Changeset 0.29.0 (#195)

server/handlers/tasks.go

@@ -133,12 +133,30 @@ func (h *TaskHandler) Create(c *gin.Context) {
 		}
 	}
 
-	// v0.28.7: Starlark tasks — pre-positioned gate for v0.29.0.
-	// The Starlark executor does not exist yet. Reject all creation with
-	// a clear message rather than a cryptic CHECK constraint failure.
+	// v0.29.0: Starlark tasks — run sandboxed extension scripts.
+	// Requires task.starlark permission. system_function holds package ID.
 	if t.TaskType == "starlark" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "starlark task execution requires v0.29.0 — not yet available"})
-		return
+		if c.GetString("role") != "admin" {
+			perms := middleware.GetResolvedPermissions(c)
+			if perms == nil || !perms[auth.PermTaskStarlark] {
+				c.JSON(http.StatusForbidden, gin.H{"error": "permission required: " + auth.PermTaskStarlark})
+				return
+			}
+		}
+		if t.SystemFunction == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "system_function (package_id) is required for starlark tasks"})
+			return
+		}
+		// Verify package exists and is starlark tier
+		pkg, err := h.stores.Packages.Get(c.Request.Context(), t.SystemFunction)
+		if err != nil || pkg == nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "package not found: " + t.SystemFunction})
+			return
+		}
+		if pkg.Tier != models.ExtTierStarlark {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "package " + t.SystemFunction + " is not a starlark package"})
+			return
+		}
 	}
 
 	// v0.28.0-audit: Workflow task execution is not yet implemented.