Implement authorization and control surfaces

cmd/orchestra/main.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"log"
 	"net/http"
+	"orchestra/internal/authz"
 	"orchestra/internal/domain"
 	"orchestra/internal/registry"
 	"orchestra/internal/router"
@@ -71,11 +72,60 @@ func main() {
 	})
 	mux.HandleFunc("/v1/tasks/", func(w http.ResponseWriter, r *http.Request) {
 		parts := strings.Split(strings.Trim(r.URL.Path, "/"), "/")
-		if len(parts) != 4 || r.Method != "POST" {
+		if len(parts) < 4 || len(parts) > 5 || r.Method != "POST" {
 			http.Error(w, "not found", http.StatusNotFound)
 			return
 		}
 		taskID, action := parts[2], parts[3]
+		if action == "approval" {
+			if len(parts) == 5 {
+				if parts[4] != "grant" && parts[4] != "deny" {
+					http.Error(w, "unknown approval action", 404)
+					return
+				}
+				t, ok := s.Task(taskID)
+				if !ok {
+					http.Error(w, "task not found", 404)
+					return
+				}
+				by := r.Header.Get("X-Orchestra-Actor")
+				if by == "" {
+					by = "surface"
+				}
+				typ := "ApprovalGranted"
+				if parts[4] == "deny" {
+					typ = "ApprovalDenied"
+				}
+				b, _ := json.Marshal(map[string]any{"subject_ref": taskID, "by": by})
+				e := domain.Event{ID: id(), Type: typ, TaskID: taskID, Version: t.Version + 1, Payload: b}
+				if err := s.Append(e); err != nil {
+					http.Error(w, err.Error(), 409)
+					return
+				}
+				json.NewEncoder(w).Encode(e)
+				return
+			}
+			var p struct {
+				Options []any `json:"options"`
+			}
+			if json.NewDecoder(r.Body).Decode(&p) != nil || len(p.Options) == 0 {
+				http.Error(w, "options required", 400)
+				return
+			}
+			if _, ok := s.Task(taskID); !ok {
+				http.Error(w, "task not found", 404)
+				return
+			}
+			b, _ := json.Marshal(map[string]any{"subject_ref": taskID, "options": p.Options})
+			t, _ := s.Task(taskID)
+			e := domain.Event{ID: id(), Type: "ApprovalRequested", TaskID: taskID, Version: t.Version + 1, Payload: b}
+			if err := s.Append(e); err != nil {
+				http.Error(w, err.Error(), 400)
+				return
+			}
+			json.NewEncoder(w).Encode(e)
+			return
+		}
 		var e domain.Event
 		var err error
 		switch action {
@@ -135,7 +185,12 @@ func main() {
 		port = "9145"
 	}
 	log.Println("orchestra listening on :" + port)
-	log.Fatal(http.ListenAndServe(":"+port, auth(mux)))
+	tokens := map[authz.Surface]string{
+		authz.TUI: os.Getenv("ORCHESTRA_TUI_TOKEN"), authz.Web: os.Getenv("ORCHESTRA_WEB_TOKEN"),
+		authz.MCP: os.Getenv("ORCHESTRA_MCP_TOKEN"), authz.Maven: os.Getenv("ORCHESTRA_MAVEN_TOKEN"),
+		authz.Telegram: os.Getenv("ORCHESTRA_TELEGRAM_TOKEN"), authz.Ntfy: os.Getenv("ORCHESTRA_NTFY_TOKEN"),
+	}
+	log.Fatal(http.ListenAndServe(":"+port, authz.HTTP(tokens, mux)))
 }
 func auth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {