head = HEADS[headOf(path)];
  return head === "admin" || head === "mixed";
}
@@ -3020,7 +3020,7 @@
async function answerGet(
  if (viaRefusal !== undefined) return viaRefusal;
  // Admin settings and releases are an admin's; a member is told so.
  const adminRefusal = adminGate(app, request, url, auth);
  const adminRefusal = adminGate(app, request, url, auth, matched.pattern);
  if (adminRefusal !== undefined) return adminRefusal;
  // A transferred repository's old path answers 308 to its new one (#569).
@@ -70,7 +70,7 @@
test("one logged request: the filter and a table row, escaped, no card", async (
  expect(page).toContain("&lt;b&gt;probe");
});
test("a non-admin still gets 404", async () => {
test("a non-admin is refused with 403", async () => {
  const res = await fetch(servers.url + "/settings/access", { headers: { cookie: cookies.bob! } });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
});
@@ -86,20 +86,20 @@
describe("an admin resets a person's access", () => {
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a profile offers Manage account to an admin only, and the page answers 404 to anyone else", async () => {
  test("a profile offers Manage account to an admin only, and the page refuses anyone else", async () => {
    const asAdmin = await (await get("/bob", owner)).text();
    expect(asAdmin).toContain("/settings/accounts/bob");
    expect(asAdmin).toContain("Manage account");
    expect(await (await get("/bob", bobCookie)).text()).not.toContain("Manage account");
    expect(await (await get("/bob")).text()).not.toContain("Manage account");
    expect((await get("/settings/accounts/bob", bobCookie)).status).toBe(404);
    expect((await get("/settings/accounts/bob", bobCookie)).status).toBe(403);
    const page = await get("/settings/accounts/bob", owner);
    expect(page.status).toBe(200);
    const text = await page.text();
    for (const word of ["Role", "[email protected]", "Verified", "a password is set", "Owns", "Signed in now", "Reset access", "End all sessions", "Model budget"])
      expect(text).toContain(word);
    expect(text).not.toContain("bob-old-passphrase");
    expect((await post("/settings/accounts/bob/reset", bobCookie)).status).toBe(404);
    expect((await post("/settings/accounts/bob/reset", bobCookie)).status).toBe(403);
  });
  test("the accounts list searches by name", async () => {
@@ -217,7 +217,7 @@
describe("an admin resets a person's access", () => {
    expect(ended.sessionsEnded).toBe(0);
  });
  test("only the forge's owner manages another admin; a member is told 404", async () => {
  test("only the forge's owner manages another admin; a member is refused with 403", async () => {
    const olive = createToken(app.db, getUserByName(app.db, "olive")!.id, "t", "admin").token;
    const refused = await api("/api/v1/admin/accounts/olive/reset", adminTwo);
    expect(refused.status).toBe(422);
@@ -61,7 +61,7 @@
test("the accounts list keeps its confirm links", async () => {
  expect(m).toContain("/-/confirm?to=%2Fsettings%2Faccounts%2Fbobby%2Fsuspend");
});
test("a non-admin gets the one 404", async () => {
test("a non-admin gets the one 403", async () => {
  const r = await fetch(`${servers.url}/settings/accounts`, { headers: { cookie: plain } });
  expect(r.status).toBe(404);
  expect(r.status).toBe(403);
});
@@ -125,8 +125,8 @@
describe("accounts: the confirm page for removing an organization too", () => {
  test("a non-admin and a cross-origin post are refused, changing nothing", async () => {
    await seed("rc");
    expect((await fetch(`${base}/settings/accounts/rc/retire`, { headers: other })).status).toBe(404);
    expect((await post("rc", other)).status).toBe(404);
    expect((await fetch(`${base}/settings/accounts/rc/retire`, { headers: other })).status).toBe(403);
    expect((await post("rc", other)).status).toBe(403);
    expect((await post("rc", { ...admin, origin: "https://evil.example" })).status).toBe(403);
    expect(getUserByName(app.db, "rc")?.removedAt).toBeNull();
    expect(existsSync(repoDir(app.reposRoot, "rcco", "ledger"))).toBe(true);
@@ -107,11 +107,11 @@
test("the suspend confirm, the removal refusal, the retire page and the removed
  expect(main).toContain("<h2>Removed</h2>");
});
test("a non-admin still gets the 404, and the page costs a handful of statements", async () => {
test("a non-admin is refused with 403, and the page costs a handful of statements", async () => {
  const mallory = await createUser(app.db, { origin: "seed", trusted: true, username: "mallory", email: "[email protected]", password: "correct-horse-battery" });
  if (!mallory.ok) throw new Error(mallory.error);
  const theirs = `forge_session=${createSession(app.db, getUserByName(app.db, "mallory")!.id).token}`;
  expect((await fetch(`${servers.url}/settings/accounts`, { headers: { cookie: theirs } })).status).toBe(404);
  expect((await fetch(`${servers.url}/settings/accounts`, { headers: { cookie: theirs } })).status).toBe(403);
  await fetch(`${servers.url}/settings/accounts`, { headers: { cookie } });
  expectWork(await requestStatements(app.db, `${servers.url}/settings/accounts`, { headers: { cookie } }), { max: 25 });
});
@@ -175,7 +175,7 @@
describe("accounts: the owner sees, suspends and removes", () => {
    const page = await fetch(`${base}/settings/accounts`, {
      headers: { authorization: `Bearer ${token}` },
    });
    expect(page.status).toBe(404);
    expect(page.status).toBe(403);
  });
  test("the owner's list shows each account, how it came, and what it holds", async () => {
@@ -9,7 +9,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { NOT_AN_ADMIN, setMember } from "../src/core/roles.ts";
import { SIGN_IN_AS_ADMIN, setMember } from "../src/core/roles.ts";
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
@@ -118,7 +118,7 @@
describe("the admin gate", () => {
      const res = await api("GET", "/api/v1/admin/settings", u);
      expect(res.status).toBe(403);
      expect(res.headers.get("content-type")).toContain("application/json");
      expect(await res.json()).toMatchObject({ error: "not_admin", message: NOT_AN_ADMIN });
      expect(await res.json()).toMatchObject({ error: "not_admin", message: SIGN_IN_AS_ADMIN });
    }
  });
@@ -130,7 +130,7 @@
describe("the admin gate", () => {
        expect(res.headers.get("content-type")).toContain("text/html");
        const body = await res.text();
        expect(body).toContain("<h1>You can't do that here</h1>");
        expect(body).toContain(NOT_AN_ADMIN.replace("'", "&#39;"));
        expect(body).toContain(SIGN_IN_AS_ADMIN.replace("'", "&#39;"));
      }
    }
  });
@@ -11,7 +11,7 @@
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createRepo } from "../src/actions/repos.ts";
import { mayRead, mayRollBack } from "../src/release/gate.ts";
import { NOT_AN_ADMIN, setMember } from "../src/core/roles.ts";
import { SIGN_IN_AS_ADMIN, setMember } from "../src/core/roles.ts";
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
@@ -86,7 +86,7 @@
describe("a member is refused admin settings and releases", () => {
    for (const [method, path, body] of apiActs) {
      const refused = await call(method, path, carol, body);
      expect(refused.status, `${method} ${path}`).toBe(403);
      expect(await refused.json()).toMatchObject({ error: "not_admin", message: NOT_AN_ADMIN });
      expect(await refused.json()).toMatchObject({ error: "not_admin", message: SIGN_IN_AS_ADMIN });
    }
    for (const path of ["/api/v1/admin/capacity", "/api/v1/admin/limits", "/api/v1/admin/people"])
      expect((await call("GET", path, alice)).status, path).toBe(200);
@@ -104,7 +104,7 @@
describe("a member is refused admin settings and releases", () => {
    for (const [method, path] of pages) {
      const refused = await visit(method, path, carol);
      expect(refused.status, `${method} ${path}`).toBe(403);
      expect(await refused.text()).toContain(NOT_AN_ADMIN.replace("'", "&#39;"));
      expect(await refused.text()).toContain(SIGN_IN_AS_ADMIN.replace("'", "&#39;"));
    }
    expect((await visit("GET", "/admin/limits", alice)).status).toBe(200);
    expect((await visit("GET", "/releases", alice)).status).toBe(200);
@@ -69,6 +69,6 @@
test("an agent's page: one h1, plain sections, both forms, no card", async () =>
  expect(page).toContain("to=%2Fsettings%2Fcrew%2Fscoutly%2Fdelete");
});
test("a non-admin still gets 404", async () => {
  expect((await fetchPage(member)).status).toBe(404);
test("a non-admin is refused with 403", async () => {
  expect((await fetchPage(member)).status).toBe(403);
});
@@ -100,7 +100,7 @@
describe("/flow backup card", () => {
    const res = await retry(await login("alice"));
    expect(res.status).toBe(303);
    expect(res.headers.get("location")).toBe("/flow");
    expect((await retry(await login("bob"))).status).toBe(404);
    expect((await retry(await login("bob"))).status).toBe(403);
    expect((await retry(await login("alice"), "https://evil.example")).status).toBeGreaterThanOrEqual(400);
  });
});
@@ -159,7 +159,7 @@
test("a failed snapshot ends in backup.finished {ok:false}, and the live part sh
test("the live part and the stream are an admin's alone", async () => {
  const bob = await login("bob", "another-good-passphrase");
  const part = await fetch(`${servers.url}/settings/backups/live`, { headers: { cookie: bob } });
  expect(part.status).toBe(404);
  expect(part.status).toBe(403);
  expect((await fetch(`${servers.url}/settings/backups/live`)).status).toBeGreaterThanOrEqual(300);
  const frames = async (cookie: string, mustArrive: boolean): Promise<string> => {
@@ -198,7 +198,7 @@
test("Settings → Billing: set three links, the home shows them; clear, the hom
  const page = await (await fetch(`${servers.url}/settings/billing`, { headers: { cookie: adminCookie } })).text();
  expect(page).toContain("Payment links");
  for (const z of ["small", "medium", "large"]) expect(page).toContain(`name="${z}"`);
  expect((await links(memberCookie, LINKS)).status).toBe(404);
  expect((await links(memberCookie, LINKS)).status).toBe(403);
  const bad = await links(adminCookie, { ...LINKS, large: "http://nope.test" });
  expect(bad.status).toBe(422);
  const badPage = await bad.text();
@@ -139,7 +139,7 @@
describe("billing seam", () => {
    expect(text).toContain("Choose the plan each forge is on.");
    expect(text).toContain("Paste a Stripe secret or restricted key");
    expect(text).toContain('data-forge="kid"');
    expect((await send("GET", "/settings/billing", bob)).status).toBe(404);
    expect((await send("GET", "/settings/billing", bob)).status).toBe(403);
  });
  test("the Billing page says the last Stripe event and the refused signatures, or that none came", async () => {
@@ -157,9 +157,9 @@
describe("billing seam", () => {
    expect(after).toContain("<dt>Refused today</dt>");
  });
  test("a non-admin gets 404 and no event data on the Billing page", async () => {
  test("a non-admin gets 403 and no event data on the Billing page", async () => {
    const res = await send("GET", "/settings/billing", bob);
    expect(res.status).toBe(404);
    expect(res.status).toBe(403);
    const text = await res.text();
    expect(text).not.toContain("invoice.paid");
    expect(text).not.toContain("Refused today");
@@ -176,13 +176,13 @@
describe("/boards/data", () => {
    expect(body.split("Average CPU cores per day, where target is forge.").length - 1).toBe(1);
    expect(body).toMatch(/<div class="card-foot">\s*Average CPU cores per day/);
  });
  test("a member who is not a site admin gets 404 for a sentence, and no redirect", async () => {
  test("a member who is not a site admin gets 403 for a sentence, and no redirect", async () => {
    const r = await createUser(app.db, { origin: "seed", trusted: true, username: "bob", email: "[email protected]", password: "a-good-passphrase" });
    if (!r.ok) throw new Error(r.error);
    const member = createToken(app.db, r.value.id, "t", "admin").token;
    for (const q of ["ask=memory+over+the+last+3+days", "ask=zzz"]) {
      const res = await fetch(`${servers.url}/boards/data?${q}`, { redirect: "manual", headers: { authorization: `Bearer ${member}` } });
      expect(res.status).toBe(404);
      expect(res.status).toBe(403);
      expect(res.headers.get("location")).toBeNull();
    }
    const anon = await fetch(`${servers.url}/boards/data?ask=memory`, { redirect: "manual" });
@@ -163,10 +163,10 @@
describe("/boards/data?ask=", () => {
    expect((await post("zzz qqq", { origin: "https://evil.example" })).status).toBe(403);
    expect(calls).toEqual([]);
  });
  test("a member who is not an admin gets 404 and the model is not asked", async () => {
  test("a member who is not an admin gets 403 and the model is not asked", async () => {
    useModel(stub(JSON.stringify(GOOD)));
    expect((await get("/boards/data?ask=zzz+qqq", {}, member)).status).toBe(404);
    expect((await fetch(servers.url + "/boards/data", { method: "POST", body: new URLSearchParams({ ask: "zzz" }), headers: { authorization: `Bearer ${member}`, origin: servers.url } })).status).toBe(404);
    expect((await get("/boards/data?ask=zzz+qqq", {}, member)).status).toBe(403);
    expect((await fetch(servers.url + "/boards/data", { method: "POST", body: new URLSearchParams({ ask: "zzz" }), headers: { authorization: `Bearer ${member}`, origin: servers.url } })).status).toBe(403);
    expect(calls).toEqual([]);
  });
});
@@ -160,8 +160,8 @@
describe("/boards/data", () => {
    expect(body).not.toContain("<script>x</script>");
  });
  test("a non-admin and a stranger get 404; the admin's menu links Boards", async () => {
    expect((await get("/boards/data", "bob")).status).toBe(404);
  test("a non-admin gets 403 and a stranger 404; the admin's menu links Boards", async () => {
    expect((await get("/boards/data", "bob")).status).toBe(403);
    expect((await get("/boards/data", null)).status).toBe(404);
    expect(await (await get("/", "admin")).text()).toContain('href="/boards"');
    expect(await (await get("/", "bob")).text()).not.toContain('href="/boards"');
@@ -124,7 +124,7 @@
describe("self-swap on /capacity and MCP capacity", () => {
    }
  });
  test("a member gets no selfSwap from the tool and a 404 from the page", async () => {
  test("a member gets no selfSwap from the tool and a 403 from the page", async () => {
    const bob = await createUser(app.db, { origin: "seed", trusted: true, username: "bob", email: "[email protected]", password: "a-good-passphrase" });
    if (!bob.ok) throw new Error(bob.error);
    const token = createToken(app.db, bob.value.id, "t", "admin").token;
@@ -132,7 +132,7 @@
describe("self-swap on /capacity and MCP capacity", () => {
    expect(result.isError).toBe(true);
    expect(result.content[0]!.text).not.toContain("selfSwap");
    const res = await fetch(`${servers.url}/settings/capacity`, { headers: { authorization: `Bearer ${token}` } });
    expect(res.status).toBe(404);
    expect(res.status).toBe(403);
    expect(await res.text()).not.toContain("self-swap");
  });
});
@@ -199,7 +199,7 @@
describe("capacity: only a forge admin reads or changes it", () => {
          headers: { cookie: bobCookie },
        })
      ).status,
    ).toBe(404);
    ).toBe(403);
    const bobPost = await fetch(`${servers.url}/settings/capacity`, {
      method: "POST",
      redirect: "manual",
@@ -210,7 +210,7 @@
describe("capacity: only a forge admin reads or changes it", () => {
      },
      body: new URLSearchParams({ key: "checks.concurrency", value: "9" }),
    });
    expect(bobPost.status).toBe(404);
    expect(bobPost.status).toBe(403);
    for (const token of [bobAdmin, agentRw]) {
      // A person who is not an admin is refused; an agent is told it is not there.
@@ -179,7 +179,8 @@
describe("revoking a forge link", () => {
  test("the routes: a member and a guest get nothing, and another origin is refused", async () => {
    for (const cookie of [bobCookie, ""]) {
      for (const act of ["revoke", "undo"] as const) expect((await post("one", act, cookie)).status).toBe(404);
      // A member is refused at the admin gate; a stranger finds nothing.
      for (const act of ["revoke", "undo"] as const) expect((await post("one", act, cookie)).status).toBe(cookie === "" ? 404 : 403);
    }
    const crossed = await post("one", "revoke", aliceCookie, "https://evil.test");
    expect(crossed.headers.get("location") ?? "").not.toContain("link=revoked");
@@ -151,7 +151,7 @@
describe("the client list", () => {
  });
  test("someone who is not an admin of the parent gets no list: page, API or MCP", async () => {
    expect((await list(reader)).status).toBe(404);
    expect((await list(reader)).status).toBe(403);
    const tool = (await (await mcp(bobRw)).json()) as any;
    expect(tool.result?.isError ?? tool.error !== undefined).toBe(true);
    expect(JSON.stringify(tool)).not.toContain("maria");
@@ -251,7 +251,7 @@
describe("the client list", () => {
        headers: { cookie, origin: "https://forge.test" },
        redirect: "manual",
      });
    expect((await fresh(reader)).status).toBe(404);
    expect((await fresh(reader)).status).toBe(403);
    const res = await fresh(admin);
    expect(res.status).toBe(201);
    expect(res.headers.get("cache-control")).toContain("no-store");
@@ -119,7 +119,7 @@
describe("cloud gate", () => {
    expect(main).toContain("Used for nothing now");
    const bobCookie = await login("bob");
    for (const path of ["/settings/cloud", "/settings/cloud/audit"])
      expect((await fetch(`${servers.url}${path}`, { headers: { cookie: bobCookie } })).status).toBe(404);
      expect((await fetch(`${servers.url}${path}`, { headers: { cookie: bobCookie } })).status).toBe(403);
  });
  test("a gated verify audits each request; bytes out counts the body", async () => {
@@ -57,7 +57,7 @@
test("today's vendor calls are a headed block, no card; with none one sentence s
  expect(main).toContain("No vendor call today. Rows are kept 90 days.");
});
test("a signed-in non-admin gets the forge's one 404 for the vendor calls", async () => {
test("a signed-in non-admin gets the gate's 403 for the vendor calls", async () => {
  const made = await createUser(app.db, { origin: "seed", trusted: true, username: "bob", email: "[email protected]", password: "a-good-passphrase" });
  if (!made.ok) throw new Error(made.error);
  const r = await fetch(`${servers.url}/signin`, {
@@ -68,6 +68,6 @@
test("a signed-in non-admin gets the forge's one 404 for the vendor calls", asyn
  });
  const bob = (r.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  const res = await fetch(`${servers.url}/settings/cloud/audit`, { headers: { cookie: bob } });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  expect(await res.text()).not.toContain("vendor call");
});
@@ -165,7 +165,7 @@
describe("cloud accounts", () => {
    expect(page).toContain("verify");
    expect(page).toContain("read-only");
    expect(page).not.toContain(TOKEN);
    expect((await get(await login("bob"))).status).toBe(404);
    expect((await get(await login("bob"))).status).toBe(403);
    const cross = await fetch(`${servers.url}/settings/cloud/write`, {
      method: "POST",
      redirect: "manual",
@@ -68,6 +68,6 @@
test("a waiting ask is a row in a .list with its same-origin Yes form", async ()
  expect(main(await (await get("/settings/confirms", plain)).text())).not.toContain(asked.needs_confirm);
});
test("a non-admin gets the one 404 on the admin pages", async () => {
  expect((await get("/settings/accounts", plain)).status).toBe(404);
test("a non-admin gets the one 403 on the admin pages", async () => {
  expect((await get("/settings/accounts", plain)).status).toBe(403);
});
@@ -113,7 +113,7 @@
describe("what the crew handed on", () => {
  test("a non-admin gets neither", async () => {
    const { status, text } = await crewPage("bob");
    expect(status).toBe(404);
    expect(status).toBe(403);
    expect(text).not.toContain("Handed to the planner");
    expect(text).not.toContain("Restore drill");
    expect(await terminal("bob")).not.toContain("Handed to the planner: ");
@@ -61,8 +61,8 @@
describe("adding the crew's key", () => {
    expect(listSubscriptions(app.db)).toEqual([]);
  });
  test("a non-admin gets the not-found page", async () => {
    expect((await post(plain, GOOD)).status).toBe(404);
  test("a non-admin gets the 403 page", async () => {
    expect((await post(plain, GOOD)).status).toBe(403);
    expect(listSubscriptions(app.db)).toEqual([]);
  });
@@ -80,7 +80,7 @@
test("with an agent: its link is on the page, still no card", async () => {
  expect(main).toContain('href="/settings/crew/bot"');
});
test("a non-admin still gets 404", async () => {
test("a non-admin is refused with 403", async () => {
  const res = await fetch(`${servers.url}/settings/crew`, { headers: { cookie: other }, redirect: "manual" });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
});
@@ -79,10 +79,10 @@
describe("crew teams", () => {
    expect(text).not.toContain("Owns <b>looks");
  });
  test("a non-admin gets the 404 on read and write, and a cross-origin post is refused", async () => {
  test("a non-admin gets 403 on read and write, and a cross-origin post is refused", async () => {
    const page = await fetch(`${servers.url}/settings/teams`, { headers: { cookie: cookie(bob) } });
    expect(page.status).toBe(404);
    expect((await post(bob, "design", new URLSearchParams({ dial: "90" }))).status).toBe(404);
    expect(page.status).toBe(403);
    expect((await post(bob, "design", new URLSearchParams({ dial: "90" }))).status).toBe(403);
    expect(dialOf("design")).toBe(30);
    expect((await post(alice, "design", new URLSearchParams({ dial: "5" }), "http://evil.example")).status).toBe(403);
    expect(dialOf("design")).toBe(30);
@@ -223,12 +223,12 @@
test("a change request by the pull's own author is not a return", () => {
  expect(weekCard(app.db).find((l) => l.username === "smith")!.returned).toBe(before);
});
test("a non-admin: the page is not found and has no week block, the API and MCP refuse", async () => {
test("a non-admin: the page is refused and has no week block, the API and MCP refuse", async () => {
  const u = await createUser(app.db, { origin: "seed", trusted: true, username: "pat", email: "[email protected]", password: "a-good-passphrase" });
  if (!u.ok) throw new Error(String(u.error));
  const pc = `forge_session=${createSession(app.db, u.value.id).token}`;
  const page = await fetch(`${servers.url}/settings/crew`, { headers: { cookie: pc } });
  expect(page.status).toBe(404);
  expect(page.status).toBe(403);
  expect(await page.text()).not.toContain("crew-week");
  const pt = createToken(app.db, u.value.id, "t", "ro").token;
  const api = await fetch(`${servers.url}/api/v1/crew/week`, { headers: { authorization: `Bearer ${pt}` } });
@@ -182,7 +182,7 @@
test("a signed-in non-admin sees nothing and can neither declare nor remove", as
  if (!keep.ok) throw new Error(keep.error);
  const before = listDevices(app.db).length;
  const page = await fetch(`${servers.url}/settings/devices`, { headers: { cookie: plain } });
  expect(page.status).toBe(404);
  expect(page.status).toBe(403);
  expect(await page.text()).not.toContain("Keep");
  await post("/settings/devices", { name: "Mine", kind: "printer", url: printerUrl }, plain);
  await post("/settings/devices/delete", { id: String(keep.value.id) }, plain);
@@ -169,7 +169,7 @@
describe("the forge with its forwardAuth edge gone", () => {
    expect(mintWayBack(app, owner, "olga")).toEqual({ ok: false, error: "not_found" });
    const beaCookie = `forge_session=${createSession(app.db, bea.id).token}`;
    const refused = await fetch(`${base}/settings/accounts/ada/way-back`, { method: "POST", headers: { cookie: beaCookie, origin: base } });
    expect(refused.status).toBe(404);
    expect(refused.status).toBe(403);
    // From another site: refused before anything is made.
    const crossed = await fetch(`${base}/settings/accounts/ada/way-back`, { method: "POST", headers: { cookie: ownerCookie, origin: "https://elsewhere.example" } });
    expect(crossed.status).toBe(403);
@@ -168,8 +168,8 @@
describe("the route", () => {
    expect(page).toContain("Run now");
  });
  test("a non-admin gets the 404", async () => {
    expect((await web(cyCookie, "/settings/features/radar/run/scan", true)).status).toBe(404);
  test("a non-admin gets the 403", async () => {
    expect((await web(cyCookie, "/settings/features/radar/run/scan", true)).status).toBe(403);
  });
  test("an admin on an asleep app is sent back with a sentence, and nothing is recorded", async () => {
@@ -276,8 +276,8 @@
describe("absorbing an app", () => {
    expect((await api("GET", cyToken, "")).status).toBe(404);
    // A read-scope token of the admin may look, not absorb.
    expect((await api("PUT", adaReadToken, "/radar")).status).toBe(403);
    expect((await web(cyCookie, "/settings/features")).status).toBe(404);
    expect((await web(cyCookie, "/settings/features/radar/absorb", new URLSearchParams())).status).toBe(404);
    expect((await web(cyCookie, "/settings/features")).status).toBe(403);
    expect((await web(cyCookie, "/settings/features/radar/absorb", new URLSearchParams())).status).toBe(403);
    expect(getAbsorbed(app.db, appId)).toBeUndefined();
  });
@@ -301,8 +301,8 @@
describe("a hosted forge scales to zero", () => {
        headers: { authorization: `Bearer ${bearer}`, "content-type": "application/x-www-form-urlencoded", ...(origin === undefined ? {} : { origin }) },
        body: "",
      });
    expect((await post("/forges/homie/stop", carolToken, "https://forge.test")).status).toBe(404);
    expect((await post("/forges/homie/remove", carolToken, "https://forge.test")).status).toBe(404);
    expect((await post("/forges/homie/stop", carolToken, "https://forge.test")).status).toBe(403);
    expect((await post("/forges/homie/remove", carolToken, "https://forge.test")).status).toBe(403);
    expect(existsSync(join(dir, "spawn", "homie.json"))).toBe(true);
    const cross = await post("/forges/homie/remove", aliceToken, "https://evil.example");
    expect(cross.status).toBe(403);
@@ -311,7 +311,7 @@
describe("a hosted forge scales to zero", () => {
    expect(confirm.status).toBe(200);
    expect(await confirm.text()).toContain("cannot be undone");
    const asCarol = await fetch(`${servers.url}/forges/homie/remove`, { headers: { authorization: `Bearer ${carolToken}` } });
    expect(asCarol.status).toBe(404);
    expect(asCarol.status).toBe(403);
    const stopped = await post("/forges/homie/stop", aliceToken, "https://forge.test");
    expect(stopped.status).toBe(200);
  });
@@ -277,7 +277,7 @@
describe("gift codes", () => {
    expect(text).toContain("Stop this code working");
    expect(await (await send("GET", "/settings/billing", admin)).text()).not.toContain(code);
    expect((await form("/settings/billing/codes", admin, { plan: "free", uses: "1" })).status).toBe(422);
    expect((await form("/settings/billing/codes", bob, { plan: "small" })).status).toBe(404);
    expect((await form("/settings/billing/codes", bob, { plan: "small" })).status).toBe(403);
    const home = await send("GET", `/?code=${code}`, undefined);
    expect(home.status).toBe(303);
@@ -89,7 +89,7 @@
test("each late region answers alone, to its own viewer, and to no one else", as
  }
  for (const name of ["kpis", "panels"]) {
    const peer = await fetch(`${f.base}/live/home/${name}`, { headers: { cookie: f.peerCookie } });
    expect(peer.status).toBe(404);
    expect(peer.status).toBe(403);
  }
  const peerFeed = await fetch(`${f.base}/live/home/feed`, { headers: { cookie: f.peerCookie } });
  expect(peerFeed.status).toBe(200);
@@ -89,7 +89,7 @@
test("a member who is not an admin is refused and changes nothing", async () =>
    headers: { authorization: `Bearer ${token}`, "content-type": "application/x-www-form-urlencoded", origin: servers.url },
    body: new URLSearchParams({ knob: "speed", value: "6", repo: "" }),
  });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  expect(capacityValue(app.db, "crew.concurrency")).toBe("3");
});
@@ -170,13 +170,13 @@
test("the stall section lists route, ms and count, the route escaped", () => {
  expect(text).toContain('<td class="mono">/api/v1/telemetry/flow</td><td class="num mono">0</td><td class="num mono">0</td>');
});
test("/system shows the owner the stall section with the flow route; a member gets 404", async () => {
test("/system shows the owner the stall section with the flow route; a member gets 403", async () => {
  const page = await fetch(`${servers.url}/system`, { headers: { cookie: await login("alice") } });
  expect(page.status).toBe(200);
  const html = await page.text();
  expect(html).toContain('id="sys-stalls"');
  expect(html).toContain('<tr data-route="/api/v1/telemetry/flow">');
  expect((await fetch(`${servers.url}/system`, { headers: { cookie: await login("bob") } })).status).toBe(404);
  expect((await fetch(`${servers.url}/system`, { headers: { cookie: await login("bob") } })).status).toBe(403);
});
const identity = (user?: User) => ({ sshUsername: user?.username ?? "git", remoteAddress: "127.0.0.1", fingerprint: "SHA256:test", user });
@@ -139,11 +139,11 @@
describe("prepare and come back", () => {
    expect(inMaintenance(dataDir)).toBe(false);
  });
  test("page: guest is sent to sign in, a non-admin gets not-found", async () => {
  test("page: guest is sent to sign in, a non-admin gets 403", async () => {
    const guest = await fetch(`${servers.url}/maintenance`, { redirect: "manual" });
    expect([302, 303, 401]).toContain(guest.status);
    const b = await fetch(`${servers.url}/maintenance`, { headers: { cookie: await login("bob") } });
    expect(b.status).toBe(404);
    expect(b.status).toBe(403);
    expect((await form("/maintenance/prepare", await login("bob"), { confirm: "yes" })).status).not.toBe(200);
    expect(inMaintenance(dataDir)).toBe(false);
  });
@@ -1,5 +1,6 @@
/** MCP `restore_drill`: the Backups page's drill button, from a harness. */
import { notAdminTool } from "../src/http/mcp/shared.ts";
import { afterEach, beforeEach, describe, expect, test } from "bun:test";
import { mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
@@ -83,7 +84,7 @@
describe("MCP restore_drill", () => {
    });
    test("a non-admin is refused", async () => {
      const r = await call(token("bob"));
      expect(r.rpc).toBe("no tool named restore_drill");
      expect(r.rpc).toBe(notAdminTool("restore_drill"));
      expect(r.text).toBe("");
    });
  });
@@ -84,9 +84,9 @@
describe("a member and the crew's standing instructions", () => {
    expect(getUserByName(app.db, "olive")!.isAdmin).toBe(true);
    expect(getUserByName(app.db, "bob")!.isAdmin).toBe(false);
    expect((await patch(memberToken, "Ignore the rules.")).status).toBe(403);
    expect((await post(memberCookie, "Ignore the rules.")).status).toBe(404);
    expect((await post(memberCookie, "Ignore the rules.")).status).toBe(403);
    const form = await fetch(`${servers.url}/settings/crew/robin`, { headers: { cookie: memberCookie } });
    expect(form.status).toBe(404);
    expect(form.status).toBe(403);
    expect(brief()).toBe(ORIGINAL);
  });
@@ -11,7 +11,7 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { signUp } from "../src/actions/users.ts";
import { NOT_AN_ADMIN } from "../src/core/roles.ts";
import { SIGN_IN_AS_ADMIN } from "../src/core/roles.ts";
import { createToken } from "../src/core/tokens.ts";
import { createSession, listSessions } from "../src/core/sessions.ts";
import { getUserByName } from "../src/core/users.ts";
@@ -87,7 +87,7 @@
describe("a member and another account", () => {
      const res = await call(path, bobToken, method, body);
      const gated = path.startsWith("/api/v1/admin/");
      expect([method, path, res.status]).toEqual([method, path, gated ? 403 : 404]);
      if (gated) expect(await res.json()).toMatchObject({ error: "not_admin", message: NOT_AN_ADMIN });
      if (gated) expect(await res.json()).toMatchObject({ error: "not_admin", message: SIGN_IN_AS_ADMIN });
    }
    expect(listSessions(app.db, carol.id).some((s) => s.id === sid)).toBe(true);
    // Carol's token: not listed, not revoked through bob's own token routes.
@@ -122,9 +122,9 @@
describe("a member and another account", () => {
      [`/settings/accounts/carol/sessions/${sid}/delete`, {}],
    ];
    for (const [path, form] of forms)
      expect([path, (await post(path, form)).status]).toEqual([path, 404]);
      expect([path, (await post(path, form)).status]).toEqual([path, 403]);
    const page = await fetch(`${servers.url}/settings/accounts/carol`, { headers: { cookie } });
    expect(page.status).toBe(404);
    expect(page.status).toBe(403);
    expect((await call("/api/v1/user", laptop.token)).status).toBe(200);
    expect(listSessions(app.db, carol.id).some((s) => s.id === sid)).toBe(true);
    expect(JSON.stringify(getUserByName(app.db, "carol"))).toBe(carolBefore);
@@ -72,7 +72,7 @@
describe("a model grant, from the account's page and the API", () => {
      body: new URLSearchParams({ usd: "20" }),
      redirect: "manual",
    });
    expect(refused.status).toBe(404);
    expect(refused.status).toBe(403);
    expect(getModelGrant(app.db, getUserByName(app.db, "bob")!.id)).toBeUndefined();
    const admin = await signIn("alice");
@@ -118,7 +118,7 @@
describe("a model grant, from the account's page and the API", () => {
    expect(getModelGrant(app.db, carol.id)).toBeUndefined();
  });
  test("the ceiling route: signed out, a person's 404, a bad amount's flash, saved; the card shows it", async () => {
  test("the ceiling route: signed out, a person's 403, a bad amount's flash, saved; the card shows it", async () => {
    const url = `${servers.url}/settings/accounts/carol/ceiling`;
    const send = (cookie: string | undefined, daily: string, perRun: string) =>
      fetch(url, {
@@ -132,7 +132,7 @@
describe("a model grant, from the account's page and the API", () => {
    const bob = await signIn("bob");
    expect((await send(undefined, "5", "1")).status).not.toBe(200);
    expect(getAccountCeiling(app.db, carol.id)).toBeUndefined();
    expect((await send(bob, "5", "1")).status).toBe(404);
    expect((await send(bob, "5", "1")).status).toBe(403);
    expect(getAccountCeiling(app.db, carol.id)).toBeUndefined();
    const bad = await send(alice, "abc", "1");
    expect(bad.status).toBe(303);
@@ -81,7 +81,7 @@
test("a ceiling still posts for an admin only, behind the same-origin check", as
  const asBob = await fetch(url, {
    method: "POST", redirect: "manual", body, headers: { ...headers, cookie: cookies.bob!, origin: servers.url },
  });
  expect(asBob.status).toBe(404);
  expect(asBob.status).toBe(403);
  const foreign = await fetch(url, {
    method: "POST", redirect: "manual", body, headers: { ...headers, cookie: cookies.alice!, origin: "https://evil.test" },
  });
@@ -107,7 +107,7 @@
describe("+ New forge", () => {
      'href="/forges/new"',
    );
    expect((await get(reader, "/forges/new")).status).toBe(200);
    expect((await get(reader, "/forges")).status).toBe(404);
    expect((await get(reader, "/forges")).status).toBe(403);
    expect(
      (
        await fetch(url("/forges/kai/claim-link"), {
@@ -116,7 +116,7 @@
describe("+ New forge", () => {
          redirect: "manual",
        })
      ).status,
    ).toBe(404);
    ).toBe(403);
    expect(await children()).toBe(0);
  });
@@ -167,8 +167,8 @@
describe("the page a nightly issue links to", () => {
    expect(await res.text()).toContain("No output here yet");
  });
  test("anyone but an admin, and any job that is not one, is not found", async () => {
    expect((await fetch(`${servers.url}${runPath("outside-gate")}`, { headers: { cookie: await login("bob") } })).status).toBe(404);
  test("anyone but an admin is refused, and any job that is not one is not found", async () => {
    expect((await fetch(`${servers.url}${runPath("outside-gate")}`, { headers: { cookie: await login("bob") } })).status).toBe(403);
    expect((await fetch(`${servers.url}${runPath("sync-env")}`, { headers: { cookie: await login("alice") } })).status).toBe(404);
    const anon = await fetch(`${servers.url}${runPath("outside-gate")}`, { redirect: "manual" });
    expect(anon.status).not.toBe(200);
@@ -86,7 +86,7 @@
test("an unknown op is refused and says so, and changes nothing", async () => {
test("only an admin sees Edit; a non-admin's and a cross-origin edit are refused", async () => {
  expect(await text("/packs/gamer", plain)).not.toContain("Edit this pack");
  expect(await text("/packs/gamer", admin)).toContain("Edit this pack");
  expect((await post("/packs/gamer/repos", plain, { op: "remove", repo: "trevato/chess" })).status).toBe(404);
  expect((await post("/packs/gamer/repos", plain, { op: "remove", repo: "trevato/chess" })).status).toBe(403);
  expect((await post("/packs/gamer/repos", admin, { op: "remove", repo: "trevato/chess" }, "https://evil.example")).status).toBeGreaterThanOrEqual(400);
  expect(getPack(app.db, "gamer")!.repos).toContain("trevato/chess");
});
@@ -53,7 +53,7 @@
test("nothing is marked, so /packs lists no pack even though the repos exist", a
});
test("only an admin sees the page or saves; a cross-origin post is refused", async () => {
  expect((await fetch(`${servers.url}/settings/packs`, { headers: { cookie: plain } })).status).toBe(404);
  expect((await fetch(`${servers.url}/settings/packs`, { headers: { cookie: plain } })).status).toBe(403);
  expect((await save(plain, "packs/games")).status).not.toBe(303);
  expect((await save(admin, "packs/games", "https://evil.example")).status).toBeGreaterThanOrEqual(400);
  expect(markedRepos(app.db)).toEqual([]);
@@ -60,7 +60,7 @@
test("GET /settings/people names its phases", async () => {
    expect(parts.find((p) => p.startsWith(`${name};`))).toMatch(/^[a-z]+;dur=\d+\.\d$/);
});
test("a non-admin gets the 404 without the admin phases", async () => {
test("a non-admin gets the 403 without the admin phases", async () => {
  const b = await createUser(app.db, {
    origin: "seed",
    trusted: true,
@@ -72,7 +72,7 @@
test("a non-admin gets the 404 without the admin phases", async () => {
  proveAll(app);
  const cookie = await signIn("bob");
  const get = await fetch(`${servers.url}/settings/people`, { headers: { cookie } });
  expect(get.status).toBe(404);
  expect(get.status).toBe(403);
  for (const name of ["people", "render", "role"]) expect(phase(get, name)).toBeUndefined();
  const post = await fetch(`${servers.url}/settings/people/alice/role`, {
    method: "POST",
@@ -80,7 +80,7 @@
test("a non-admin gets the 404 without the admin phases", async () => {
    body: new URLSearchParams({ role: "guest" }),
    redirect: "manual",
  });
  expect(post.status).toBe(404);
  expect(post.status).toBe(403);
  for (const name of ["session", "role"]) expect(phase(post, name)).toBeUndefined();
});
@@ -80,8 +80,8 @@
describe("deploy-to page", () => {
  });
  test("someone who is not an admin finds nothing", async () => {
    expect((await get("/deploy-to", bobTok)).status).toBe(404);
    expect((await post(good, bobTok)).status).toBe(404);
    expect((await get("/deploy-to", bobTok)).status).toBe(403);
    expect((await post(good, bobTok)).status).toBe(403);
    expect(getPinned(app.db, "acme")).toBeUndefined();
  });
@@ -109,7 +109,7 @@
describe("deploy-to page", () => {
});
describe("pinned list page", () => {
  test("renders none, then one forge; a non-admin gets 404", async () => {
  test("renders none, then one forge; a non-admin gets 403", async () => {
    const dataDir = await mkdtemp(join(tmpdir(), "forge-pinned-list-"));
    const app = createApp({ dataDir, port: 0 });
    const servers = await serve(app);
@@ -122,7 +122,7 @@
describe("pinned list page", () => {
      const bobTok = createToken(app.db, getUserByName(app.db, "bob")!.id, "admin", "admin").token;
      const get = (tok?: string) => fetch(servers.url + "/pinned", { redirect: "manual", headers: tok ? { authorization: `Bearer ${tok}` } : {} });
      expect((await get()).status).toBe(303);
      expect((await get(bobTok)).status).toBe(404);
      expect((await get(bobTok)).status).toBe(403);
      const empty = await (await get(adminTok)).text();
      expect(empty).toContain("No pinned forge yet");
      expect(empty).toContain('href="/deploy-to"');
@@ -204,7 +204,7 @@
describe("pinned list page actions", () => {
      expect((await get("/-/confirm?to=/pinned/Bad_Name/update", adminTok)).status).toBe(404);
      // Not an admin: 404 and nothing moves. Cross-origin: 403.
      for (const a of ["update", "rollback", "check"]) expect((await act(`/pinned/acme/${a}`, bobTok, { version: V2 })).status).toBe(404);
      for (const a of ["update", "rollback", "check"]) expect((await act(`/pinned/acme/${a}`, bobTok, { version: V2 })).status).toBe(403);
      expect((await act("/pinned/acme/update", adminTok, { version: V2 }, "https://evil.example")).status).toBe(403);
      expect(getPinned(app.db, "acme")!.version).toBe(V);
@@ -114,7 +114,7 @@
test("the portal setting refuses a member, an agent and a cross-origin post; not
    fetch(`${servers.url}/settings/billing/portal`, { method: "POST", headers: { cookie, origin, accept: "text/html" }, body: new URLSearchParams({ portal_url: PORTAL }), redirect: "manual" });
  const mine = `forge_session=${createSession(app.db, member.id).token}`;
  const theirs = `forge_session=${createSession(app.db, admin.id).token}`;
  expect((await post(mine, servers.url)).status).toBe(404);
  expect((await post(mine, servers.url)).status).toBe(403);
  expect((await post(theirs, "https://evil.test")).status).toBe(403);
  expect(getPortalUrl(app.db)).toBe(before);
  expect((await post(theirs, servers.url)).status).toBe(303);
@@ -332,7 +332,7 @@
test("only an admin sets the cap, and setting it appends device.cap_set", async
    body: new URLSearchParams({ id: String(deviceId), app: "racer", cap: "7" }),
    redirect: "manual",
  });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  expect(cap()).toBe(1);
  const before = app.db.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM event WHERE kind = 'device.cap_set'").get()!.n;
  expect(setCap(app, owner, deviceId, "racer", 7).ok).toBe(true);
@@ -80,7 +80,7 @@
describe("Settings → Backups → Failure domains", () => {
    const bob = await fetch(`${servers.url}/settings/backups`, {
      headers: { cookie: await login("bob") },
    });
    expect(bob.status).toBe(404);
    expect(bob.status).toBe(403);
    expect(await bob.text()).not.toContain("Failure domains");
    const anon = await fetch(`${servers.url}/settings/backups`, { redirect: "manual" });
    expect(anon.status).toBe(303);
@@ -120,7 +120,7 @@
describe("resilience", () => {
    return (res.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
  };
  test("a guest is sent to sign in, a non-admin gets 404, an admin sees the rows", async () => {
  test("a guest is sent to sign in, a non-admin gets 403, an admin sees the rows", async () => {
    for (const [name, admin] of [["alice", true], ["bob", false]] as const) {
      const made = await createUser(app.db, {
        origin: "seed",
@@ -139,7 +139,7 @@
describe("resilience", () => {
    expect(guest.status).not.toBe(200);
    expect(guest.status).not.toBe(404);
    const bob = await fetch(`${servers.url}/resilience`, { headers: { cookie: await login("bob") } });
    expect(bob.status).toBe(404);
    expect(bob.status).toBe(403);
    expect(await bob.text()).not.toContain("data-standing");
    const res = await fetch(`${servers.url}/resilience`, { headers: { cookie: await login("alice") } });
@@ -85,7 +85,7 @@
describe("roles on /settings/people", () => {
    expect(html).toContain("bob");
    expect(html).toContain("Make member");
    const bob = await signIn("bob");
    expect((await fetch(`${servers.url}/settings/people`, { headers: { cookie: bob } })).status).toBe(404);
    expect((await fetch(`${servers.url}/settings/people`, { headers: { cookie: bob } })).status).toBe(403);
  });
  test("the account page shows the caller's own row of the table", async () => {
@@ -124,7 +124,7 @@
describe("roles on /settings/people", () => {
  test("a non-admin, a foreign origin, an admin target and an unknown role are refused", async () => {
    const bob = await signIn("bob");
    expect((await post(bob, "bob", { role: "member" })).status).toBe(404);
    expect((await post(bob, "bob", { role: "member" })).status).toBe(403);
    expect(roleNow("bob")).toBe("guest");
    const alice = await signIn("alice");
    expect((await post(alice, "bob", { role: "member" }, "https://evil.example")).status).toBeGreaterThanOrEqual(400);
@@ -0,0 +1,261 @@
/**
 * Every admin-only action refuses the everyday account (#11818). Both routers
 * are walked: each route must be marked `admin` or `open` in
 * `src/http/route_marks.ts`, so a new route has to choose. Each route marked
 * `admin` is called with an everyday (member) account and with the admin:
 * the first is refused with a 403 and the one sentence that says to sign in
 * as admin, the second is let through to its handler. Each MCP tool marked
 * `adminOnly` is called by the everyday account and refused with the same
 * sentence, and is listed to the admin.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { SIGN_IN_AS_ADMIN, setMember } from "../src/core/roles.ts";
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { TOOLS } from "../src/http/mcp/tools.ts";
import { mintViaToken } from "../src/core/via_token.ts";
import { readFenced, waitingFor } from "../src/core/fence.ts";
import { HEADS, ROUTES, headOf, isAdminRoute, markOf } from "../src/http/route_marks.ts";
import { buildApiRouter, buildRouter, forgeHttp, type ForgeHttp } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const FILL: Record<string, string> = {
  owner: "alice", username: "alice", name: "notes", number: "1", org: "alice",
  id: "1", team: "core", scope: "alice", job: "1", oid: "0", env: "prod", sha: "a".repeat(40),
};
const fill = (pattern: string): string =>
  pattern.replace(/:([a-z_]+)/g, (_, k: string) => FILL[k] ?? "x").replace(/\*[a-z_]+/, "x");
/** Admin pages with nothing in the path to fill that still answer 4xx on a bare forge, each with what it waits for. */
const ADMIN_GET_WANTS: Record<string, string> = {
  "GET /settings/traffic/scrapes/export": "a running capture and its ?group, else not found",
  "GET /settings/backups/live": "a snapshot store, which a bare forge has not started",
  "GET /api/v1/admin/profile": "a query naming what to profile, else 422",
};
const routes = () => [
  ...buildRouter().routes().map((r) => ({ ...r, api: false })),
  ...buildApiRouter().routes().map((r) => ({ ...r, api: true })),
];
describe("the route marks", () => {
  test("every registered route is marked admin or open", () => {
    const unmarked = routes().filter((r) => markOf(r.pattern) === undefined).map((r) => `${r.method} ${r.pattern}`);
    expect(unmarked).toEqual([]);
  });
  test("a route marked neither fails: an unknown head, or a new route under a mixed head", () => {
    expect(markOf("/brand-new-page")).toBeUndefined();
    expect(markOf("/api/v1/brand-new")).toBeUndefined();
    expect(HEADS["/settings"]).toBe("mixed");
    expect(markOf("/settings/brand-new")).toBeUndefined();
  });
  test("the marks name only registered routes and heads, so neither list goes stale", () => {
    const patterns = new Set(routes().map((r) => r.pattern));
    expect(Object.keys(ROUTES).filter((p) => !patterns.has(p))).toEqual([]);
    const heads = new Set([...patterns].map((p) => (p.startsWith("/api/") ? p.split("/").slice(0, 4).join("/") : `/${p.split("/")[1]}`)));
    expect(Object.keys(HEADS).filter((h) => !heads.has(h))).toEqual([]);
  });
  test("each route whose admin side is not called is a registered admin route", () => {
    const admin = new Set(routes().filter((r) => markOf(r.pattern) === "admin").map((r) => `${r.method} ${r.pattern}`));
    expect(Object.keys(ADMIN_GET_WANTS).filter((k) => !admin.has(k))).toEqual([]);
  });
  test("a head holding both admin and open routes is mixed, so each of its routes chooses", () => {
    const exceptions = Object.entries(ROUTES).filter(([p, m]) => {
      const head = HEADS[headOf(p)];
      return head !== "mixed" && head !== m;
    });
    expect(exceptions.map(([p]) => p)).toEqual([]);
  });
  test("an unlisted path under a mixed head is admin: a forgotten mark fails closed", () => {
    expect(isAdminRoute("/settings/brand-new")).toBe(true);
    expect(isAdminRoute("/admin/brand-new")).toBe(true);
    expect(isAdminRoute("/boards/a/b/c/d")).toBe(true);
  });
  test("a path falls on its pattern's mark, literal before parameter", () => {
    expect(isAdminRoute("/packs/new")).toBe(true);
    expect(isAdminRoute("/packs/someone")).toBe(false);
    expect(isAdminRoute("/settings/billing")).toBe(true);
    expect(isAdminRoute("/settings/tokens")).toBe(false);
    expect(isAdminRoute("/admin/flows")).toBe(false);
    expect(isAdminRoute("/api/v1/admin/capacity")).toBe(true);
    expect(isAdminRoute("/alice/notes")).toBe(false);
  });
  test("the refusal is one sentence that says to sign in as admin", () => {
    expect(SIGN_IN_AS_ADMIN).toContain("sign in as admin");
    expect(SIGN_IN_AS_ADMIN.match(/[.!?]/g)?.length).toBe(1);
    expect(SIGN_IN_AS_ADMIN.endsWith(".")).toBe(true);
  });
});
describe("every admin-only action refuses the everyday account", () => {
  let dataDir = "";
  let app: App;
  let http: ForgeHttp;
  let alice: User; // admin
  let carol: User; // everyday: a member, no `administer`
  const cells = process.env["FORGE_CELLS"];
  beforeAll(async () => {
    process.env["FORGE_CELLS"] = "off";
    dataDir = await mkdtemp(join(tmpdir(), "forge-route-marks-"));
    app = createApp({ dataDir, port: 0 });
    const mk = async (username: string, isAdmin: boolean) => {
      const r = await createUser(app.db, {
        origin: "seed", trusted: true, isAdmin, username, email: `${username}@forge.local`, password: "a-good-passphrase",
      });
      if (!r.ok) throw new Error(r.error);
      return r.value;
    };
    alice = await mk("alice", true);
    carol = await mk("carol", false);
    setMember(app.db, carol.id, true, alice.id, new Date(0));
    http = forgeHttp(app);
  }, 60_000);
  afterAll(async () => {
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    if (cells === undefined) delete process.env["FORGE_CELLS"];
    else process.env["FORGE_CELLS"] = cells;
  });
  const creds = new Map<string, { bearer: string; cookie: string }>();
  const credsOf = (u: User) => {
    const known = creds.get(u.id);
    if (known !== undefined) return known;
    const made = {
      bearer: `Bearer ${createToken(app.db, u.id, "t", "admin").token}`,
      cookie: `forge_session=${createSession(app.db, u.id).token}`,
    };
    creds.set(u.id, made);
    return made;
  };
  /** A refusal's status and words; a stream the gate let through is not read, only its status. */
  const send = async (u: User, method: string, pattern: string, api: boolean) => {
    const { bearer, cookie } = credsOf(u);
    const headers: Record<string, string> = api
      ? { authorization: bearer, "content-type": "application/json" }
      : { cookie, accept: "text/html", "content-type": "application/json" };
    if (method !== "GET") headers["origin"] = "http://forge.test";
    const res = await http.handle(
      new Request(`http://forge.test${fill(pattern)}`, { method, headers, ...(method === "GET" ? {} : { body: "{}" }) }),
    );
    if (res.status !== 403) {
      await res.body?.cancel();
      return { status: res.status, text: "" };
    }
    return { status: res.status, text: await res.text() };
  };
  const refusedKindly = (r: { status: number; text: string }, api: boolean): boolean =>
    r.status === 403 &&
    (api ? JSON.parse(r.text).message === SIGN_IN_AS_ADMIN : r.text.includes(SIGN_IN_AS_ADMIN.replace("'", "&#39;")));
  test("each admin route refuses the everyday account with the sentence, and lets the admin through", async () => {
    const admin = routes().filter((r) => markOf(r.pattern) === "admin");
    expect(admin.length).toBeGreaterThan(150);
    const wrong: string[] = [];
    for (const r of admin) {
      const everyday = await send(carol, r.method, r.pattern, r.api);
      if (!refusedKindly(everyday, r.api)) wrong.push(`${r.method} ${r.pattern}: everyday got ${everyday.status}`);
      const own = await send(alice, r.method, r.pattern, r.api);
      if (refusedKindly(own, r.api) || own.status >= 500) wrong.push(`${r.method} ${r.pattern}: admin got ${own.status}`);
      // A page with nothing to fill in answers the admin outright.
      if (r.method === "GET" && !r.pattern.includes(":") && own.status >= 400 && !(`GET ${r.pattern}` in ADMIN_GET_WANTS))
        wrong.push(`${r.method} ${r.pattern}: admin got ${own.status}`);
    }
    expect(wrong).toEqual([]);
  }, 120_000);
  const mcp = async (u: User, method: string, params: Record<string, unknown>, token?: string) => {
    const res = await http.handle(
      new Request("http://forge.test/mcp", {
        method: "POST",
        headers: {
          "content-type": "application/json",
          accept: "application/json, text/event-stream",
          authorization: `Bearer ${token ?? createToken(app.db, u.id, "t", "admin").token}`,
        },
        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
      }),
    );
    return (await res.json()) as {
      result?: { tools?: { name: string }[]; isError?: boolean; content?: { text: string }[] };
      error?: { message: string };
    };
  };
  test("each admin MCP tool refuses the everyday account with the sentence, and is listed to the admin", async () => {
    const adminTools = TOOLS.filter((t) => t.adminOnly === true);
    expect(adminTools.length).toBeGreaterThan(5);
    const listed = async (u: User) => {
      const names = new Set<string>();
      let cursor: string | undefined;
      do {
        const page = (await mcp(u, "tools/list", cursor === undefined ? {} : { cursor })) as {
          result?: { tools?: { name: string }[]; nextCursor?: string };
        };
        for (const t of page.result?.tools ?? []) names.add(t.name);
        cursor = page.result?.nextCursor;
      } while (cursor !== undefined);
      return names;
    };
    const forAdmin = await listed(alice);
    const forEveryday = await listed(carol);
    const wrong: string[] = [];
    for (const t of adminTools) {
      const called = await mcp(carol, "tools/call", { name: t.name, arguments: {} });
      if (!called.error?.message.endsWith(SIGN_IN_AS_ADMIN)) wrong.push(`${t.name}: everyday got ${JSON.stringify(called)}`);
      if (forEveryday.has(t.name)) wrong.push(`${t.name}: listed to the everyday account`);
      if (!forAdmin.has(t.name)) wrong.push(`${t.name}: not listed to the admin`);
    }
    expect(wrong).toEqual([]);
  });
  test("the gate marks by the route the router matched: a git path under an owner named like a mixed head is open", async () => {
    const res = await send(carol, "GET", "/settings/demo.git/info/refs", false);
    expect(res.status).not.toBe(403);
    expect((await send(carol, "GET", "/settings/no-such-page", false)).status).toBe(404);
  });
  test("the admin calls each read-only admin MCP tool and it answers; the write ones stay listed only", async () => {
    const reads = TOOLS.filter((t) => t.adminOnly === true && !t.writes);
    expect(reads.length).toBeGreaterThan(3);
    const wrong: string[] = [];
    for (const t of reads) {
      const called = await mcp(alice, "tools/call", { name: t.name, arguments: {} });
      if (called.error !== undefined || called.result?.isError === true)
        wrong.push(`${t.name}: ${JSON.stringify(called).slice(0, 200)}`);
    }
    expect(wrong).toEqual([]);
  });
  test("an everyday account's agent calling an admin MCP tool is refused before anything is held or asked", async () => {
    const via = "conversation:routemarks";
    const minted = mintViaToken(app.db, carol.id, via, "", new Date(Date.now() + 10 * 60_000).toISOString());
    if (!minted.ok) throw new Error(minted.error);
    // The agent has read fenced text, so a write it was not asked for would be held, were the call let that far.
    readFenced(app.db, via);
    const wrong: string[] = [];
    for (const t of TOOLS.filter((t) => t.adminOnly === true)) {
      const called = await mcp(carol, "tools/call", { name: t.name, arguments: {} }, minted.value.token);
      if (!called.error?.message.endsWith(SIGN_IN_AS_ADMIN)) wrong.push(`${t.name}: ${JSON.stringify(called).slice(0, 200)}`);
    }
    expect(wrong).toEqual([]);
    expect(waitingFor(app.db, carol.id)).toEqual([]);
  });
});
@@ -137,7 +137,7 @@
test("the page, capture, import and export are an admin's and need a same-origin
  const cookie = `forge_session=${createSession(app.db, admin.id).token}`;
  const other = `forge_session=${createSession(app.db, bob.id).token}`;
  const url = `${servers.url}/settings/traffic/scrapes`;
  expect((await fetch(url, { headers: { cookie: other } })).status).toBe(404);
  expect((await fetch(url, { headers: { cookie: other } })).status).toBe(403);
  const page = await fetch(url, { headers: { cookie } });
  expect(page.status).toBe(200);
  const text = await page.text();
@@ -167,7 +167,7 @@
test("the page, capture, import and export are an admin's and need a same-origin
  const reportText = await report.text();
  expect(reportText).toContain("[email protected]");
  expect(reportText).toContain("Limits:");
  expect((await fetch(`${url}/export?group=${id}`, { headers: { cookie: other } })).status).toBe(404);
  expect((await fetch(`${url}/export?group=${id}`, { headers: { cookie: other } })).status).toBe(403);
  expect((await post("stop", "")).status).toBe(303);
  expect(captureStore.current(Date.now())).toBeNull();
@@ -317,7 +317,7 @@
describe("forge-level secrets", () => {
      "Signup has no human check. Set FORGE_TURNSTILE_SECRET and FORGE_TURNSTILE_SITEKEY",
    );
    const bob = await login("bob");
    expect((await get("/settings/secrets", bob)).status).toBe(404);
    expect((await get("/settings/secrets", bob)).status).toBe(403);
    expect(await (await get("/acme", bob)).text()).not.toContain("Seal");
    const set = await fetch(`${servers.url}/settings/secrets`, {
@@ -44,7 +44,7 @@
test("an admin sees every control; with no report each says no check recorded",
test("the page is an admin's", async () => {
  expect((await get()).status).toBe(303);
  expect((await get(other)).status).toBe(404);
  expect((await get(other)).status).toBe(403);
});
test("a recorded check shows its time; a failed one says failed; junk is ignored", async () => {
@@ -109,7 +109,7 @@
test("Test with nothing typed and nothing sealed says there is nothing to test",
for (const path of ["/settings/backups/test", "/settings/backups/mirror/now"]) {
  test(`${path}: a non-admin, an anonymous visitor and a cross-origin post are refused`, async () => {
    const asBob = await post(path, bob);
    expect(asBob.status).toBe(404);
    expect(asBob.status).toBe(403);
    expect(asBob.headers.getSetCookie().join(";")).not.toMatch(/flash/);
    const anon = await post(path, "");
@@ -89,9 +89,9 @@
describe("Settings → Backups mirror", () => {
  test("a non-admin and a cross-origin post are refused and change nothing", async () => {
    const asBob = await post("/settings/backups/mirror", GOOD, bob);
    expect(asBob.status).toBe(404);
    expect(asBob.status).toBe(403);
    const asBobClear = await post("/settings/backups/mirror/clear", {}, bob);
    expect(asBobClear.status).toBe(404);
    expect(asBobClear.status).toBe(403);
    const cross = await post("/settings/backups/mirror", GOOD, admin, "https://evil.example");
    expect(cross.status).toBe(403);
    expect(mirrorSealedSet(app.db)).toEqual([]);
@@ -104,7 +104,7 @@
describe("cloud account forms in Settings", () => {
  test("a non-admin and a cross-origin post are refused for each, and the account stays", async () => {
    const before = JSON.stringify(listCloudAccounts(app.db));
    for (const path of ["rotate", "rename", "remove"]) {
      expect((await post(path, member, form(path))).status).toBe(404);
      expect((await post(path, member, form(path))).status).toBe(403);
      expect((await post(path, admin, form(path), "https://evil.example")).status).toBe(403);
    }
    expect(JSON.stringify(listCloudAccounts(app.db))).toBe(before);
@@ -101,7 +101,7 @@
describe("POST /settings/cloud/verify", () => {
    const bob = await login("bob");
    const alice = await login("alice");
    const before = calls;
    expect((await verify(bob)).status).toBe(404);
    expect((await verify(bob)).status).toBe(403);
    expect((await verify(alice, "https://evil.example")).status).toBe(403);
    const anon = await verify("");
    expect(anon.headers.get("location") ?? "").not.toBe("/settings/cloud");
@@ -82,7 +82,7 @@
test("a non-admin, a signed-out caller and a cross-origin post are refused; the
    await post(undefined, servers.url),
    await post(admin, "https://evil.example"),
  ];
  expect(refused[0]!.status).toBe(404);
  expect(refused[0]!.status).toBe(403);
  expect(refused[1]!.headers.get("location")).toStartWith("/signin");
  expect(refused[2]!.status).toBe(403);
  for (const res of refused) {
@@ -67,8 +67,8 @@
afterAll(async () => {
test("the page is an admin's: a stranger signs in, anyone else finds nothing, and the API refuses them at the admin gate", async () => {
  expect((await get("/settings/security")).status).toBe(303);
  expect((await get("/settings/security", { cookie: bobCookie })).status).toBe(404);
  expect((await post("signin", { cookie: bobCookie })).status).toBe(404);
  expect((await get("/settings/security", { cookie: bobCookie })).status).toBe(403);
  expect((await post("signin", { cookie: bobCookie })).status).toBe(403);
  // The same answer the capacity door gives this token: never a change, never a hint of one.
  const capacity = await fetch(`${servers.url}/api/v1/admin/capacity/crew.concurrency`, {
    method: "PUT",
@@ -214,14 +214,14 @@
describe("sign-ins: tokens and browsers, seen and ended", () => {
    expect(
      (await fetch(`${base}/settings/accounts/bo`, { headers: { cookie: adaCookie } }))
        .status,
    ).toBe(404);
    ).toBe(403);
    expect(
      (await post(`/settings/accounts/bo/tokens/${victimToken.id}/delete`, adaCookie))
        .status,
    ).toBe(404);
    ).toBe(403);
    expect(
      (await post(`/settings/accounts/bo/sessions/${id}/delete`, adaCookie)).status,
    ).toBe(404);
    ).toBe(403);
    // Strangers too.
    expect(
      (await fetch(`${base}/api/v1/users/bo/signins`)).status,
@@ -95,7 +95,7 @@
describe("the mirror's admin routes", () => {
      const guest = await post(path, full);
      expect(guest.status).toBe(303);
      expect(guest.headers.get("location")).toContain("/signin");
      expect((await post(path, full, bob)).status).toBe(404);
      expect((await post(path, full, bob)).status).toBe(403);
    }
    expect(sealed()).toEqual([]);
  });
@@ -39,7 +39,7 @@
test("the spend view is one settings-block under an h2, no card", async () => {
  expect(m).toContain('id="spend" data-live="run.queued,run.started,run.finished,usage.*"');
});
test("a non-admin gets the one 404", async () => {
test("a non-admin gets the one 403", async () => {
  const r = await fetch(`${servers.url}/settings/spend`, { headers: { cookie: plain } });
  expect(r.status).toBe(404);
  expect(r.status).toBe(403);
});
@@ -89,12 +89,12 @@
test("a guest is sent to sign in", async () => {
  expect(await res.text()).not.toContain("12.34");
});
test("a signed-in non-admin, even an app's owner, is told not found and sees no figure", async () => {
test("a signed-in non-admin, even an app's owner, is refused with 403 and sees no figure", async () => {
  const res = await fetch(`${servers.url}/settings/spend`, {
    headers: { cookie: await cookieOf("bob") },
  });
  const body = await res.text();
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  expect(body).not.toContain("12.34");
  expect(body).not.toContain("work-plan");
  expect(body).not.toContain("<h2>Spend</h2>");
@@ -233,6 +233,6 @@
describe("connecting stripe", () => {
    const saved = await form("secret", { secret: "whsec_another12345" });
    expect(await flashOf(saved)).toContain("Signing secret saved.");
    const asBob = await fetch(`${servers.url}/settings/billing/stripe/connect`, { method: "POST", redirect: "manual", headers: { authorization: `Bearer ${createToken(app.db, bob.id, "bob", "admin").token}`, "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ key: KEY }) });
    expect(asBob.status).toBe(404);
    expect(asBob.status).toBe(403);
  });
});
@@ -1064,7 +1064,7 @@
describe("the studio's crew panel on a forge with no agents yet", () => {
    expect(settings).not.toContain('href="/settings/crew"');
    const refused = await get("/settings/crew", teamAdminCookie);
    expect(refused.status).toBe(404);
    expect(refused.status).toBe(403);
  });
  test("the app page's way to add a crew member leads unbroken to the door an agent is made through, with nothing dev-only in the way", async () => {
@@ -165,7 +165,7 @@
describe("an account's whole-life budget", () => {
        redirect: "manual",
      },
    );
    expect(refused.status).toBe(404);
    expect(refused.status).toBe(403);
    expect(budgetsOf(app.db).get(starter)!.budgetUsd).toBe(1);
    const admin = await signIn("alice");
    const set = await fetch(
@@ -666,14 +666,14 @@
describe("the pages", () => {
    const page = await fetch(`${base}/settings/subscriptions`, {
      headers: { cookie: guest },
    });
    expect(page.status).toBe(404);
    expect(page.status).toBe(403);
    const posted = await fetch(`${base}/settings/subscriptions`, {
      method: "POST",
      headers: { cookie: guest, origin: base },
      body: new URLSearchParams({ name: "mine", token: OAT }),
      redirect: "manual",
    });
    expect(posted.status).toBe(404);
    expect(posted.status).toBe(403);
    const work = account();
    expect(listSubscriptions(app.db)).toHaveLength(1);
    setHeadroom(app.db, work.id, 25);
@@ -683,7 +683,7 @@
describe("the pages", () => {
      body: new URLSearchParams({ headroom: "0" }),
      redirect: "manual",
    });
    expect(headroom.status).toBe(404);
    expect(headroom.status).toBe(403);
    expect(getHeadroom(app.db, work.id)).toBe(25);
  });
});
@@ -99,8 +99,8 @@
describe("GET /system", () => {
    expect(body).toContain("Heap max");
  });
  test("a non-admin gets 404 and an anonymous visitor is sent to sign in", async () => {
    expect((await get("bob")).status).toBe(404);
  test("a non-admin gets 403 and an anonymous visitor is sent to sign in", async () => {
    expect((await get("bob")).status).toBe(403);
    const anon = await fetch(servers.url + "/system", { redirect: "manual" });
    expect(anon.status).toBe(303);
  });
@@ -144,7 +144,7 @@
describe("reaching /system", () => {
  test("a refused visitor gets a page, not bare text", async () => {
    const res = await get("bob");
    expect(res.status).toBe(404);
    expect(res.status).toBe(403);
    expect(await res.text()).toContain("<h1>");
  });
});
@@ -101,7 +101,7 @@
describe("/system over server-sent events", () => {
    const bob = (res.headers.get("set-cookie") ?? "").split(";")[0] ?? "";
    expect(bob).not.toBe("");
    const stream = await fetch(`${servers.url}/system/stream`, { headers: { cookie: bob } });
    expect(stream.status).toBe(404);
    expect(stream.status).toBe(403);
    expect(stream.headers.get("content-type") ?? "").not.toContain("text/event-stream");
    await stream.body?.cancel();
  });
@@ -227,7 +227,7 @@
describe("telemetry:read: the owner grants it, an agent reads with it, nobody el
    expect((await tool(tokens["grok"]!, "system")).error).toBe(true);
    expect((await tool(tokens["grok"]!, "flow")).error).toBe(true);
    const bobCookie = await login("bob");
    expect((await fetch(`${servers.url}/system`, { headers: { cookie: bobCookie } })).status).toBe(404);
    expect((await fetch(`${servers.url}/system`, { headers: { cookie: bobCookie } })).status).toBe(403);
    const bobPage = await fetch(`${servers.url}/system`, { headers: { cookie: bobCookie } });
    expect(await bobPage.text()).not.toContain("Telemetry readers");
  });
@@ -41,7 +41,7 @@
test("GET /system names its phases", async () => {
    expect(parts.find((p) => p.startsWith(`${name};`))).toMatch(/^[a-z]+;dur=\d+\.\d$/);
});
test("a non-owner gets the 404 page and no sample or memory phase", async () => {
test("a non-admin is refused at the admin gate, before any reader, sample or memory phase", async () => {
  const r = await createUser(app.db, {
    origin: "everyday",
    username: "bob",
@@ -51,8 +51,7 @@
test("a non-owner gets the 404 page and no sample or memory phase", async () =>
  if (!r.ok) throw new Error(r.error);
  const bob = createToken(app.db, r.value.id, "t", "admin").token;
  const res = await fetch(`${servers.url}/system`, { headers: { authorization: `Bearer ${bob}` } });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  const names = (res.headers.get("server-timing") ?? "").split(", ").map((p) => p.split(";")[0]);
  expect(names).toContain("reader");
  for (const name of ["sample", "caps", "memory", "render"]) expect(names).not.toContain(name);
  for (const name of ["reader", "sample", "caps", "memory", "render"]) expect(names).not.toContain(name);
});
@@ -206,7 +206,7 @@
describe("Settings › Captain", () => {
    expect(text).toContain("Memory");
    expect(text).toContain("Morning paper");
    expect(text).toContain(STARTING_RULES[0]!);
    expect((await fetch(`${servers.url}/settings/captain`, { headers: { cookie: cookie(other) } })).status).toBe(404);
    expect((await fetch(`${servers.url}/settings/captain`, { headers: { cookie: cookie(other) } })).status).toBe(403);
    expect((await fetch(`${servers.url}/settings/captain`, { redirect: "manual" })).status).not.toBe(200);
    expect((await post(owner, { do: "add", text: "Lend credit only to friends." })).status).toBe(303);
@@ -220,7 +220,7 @@
describe("Settings › Captain", () => {
    expect((await post(owner, { do: "routine", kind: "checkin", enabled: "1", every: "30", hour: "" })).status).toBe(303);
    expect(listRoutines(app.db, owner.id).find((r) => r.kind === "checkin")?.everyMin).toBe(30);
    expect((await post(owner, { do: "routine", kind: "checkin", enabled: "1", every: "3", hour: "" })).status).toBe(422);
    expect((await post(other, { do: "add", text: "mine" })).status).toBe(404);
    expect((await post(other, { do: "add", text: "mine" })).status).toBe(403);
  });
  test("a post from another origin changes nothing", async () => {
@@ -88,11 +88,11 @@
test("one POST saves; Recent changes is then a plain h2 and ul, and the total is
  expect(main).toMatch(/id="teams-total">\d+%</);
});
test("a non-admin still gets 404, on page and post", async () => {
test("a non-admin is refused with 403, on page and post", async () => {
  const res = await fetch(`${servers.url}/settings/teams`, { headers: { cookie: other }, redirect: "manual" });
  expect(res.status).toBe(404);
  expect(res.status).toBe(403);
  const own = await fetch(`${servers.url}/settings/teams/design`, { headers: { cookie: other }, redirect: "manual" });
  expect(own.status).toBe(404);
  expect(own.status).toBe(403);
  const post = await fetch(`${servers.url}/settings/teams/x`, { method: "POST", headers: { cookie: other }, redirect: "manual" });
  expect(post.status).toBe(404);
  expect(post.status).toBe(403);
});
@@ -187,7 +187,7 @@
test("the page offers the three windows, for an admin alone, and a loopback requ
  expect(text).not.toContain("<table class=\"table\" data-dense>\n            <caption class=\"sr-only\">\n              User agent");
  expect(windowOf("nonsense")).toBe("15m");
  const notAdmin = `forge_session=${createSession(app.db, bob.id).token}`;
  expect((await fetch(`${servers.url}/settings/traffic?window=7d`, { headers: { cookie: notAdmin } })).status).toBe(404);
  expect((await fetch(`${servers.url}/settings/traffic?window=7d`, { headers: { cookie: notAdmin } })).status).toBe(403);
});
test("an empty window is one sentence, not a card", async () => {
@@ -257,12 +257,13 @@
describe("review: caps, cache, gates and the terminal door", () => {
    expect(readVisits(app.db, scope, since)).toHaveLength(2);
  });
  test("a non-admin gets 404 on both pages and the probe; the pages carry the security floor", async () => {
  test("a non-admin is refused both pages and the probe; the pages carry the security floor", async () => {
    const made = await createUser(app.db, { origin: "seed", trusted: true, username: "guest1", email: "[email protected]", password: "correct-horse-battery", isAdmin: false });
    if (!made.ok) throw new Error(made.error);
    const plain = `forge_session=${createSession(app.db, made.value.id).token}`;
    for (const path of ["/settings/traffic/sources", "/ada/none/settings/app/traffic"])
      expect((await fetch(`${servers.url}${path}`, { headers: { cookie: plain } })).status).toBe(404);
    // The forge's page is an admin route, refused at the gate; an app's is not found.
    for (const [path, status] of [["/settings/traffic/sources", 403], ["/ada/none/settings/app/traffic", 404]] as const)
      expect((await fetch(`${servers.url}${path}`, { headers: { cookie: plain } })).status).toBe(status);
    expect((await fetch(`${servers.url}/api/v1/admin/traffic/probe?scope=forge`, { headers: { cookie: plain } })).status).not.toBe(200);
    const ok = await fetch(`${servers.url}/settings/traffic/sources`, { headers: { cookie } });
    expect(ok.status).toBe(200);
@@ -339,7 +339,7 @@
test("a stranger's deep read reaches the record with its class, and the board an
  expect(text).not.toContain("203.0.113.200");
  expect(board.headers.get("cache-control") ?? "").not.toContain("public");
  expect((await get("/settings/traffic", { cookie: notAdmin })).status).toBe(404);
  expect((await get("/settings/traffic", { cookie: notAdmin })).status).toBe(403);
  expect((await get("/settings/traffic")).status).toBeGreaterThanOrEqual(300);
  expect((await get("/api/v1/admin/kpis/probe")).status).toBe(404);
  expect((await get("/api/v1/admin/kpis/probe", { authorization: `Bearer ${await mintToken("bob", "read")}` })).status).toBe(404);
@@ -252,7 +252,7 @@
describe("the doors", () => {
      ] as const) {
        const res = await post(path, bob.value, body);
        await res.arrayBuffer();
        expect(res.status).toBe(404);
        expect(res.status).toBe(403);
      }
      const { listTrusted, foldInStopped } = await import("../src/core/trusted_sources.ts");
      expect(listTrusted(f.app.db).map((s) => s.account)).toEqual(["jmoran"]);
@@ -122,7 +122,7 @@
describe("teams in the terminal", () => {
    const bob = getUserByName(forge.db, "bob")!;
    const cookie = (id: string) => `forge_session=${createSession(forge.db, id).token}`;
    const denied = await fetch(`${servers.url}/settings/teams/stream`, { headers: { cookie: cookie(bob.id) } });
    expect(denied.status).toBe(404);
    expect(denied.status).toBe(403);
    await denied.body?.cancel();
    const res = await fetch(`${servers.url}/settings/teams/stream`, { headers: { cookie: cookie(alice.id) } });
    expect(res.headers.get("content-type")).toContain("text/event-stream");
@@ -111,5 +111,5 @@
test("Usage is one page: the four tabs on every tab, Spend admin-only, one sideb
    expect(text.match(/data-nav/g) ?? []).not.toHaveLength(0);
    expect(text).not.toMatch(/data-nav[^>]*>[^<]*(<svg[\s\S]*?<\/svg>)?\s*(Capacity|Telemetry)\s*</);
  }
  expect((await get("/settings/spend", "bob")).status).toBe(404);
  expect((await get("/settings/spend", "bob")).status).toBe(403);
});
@@ -53,7 +53,7 @@
test("GET /settings/usage names its phases", async () => {
    expect(parts.find((p) => p.startsWith(`${name};`))).toMatch(/^[a-z]+;dur=\d+\.\d$/);
});
test("a non-admin's 403 names session but not usage or render", async () => {
test("a non-admin is refused by the admin gate before the page runs: no usage or render phase", async () => {
  const bob = await createUser(app.db, {
    origin: "seed",
    trusted: true,
@@ -74,7 +74,6 @@
test("a non-admin's 403 names session but not usage or render", async () => {
  await res.text();
  expect(res.status).toBe(403);
  const timing = res.headers.get("server-timing") ?? "";
  expect(timing).toContain("session;");
  for (const name of ["patterns", "usage", "render"]) expect(timing).not.toContain(`${name};`);
});
@@ -749,7 +749,7 @@
describe("apps, runs and the crew on the web", () => {
  // ---- the crew ----
  test("the crew section: admin only, and an agent made on the web", async () => {
    expect((await web(bob, "/settings/crew")).status).toBe(404);
    expect((await web(bob, "/settings/crew")).status).toBe(403);
    expect(await bodyOf(bob, "/settings")).not.toContain(
      'href="/settings/crew"',
    );
@@ -817,7 +817,7 @@
describe("apps, runs and the crew on the web", () => {
    const forged = await web(bob, "/settings/crew/bot", {
      form: { model: "opus" },
    });
    expect(forged.status).toBe(404);
    expect(forged.status).toBe(403);
    expect(getAgentByName(app.db, "bot")?.model).toBe("sonnet");
  });
		@@ -86,6 +86,19 @@ can change the forge's settings or its releases" (`not_admin` in the API).
86	86	`src/http/admin_gate.ts` is the one gate, ahead of every handler;
87	87	`/releases.json` stays public. Token scopes are a later part.
88	88
	89	Since #11818 the gate guards every route `src/http/route_marks.ts` marks
	90	`admin` — the admin's pages under `/settings`, `/forges`, `/system`,
	91	`/maintenance` and the rest, not only `/admin` — and answers with one
	92	sentence that says what to do next: "This is for the forge's admin account,
	93	so sign in as admin to do it." An admin-only MCP tool called by name from an
	94	everyday account gets the same sentence. Every route either router registers
	95	is marked `admin` or `open` there; `test/route-marks.test.ts` fails on one
	96	marked neither, and calls each admin route and tool as an everyday account
	97	and as the admin. A head holding both kinds of route is `mixed`, so each of
	98	its routes is listed, and a path under it that no listed route matches is
	99	treated as `admin`: a forgotten mark fails closed. The 403 does tell an
	100	everyday account that an admin route or tool by that name exists.
	101
89	102	Nothing switches the refusal off: the test suite runs with it everywhere, and
90	103	a suite whose people make things promotes them first (`promote` in
91	104	`test/helpers/members.ts`). The crew's wake-up sweep, which starts a run on an
		@@ -55,6 +55,9 @@ export const NOT_A_MEMBER =
55	55	/** The words a member (or guest) is refused admin settings and releases with. */
56	56	export const NOT_AN_ADMIN = "only an admin can change the forge's settings or its releases";
57	57
	58	/** The one sentence an everyday account is refused an admin-only route or tool with: why, and what to do next (#11818). */
	59	export const SIGN_IN_AS_ADMIN = "This is for the forge's admin account, so sign in as admin to do it.";
	60
58	61	const lower = (s: string) => s.charAt(0).toLowerCase() + s.slice(1);
59	62	const capital = (s: string) => s.charAt(0).toUpperCase() + s.slice(1);
60	63
		@@ -1,34 +1,43 @@
1	1	/**
2		* The one gate in front of admin settings and releases: `/admin/*`,
3		* `/api/v1/admin/*` and the `/releases` page with its rollback. A signed-in
4		* person whose role lacks `administer` (`core/roles.ts`) is refused with a
5		* 403 and one plain sentence, as JSON for the API and as a page for a
6		* browser, before any handler runs. Anyone else meets the handler's own
	2	* The one gate in front of every admin-only route: those `route_marks.ts`
	3	* marks `admin` — `/admin/`, `/api/v1/admin/`, `/releases` with its
	4	* rollback, and the admin's pages elsewhere (`/settings/billing`, `/boards`,
	5	* …). A signed-in person whose role lacks `administer` (`core/roles.ts`) is
	6	* refused with a 403 and one plain sentence saying to sign in as admin, as
	7	* JSON for the API and as a page for a browser, before any handler runs. Anyone else meets the handler's own
7	8	* rules, so an admin is unchanged. For releases the rule itself is
8	9	* `release/gate.ts`'s, which the terminal shares; this gate only supplies the
9	10	* 403 and its wording on the page. `/releases.json` stays public.
10	11	*/
11	12
12	13	import type { App } from "../app.ts";
13		import { lacks, NOT_AN_ADMIN } from "../core/roles.ts";
	14	import { lacks, SIGN_IN_AS_ADMIN } from "../core/roles.ts";
14	15	import { forbiddenPage } from "../web/chrome.ts";
15	16	import type { Auth, Ctx } from "./context.ts";
16	17	import { json } from "./respond.ts";
	18	import { isAdminRoute, markOf } from "./route_marks.ts";
17	19
18		const under = (path: string, root: string): boolean => path === root \|\| path.startsWith(`${root}/`);
19
20		/** Whether this path is one the `administer` ability guards. */
	20	/**
	21	* Whether this path is one the `administer` ability guards: its mark in
	22	* `route_marks.ts`. `/admin/flows` is marked open there: it answers anyone but
	23	* a site admin with the not-found page (#9594), its own refusal.
	24	*/
21	25	export function isAdminPath(path: string): boolean {
22		// `/admin/flows` answers anyone but a site admin with the not-found page (#9594), so it keeps its own refusal.
23		if (path === "/admin/flows") return false;
24		return under(path, "/admin") \|\| under(path, "/api/v1/admin") \|\| under(path, "/releases");
	26	return isAdminRoute(path);
25	27	}
26	28
27		/** The refusal for a person who may not administer, or undefined to carry on. */
28		export function adminGate(app: App, request: Request, url: URL, auth: Auth): Response \| undefined {
29		if (auth.user === undefined \|\| !isAdminPath(url.pathname)) return undefined;
	29	/**
	30	* The refusal for a person who may not administer, or undefined to carry on.
	31	* `pattern` is the route the router matched, so the mark is the one of the
	32	* handler that would run — `/packs/demo.git/info/refs` is the git route, not
	33	* a `/packs` page; without one the path's own mark decides.
	34	*/
	35	export function adminGate(app: App, request: Request, url: URL, auth: Auth, pattern?: string): Response \| undefined {
	36	if (auth.user === undefined) return undefined;
	37	const mark = pattern === undefined ? undefined : markOf(pattern);
	38	if (!(mark === undefined ? isAdminPath(url.pathname) : mark === "admin")) return undefined;
30	39	if (!lacks(app.db, auth.user, "administer")) return undefined;
31		if (url.pathname.startsWith("/api/")) return json({ error: "not_admin", message: NOT_AN_ADMIN }, 403);
	40	if (url.pathname.startsWith("/api/")) return json({ error: "not_admin", message: SIGN_IN_AS_ADMIN }, 403);
32	41	const ctx: Ctx = { app, request, url, params: {}, auth, theme: undefined };
33		return forbiddenPage(ctx, NOT_AN_ADMIN);
	42	return forbiddenPage(ctx, SIGN_IN_AS_ADMIN);
34	43	}
		@@ -37,7 +37,7 @@ import { REPORT_RECEIVED } from "../actions/report_words.ts";
37	37	import { BODY_MAX, REQUEST_MAX, TITLE_MAX } from "../core/reports.ts";
38	38	import { everydayOf } from "../core/everyday.ts";
39	39	import { claimDone, completeWrite, dropWrite, recordWrite } from "../core/conversation_writes.ts";
40		import { type Args, alreadyDone, visible, plansOnly, str, REPO_ARG, lean, fenceAnswer, heldWrite, askedFirst, readThrough } from "./mcp/shared.ts";
	40	import { type Args, alreadyDone, notAdminTool, visible, plansOnly, str, REPO_ARG, lean, fenceAnswer, heldWrite, askedFirst, readThrough } from "./mcp/shared.ts";
41	41	import { CONVERSATION_BRIEF } from "../crew/conversation_brief.ts";
42	42	import { TOOLS } from "./mcp/tools.ts";
43	43
		@@ -191,6 +191,9 @@ function rpcOne(
191	191	typeof params["arguments"] === "object" && params["arguments"] !== null
192	192	? (params["arguments"] as Args)
193	193	: {};
	194	// An admin's tool stays out of an everyday account's list, and a call to
	195	// it by name is told how to reach it before anything is held or asked (#11818).
	196	if (tool?.adminOnly === true && !user.isAdmin) return refuse(-32602, notAdminTool(tool.name));
194	197	// Before the scope floor, so an admin tool the forge's agent was
195	198	// steered to is held as a confirm too, not merely refused (#7649), and
196	199	// one the person asked for waits for their yes (#7650).
		@@ -1,3 +1,4 @@
	1	import { SIGN_IN_AS_ADMIN } from "../../core/roles.ts";
1	2	import { mayView } from "../../core/sealed.ts";
2	3	import { getIssue, LIST_LIMIT_MAX } from "../../core/issues.ts";
3	4	import { canRead, canWrite, getRepo, type Repo } from "../../core/repos.ts";
		@@ -73,6 +74,9 @@ export interface Tool {
73	74	run(ctx: Ctx, user: User, args: Args): Promise<Answer> \| Answer;
74	75	}
75	76
	77	/** What an everyday account calling an admin's tool by name is told: not here, and the one sentence on what to do next. */
	78	export const notAdminTool = (name: string): string => `no tool named ${name} for this account. ${SIGN_IN_AS_ADMIN}`;
	79
76	80	/** Whether this caller is shown the tool and may call it: one rule for the manifest and dispatch. */
77	81	export const visible = (tool: Tool, ctx: Ctx, user: User): boolean =>
78	82	(tool.adminOnly !== true \|\| user.isAdmin) &&
		@@ -125,8 +129,6 @@ function askedWork(ctx: Ctx, user: User, via: string, tool: Tool, args: Args, wo
125	129	export function heldWrite(ctx: Ctx, user: User, tool: Tool, args: Args): Record<string, unknown> \| undefined {
126	130	const via = ctx.auth.through;
127	131	if (via === undefined \|\| !tool.writes \|\| plansOnly(tool, args)) return undefined;
128		// An admin-only tool stays unknown to a person who is not one.
129		if (tool.adminOnly === true && !user.isAdmin) return undefined;
130	132	const words = fenceUp(ctx.app.db, via);
131	133	if (words === undefined \|\| named(words, tool.name, args) \|\| askedWork(ctx, user, via, tool, args, words)) return undefined;
132	134	if (tooBigToApprove(args)) return tooBig(tool.name);
		@@ -184,7 +186,8 @@ export function askedFirst(ctx: Ctx, user: User, tool: Tool, args: Args): Record
184	186	const via = ctx.auth.through;
185	187	if (via === undefined) return undefined;
186	188	// What the person may not do stays unknown to their agent.
187		if ((tool.adminOnly === true \|\| tool.needsAdminScope === true) && !user.isAdmin) return undefined;
	189	// An admin-only tool is refused before this, in mcp.ts (#11818).
	190	if (tool.needsAdminScope === true && !user.isAdmin) return undefined;
188	191	const short = tool.needsAdminScope === true && !scopeAllows(ctx.auth.scope ?? "ro", "admin");
189	192	if (!short && (!tool.writes \|\| plansOnly(tool, args) \|\| !asksFirst(tool.name, args))) return undefined;
190	193	if (tooBigToApprove(args)) return tooBig(tool.name);
		@@ -0,0 +1,415 @@
	1	/**
	2	* Which routes are an admin's, as data (#11818). Every route either router
	3	* registers is marked `admin` or `open` here, by its head — the first path
	4	* segment, or `/api/v1/<segment>` on the API — or, under a head marked
	5	* `mixed`, by its own pattern. A head holding both kinds is `mixed`, so each
	6	* of its routes chooses; a path under a `mixed` head that no listed route
	7	* matches is treated as `admin`, so a forgotten mark fails closed.
	8	*
	9	* `admin_gate.ts` refuses a signed-in account that may not administer every
	10	* path marked `admin`, before any handler runs; `open` routes keep their
	11	* handler's own rules. `test/route-marks.test.ts` walks both routers and
	12	* fails on a route marked neither, so a new route must choose here.
	13	*/
	14
	15	import { Router } from "./router.ts";
	16
	17	export type Mark = "admin" \| "open";
	18
	19	/** Every head of a registered route: one mark for all of it, or `mixed` when each route is listed below. */
	20	export const HEADS: Readonly<Record<string, Mark \| "mixed">> = {
	21	"/": "open",
	22	"/-": "open",
	23	"/.well-known": "open",
	24	"/:owner": "open",
	25	"/__forge": "open",
	26	"/_funnel": "open",
	27	"/_measure": "open",
	28	"/_script-error": "open",
	29	"/admin": "mixed",
	30	"/agents": "open",
	31	"/api": "open",
	32	"/api/v1": "open",
	33	"/api/v1/": "open",
	34	"/api/v1/admin": "admin",
	35	"/api/v1/agents": "open",
	36	"/api/v1/app-templates": "open",
	37	"/api/v1/apps": "open",
	38	"/api/v1/asked": "open",
	39	"/api/v1/asks": "open",
	40	"/api/v1/boards": "open",
	41	"/api/v1/builds": "open",
	42	"/api/v1/changelog": "open",
	43	"/api/v1/cloud": "open",
	44	"/api/v1/codes": "open",
	45	"/api/v1/contribute": "open",
	46	"/api/v1/conversation": "open",
	47	"/api/v1/conversation-confirms": "open",
	48	"/api/v1/conversation-tokens": "open",
	49	"/api/v1/conversations": "open",
	50	"/api/v1/credit": "open",
	51	"/api/v1/crew": "open",
	52	"/api/v1/devices": "open",
	53	"/api/v1/drills": "open",
	54	"/api/v1/explore": "open",
	55	"/api/v1/family": "open",
	56	"/api/v1/features": "open",
	57	"/api/v1/feed": "open",
	58	"/api/v1/first-admin": "open",
	59	"/api/v1/flags": "open",
	60	"/api/v1/fleet": "open",
	61	"/api/v1/forge": "open",
	62	"/api/v1/forges": "open",
	63	"/api/v1/front": "open",
	64	"/api/v1/health": "open",
	65	"/api/v1/heartbeat": "open",
	66	"/api/v1/here": "open",
	67	"/api/v1/keeper": "open",
	68	"/api/v1/maintenance": "open",
	69	"/api/v1/map": "open",
	70	"/api/v1/migrate": "open",
	71	"/api/v1/openapi.json": "open",
	72	"/api/v1/orgs": "open",
	73	"/api/v1/packs": "open",
	74	"/api/v1/passport": "open",
	75	"/api/v1/plans": "open",
	76	"/api/v1/release": "open",
	77	"/api/v1/releases": "open",
	78	"/api/v1/repos": "open",
	79	"/api/v1/returns": "open",
	80	"/api/v1/search": "open",
	81	"/api/v1/secrets": "open",
	82	"/api/v1/sessions": "open",
	83	"/api/v1/share": "open",
	84	"/api/v1/start": "open",
	85	"/api/v1/telemetry": "open",
	86	"/api/v1/thoughts": "open",
	87	"/api/v1/timers": "open",
	88	"/api/v1/tokens": "open",
	89	"/api/v1/usage": "open",
	90	"/api/v1/user": "open",
	91	"/api/v1/users": "open",
	92	"/api/v1/version": "open",
	93	"/apple-touch-icon-precomposed.png": "open",
	94	"/apple-touch-icon.png": "open",
	95	"/apps": "open",
	96	"/asked": "open",
	97	"/asks": "open",
	98	"/assets": "open",
	99	"/audit": "open",
	100	"/audit.csv": "open",
	101	"/big": "open",
	102	"/board": "open",
	103	"/boards": "mixed",
	104	"/bring": "open",
	105	"/changelog": "open",
	106	"/changelog.atom": "open",
	107	"/claim": "open",
	108	"/contract": "open",
	109	"/contribute": "open",
	110	"/csp-report": "open",
	111	"/data": "open",
	112	"/deploy-to": "admin",
	113	"/displays": "open",
	114	"/docs": "open",
	115	"/events": "open",
	116	"/explore": "open",
	117	"/explore.atom": "open",
	118	"/family": "open",
	119	"/favicon.ico": "open",
	120	"/feed": "open",
	121	"/first-admin": "open",
	122	"/fleet": "open",
	123	"/flow": "mixed",
	124	"/forges": "mixed",
	125	"/front": "open",
	126	"/go": "open",
	127	"/home": "open",
	128	"/hooks": "open",
	129	"/icons": "open",
	130	"/live": "mixed",
	131	"/llms.txt": "open",
	132	"/login": "open",
	133	"/logout": "open",
	134	"/maintenance": "admin",
	135	"/manifest.webmanifest": "open",
	136	"/map": "open",
	137	"/mcp": "open",
	138	"/metrics": "open",
	139	"/migrate": "open",
	140	"/new": "open",
	141	"/notes": "open",
	142	"/now": "open",
	143	"/oauth": "open",
	144	"/og": "open",
	145	"/openapi.json": "open",
	146	"/opensearch.xml": "open",
	147	"/organizations": "open",
	148	"/origins": "open",
	149	"/packs": "mixed",
	150	"/pinned": "admin",
	151	"/pipeline": "open",
	152	"/plugins": "open",
	153	"/pricing": "open",
	154	"/privacy": "open",
	155	"/recover": "open",
	156	"/releases": "admin",
	157	"/releases.json": "open",
	158	"/repos": "open",
	159	"/resilience": "admin",
	160	"/review": "open",
	161	"/robots.txt": "open",
	162	"/runs": "open",
	163	"/search": "open",
	164	"/settings": "mixed",
	165	"/sign-in": "open",
	166	"/signin": "open",
	167	"/signup": "open",
	168	"/sitemap.xml": "open",
	169	"/sw.js": "open",
	170	"/system": "admin",
	171	"/talk": "open",
	172	"/tell": "open",
	173	"/theme": "open",
	174	"/verify": "open",
	175	"/welcome": "open",
	176	};
	177
	178	/** Routes marked one by one: every route under a `mixed` head, and nothing else. */
	179	export const ROUTES: Readonly<Record<string, Mark>> = {
	180	"/boards": "open",
	181	"/boards/data": "admin",
	182	"/boards/new": "open",
	183	"/boards/holds": "open",
	184	"/boards/pin": "open",
	185	"/boards/pin-panel": "open",
	186	"/boards/unpin-panel": "open",
	187	"/boards/move-pin": "open",
	188	"/boards/:slug": "open",
	189	"/boards/:slug/live": "open",
	190	"/boards/:slug/:op": "open",
	191	"/admin/flows": "open",
	192	"/admin/agent-start": "admin",
	193	"/admin/billing-links": "admin",
	194	"/admin/data": "admin",
	195	"/admin/invites": "admin",
	196	"/admin/invites/:id/revoke": "admin",
	197	"/admin/limits": "admin",
	198	"/admin/plans": "admin",
	199	"/admin/quotas": "admin",
	200	"/admin/signup": "admin",
	201	"/flow/keeper/answer": "admin",
	202	"/flow": "open",
	203	"/flow/valve": "open",
	204	"/flow/backup/retry": "admin",
	205	"/flow/suggestion": "open",
	206	"/forges": "admin",
	207	"/forges/refused": "admin",
	208	"/forges/name/:name": "open",
	209	"/forges/:name/claim-link": "admin",
	210	"/forges/:name/revoke-link": "admin",
	211	"/forges/:name/undo-link": "admin",
	212	"/forges/:name/stop": "admin",
	213	"/forges/:name/own-code": "admin",
	214	"/forges/:name/remove": "admin",
	215	"/forges/:name/ready": "open",
	216	"/forges/:name/waiting": "open",
	217	"/forges/new": "open",
	218	"/forges/start": "open",
	219	"/live/apps": "open",
	220	"/live/on-you": "open",
	221	"/live/client-apps": "open",
	222	"/live/feed": "open",
	223	"/live/milestones": "open",
	224	"/live/moving": "open",
	225	"/live/chips": "open",
	226	"/live/home/kpis": "admin",
	227	"/live/home/waiting": "open",
	228	"/live/home/panels": "admin",
	229	"/live/home/asked": "open",
	230	"/live/home/feed": "open",
	231	"/packs": "open",
	232	"/packs/mirror": "admin",
	233	"/packs/new": "admin",
	234	"/packs/:name/edit": "admin",
	235	"/packs/:name/repos": "admin",
	236	"/packs/:name": "open",
	237	"/settings/trusted": "admin",
	238	"/settings/trusted/stop": "admin",
	239	"/settings/trusted/revert": "admin",
	240	"/settings/trusted/:id/remove": "admin",
	241	"/settings/telemetry": "admin",
	242	"/settings": "open",
	243	"/settings/notify": "open",
	244	"/settings/dotfiles": "open",
	245	"/settings/edge/link": "open",
	246	"/settings/edge/unlink": "open",
	247	"/settings/parent/link": "open",
	248	"/settings/parent/unlink": "open",
	249	"/settings/email/verify": "open",
	250	"/settings/password": "open",
	251	"/settings/everyday": "open",
	252	"/settings/everyday/options": "admin",
	253	"/settings/everyday/switch": "open",
	254	"/settings/everyday/keep": "open",
	255	"/settings/shells": "open",
	256	"/settings/shells/stop-idle": "open",
	257	"/settings/shells/:id/stop": "open",
	258	"/settings/tokens": "open",
	259	"/settings/tokens/:id/delete": "open",
	260	"/settings/sessions/:id/delete": "open",
	261	"/settings/confirms": "open",
	262	"/settings/confirms/:id": "open",
	263	"/settings/passkeys": "open",
	264	"/settings/passkeys/options": "open",
	265	"/settings/passkeys/:id/delete": "open",
	266	"/settings/subscriptions": "admin",
	267	"/settings/crew/key": "admin",
	268	"/settings/crew/budgets": "admin",
	269	"/settings/subscriptions/:id/delete": "admin",
	270	"/settings/subscriptions/:id/wake": "admin",
	271	"/settings/subscriptions/:id/headroom": "admin",
	272	"/settings/subscriptions/:id/budget": "admin",
	273	"/settings/secrets": "admin",
	274	"/settings/secrets/delete": "admin",
	275	"/settings/devices": "admin",
	276	"/settings/devices/delete": "admin",
	277	"/settings/devices/grant": "admin",
	278	"/settings/devices/revoke": "admin",
	279	"/settings/devices/cap": "admin",
	280	"/settings/cloud": "admin",
	281	"/settings/cloud/verify": "admin",
	282	"/settings/cloud/write": "admin",
	283	"/settings/cloud/audit": "admin",
	284	"/settings/cloud/rotate": "admin",
	285	"/settings/cloud/rename": "admin",
	286	"/settings/cloud/remove": "admin",
	287	"/settings/access": "admin",
	288	"/settings/resilience": "admin",
	289	"/settings/capacity": "admin",
	290	"/settings/economics": "admin",
	291	"/settings/billing": "admin",
	292	"/settings/billing/grant": "admin",
	293	"/settings/billing/links": "admin",
	294	"/settings/billing/portal": "admin",
	295	"/settings/billing/stripe/connect": "admin",
	296	"/settings/billing/stripe/secret": "admin",
	297	"/settings/billing/stripe/disconnect": "admin",
	298	"/settings/billing/orders/retry": "admin",
	299	"/settings/billing/codes": "admin",
	300	"/settings/billing/codes/revoke": "admin",
	301	"/settings/flags": "admin",
	302	"/settings/captain": "admin",
	303	"/settings/packs": "admin",
	304	"/settings/features": "admin",
	305	"/settings/features/:slug": "admin",
	306	"/settings/features/:slug/run/:tool": "admin",
	307	"/settings/features/:slug/absorb": "admin",
	308	"/settings/features/:slug/unabsorb": "admin",
	309	"/settings/features/:slug/accept": "admin",
	310	"/settings/app-templates": "admin",
	311	"/settings/usage": "admin",
	312	"/settings/spend": "admin",
	313	"/settings/traffic": "admin",
	314	"/settings/traffic/returning": "admin",
	315	"/settings/traffic/sources": "admin",
	316	"/settings/traffic/scrapes": "admin",
	317	"/settings/traffic/scrapes/export": "admin",
	318	"/settings/traffic/scrapes/capture": "admin",
	319	"/settings/traffic/scrapes/stop": "admin",
	320	"/settings/traffic/scrapes/networks": "admin",
	321	"/settings/security": "admin",
	322	"/settings/security/controls": "admin",
	323	"/settings/security/shield": "admin",
	324	"/settings/backups": "admin",
	325	"/settings/backups/live": "admin",
	326	"/settings/backups/now": "admin",
	327	"/settings/backups/drill": "admin",
	328	"/settings/backups/destination": "admin",
	329	"/settings/backups/test": "admin",
	330	"/settings/backups/clear": "admin",
	331	"/settings/backups/mirror": "admin",
	332	"/settings/backups/mirror/clear": "admin",
	333	"/settings/backups/mirror/now": "admin",
	334	"/settings/accounts": "admin",
	335	"/settings/accounts/:username/allow": "admin",
	336	"/settings/accounts/:username/decline": "admin",
	337	"/settings/people": "admin",
	338	"/settings/people/:username/role": "admin",
	339	"/settings/model": "open",
	340	"/settings/accounts/:username/model": "admin",
	341	"/settings/accounts/:username/ceiling": "admin",
	342	"/settings/accounts/:username": "admin",
	343	"/settings/accounts/:username/tokens/:id/delete": "admin",
	344	"/settings/accounts/:username/sessions/:id/delete": "admin",
	345	"/settings/accounts/:username/suspend": "admin",
	346	"/settings/accounts/:username/unsuspend": "admin",
	347	"/settings/accounts/:username/remove": "admin",
	348	"/settings/accounts/:username/retire": "admin",
	349	"/settings/accounts/:username/verify": "admin",
	350	"/settings/accounts/:username/reset": "admin",
	351	"/settings/accounts/:username/end-sessions": "admin",
	352	"/settings/accounts/:username/way-back": "admin",
	353	"/settings/crew": "admin",
	354	"/settings/crew/knobs": "admin",
	355	"/settings/teams": "admin",
	356	"/settings/teams/stream": "admin",
	357	"/settings/teams/:slug": "admin",
	358	"/settings/crew/:username": "admin",
	359	"/settings/crew/:username/delete": "admin",
	360	"/settings/crew/model-review/:id/take": "admin",
	361	"/settings/crew/model-review/:id/decline": "admin",
	362	"/settings/origins/callback": "open",
	363	"/settings/origins": "open",
	364	"/settings/origins/token": "open",
	365	"/settings/origins/oauth": "open",
	366	"/settings/origins/apps": "open",
	367	"/settings/origins/trusted-hosts": "admin",
	368	"/settings/origins/apps/:id/delete": "open",
	369	"/settings/origins/flows/:id": "open",
	370	"/settings/origins/flows/:id/poll": "open",
	371	"/settings/origins/flows/:id/stream": "open",
	372	"/settings/origins/:id/repos": "open",
	373	"/settings/origins/:id/archived": "open",
	374	"/settings/origins/:id/mirror": "open",
	375	"/settings/origins/:id/mirror/:job": "open",
	376	"/settings/origins/:id/sync": "open",
	377	"/settings/origins/:id/check": "open",
	378	"/settings/origins/:id/delete": "open",
	379	"/settings/origins/:id/token": "open",
	380	"/settings/keys": "open",
	381	"/settings/keys/:id/delete": "open",
	382	};
	383
	384	/** The head a pattern or a path is marked by. */
	385	export function headOf(path: string): string {
	386	const parts = path.split("/");
	387	return path.startsWith("/api/") ? parts.slice(0, 4).join("/") : `/${parts[1] ?? ""}`;
	388	}
	389
	390	/** A pattern's mark, or undefined when it has none: a route that has not chosen. */
	391	export function markOf(pattern: string): Mark \| undefined {
	392	const own = ROUTES[pattern];
	393	if (own !== undefined) return own;
	394	const head = HEADS[headOf(pattern)];
	395	return head === "mixed" ? undefined : head;
	396	}
	397
	398	let listed: Router<Mark> \| undefined;
	399	/** ROUTES as a matcher, literal segments before parameters so `/packs/new` is not read as `/packs/:name`. */
	400	function listedRoutes(): Router<Mark> {
	401	if (listed !== undefined) return listed;
	402	const params = (p: string) => p.split("/").filter((s) => s.startsWith(":") \|\| s.startsWith("*")).length;
	403	const matcher = new Router<Mark>();
	404	for (const pattern of Object.keys(ROUTES).sort((a, b) => params(a) - params(b)))
	405	matcher.add("*", pattern, ROUTES[pattern] as Mark);
	406	return (listed = matcher);
	407	}
	408
	409	/** Whether a request path falls on a route marked `admin`; unlisted under a `mixed` head counts as `admin`. */
	410	export function isAdminRoute(path: string): boolean {
	411	const own = listedRoutes().match("*", path);
	412	if (own !== undefined) return own.handler === "admin";
	413	const head = HEADS[headOf(path)];
	414	return head === "admin" \|\| head === "mixed";
	415	}
		@@ -3020,7 +3020,7 @@ async function answerGet(
3020	3020	if (viaRefusal !== undefined) return viaRefusal;
3021	3021
3022	3022	// Admin settings and releases are an admin's; a member is told so.
3023		const adminRefusal = adminGate(app, request, url, auth);
	3023	const adminRefusal = adminGate(app, request, url, auth, matched.pattern);
3024	3024	if (adminRefusal !== undefined) return adminRefusal;
3025	3025
3026	3026	// A transferred repository's old path answers 308 to its new one (#569).
		@@ -70,7 +70,7 @@ test("one logged request: the filter and a table row, escaped, no card", async (
70	70	expect(page).toContain("<b>probe");
71	71	});
72	72
73		test("a non-admin still gets 404", async () => {
	73	test("a non-admin is refused with 403", async () => {
74	74	const res = await fetch(servers.url + "/settings/access", { headers: { cookie: cookies.bob! } });
75		expect(res.status).toBe(404);
	75	expect(res.status).toBe(403);
76	76	});
		@@ -86,20 +86,20 @@ describe("an admin resets a person's access", () => {
86	86	await rm(dataDir, { recursive: true, force: true });
87	87	});
88	88
89		test("a profile offers Manage account to an admin only, and the page answers 404 to anyone else", async () => {
	89	test("a profile offers Manage account to an admin only, and the page refuses anyone else", async () => {
90	90	const asAdmin = await (await get("/bob", owner)).text();
91	91	expect(asAdmin).toContain("/settings/accounts/bob");
92	92	expect(asAdmin).toContain("Manage account");
93	93	expect(await (await get("/bob", bobCookie)).text()).not.toContain("Manage account");
94	94	expect(await (await get("/bob")).text()).not.toContain("Manage account");
95		expect((await get("/settings/accounts/bob", bobCookie)).status).toBe(404);
	95	expect((await get("/settings/accounts/bob", bobCookie)).status).toBe(403);
96	96	const page = await get("/settings/accounts/bob", owner);
97	97	expect(page.status).toBe(200);
98	98	const text = await page.text();
99	99	for (const word of ["Role", "[email protected]", "Verified", "a password is set", "Owns", "Signed in now", "Reset access", "End all sessions", "Model budget"])
100	100	expect(text).toContain(word);
101	101	expect(text).not.toContain("bob-old-passphrase");
102		expect((await post("/settings/accounts/bob/reset", bobCookie)).status).toBe(404);
	102	expect((await post("/settings/accounts/bob/reset", bobCookie)).status).toBe(403);
103	103	});
104	104
105	105	test("the accounts list searches by name", async () => {
		@@ -217,7 +217,7 @@ describe("an admin resets a person's access", () => {
217	217	expect(ended.sessionsEnded).toBe(0);
218	218	});
219	219
220		test("only the forge's owner manages another admin; a member is told 404", async () => {
	220	test("only the forge's owner manages another admin; a member is refused with 403", async () => {
221	221	const olive = createToken(app.db, getUserByName(app.db, "olive")!.id, "t", "admin").token;
222	222	const refused = await api("/api/v1/admin/accounts/olive/reset", adminTwo);
223	223	expect(refused.status).toBe(422);
		@@ -61,7 +61,7 @@ test("the accounts list keeps its confirm links", async () => {
61	61	expect(m).toContain("/-/confirm?to=%2Fsettings%2Faccounts%2Fbobby%2Fsuspend");
62	62	});
63	63
64		test("a non-admin gets the one 404", async () => {
	64	test("a non-admin gets the one 403", async () => {
65	65	const r = await fetch(`${servers.url}/settings/accounts`, { headers: { cookie: plain } });
66		expect(r.status).toBe(404);
	66	expect(r.status).toBe(403);
67	67	});