From a64ef3c3cb0ba8d96faf122c25eb75bcb1a2ab1e Mon Sep 17 00:00:00 2001
From: os-zhuang <jack@objectstack.ai>
Date: Fri, 26 Jun 2026 11:15:41 +0800
Subject: [PATCH] fix(runtime): accept integer ai_access (Turso) in the AI-seat
 synthesis
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sys_user.ai_access reads back as integer 1 on Turso/libSQL (sqlite booleans),
but the seat synthesis checked `=== true` (boolean) — so `1 !== true` and a
SEATED user got no `ai_seat` -> /ai/agents=[] under enforce. The memory driver
returns a JS boolean, which masked it in local testing. Caught on a real
Turso-backed staging env (the env creator was seated yet denied).

Accept `true | 1 | '1'` in both synthesis points: resolveExecutionContext (the
gate) and plugin-hono-server data-route resolveCtx.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packages/plugins/plugin-hono-server/src/hono-plugin.ts     | 4 +++-
 packages/runtime/src/security/resolve-execution-context.ts | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/plugins/plugin-hono-server/src/hono-plugin.ts b/packages/plugins/plugin-hono-server/src/hono-plugin.ts
index 7b307c74e9..b6a3e7507c 100644
--- a/packages/plugins/plugin-hono-server/src/hono-plugin.ts
+++ b/packages/plugins/plugin-hono-server/src/hono-plugin.ts
@@ -509,7 +509,9 @@ export class HonoServerPlugin implements Plugin {
                             'sys_user',
                             { where: { id: userId }, limit: 1, ...sysCtx } as any,
                         ).catch(() => []);
-                        if ((uRows?.[0] as any)?.ai_access === true) permissions.push('ai_seat');
+                        // Turso returns sqlite booleans as 1/0; memory driver as boolean.
+                        const aiAccess = (uRows?.[0] as any)?.ai_access;
+                        if (aiAccess === true || aiAccess === 1 || aiAccess === '1') permissions.push('ai_seat');
                     } catch {
                         /* no ai_access column / query failed → no seat (safe) */
                     }
diff --git a/packages/runtime/src/security/resolve-execution-context.ts b/packages/runtime/src/security/resolve-execution-context.ts
index 1aef758aaa..0ea1decdcd 100644
--- a/packages/runtime/src/security/resolve-execution-context.ts
+++ b/packages/runtime/src/security/resolve-execution-context.ts
@@ -414,7 +414,11 @@ export async function resolveExecutionContext(opts: ResolveOptions): Promise<Exe
   // Guarded (tryFind swallows errors) → can only ever ADD access, never break auth.
   if (userId && !ctx.permissions!.includes('ai_seat')) {
     const seatRows = await tryFind(ql, 'sys_user', { id: userId }, 1);
-    if ((seatRows?.[0] as { ai_access?: unknown } | undefined)?.ai_access === true) {
+    // Turso/libSQL returns sqlite booleans as integer 1/0; the memory driver
+    // returns a JS boolean. Accept both (+ the stringified form) so the seat
+    // resolves regardless of the env's data driver.
+    const aiAccess = (seatRows?.[0] as { ai_access?: unknown } | undefined)?.ai_access;
+    if (aiAccess === true || aiAccess === 1 || aiAccess === '1') {
       ctx.permissions!.push('ai_seat');
     }
   }