feat: ship enterprise control and desktop governance

src/app/api/v1/audits/permission-logs/route.ts

@@ -0,0 +1,24 @@
+import { NextRequest } from "next/server";
+import { requireRequestSession } from "@/lib/boss-auth";
+import { jsonNoStore } from "@/lib/api-response";
+import { permissionAuditQueryFromSearchParams, queryPermissionAuditLogs, summarizePermissionAuditRisks } from "@/lib/boss-audit";
+import { readState } from "@/lib/boss-data";
+
+export async function GET(request: NextRequest) {
+  const session = await requireRequestSession(request);
+  if (!session) {
+    return jsonNoStore({ ok: false, message: "UNAUTHORIZED" }, { status: 401 });
+  }
+  if (session.role !== "highest_admin") {
+    return jsonNoStore({ ok: false, message: "FORBIDDEN" }, { status: 403 });
+  }
+
+  const state = await readState();
+  const query = permissionAuditQueryFromSearchParams(request.nextUrl.searchParams);
+  const result = queryPermissionAuditLogs(state.permissionAuditLogs, query);
+  return jsonNoStore({
+    ok: true,
+    ...result,
+    riskSummary: summarizePermissionAuditRisks(state),
+  });
+}