feat(auth): centralize ThothII permission enforcement

backend/src/routes/settings.ts

@@ -2,8 +2,8 @@ import type { FastifyInstance } from "fastify";
 import type { AppConfig } from "../config.js";
 import type { Settings } from "../settings/settings-store.js";
 import { listWorkspaces, type ListModelsFn } from "./meta.js";
-import { getPrincipal } from "../auth/auth.js";
 import type { PrincipalContext } from "../auth/principal.js";
+import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
 
 /** Merge stored settings over env/first-workspace defaults. */
 export function effectiveSettings(cfg: AppConfig, stored: Settings): Settings {
@@ -24,14 +24,18 @@ export function settingsRoutes(
   },
 ): void {
   app.get("/settings", async (req, reply) => {
+    const principal = requirePermission(req, reply, "session.use");
+    if (!isPrincipalContext(principal)) return principal;
     try {
-      return await deps.getSettings(getPrincipal(req));
+      return await deps.getSettings(principal);
     } catch {
       return reply.code(503).send({ error: "settings storage is unavailable" });
     }
   });
 
   app.put("/settings", async (req, reply) => {
+    const principal = requirePermission(req, reply, "settings.manage");
+    if (!isPrincipalContext(principal)) return principal;
     const b = (req.body ?? {}) as Settings;
     if (b.model) {
       let available: { provider: string; id: string }[] = [];
@@ -52,7 +56,7 @@ export function settingsRoutes(
     try {
       // Retain this endpoint as a validating compatibility surface for older clients, but do
       // not write anonymous users' choices to shared server storage.
-      return await deps.getSettings(getPrincipal(req));
+      return await deps.getSettings(principal);
     } catch {
       return reply.code(503).send({ error: "settings storage is unavailable" });
     }