feat(scripts): group-owned script admin API + pic scripts … --group

Phase 4-lite C2. Lets a group own scripts (templates inherited by descendant
apps), with the create/list/manage surface — but not yet the inherited
resolution (binding + runtime), which is C3.

Capabilities: add `GroupScriptsRead` (viewer+ on the group → script:read) and
`GroupScriptsWrite` (editor+ → script:write), mirroring the group-vars tier and
resolved through the same group-ancestor walk.

API:
  * New `group_scripts_api`: `POST/GET /groups/{id}/scripts` — create a
    group-owned endpoint script and list a group's own (non-inherited) rows.
    Phase 4-lite is endpoint-only and self-contained: `kind=module` and any
    `import` are rejected (group modules + the lexical resolver are Phase 4b).
    Owner resolved first (slug-or-uuid); capability bound to the resolved id.
  * The by-id `/scripts/{id}` get/update/delete/logs handlers are now
    owner-polymorphic via a `script_cap` helper: app-owned scripts gate on
    `App*` exactly as before; group-owned on `GroupScripts*`. This is what
    makes `deploy --group` idempotent (update reuses the by-id PUT) and lets a
    group script be deleted by id. (C1 had these fail closed for groups.)

Repo: `list_for_group(group_id)` (the group's own rows).

CLI: `pic scripts ls --group <g>`, `pic scripts deploy --group <g>` (create or
update by name; `--app`/`--group` are mutually exclusive, exactly one
required). `pic scripts delete <id>` already works for group scripts via the
owner-polymorphic by-id route.

Live-validated against the dev DB: create → update (v2 via the by-id PUT) →
list → delete, plus module rejection and the polymorphic row shape
(`app_id NULL`, `group_id` set). Group scripts still can't be routed/triggered
or invoked — that lands in C3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/group_scripts_api.rs

@@ -0,0 +1,236 @@
+//! `/api/v1/admin/groups/{id}/scripts*` — group-owned script admin (Phase 4).
+//!
+//!   * `GET  /groups/{id}/scripts` — list the group's own scripts (not
+//!     inherited; just rows owned directly by this group). Gated by
+//!     `GroupScriptsRead` (viewer+ on the group).
+//!   * `POST /groups/{id}/scripts` — create a group-owned script. Gated by
+//!     `GroupScriptsWrite` (editor+ on the group).
+//!
+//! A group script is a **template** inherited by every descendant app,
+//! resolved by name with nearest-owner-wins (CoW). Get / update / delete of an
+//! existing group script go through the by-id `/scripts/{id}` endpoints, which
+//! are owner-polymorphic — a group script there gates on `GroupScripts*`.
+//!
+//! **Phase 4-lite scope:** group ENDPOINT scripts only, and they must be
+//! self-contained — `kind=module` and any `import` are rejected here, because
+//! the origin-aware (lexical) module resolver is Phase 4b. The owner is
+//! resolved FIRST (slug-or-uuid) and `authz::require` binds the capability to
+//! the resolved group id, never to a caller-controlled path param.
+
+use std::sync::Arc;
+
+use axum::extract::{Path, State};
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Json, Response};
+use axum::routing::get;
+use axum::{Extension, Router};
+use picloud_shared::{
+    GroupId, Principal, Script, ScriptKind, ScriptSandbox, ScriptValidator, ValidationError,
+};
+use serde::Deserialize;
+use serde_json::json;
+
+use crate::authz::{require, AuthzDenied, AuthzError, AuthzRepo, Capability};
+use crate::group_repo::GroupRepository;
+use crate::repo::{NewScript, ScriptRepository, ScriptRepositoryError};
+use crate::sandbox::SandboxCeiling;
+
+#[derive(Clone)]
+pub struct GroupScriptsState {
+    pub scripts: Arc<dyn ScriptRepository>,
+    pub groups: Arc<dyn GroupRepository>,
+    pub authz: Arc<dyn AuthzRepo>,
+    pub validator: Arc<dyn ScriptValidator>,
+    pub sandbox_ceiling: SandboxCeiling,
+}
+
+pub fn group_scripts_router(state: GroupScriptsState) -> Router {
+    Router::new()
+        .route(
+            "/groups/{group_id}/scripts",
+            get(list_group_scripts).post(create_group_script),
+        )
+        .with_state(state)
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateGroupScriptRequest {
+    pub name: String,
+    pub description: Option<String>,
+    pub source: String,
+    /// Phase 4-lite accepts only `endpoint`. A `module` is rejected (group
+    /// modules + the lexical import resolver are Phase 4b).
+    #[serde(default)]
+    pub kind: ScriptKind,
+    pub timeout_seconds: Option<i32>,
+    pub memory_limit_mb: Option<i32>,
+    #[serde(default)]
+    pub sandbox: ScriptSandbox,
+}
+
+async fn list_group_scripts(
+    State(s): State<GroupScriptsState>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+) -> Result<Json<Vec<Script>>, GroupScriptsApiError> {
+    let group_id = resolve_group(&*s.groups, &id_or_slug).await?;
+    require(
+        s.authz.as_ref(),
+        &principal,
+        Capability::GroupScriptsRead(group_id),
+    )
+    .await?;
+    Ok(Json(s.scripts.list_for_group(group_id).await?))
+}
+
+async fn create_group_script(
+    State(s): State<GroupScriptsState>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+    Json(input): Json<CreateGroupScriptRequest>,
+) -> Result<(StatusCode, Json<Script>), GroupScriptsApiError> {
+    let group_id = resolve_group(&*s.groups, &id_or_slug).await?;
+    require(
+        s.authz.as_ref(),
+        &principal,
+        Capability::GroupScriptsWrite(group_id),
+    )
+    .await?;
+
+    // Phase 4-lite: endpoint-only, self-contained.
+    if input.kind == ScriptKind::Module {
+        return Err(GroupScriptsApiError::Invalid(
+            "group modules are not supported yet (Phase 4b); create an endpoint script".into(),
+        ));
+    }
+    let validated = s.validator.validate(&input.source)?;
+    if !validated.imports.is_empty() {
+        return Err(GroupScriptsApiError::Invalid(format!(
+            "group scripts must be self-contained in Phase 4-lite; \
+             remove the import(s): {}",
+            validated.imports.join(", ")
+        )));
+    }
+    s.sandbox_ceiling
+        .check(&input.sandbox)
+        .map_err(|e| GroupScriptsApiError::Invalid(e.to_string()))?;
+
+    let created = s
+        .scripts
+        .create(NewScript {
+            app_id: None,
+            group_id: Some(group_id),
+            name: input.name,
+            description: input.description,
+            source: input.source,
+            kind: ScriptKind::Endpoint,
+            timeout_seconds: input.timeout_seconds,
+            memory_limit_mb: input.memory_limit_mb,
+            sandbox: if input.sandbox.is_empty() {
+                None
+            } else {
+                Some(input.sandbox)
+            },
+            enabled: true,
+            // Self-contained — no import edges (enforced above).
+            imports: Vec::new(),
+        })
+        .await?;
+    Ok((StatusCode::CREATED, Json(created)))
+}
+
+async fn resolve_group(
+    groups: &dyn GroupRepository,
+    ident: &str,
+) -> Result<GroupId, GroupScriptsApiError> {
+    let found = if let Ok(uuid) = ident.parse::<uuid::Uuid>() {
+        groups
+            .get_by_id(uuid.into())
+            .await
+            .map_err(|e| GroupScriptsApiError::Backend(e.to_string()))?
+    } else {
+        groups
+            .get_by_slug(ident)
+            .await
+            .map_err(|e| GroupScriptsApiError::Backend(e.to_string()))?
+    };
+    found
+        .map(|g| g.id)
+        .ok_or(GroupScriptsApiError::GroupNotFound)
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum GroupScriptsApiError {
+    #[error("group not found")]
+    GroupNotFound,
+    #[error("invalid request: {0}")]
+    Invalid(String),
+    #[error("conflict: {0}")]
+    Conflict(String),
+    #[error("forbidden")]
+    Forbidden,
+    #[error("authorization repo error: {0}")]
+    AuthzRepo(String),
+    #[error("scripts backend: {0}")]
+    Backend(String),
+}
+
+impl From<AuthzDenied> for GroupScriptsApiError {
+    fn from(d: AuthzDenied) -> Self {
+        match d {
+            AuthzDenied::Denied => Self::Forbidden,
+            AuthzDenied::Repo(e) => Self::AuthzRepo(e.to_string()),
+        }
+    }
+}
+
+impl From<AuthzError> for GroupScriptsApiError {
+    fn from(e: AuthzError) -> Self {
+        Self::AuthzRepo(e.to_string())
+    }
+}
+
+impl From<ValidationError> for GroupScriptsApiError {
+    fn from(e: ValidationError) -> Self {
+        Self::Invalid(e.to_string())
+    }
+}
+
+impl From<ScriptRepositoryError> for GroupScriptsApiError {
+    fn from(e: ScriptRepositoryError) -> Self {
+        match e {
+            ScriptRepositoryError::Conflict(m) => Self::Conflict(m),
+            ScriptRepositoryError::NotFound(id) => Self::Invalid(format!("script {id} not found")),
+            ScriptRepositoryError::Db(e) => Self::Backend(e.to_string()),
+        }
+    }
+}
+
+impl IntoResponse for GroupScriptsApiError {
+    fn into_response(self) -> Response {
+        let (status, body) = match &self {
+            Self::GroupNotFound => (StatusCode::NOT_FOUND, json!({ "error": self.to_string() })),
+            Self::Invalid(_) => (
+                StatusCode::UNPROCESSABLE_ENTITY,
+                json!({ "error": self.to_string() }),
+            ),
+            Self::Conflict(_) => (StatusCode::CONFLICT, json!({ "error": self.to_string() })),
+            Self::Forbidden => (StatusCode::FORBIDDEN, json!({ "error": self.to_string() })),
+            Self::AuthzRepo(e) => {
+                tracing::error!(error = %e, "group-scripts admin authz repo error");
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    json!({ "error": "internal error" }),
+                )
+            }
+            Self::Backend(e) => {
+                tracing::error!(error = %e, "group-scripts admin backend error");
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    json!({ "error": "internal error" }),
+                )
+            }
+        };
+        (status, Json(body)).into_response()
+    }
+}