mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
cb70bc42f9
## Summary - splits agent register, permission, and routing route guards so read-like POSTs stay available without treating all agent self-service POSTs as read-only safe - requires task:write for agent approval requests, telemetry:write for agent registration writes, and admin:manage for approval review/routing configuration/permission elevation - mirrors the route guard changes in the shared CLI/MCP permission preflight map - expands REST, CLI, and MCP authorization tests for read-only mutation denial and scoped agent approval requests Closes #336. ## Verification - VERITAS_DISABLE_WATCHERS=1 node_modules/.bin/vitest run server/src/__tests__/routes/v1-permission-guards.test.ts cli/src/__tests__/api-permissions.test.ts mcp/src/__tests__/api-permissions.test.ts - node scripts/check-permission-coverage.mjs - pnpm --filter @veritas-kanban/shared build - pnpm --filter @veritas-kanban/server typecheck - pnpm --filter @veritas-kanban/cli typecheck - pnpm --filter @veritas-kanban/mcp build - pnpm build - pnpm lint:budget - pnpm audit --prod --audit-level=high - node_modules/.bin/prettier --check server/src/routes/v1/permissions.ts server/src/routes/v1/index.ts shared/src/utils/api-permissions.ts server/src/__tests__/routes/v1-permission-guards.test.ts cli/src/__tests__/api-permissions.test.ts mcp/src/__tests__/api-permissions.test.ts docs/security.md - git diff --check ## Notes - pnpm audit --prod --audit-level=high passes the high-severity gate and still reports 3 moderate existing vulnerabilities. - pnpm lint:budget passed with 705 warnings under the 714 warning budget. - pnpm --filter @veritas-kanban/mcp typecheck is not available because the package has no typecheck script; pnpm --filter @veritas-kanban/mcp build covers TypeScript compilation. |
||
|---|---|---|
| .. | ||
| src | ||
| package.json | ||
| tsconfig.json | ||
| vitest.config.ts | ||