memind_adm/server/skills/flag-resolver.mjs

/**
 * SkillFlagResolver — decides whether a skill invocation is permitted.
 *
 * Priority chain (highest → lowest):
 *   1. skill_flags WHERE scope_type='user'        AND scope_id=userId
 *   2. skill_flags WHERE scope_type='plan'        AND scope_id=planName
 *   3. skill_flags WHERE scope_type='caller_type' AND scope_id=callerType
 *   4. skills.enabled  (global on/off)
 *
 * Returns { allowed: boolean, reason?: string }
 */

export async function resolveSkillFlag(pool, skillId, { userId, planName, callerType } = {}) {
  // Fetch skill base enabled + any flag overrides in one query
  const [rows] = await pool.query(
    `SELECT scope_type, scope_id, enabled
     FROM adm_skill_flags
     WHERE skill_id = ?
     ORDER BY FIELD(scope_type, 'user', 'plan', 'caller_type', 'global')`,
    [skillId],
  );

  // Build override map: "user:alice" → true/false
  const overrides = new Map(rows.map((r) => [`${r.scope_type}:${r.scope_id ?? ''}`, r.enabled === 1]));

  // Walk priority chain
  if (userId !== undefined) {
    const key = `user:${userId}`;
    if (overrides.has(key)) {
      const enabled = overrides.get(key);
      return enabled
        ? { allowed: true }
        : { allowed: false, reason: 'skill_disabled_for_user' };
    }
  }

  if (planName) {
    const key = `plan:${planName}`;
    if (overrides.has(key)) {
      const enabled = overrides.get(key);
      return enabled
        ? { allowed: true }
        : { allowed: false, reason: 'skill_disabled_for_plan' };
    }
  }

  if (callerType) {
    const key = `caller_type:${callerType}`;
    if (overrides.has(key)) {
      const enabled = overrides.get(key);
      return enabled
        ? { allowed: true }
        : { allowed: false, reason: 'skill_disabled_for_caller_type' };
    }
  }

  // Fall through to global flag (already fetched with the skill row)
  const globalKey = 'global:';
  if (overrides.has(globalKey)) {
    const enabled = overrides.get(globalKey);
    return enabled ? { allowed: true } : { allowed: false, reason: 'skill_disabled_globally' };
  }

  // No override rows; rely on skills.enabled (fetched by caller)
  return { allowed: true };
}