feat: org-level ACL audit overview (#292)

[schmug]

Summary

• Adds GET /api/v1/org/acl-overview — returns every mailbox with { email, acl_status, owner|null, members[] } so operators can audit fleet-wide access without inspecting R2 blobs by hand
• Adds a UI route at /acl-overview that groups mailboxes by domain, flags unscoped mailboxes with an amber badge (consistent with the /mailboxes page), and shows owner + member lists per mailbox
• 8 new tests cover scoped, unscoped, mixed fleets, backwards-compat (pre-Single trust boundary: anyone passing Access sees all mailboxes #27 no-ACL mailboxes), multiple members, and ACL-blob isolation

Closes #292

Authz model

Any CF-Access-admitted caller may call this endpoint — no org-admin role exists today. This is documented in the endpoint code comment and matches the existing GET /api/v1/org/overview policy. Consequence: owner and member emails of scoped mailboxes are visible to all admitted callers — acknowledged as an operator-oriented audit surface, not an end-user surface. A future RBAC/org-admin issue could narrow this.

Test plan

• node_modules/.bin/vitest run tests/routes/org-acl-overview.test.ts — 8 tests pass
• npm run typecheck — exit 0
• Full suite: node_modules/.bin/vitest run — 1087 passing, 0 failing (all pre-existing tests continue to pass)
• Navigate to /acl-overview in the SPA — table renders grouped by domain, unscoped mailboxes show amber "Unscoped" badge, scoped mailboxes show green "Scoped" badge with owner and members listed

Files changed (5)

File	Change
workers/index.ts	New GET /api/v1/org/acl-overview endpoint (30 lines)
app/services/api.ts	Add getAclOverview() typed API client method
app/routes.ts	Register /acl-overview route
app/routes/org-acl-overview.tsx	New UI route — table grouped by domain
tests/routes/org-acl-overview.test.ts	8 tests using in-memory R2 stub

Deferred

• Navigation link in Shell sidebar (not required by acceptance; avoids touching a 6th file beyond the auto-decompose threshold; easy follow-up)
• Future: narrow authz to an org-admin role once RBAC exists

https://claude.ai/code/session_0158NZ9vuCtZ8vUC627Ubm3a

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ais-hub	29a8e3f	Commit Preview URL Branch Preview URL	May 20 2026, 12:15 PM