Files
realmroot[bot] 96fdd70d2c feat(api)!: redesign task resource operations (#265)
* feat(api)!: redesign task resource operations

Publish the complete resource-oriented OpenAPI contract, enforce scope-based authorization at the HTTP boundary, and replace lifecycle command routes with Task PATCH and nested Claim/Event resources.

Add server-side Task CAS, migration coverage, updated Agent Skills, and browser/API regression tests.

BREAKING CHANGE: remove the legacy task lifecycle endpoints and move bounded waits to /tasks/{taskId}/events.

* refactor(tasks)!: make claims create-only

Remove Task Claim retrieval and deletion routes, the release scope, live deletion logic, and release workflow guidance.

Keep historical release records readable for migration and audit compatibility.

BREAKING CHANGE: remove GET and DELETE /tasks/{taskId}/claims/{claimId} and the task:release scope.

* test(ci): align actor and projection contracts

Cover machine and service Task Action writes and update Agent detail fixtures to the canonical assignedTo query and paged lowerCamelCase response.

* fix(api): preserve merge patch fields and consume browser pagination

* test(ui): include terminal pagination in agent task fixture

---------

Co-authored-by: jarvis <jarvis@agents.realmroot.dev>
2026-09-05 02:40:42 +00:00

49 lines
2.5 KiB
TypeScript

import { authenticationMiddleware, csrfProtectionMiddleware, principalProvisioningMiddleware } from "@server/auth/middleware";
import type { Env } from "@server/env";
import { registerAgentRoutes } from "@server/http/agents/routes";
import { registerAuthRoutes } from "@server/http/auth/routes";
import { registerBoardRoutes } from "@server/http/boards/routes";
import { registerGithubApplicationRoutes, registerGithubSetupRedirectRoute, registerGithubWebhookRoutes } from "@server/http/github/routes";
import { registerMachineRoutes } from "@server/http/machines/routes";
import { createAccessLogMiddleware } from "@server/http/middleware/accessLog";
import { resourceServerErrorHandler } from "@server/http/middleware/idempotency";
import { requestContextMiddleware } from "@server/http/middleware/requestContext";
import { isPublishedV2Operation, v2ApiVersionMiddleware } from "@server/http/middleware/v2Contract";
import { registerPublicRoutes } from "@server/http/public/routes";
import { registerRepositoryRoutes } from "@server/http/repositories/routes";
import { registerResourceServerRoutes } from "@server/http/resource-server/routes";
import { registerTaskResourceRoutes } from "@server/http/tasks/resourceRoutes";
import { registerTaskWorkflowRoutes } from "@server/http/tasks/routes";
import { createLogger } from "@server/observability/logger";
import { Hono } from "hono";
const api = new Hono<{ Bindings: Env }>();
const logger = createLogger("api");
api.use("*", requestContextMiddleware);
api.use("*", createAccessLogMiddleware(logger));
api.onError(resourceServerErrorHandler);
// Public routes must be registered before the protected /api middleware.
registerAuthRoutes(api);
registerResourceServerRoutes(api);
registerGithubWebhookRoutes(api);
registerGithubSetupRedirectRoute(api);
registerPublicRoutes(api);
api.get("/api/ping", (c) => c.json({ pong: true }));
api.use("/api/*", (c, next) => (isPublishedV2Operation(c.req.method, c.req.path) ? v2ApiVersionMiddleware(c, next) : next()));
api.use("/api/*", (c, next) => (c.req.path.startsWith("/api/auth/") ? next() : authenticationMiddleware(c, next)));
api.use("/api/*", (c, next) => (c.req.path.startsWith("/api/auth/") ? next() : csrfProtectionMiddleware(c, next)));
api.use("/api/*", (c, next) => (c.req.path.startsWith("/api/auth/") ? next() : principalProvisioningMiddleware(c, next)));
registerTaskWorkflowRoutes(api);
registerTaskResourceRoutes(api);
registerBoardRoutes(api);
registerAgentRoutes(api);
registerMachineRoutes(api);
registerGithubApplicationRoutes(api);
registerRepositoryRoutes(api);
export { api };