diff --git a/apps/api/src/routes/templates.ts b/apps/api/src/routes/templates.ts index 8f4b4e0..cf1fd37 100644 --- a/apps/api/src/routes/templates.ts +++ b/apps/api/src/routes/templates.ts @@ -16,6 +16,7 @@ import { users, } from '@bmm/db'; import { GeneratorSpec } from '@bmm/types'; +import { getSession } from '@bmm/auth'; import { requireAuth, requireAdmin } from '../plugins/session.js'; import { audit } from '../lib/audit.js'; import { cacheSpec, cachePrebuiltCode } from '../lib/preview-cache.js'; @@ -345,6 +346,33 @@ export async function templateRoutes(app: FastifyInstance): Promise { return reply.send({ templates: ranked, categories: CATEGORIES }); }); + // ---- My templates (authed — all statuses, for the marketplace "Mine" filter) ---- + // Registered before /:slug so the static segment always wins the router match. + app.get('/v1/templates/mine', { preHandler: requireAuth }, async (req, reply) => { + const user = req.user!; + const rows = await db + .select() + .from(templates) + .where(eq(templates.ownerUserId, user.userId)) + .orderBy(desc(templates.createdAt)); + + const enriched = await Promise.all( + rows.map(async (t) => { + const [active] = await db + .select({ c: count() }) + .from(mcpServers) + .where(and(eq(mcpServers.templateId, t.id), eq(mcpServers.status, 'live'))); + return { + ...t, + ownerName: user.email.split('@')[0], + ownerOrgName: null, + activeDeployments: Number(active?.c ?? 0), + }; + }), + ); + return reply.send({ templates: enriched, categories: CATEGORIES }); + }); + // ---- Detail ---- app.get('/v1/templates/:slug', async (req, reply) => { const Params = z.object({ slug: z.string().regex(SLUG_REGEX) }); @@ -365,16 +393,19 @@ export async function templateRoutes(app: FastifyInstance): Promise { .limit(1); if (!row) return reply.code(404).send({ error: 'not_found' }); if (row.template.status === 'takedown') { + // Takedown is an admin decision — sealed for everyone, including the owner. return reply.code(410).send({ error: 'taken_down', reason: row.template.takedownReason, }); } if (row.template.status !== 'public') { - // hidden / draft — only owner can view - // Note: viewing endpoint is public, so we 404 to non-owners. - // (Owner UI would use a separate auth'd endpoint; out of scope for v1.) - return reply.code(404).send({ error: 'not_found' }); + // hidden / draft — visible only to the owner (optional auth check). + const session = await getSession(req.cookies['bmm_session']); + const isOwner = session != null && session.userId === row.template.ownerUserId; + if (!isOwner) { + return reply.code(404).send({ error: 'not_found' }); + } } const [active] = await db diff --git a/apps/web/app/(dashboard)/layout.tsx b/apps/web/app/(dashboard)/layout.tsx index 72fdc2b..e687907 100644 --- a/apps/web/app/(dashboard)/layout.tsx +++ b/apps/web/app/(dashboard)/layout.tsx @@ -1,6 +1,6 @@ import Link from 'next/link'; import { Logo } from '@/components/logo'; -import { LayoutGrid, Server, Settings, FileClock } from 'lucide-react'; +import { LayoutGrid, Server, Settings, FileClock, Package } from 'lucide-react'; export default function DashboardLayout({ children }: { children: React.ReactNode }) { return ( @@ -16,6 +16,9 @@ export default function DashboardLayout({ children }: { children: React.ReactNod }> Servers + }> + Marketplace + }> Audit diff --git a/apps/web/app/templates/[slug]/page.tsx b/apps/web/app/templates/[slug]/page.tsx index cf3e70e..23cad14 100644 --- a/apps/web/app/templates/[slug]/page.tsx +++ b/apps/web/app/templates/[slug]/page.tsx @@ -28,6 +28,7 @@ interface TemplateDetail { shortDescription: string; longDescription: string | null; category: string; + status: 'draft' | 'public' | 'hidden' | 'takedown'; verified: boolean; forkCount: number; activeDeployments: number; @@ -37,6 +38,7 @@ interface TemplateDetail { scopes: string[]; ownerName: string | null; ownerOrgName: string | null; + sourceServerId: string | null; createdAt: string; } @@ -208,12 +210,31 @@ export default function TemplateDetail() {