pnpm test currently fails locally in apps/gateway/src/__tests__/cross-user-isolation.test.ts due local PostgreSQL connection/schema state around the messages table; changed capabilities tests pass. No fleet-personas.spec flake encountered.
## Summary
- add `GET /api/federation/v1/capabilities` controller
- protect endpoint with `FederationAuthGuard` only (active grant is sufficient; no RBAC eval)
- derive `{ resources, excluded_resources, max_rows_per_query, supported_verbs }` from parsed grant scope
- register capabilities controller in `FederationModule`
Refs #462
## Verification
- `pnpm typecheck` — PASS
- `pnpm lint` — PASS
- `pnpm format:check` — PASS
- `pnpm --filter @mosaicstack/gateway test -- capabilities.controller.spec.ts` — PASS (5 tests)
- `~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` — PASS
- `~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted` — PASS
## Note
- `pnpm test` currently fails locally in `apps/gateway/src/__tests__/cross-user-isolation.test.ts` due local PostgreSQL connection/schema state around the `messages` table; changed capabilities tests pass. No `fleet-personas.spec` flake encountered.
RETROACTIVE REVIEW-OF-RECORD — APPROVE ON MERITS (#674 FED-M3-07 capabilities). Verified endpoint is FederationAuthGuard-protected, has no RBAC/DB/data query path, and derives resources/excluded_resources/max_rows_per_query/supported_verbs strictly from parsed grant scope / federation verb constants. Reviewer verification: capabilities.controller.spec 5/5 pass; gateway typecheck/lint pass; formatting check pass; PR CI was green at review time.
RETROACTIVE REVIEW-OF-RECORD — APPROVE ON MERITS (#674 FED-M3-07 capabilities). Verified endpoint is FederationAuthGuard-protected, has no RBAC/DB/data query path, and derives resources/excluded_resources/max_rows_per_query/supported_verbs strictly from parsed grant scope / federation verb constants. Reviewer verification: capabilities.controller.spec 5/5 pass; gateway typecheck/lint pass; formatting check pass; PR CI was green at review time.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
GET /api/federation/v1/capabilitiescontrollerFederationAuthGuardonly (active grant is sufficient; no RBAC eval){ resources, excluded_resources, max_rows_per_query, supported_verbs }from parsed grant scopeFederationModuleRefs #462
Verification
pnpm typecheck— PASSpnpm lint— PASSpnpm format:check— PASSpnpm --filter @mosaicstack/gateway test -- capabilities.controller.spec.ts— PASS (5 tests)~/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted— PASS~/.config/mosaic/tools/codex/codex-security-review.sh --uncommitted— PASSNote
pnpm testcurrently fails locally inapps/gateway/src/__tests__/cross-user-isolation.test.tsdue local PostgreSQL connection/schema state around themessagestable; changed capabilities tests pass. Nofleet-personas.specflake encountered.RETROACTIVE REVIEW-OF-RECORD — APPROVE ON MERITS (#674 FED-M3-07 capabilities). Verified endpoint is FederationAuthGuard-protected, has no RBAC/DB/data query path, and derives resources/excluded_resources/max_rows_per_query/supported_verbs strictly from parsed grant scope / federation verb constants. Reviewer verification: capabilities.controller.spec 5/5 pass; gateway typecheck/lint pass; formatting check pass; PR CI was green at review time.