Add bot types with a permission matrix, and workspace admin bots

A bot's powers came from bots.kind alone, so only the coordinator could hand work to other bots. bot_types now works like user_types: a row with no workspace holds everywhere (the coordinator), one with a workspace only there (a workspace admin), and no row is a worker. bots.kind stays the legacy marker of the one coordinator for who sees it. The matrices in src/dict/bot-types-dict.ts say what each type may do, whom it may direct and who grants it, read by one generic interpreter (rbac/type-assignment.ts) that userTypeAssignment now wraps too. Every run reads its powers once (grabBotRunPowers) and the chat tools, task runs and task tools gate on them instead of kind; a run's powers are its type's and its user's together. In the workspace it leads, an admin hands tasks to the workers there (results relayed back to it), sets their instructions, adds tasks to their lists and keeps the workspace's context when its user may. Super admins and admins grant it from the workspace's settings or the chat header's menu, and the coordinator with set_bot_type. Admins are marked with a filled green shield beside their name across the workspace, kept live by pushBotUpdated's admin_workspace_ids. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-25 09:04:14 +01:00
parent 4161863587
commit ea62dd11f0
65 changed files with 1970 additions and 239 deletions
@@ -0,0 +1,60 @@
+import pushBotUpdated from "@/src/bots-queue/push-bot-updated";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import removeBotType from "@/src/functions/backend/db/bot-types/remove-bot-type";
+import setBotType from "@/src/functions/backend/db/bot-types/set-bot-type";
+import grabWorkspaceBots from "@/src/functions/backend/db/workspaces/grab-workspace-bots";
+import { SetBotTypeRequestSchema } from "@/src/schemas/bot-type-schema";
+import type { WorkspaceBot } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type {
+    APIResponseObject,
+    BunextAPIRouteHandler,
+} from "@moduletrace/bunext/types";
+
+/**
+ * Makes a bot the admin of a workspace it works in, or takes that away
+ * (super admins and admins, `BotTypeAssignmentMatrix`). Returns the
+ * workspace's crew, and pushes the change to everyone who sees the bot.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<WorkspaceBot>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { bot_id, workspace_id, bot_type, given } = parseWithSchema({
+            schema: SetBotTypeRequestSchema,
+            data: body,
+        });
+
+        const change = { user_id: user.id, bot_id, workspace_id, bot_type };
+
+        if (given) await setBotType(change);
+        else await removeBotType(change);
+
+        /**
+         * Every open crew list shows or drops its shield.
+         */
+        await pushBotUpdated({ bot_id });
+
+        return {
+            success: true,
+            payload: await grabWorkspaceBots({ user_id: user.id, workspace_id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};