feat(platform): checkpoint current implementation state

packages/api/src/router/assistant-tools/user-admin.ts

@@ -1,6 +1,6 @@
 import { SystemRole } from "@capakraken/shared";
 import type { TRPCContext } from "../../trpc.js";
-import type { ToolContext, ToolDef, ToolExecutor } from "./shared.js";
+import { withToolAccess, type ToolContext, type ToolDef, type ToolExecutor } from "./shared.js";
 
 type AssistantToolErrorResult = { error: string };
 
@@ -48,7 +48,7 @@ type UserAdminDeps = {
   ) => AssistantToolErrorResult | null;
 };
 
-export const userAdminToolDefinitions: ToolDef[] = [
+export const userAdminToolDefinitions: ToolDef[] = withToolAccess([
   {
     type: "function",
     function: {
@@ -212,7 +212,41 @@ export const userAdminToolDefinitions: ToolDef[] = [
       },
     },
   },
-];
+], {
+  list_users: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  create_user: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  set_user_password: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  update_user_role: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  update_user_name: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  link_user_resource: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  auto_link_users_by_email: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  set_user_permissions: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  reset_user_permissions: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  get_effective_user_permissions: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+  disable_user_totp: {
+    allowedSystemRoles: [SystemRole.ADMIN],
+  },
+});
 
 export function createUserAdminExecutors(
   deps: UserAdminDeps,