refactor: convert settings, skills, and RBAC routes to Hono sub-apps

packages/control-plane/src/router.policy.test.ts

@@ -2,10 +2,10 @@ import { describe, expect, it, vi } from "vitest";
 import { enforceRoutePrincipal } from "./routing/route-admission";
 import {
   handleRequest,
-  legacyRoutes,
   matchRoute,
   routeContracts as routes,
   TEST_BACKGROUND_TASK_CONTEXT,
+  TEST_SERVICE_SECRETS,
 } from "./router.test-support";
 import { serviceAllowsPermission } from "./authorization/service-permissions";
 import { SCOPED_PERMISSION_PAIRS } from "@open-inspect/shared/rbac";
@@ -244,23 +244,20 @@ describe("route policy table", () => {
     });
   });
 
-  it("returns 400 for a malformed percent-encoded role ID before querying D1", async () => {
-    const path = "/roles/%E0%A4%A";
-    const { route, match } = matchRoute(legacyRoutes(), "GET", path)!;
+  it("refuses a malformed percent-encoded role ID before authentication or D1", async () => {
+    // Hono leaves the segment undecoded; admission refuses it before the
+    // principal is resolved, so neither authentication nor the role lookup
+    // touches D1.
     const prepare = vi.fn();
 
-    const response = await route.handler(
-      new Request(`https://test.local${path}`),
-      {} as never,
-      match,
-      {
-        principal: { kind: "user", userId: "user-1" },
-        db: { prepare },
-      } as never
+    const response = await handleRequest(
+      new Request("https://test.local/roles/%E0%A4%A"),
+      { ...TEST_SERVICE_SECRETS, DB: { prepare } } as never,
+      TEST_BACKGROUND_TASK_CONTEXT
     );
 
     expect(response.status).toBe(400);
-    await expect(response.json()).resolves.toEqual({ error: "Invalid role ID" });
+    await expect(response.json()).resolves.toEqual({ error: "Invalid path encoding" });
     expect(prepare).not.toHaveBeenCalled();
   });
 

packages/control-plane/src/routes/catalog.ts

@@ -62,22 +62,22 @@ export const catalog: RouteCatalogEntry[] = [
   modelPreferencesRoutes,
 
   // Subscription provider account management and sandbox access broker
-  ...modelProviderAccountRoutes,
+  modelProviderAccountRoutes,
 
   // Integration settings
-  ...integrationSettingsRoutes,
+  integrationSettingsRoutes,
 
   // Deployment-wide commit signing identity
-  ...commitSigningRoutes,
+  commitSigningRoutes,
 
   // SCM (source-control) settings
-  ...scmSettingsRoutes,
+  scmSettingsRoutes,
 
   // Automations
   ...automationRoutes,
 
   // MCP servers
-  ...mcpServerRoutes,
+  mcpServerRoutes,
 
   // Analytics
   analyticsRoutes,
@@ -89,13 +89,13 @@ export const catalog: RouteCatalogEntry[] = [
   ...autofixRoutes,
 
   // Installation-wide managed skills and personal profiles
-  ...skillRoutes,
+  skillRoutes,
 
   // Personal keyboard shortcuts
   keyboardShortcutRoutes,
 
   // Workspace roles, members, and current-user authorization
-  ...rbacRoutes,
+  rbacRoutes,
 
   // Webhooks (public routes — auth handled per-route)
   ...webhookRoutes,

packages/control-plane/src/routes/commit-signing.ts

@@ -1,4 +1,5 @@
 import { commitSigningWriteRequestSchema } from "@open-inspect/shared/types/commit-signing";
+import { Hono } from "hono";
 
 import {
   OpenSshKeyValidationError,
@@ -7,15 +8,15 @@ import {
 } from "../auth/openssh-ed25519";
 import { CommitSigningStore } from "../db/commit-signing";
 import type { SqlDatabase } from "../db/sql-database";
+import { admit, dispatch } from "../routing/admit";
+import type { ControlPlaneHonoEnv } from "../routing/hono-env";
 import { resolveScmProviderFromEnv } from "../source-control";
 import type { Env } from "../types";
 import {
   error,
   json,
   parseJsonBody,
   type RequestContext,
-  type Route,
-  defineRoute,
   GITHUB_USER_OR_SERVICE_ROUTE,
   SCM_AGNOSTIC_SANDBOX_ROUTE,
   NO_AUTHORIZATION,
@@ -70,7 +71,7 @@ async function readSigningPayload(request: Request): Promise<Uint8Array | null>
 async function handleGetCommitSigning(
   _request: Request,
   env: Env,
-  _match: RegExpMatchArray,
+  _params: object,
   ctx: RequestContext
 ): Promise<Response> {
   const store = createStore(env, ctx.db);
@@ -87,7 +88,7 @@ async function handleGetCommitSigning(
 async function handlePutCommitSigning(
   request: Request,
   env: Env,
-  _match: RegExpMatchArray,
+  _params: object,
   ctx: RequestContext
 ): Promise<Response> {
   const store = createStore(env, ctx.db);
@@ -120,7 +121,7 @@ async function handlePutCommitSigning(
 async function handleDeleteCommitSigning(
   _request: Request,
   env: Env,
-  _match: RegExpMatchArray,
+  _params: object,
   ctx: RequestContext
 ): Promise<Response> {
   const store = createStore(env, ctx.db);
@@ -137,12 +138,9 @@ async function handleDeleteCommitSigning(
 async function handleGetSandboxCommitSigning(
   _request: Request,
   env: Env,
-  match: RegExpMatchArray,
+  _params: { id: string },
   ctx: RequestContext
 ): Promise<Response> {
-  const sessionId = match.groups?.id;
-  if (!sessionId) return noStore(error("Session ID required", 400));
-
   // The bridge runs on every supported SCM deployment. Signing is GitHub-only,
   // so other providers receive the explicit disabled state required for safe
   // unsigned execution instead of failing the session at the provider gate.
@@ -164,11 +162,9 @@ async function handleGetSandboxCommitSigning(
 async function handlePostSandboxCommitSigning(
   request: Request,
   env: Env,
-  match: RegExpMatchArray,
+  _params: { id: string },
   ctx: RequestContext
 ): Promise<Response> {
-  const sessionId = match.groups?.id;
-  if (!sessionId) return noStore(error("Session ID required", 400));
   if (resolveScmProviderFromEnv(env.SCM_PROVIDER) !== "github") {
     return noStore(error("Commit signing is disabled", 409));
   }
@@ -212,35 +208,28 @@ async function handlePostSandboxCommitSigning(
   }
 }
 
-export const commitSigningRoutes: Route[] = [
-  defineRoute(GITHUB_USER_OR_SERVICE_ROUTE, {
-    method: "GET",
-    path: "/commit-signing",
-    authorization: requirePermission("integrations.read"),
-    handler: handleGetCommitSigning,
-  }),
-  defineRoute(GITHUB_USER_OR_SERVICE_ROUTE, {
-    method: "PUT",
-    path: "/commit-signing",
-    authorization: requirePermission("commit_signing.manage"),
-    handler: handlePutCommitSigning,
-  }),
-  defineRoute(GITHUB_USER_OR_SERVICE_ROUTE, {
-    method: "DELETE",
-    path: "/commit-signing",
-    authorization: requirePermission("commit_signing.manage"),
-    handler: handleDeleteCommitSigning,
-  }),
-  defineRoute(SCM_AGNOSTIC_SANDBOX_ROUTE, {
-    method: "GET",
-    path: "/sessions/:id/commit-signing",
-    authorization: NO_AUTHORIZATION,
-    handler: handleGetSandboxCommitSigning,
-  }),
-  defineRoute(SCM_AGNOSTIC_SANDBOX_ROUTE, {
-    method: "POST",
-    path: "/sessions/:id/commit-signing",
-    authorization: NO_AUTHORIZATION,
-    handler: handlePostSandboxCommitSigning,
-  }),
-];
+const COMMIT_SIGNING_MANAGE = admit({
+  ...GITHUB_USER_OR_SERVICE_ROUTE,
+  authorization: requirePermission("commit_signing.manage"),
+});
+const SANDBOX = admit({ ...SCM_AGNOSTIC_SANDBOX_ROUTE, authorization: NO_AUTHORIZATION });
+
+export const commitSigningRoutes = new Hono<ControlPlaneHonoEnv>();
+
+commitSigningRoutes.get(
+  "/commit-signing",
+  admit({ ...GITHUB_USER_OR_SERVICE_ROUTE, authorization: requirePermission("integrations.read") }),
+  (c) => dispatch(c, handleGetCommitSigning)
+);
+commitSigningRoutes.put("/commit-signing", COMMIT_SIGNING_MANAGE, (c) =>
+  dispatch(c, handlePutCommitSigning)
+);
+commitSigningRoutes.delete("/commit-signing", COMMIT_SIGNING_MANAGE, (c) =>
+  dispatch(c, handleDeleteCommitSigning)
+);
+commitSigningRoutes.get("/sessions/:id/commit-signing", SANDBOX, (c) =>
+  dispatch(c, handleGetSandboxCommitSigning)
+);
+commitSigningRoutes.post("/sessions/:id/commit-signing", SANDBOX, (c) =>
+  dispatch(c, handlePostSandboxCommitSigning)
+);