[alliscode]

Why

Authentication and installation membership prove who a user is and whether they may enter Hub, but they should not decide which prototypes that user can access. Hub needs its own product authorization boundary so teams can share prototypes without requiring repository access and can keep explicit Hub decisions above future synchronized policy sources.

What changes

Hub now stores workspaces, prototypes, and immutable prototype versions. Direct workspace and prototype rules support viewer, commenter, editor, and administrator roles, plus explicit deny and prototype-specific overrides. One explainable evaluator applies explicit Hub deny first, then explicit Hub roles, then an optional lower-precedence baseline, and otherwise denies access.

Every new product route enforces that policy and preserves Hub's origin, CSRF, logging, caching, pagination, and rate-limit boundaries. Administrator changes, membership suspension or removal, prototype archival, and version creation use transactional locks so overlapping requests cannot orphan administration or create history after archival. Structured audits commit with access-sensitive changes and omit request bodies and secrets.

GitHub repository synchronization, repository-to-role mapping, artifact ingestion, publishing credentials, promotion, retention, and rollback remain later layers.

[Copilot]

🟡 Changes recommended

A UUID-casing bypass can remove the final administrator, baseline-only viewers are incorrectly denied access, and the added tests contain a TypeScript error.

9 open issues

• Provide administrator recovery without target cooperation · New
• Use baseline-aware authorization for single-prototype operations · New
• Normalize target UUIDs before continuity comparisons · New
• Order version history by immutable sequence · New
• Narrow row shapes before destructuring optional body · New
• Add rejection tests for stale and insufficient authority · New
• Return only declared prototype fields from list responses · New
• Short-circuit explicit workspace denials before prototype scans · New
• Batch continuity queries outside the identity lock · New

What changed in this PR

Adds Hub-managed prototype authorization, separating product access from sign-in, installation membership, and GitHub repository permissions.

Changes:

• Introduces workspaces, prototypes, version history, scoped roles, explicit denies, and explainable access decisions.
• Adds product APIs, transactional administration safeguards, archival controls, and product audit context.
• Adds policy, route, and database coverage and documents the new authorization boundary.

File	Description
hub/​server/​routes/​types.ts	Adds the prototype authorization service dependency.
hub/​server/​routes/​product/​index.ts	Adds workspace, prototype, access, and version handlers.
hub/​server/​routes/​product/​index.test.ts	Covers route failures and HTTP security boundaries.
hub/​server/​routes/​index.ts	Registers product endpoints and mutation limits.
hub/​server/​routes/​authentication.test.ts	Updates authentication route fixtures.
hub/​server/​routes/​administration.test.ts	Updates administration route fixtures.
hub/​server/​repositories/​security-audits/​types.ts	Adds product identifiers to audit contracts.
hub/​server/​repositories/​security-audits/​save-audit/​index.ts	Persists product audit context.
hub/​server/​integrations/​express/​create-rate-limit/​index.ts	Supports custom rate-limit messages.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​types.ts	Defines roles, grants, and access decisions.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​index.ts	Implements access-rule precedence.
hub/​server/​domains/​prototype-authorization/​evaluate-access/​index.test.ts	Covers precedence and default denial.
hub/​server/​domains/​prototype-authorization/​ensure-administration-continuity/​index.ts	Checks product administration before membership deactivation.
hub/​server/​domains/​prototype-authorization/​create-service/​types.ts	Defines product service and baseline-policy contracts.
hub/​server/​domains/​prototype-authorization/​create-service/​index.ts	Implements product operations and authorization checks.
hub/​server/​domains/​prototype-authorization/​create-service/​index.db.test.ts	Covers persistence, authorization, pagination, audits, and races.
hub/​server/​domains/​identity/​with-store-lock/​index.ts	Exposes the transaction to locked operations.
hub/​server/​domains/​identity/​create-store/​types.ts	Updates the store-lock callback contract.
hub/​server/​domains/​authentication/​create-service/​membership.test.ts	Adapts membership test fixtures.
hub/​server/​domains/​authentication/​create-service/​index.test.ts	Adapts authentication store fixtures.
hub/​server/​domains/​authentication/​create-runtime/​index.ts	Composes the prototype authorization service.
hub/​server/​domains/​administration/​create-service/​index.ts	Adds product continuity checks to membership changes.
hub/​server/​domains/​administration/​create-service/​index.db.test.ts	Covers membership and product administration interactions.
hub/​server/​create-app/​index.ts	Omits product request payloads from logs.
hub/​schema/​workspace.prisma	Defines workspace ownership and relations.
hub/​schema/​workspace-access-grant.prisma	Stores per-user workspace access rules.
hub/​schema/​user.prisma	Adds product creator and grant relations.
hub/​schema/​security-audit.prisma	Adds indexed product audit identifiers.
hub/​schema/​prototype.prisma	Defines prototypes and archival state.
hub/​schema/​prototype-version.prisma	Defines version records and unique sequences.
hub/​schema/​prototype-role.enum.prisma	Defines the four product roles.
hub/​schema/​prototype-access-grant.prisma	Stores per-user prototype access rules.
hub/​schema/​migrations/​20261027220000_prototype_authorization/​migration.sql	Creates product tables, constraints, and indexes.
hub/​schema/​access-effect.enum.prisma	Defines allow and deny effects.
hub/​docs/​testing-and-operations.md	Describes prototype authorization coverage.
hub/​docs/​README.md	Links the authorization guide.
hub/​docs/​prototype-authorization.md	Documents policy, lifecycle, APIs, and audits.
hub/​docs/​membership-and-administration.md	Explains product continuity during membership changes.
hub/​docs/​identity.md	Clarifies identity and product authorization boundaries.
hub/​docs/​database.md	Documents product models and database constraints.
hub/​docs/​architecture.md	Updates the implemented backend scope.

_{Review effort: Max (auto)}

[Copilot]

🟡 Changes recommended

Authorization queries can perform unbounded scans and skip accessible workspaces after cursor access is revoked, while grant-setting tests lack coverage for unknown, suspended, or removed targets.

3 open issues

• Cover inactive grant targets with database tests · New
• Avoid unbounded authorization scans without a baseline · New
• Use exclusive ID cursor filtering to prevent skipped results · New

9 resolved since last review

• Narrow row shapes before destructuring optional body
• Order version history by immutable sequence
• Normalize target UUIDs before continuity comparisons
• Use baseline-aware authorization for single-prototype operations
• Provide administrator recovery without target cooperation
• Batch continuity queries outside the identity lock
• Short-circuit explicit workspace denials before prototype scans
• Return only declared prototype fields from list responses
• Add rejection tests for stale and insufficient authority

_{Review effort: Max (auto)}

[Copilot]

🔵 Needs a closer look

Tests leave child-prototype administrator guards and role thresholds uncovered, while route mocks fail to verify request-to-service argument mapping.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Test role thresholds for access and prototype operations

hub/​server/​domains/​prototype-authorization/​create-service/​index.ts:521

The database suite does not test the role thresholds for direct access changes, archival, or version creation, so weakening these checks would leave it passing. Add editor attempts to set and remove workspace/prototype rules, plus commenter attempts to archive a prototype and create a version. Assert 403 prototype_access_denied and unchanged product state and audits.

Add coverage for last prototype administrator guards

hub/​server/​domains/​prototype-authorization/​create-service/​index.ts:533

The workspace tests never reach this guard: they either fail workspace continuity first or create no child prototypes. Add downgrade and removal cases with two workspace administrators, one restricted to viewer on a child prototype, and assert 409 last_prototype_administrator with unchanged grants and audits. Cover both this guard and the matching guard in removeWorkspaceAccess() at lines 590–606.

Assert route mock arguments and request-to-service mapping

hub/​server/​routes/​product/​index.test.ts:167

These mocks reject regardless of their arguments, so swapping a scope ID and user ID or omitting the session token still leaves the route tests passing. Assert the exact mock.calls arguments for each endpoint, including distinct prototype/version IDs and request query/body values, so the suite protects request-to-service mapping.

3 resolved since last review

• Use exclusive ID cursor filtering to prevent skipped results
• Avoid unbounded authorization scans without a baseline
• Cover inactive grant targets with database tests

_{Review effort: Max (auto)}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate cross-prototype pagination behavior, inconsistent validation responses, and gaps in administration-continuity test coverage.

No open issues 🎉

_{Review effort: Max (auto)}