Add server routes for companies, approvals, costs, and dashboard

New routes: companies, approvals, costs, dashboard, authz. New
services: companies, approvals, costs, dashboard, heartbeat,
activity-log. Add auth middleware and structured error handling.
Expand existing agent and issue routes with richer CRUD operations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/projects.ts

@@ -2,49 +2,103 @@ import { Router } from "express";
 import type { Db } from "@paperclip/db";
 import { createProjectSchema, updateProjectSchema } from "@paperclip/shared";
 import { validate } from "../middleware/validate.js";
-import { projectService } from "../services/projects.js";
+import { projectService, logActivity } from "../services/index.js";
+import { assertCompanyAccess, getActorInfo } from "./authz.js";
 
 export function projectRoutes(db: Db) {
   const router = Router();
   const svc = projectService(db);
 
-  router.get("/", async (_req, res) => {
-    const result = await svc.list();
+  router.get("/companies/:companyId/projects", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const result = await svc.list(companyId);
     res.json(result);
   });
 
-  router.get("/:id", async (req, res) => {
+  router.get("/projects/:id", async (req, res) => {
     const id = req.params.id as string;
     const project = await svc.getById(id);
     if (!project) {
       res.status(404).json({ error: "Project not found" });
       return;
     }
+    assertCompanyAccess(req, project.companyId);
     res.json(project);
   });
 
-  router.post("/", validate(createProjectSchema), async (req, res) => {
-    const project = await svc.create(req.body);
+  router.post("/companies/:companyId/projects", validate(createProjectSchema), async (req, res) => {
+    const companyId = req.params.companyId as string;
+    assertCompanyAccess(req, companyId);
+    const project = await svc.create(companyId, req.body);
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      action: "project.created",
+      entityType: "project",
+      entityId: project.id,
+      details: { name: project.name },
+    });
     res.status(201).json(project);
   });
 
-  router.patch("/:id", validate(updateProjectSchema), async (req, res) => {
+  router.patch("/projects/:id", validate(updateProjectSchema), async (req, res) => {
     const id = req.params.id as string;
+    const existing = await svc.getById(id);
+    if (!existing) {
+      res.status(404).json({ error: "Project not found" });
+      return;
+    }
+    assertCompanyAccess(req, existing.companyId);
     const project = await svc.update(id, req.body);
     if (!project) {
       res.status(404).json({ error: "Project not found" });
       return;
     }
+
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId: project.companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      action: "project.updated",
+      entityType: "project",
+      entityId: project.id,
+      details: req.body,
+    });
+
     res.json(project);
   });
 
-  router.delete("/:id", async (req, res) => {
+  router.delete("/projects/:id", async (req, res) => {
     const id = req.params.id as string;
+    const existing = await svc.getById(id);
+    if (!existing) {
+      res.status(404).json({ error: "Project not found" });
+      return;
+    }
+    assertCompanyAccess(req, existing.companyId);
     const project = await svc.remove(id);
     if (!project) {
       res.status(404).json({ error: "Project not found" });
       return;
     }
+
+    const actor = getActorInfo(req);
+    await logActivity(db, {
+      companyId: project.companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      action: "project.deleted",
+      entityType: "project",
+      entityId: project.id,
+    });
+
     res.json(project);
   });