feat: enforce per-user module access in Makelore

src/lib/ai-modules.ts

@@ -1,5 +1,6 @@
 import type { LucideIcon } from 'lucide-react';
 import { Bot, Code2, Paintbrush, Sigma } from 'lucide-react';
+import type { ModuleAccess, ModuleAccessKey } from '../../shared/module-access';
 
 export const AI_MODULE_SELECTION_PATH = '/module-select';
 
@@ -56,7 +57,37 @@ export const aiModules: readonly AiModuleDefinition[] = [
   },
 ];
 
-export function getAiModuleForPath(pathname: string): AiModuleId {
+const moduleAccessKeyById: Record<AiModuleId, ModuleAccessKey> = {
+  programming: 'programming',
+  painting: 'design',
+  learning: 'learning',
+  robot: 'robot',
+};
+
+const PROGRAMMING_ROUTE_PREFIXES = [
+  '/project-config',
+  '/makelore-home',
+  '/kangaroo',
+  '/subagents',
+  '/chat',
+  '/deliverables',
+  '/workbench',
+  '/opencode-chat',
+  '/projects',
+  '/sessions',
+  '/models',
+  '/settings',
+] as const;
+
+function matchesRoute(pathname: string, route: string): boolean {
+  return pathname === route || pathname.startsWith(`${route}/`);
+}
+
+export function isAiModuleAllowed(moduleId: AiModuleId, access: ModuleAccess): boolean {
+  return access[moduleAccessKeyById[moduleId]];
+}
+
+export function getGuardedAiModuleForPath(pathname: string): AiModuleId | null {
   if (pathname === '/image-canvas'
     || pathname.startsWith('/image-canvas/')
     || pathname === '/image-prompts'
@@ -69,5 +100,12 @@ export function getAiModuleForPath(pathname: string): AiModuleId {
   if (pathname === '/learning' || pathname.startsWith('/learning/')) {
     return 'learning';
   }
-  return 'programming';
+  if (PROGRAMMING_ROUTE_PREFIXES.some((route) => matchesRoute(pathname, route))) {
+    return 'programming';
+  }
+  return null;
+}
+
+export function getAiModuleForPath(pathname: string): AiModuleId {
+  return getGuardedAiModuleForPath(pathname) ?? 'programming';
 }