Changeset 0.28.2.1 (#184)

server/handlers/knowledge_bases.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"git.gobha.me/xcaliber/chat-switchboard/database"
 	"git.gobha.me/xcaliber/chat-switchboard/knowledge"
 	"git.gobha.me/xcaliber/chat-switchboard/models"
 	"git.gobha.me/xcaliber/chat-switchboard/storage"
@@ -150,11 +149,8 @@ func (h *KnowledgeBaseHandler) CreateKB(c *gin.Context) {
 		// Verify user is team admin (or system admin)
 		role, _ := c.Get("role")
 		if role != "admin" {
-			var teamRole string
-			err := database.DB.QueryRow(
-				database.Q(`SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2`),
-				req.TeamID, userID).Scan(&teamRole)
-			if err != nil || teamRole != "admin" {
+			isTA, err := h.stores.Teams.IsTeamAdmin(c.Request.Context(), req.TeamID, userID)
+			if err != nil || !isTA {
 				c.JSON(http.StatusForbidden, gin.H{"error": "team admin access required to create team knowledge bases"})
 				return
 			}
@@ -764,8 +760,23 @@ func (h *KnowledgeBaseHandler) SetChannelKBs(c *gin.Context) {
 // ── Discoverable Management (v0.17.0) ────────────
 
 // SetDiscoverable toggles KB visibility to users.
+// Only the KB owner or a system admin may change this flag.
 func (h *KnowledgeBaseHandler) SetDiscoverable(c *gin.Context) {
-	kbID := c.Param("id")
+	kb, ok := h.loadAndAuthorize(c)
+	if !ok {
+		return
+	}
+
+	// Require ownership or admin role to toggle discoverability
+	userID := getUserID(c)
+	role, _ := c.Get("role")
+	isAdmin := role == "admin"
+	isOwner := kb.OwnerID != nil && *kb.OwnerID == userID
+
+	if !isAdmin && !isOwner {
+		c.JSON(http.StatusForbidden, gin.H{"error": "only the KB owner or a system admin can change discoverability"})
+		return
+	}
 
 	var req struct {
 		Discoverable bool `json:"discoverable"`
@@ -775,11 +786,15 @@ func (h *KnowledgeBaseHandler) SetDiscoverable(c *gin.Context) {
 		return
 	}
 
-	if err := h.stores.KnowledgeBases.SetDiscoverable(c.Request.Context(), kbID, req.Discoverable); err != nil {
+	if err := h.stores.KnowledgeBases.SetDiscoverable(c.Request.Context(), kb.ID, req.Discoverable); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update discoverability"})
 		return
 	}
 
+	h.auditLog(c, "kb.discoverable", kb.ID, map[string]interface{}{
+		"kb_name": kb.Name, "discoverable": req.Discoverable,
+	})
+
 	c.JSON(http.StatusOK, gin.H{"status": "ok"})
 }
 
@@ -798,7 +813,12 @@ func (h *KnowledgeBaseHandler) ListDiscoverableKBs(c *gin.Context) {
 		kbs = []models.KnowledgeBase{}
 	}
 
-	c.JSON(http.StatusOK, gin.H{"data": kbs})
+	items := make([]kbResponse, len(kbs))
+	for i := range kbs {
+		items[i] = toKBResponse(&kbs[i])
+	}
+
+	c.JSON(http.StatusOK, gin.H{"data": items})
 }
 
 // userCanAccess checks if a user can access a KB based on scope.