feat(tenancy): implement workspace isolation

src/langbot/pkg/api/http/controller/groups/skills.py

@@ -4,6 +4,8 @@ import quart
 
 from langbot_plugin.box.errors import BoxError
 
+from ...authz import Permission
+from ...context import RequestContext
 from .. import group
 
 
@@ -12,58 +14,86 @@ class SkillsRouterGroup(group.RouterGroup):
     """Skills management API endpoints."""
 
     async def initialize(self) -> None:
-        @self.route('', methods=['GET', 'POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def list_or_create_skills() -> quart.Response:
-            if quart.request.method == 'GET':
-                try:
-                    skills = await self.ap.skill_service.list_skills()
-                except (ValueError, BoxError) as exc:
-                    return self.http_status(400, -1, str(exc))
-                return self.success(data={'skills': skills})
+        @self.route(
+            '',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_VIEW,
+        )
+        async def list_skills(request_context: RequestContext) -> quart.Response:
+            try:
+                skills = await self.ap.skill_service.list_skills(request_context)
+            except (ValueError, BoxError) as exc:
+                return self.http_status(400, -1, str(exc))
+            return self.success(data={'skills': skills})
 
+        @self.route(
+            '',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def create_skill(request_context: RequestContext) -> quart.Response:
             data = await quart.request.json
             if 'name' not in data or not data['name']:
                 return self.http_status(400, -1, 'Missing required field: name')
 
             try:
-                skill = await self.ap.skill_service.create_skill(data)
+                skill = await self.ap.skill_service.create_skill(request_context, data)
                 return self.success(data={'skill': skill})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
 
-        @self.route('/<skill_name>', methods=['GET', 'PUT', 'DELETE'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def get_update_delete_skill(skill_name: str) -> quart.Response:
-            if quart.request.method == 'GET':
-                try:
-                    skill = await self.ap.skill_service.get_skill(skill_name)
-                except (ValueError, BoxError) as exc:
-                    return self.http_status(400, -1, str(exc))
-                if not skill:
-                    return self.http_status(404, -1, 'Skill not found')
-                return self.success(data={'skill': skill})
+        @self.route(
+            '/<skill_name>',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_VIEW,
+        )
+        async def get_skill(skill_name: str, request_context: RequestContext) -> quart.Response:
+            try:
+                skill = await self.ap.skill_service.get_skill(request_context, skill_name)
+            except (ValueError, BoxError) as exc:
+                return self.http_status(400, -1, str(exc))
+            if not skill:
+                return self.http_status(404, -1, 'Skill not found')
+            return self.success(data={'skill': skill})
 
+        @self.route(
+            '/<skill_name>',
+            methods=['PUT', 'DELETE'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def update_delete_skill(skill_name: str, request_context: RequestContext) -> quart.Response:
             if quart.request.method == 'PUT':
                 data = await quart.request.json
                 try:
-                    skill = await self.ap.skill_service.update_skill(skill_name, data)
+                    skill = await self.ap.skill_service.update_skill(request_context, skill_name, data)
                     return self.success(data={'skill': skill})
                 except (ValueError, BoxError) as exc:
                     return self.http_status(400, -1, str(exc))
 
             try:
-                await self.ap.skill_service.delete_skill(skill_name)
+                await self.ap.skill_service.delete_skill(request_context, skill_name)
                 return self.success()
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
 
-        @self.route('/<skill_name>/files', methods=['GET'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def list_skill_files(skill_name: str) -> quart.Response:
+        @self.route(
+            '/<skill_name>/files',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_VIEW,
+        )
+        async def list_skill_files(skill_name: str, request_context: RequestContext) -> quart.Response:
             """List files in skill package directory."""
             path = quart.request.args.get('path', '.').strip()
             include_hidden = quart.request.args.get('include_hidden', 'false').lower() == 'true'
 
             try:
                 result = await self.ap.skill_service.list_skill_files(
+                    request_context,
                     skill_name,
                     path=path,
                     include_hidden=include_hidden,
@@ -73,38 +103,55 @@ class SkillsRouterGroup(group.RouterGroup):
                 return self.http_status(400, -1, str(exc))
 
         @self.route(
-            '/<skill_name>/files/<path:path>', methods=['GET', 'PUT'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY
+            '/<skill_name>/files/<path:path>',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_VIEW,
         )
-        async def read_or_write_skill_file(skill_name: str, path: str) -> quart.Response:
-            """Read or write a file in skill package."""
-            if quart.request.method == 'GET':
-                try:
-                    result = await self.ap.skill_service.read_skill_file(skill_name, path)
-                    return self.success(data=result)
-                except (ValueError, BoxError) as exc:
-                    return self.http_status(400, -1, str(exc))
+        async def read_skill_file(skill_name: str, path: str, request_context: RequestContext) -> quart.Response:
+            try:
+                result = await self.ap.skill_service.read_skill_file(request_context, skill_name, path)
+                return self.success(data=result)
+            except (ValueError, BoxError) as exc:
+                return self.http_status(400, -1, str(exc))
 
-            # PUT - write file
+        @self.route(
+            '/<skill_name>/files/<path:path>',
+            methods=['PUT'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def write_skill_file(skill_name: str, path: str, request_context: RequestContext) -> quart.Response:
             data = await quart.request.json
             content = data.get('content', '')
             if content is None:
                 return self.http_status(400, -1, 'Missing required field: content')
 
             try:
-                result = await self.ap.skill_service.write_skill_file(skill_name, path, content)
+                result = await self.ap.skill_service.write_skill_file(request_context, skill_name, path, content)
                 return self.success(data=result)
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
 
-        @self.route('/<skill_name>/preview', methods=['GET'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def preview_skill(skill_name: str) -> quart.Response:
-            skill = self.ap.skill_mgr.get_skill_by_name(skill_name)
+        @self.route(
+            '/<skill_name>/preview',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_VIEW,
+        )
+        async def preview_skill(skill_name: str, request_context: RequestContext) -> quart.Response:
+            skill = await self.ap.skill_service.get_skill(request_context, skill_name)
             if not skill:
                 return self.http_status(404, -1, 'Skill not found')
             return self.success(data={'instructions': skill.get('instructions', '')})
 
-        @self.route('/install/github', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def install_skill_from_github() -> quart.Response:
+        @self.route(
+            '/install/github',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def install_skill_from_github(request_context: RequestContext) -> quart.Response:
             data = await quart.request.json
             required_fields = ['asset_url', 'owner', 'repo']
             for field in required_fields:
@@ -115,15 +162,20 @@ class SkillsRouterGroup(group.RouterGroup):
                 return self.http_status(400, -1, 'Missing required field: release_tag')
 
             try:
-                skill = await self.ap.skill_service.install_from_github(data)
+                skill = await self.ap.skill_service.install_from_github(request_context, data)
                 return self.success(data={'skills': skill})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
-            except Exception as exc:
-                return self.http_status(500, -1, f'Failed to install skill: {exc}')
+            except Exception:
+                raise
 
-        @self.route('/install/github/preview', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def preview_skill_from_github() -> quart.Response:
+        @self.route(
+            '/install/github/preview',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def preview_skill_from_github(request_context: RequestContext) -> quart.Response:
             data = await quart.request.json
             required_fields = ['asset_url', 'owner', 'repo']
             for field in required_fields:
@@ -134,15 +186,20 @@ class SkillsRouterGroup(group.RouterGroup):
                 return self.http_status(400, -1, 'Missing required field: release_tag')
 
             try:
-                preview = await self.ap.skill_service.preview_install_from_github(data)
+                preview = await self.ap.skill_service.preview_install_from_github(request_context, data)
                 return self.success(data={'skills': preview})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
-            except Exception as exc:
-                return self.http_status(500, -1, f'Failed to preview skill: {exc}')
+            except Exception:
+                raise
 
-        @self.route('/install/upload', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def install_skill_from_upload() -> quart.Response:
+        @self.route(
+            '/install/upload',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def install_skill_from_upload(request_context: RequestContext) -> quart.Response:
             file = (await quart.request.files).get('file')
             if file is None:
                 return self.http_status(400, -1, 'file is required')
@@ -150,6 +207,7 @@ class SkillsRouterGroup(group.RouterGroup):
 
             try:
                 skill = await self.ap.skill_service.install_from_zip_upload(
+                    request_context,
                     file_bytes=file.read(),
                     filename=file.filename or '',
                     source_paths=form.getlist('source_paths'),
@@ -157,34 +215,45 @@ class SkillsRouterGroup(group.RouterGroup):
                 return self.success(data={'skills': skill})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
-            except Exception as exc:
-                return self.http_status(500, -1, f'Failed to install skill: {exc}')
+            except Exception:
+                raise
 
-        @self.route('/install/upload/preview', methods=['POST'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def preview_skill_from_upload() -> quart.Response:
+        @self.route(
+            '/install/upload/preview',
+            methods=['POST'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def preview_skill_from_upload(request_context: RequestContext) -> quart.Response:
             file = (await quart.request.files).get('file')
             if file is None:
                 return self.http_status(400, -1, 'file is required')
 
             try:
                 preview = await self.ap.skill_service.preview_install_from_zip_upload(
+                    request_context,
                     file_bytes=file.read(),
                     filename=file.filename or '',
                 )
                 return self.success(data={'skills': preview})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
-            except Exception as exc:
-                return self.http_status(500, -1, f'Failed to preview skill: {exc}')
+            except Exception:
+                raise
 
-        @self.route('/scan', methods=['GET'], auth_type=group.AuthType.USER_TOKEN_OR_API_KEY)
-        async def scan_skill_directory() -> quart.Response:
+        @self.route(
+            '/scan',
+            methods=['GET'],
+            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
+            permission=Permission.RESOURCE_MANAGE,
+        )
+        async def scan_skill_directory(request_context: RequestContext) -> quart.Response:
             path = quart.request.args.get('path', '').strip()
             if not path:
                 return self.http_status(400, -1, 'Missing required parameter: path')
 
             try:
-                result = await self.ap.skill_service.scan_directory_async(path)
+                result = await self.ap.skill_service.scan_directory_async(request_context, path)
                 return self.success(data=result)
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))