From 9d4d7a5346c90a1aa037d0dca13ebe217018783a Mon Sep 17 00:00:00 2001
From: Patrick Buckley <eous@users.noreply.github.com>
Date: Sat, 4 Apr 2026 22:19:03 -0700
Subject: [PATCH] fix: add admin.prompt_policies to valid permissions and
 builtin-admin role (#303)

Migration 031 created the prompt_policies table but never registered
admin.prompt_policies in _VALID_PERMISSIONS or granted it to the
builtin-admin role, causing 403 on all prompt-policy admin endpoints.
---
 tests/test_governance_endpoints.py            |  1 +
 tests/test_sdk_governance.py                  |  1 +
 turnstone/console/server.py                   |  1 +
 .../versions/032_prompt_policy_permission.py  | 39 +++++++++++++++++++
 4 files changed, 42 insertions(+)
 create mode 100644 turnstone/core/storage/migrations/versions/032_prompt_policy_permission.py

diff --git a/tests/test_governance_endpoints.py b/tests/test_governance_endpoints.py
index c79eb54d..d43f9b00 100644
--- a/tests/test_governance_endpoints.py
+++ b/tests/test_governance_endpoints.py
@@ -57,6 +57,7 @@ class _InjectAuthMiddleware(BaseHTTPMiddleware):
                     "admin.users",
                     "admin.orgs",
                     "admin.policies",
+                    "admin.prompt_policies",
                     "admin.skills",
                     "admin.usage",
                     "admin.audit",
diff --git a/tests/test_sdk_governance.py b/tests/test_sdk_governance.py
index e0e5d22f..d8eb13d3 100644
--- a/tests/test_sdk_governance.py
+++ b/tests/test_sdk_governance.py
@@ -64,6 +64,7 @@ class _InjectAuthMiddleware(BaseHTTPMiddleware):
                     "admin.roles",
                     "admin.orgs",
                     "admin.policies",
+                    "admin.prompt_policies",
                 }
             ),
         )
diff --git a/turnstone/console/server.py b/turnstone/console/server.py
index 66e4246c..d978db66 100644
--- a/turnstone/console/server.py
+++ b/turnstone/console/server.py
@@ -2125,6 +2125,7 @@ _VALID_PERMISSIONS = frozenset(
         "admin.roles",
         "admin.orgs",
         "admin.policies",
+        "admin.prompt_policies",
         "admin.skills",
         "admin.audit",
         "admin.usage",
diff --git a/turnstone/core/storage/migrations/versions/032_prompt_policy_permission.py b/turnstone/core/storage/migrations/versions/032_prompt_policy_permission.py
new file mode 100644
index 00000000..6f212ac7
--- /dev/null
+++ b/turnstone/core/storage/migrations/versions/032_prompt_policy_permission.py
@@ -0,0 +1,39 @@
+"""Grant admin.prompt_policies permission to builtin-admin role.
+
+Migration 031 created the prompt_policies table but did not add the
+corresponding permission to the builtin-admin role, causing 403 on
+/v1/api/admin/prompt-policies for all users.
+
+Revision ID: 032
+Revises: 031
+Create Date: 2026-04-05
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "032"
+down_revision = "031"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(
+        sa.text(
+            "UPDATE roles SET permissions = permissions || ',admin.prompt_policies' "
+            "WHERE role_id = 'builtin-admin' "
+            "AND permissions NOT LIKE '%admin.prompt_policies%'"
+        )
+    )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(
+        sa.text(
+            "UPDATE roles SET permissions = REPLACE(permissions, ',admin.prompt_policies', '') "
+            "WHERE role_id = 'builtin-admin'"
+        )
+    )