registri dei piani in git (AI-OS#309)

Refs gitea:Adriano/AI-OS#310

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.superpowers/sdd/review-0f94b50..5f1d9f3.diff

@@ -0,0 +1,50 @@
+# Review package: 0f94b50..5f1d9f3
+
+## Commits
+5f1d9f3 feat: middleware limita editor ai percorsi contenuti
+
+## Files changed
+ src/middleware.ts | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+## Diff
+diff --git a/src/middleware.ts b/src/middleware.ts
+index fa8dcfd..bed89db 100644
+--- a/src/middleware.ts
++++ b/src/middleware.ts
+@@ -1,24 +1,34 @@
+ import { defineMiddleware } from 'astro:middleware';
+ import { getDb } from './lib/db';
+-import { getSessionUser, SESSION_COOKIE } from './lib/auth';
++import { getSessionUser, SESSION_COOKIE, canAccessAdminPath } from './lib/auth';
+ 
+ export const onRequest = defineMiddleware((context, next) => {
+   const { pathname } = context.url;
+   const isProtected =
+     (pathname.startsWith('/admin') && pathname !== '/admin/login') ||
+     pathname.startsWith('/api/admin');
+   if (!isProtected) return next();
+ 
+   const token = context.cookies.get(SESSION_COOKIE)?.value;
+   const user = token ? getSessionUser(getDb(), token) : null;
+   if (!user) {
+     if (pathname.startsWith('/api/')) {
+       return new Response(JSON.stringify({ error: 'Non autorizzato' }), {
+         status: 401, headers: { 'Content-Type': 'application/json' },
+       });
+     }
+     return context.redirect('/admin/login');
+   }
++
++  if (!canAccessAdminPath(user.role, pathname)) {
++    if (pathname.startsWith('/api/')) {
++      return new Response(JSON.stringify({ error: 'Permessi insufficienti' }), {
++        status: 403, headers: { 'Content-Type': 'application/json' },
++      });
++    }
++    return context.redirect('/admin/content');
++  }
++
+   context.locals.user = user;
+   return next();
+ });