feat: finish the ai plugin (B18)

plugins/snippets/src/backend/index.ts

@@ -91,6 +91,15 @@ export async function activate(ctx: PluginContext) {
     return repo.findAccessibleSharedSnippet(id, userId, roleIds);
   }
 
+  // The service is gated on snippets.view; a write also needs the same
+  // permission its route requires, so a caller cannot write through here
+  // what the user could not write in the panel.
+  async function requirePermission(permission: string): Promise<void> {
+    if (!(await ctx.rbac.has(permission))) {
+      throw new Error(`Missing permission snippets.${permission}`);
+    }
+  }
+
   const service: SnippetsService = {
     list: async () => {
       const userId = ctx.currentActor();
@@ -127,18 +136,21 @@ export async function activate(ctx: PluginContext) {
     create: async (input) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.create needs an actor");
+      await requirePermission("create");
       const created = await repo.createSnippet(userId, input);
       return { id: created.id, name: created.name };
     },
     update: async (id, changes) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.update needs an actor");
+      await requirePermission("edit");
       const result = await repo.updateSnippet(userId, id, changes);
       if (!result) throw new Error("Snippet not found");
     },
     remove: async (id) => {
       const userId = ctx.currentActor();
       if (!userId) throw new Error("snippets.access.remove needs an actor");
+      await requirePermission("delete");
       const existing = await repo.deleteSnippet(userId, id);
       if (existing?.syncId) {
         await ctx.sync.recordTombstone(userId, "snippets", existing.syncId);

plugins/snippets/src/frontend/index.tsx

@@ -76,6 +76,14 @@ export function activate(app: TermixApp): void {
       : null;
   }) as never);
 
+  // For pickers in other plugins (the AI assistant's @-mentions): id and name.
+  app.registerAction("snippets.list", (async () => {
+    const snippets = await createSnippetsApi(app.api)
+      .list()
+      .catch(() => []);
+    return snippets.map((snippet) => ({ id: snippet.id, name: snippet.name }));
+  }) as never);
+
   app.registerAction("snippets.execute", (async (
     snippetId: number,
     hostId: number,

plugins/snippets/tests/backend/activate.test.ts

@@ -56,6 +56,27 @@ describe("snippets activate", () => {
     expect(otherUsersList).toEqual([]);
   });
 
+  it("refuses service writes the user could not make in the panel", async () => {
+    server = await startServer({ permissions: ["snippets.view"] });
+    const service = server.mock.services.get("snippets.access") as {
+      create: (input: { name: string; content: string }) => Promise<unknown>;
+      update: (id: number, changes: { name: string }) => Promise<unknown>;
+      remove: (id: number) => Promise<unknown>;
+    };
+    const asUser = <T>(fn: () => Promise<T>) =>
+      server!.mock.ctx.asUser("user-1", fn);
+
+    await expect(
+      asUser(() => service.create({ name: "x", content: "ls" })),
+    ).rejects.toThrow("snippets.create");
+    await expect(
+      asUser(() => service.update(1, { name: "y" })),
+    ).rejects.toThrow("snippets.edit");
+    await expect(asUser(() => service.remove(1))).rejects.toThrow(
+      "snippets.delete",
+    );
+  });
+
   it("wipes a user's snippets when user.data_wiped fires", async () => {
     // events:core only to simulate core firing the topic in this test; the
     // plugin's own manifest never declares it, since it only subscribes.