Add admin query endpoints: GetSession, GetGrant, ListGrants, ListSessions

[haasonsaas]

Summary

The API only supports create/mutate operations. There are no query endpoints for inspecting sessions, grants, approvals, or artifacts. This makes admin, audit, and debugging workflows impossible without direct database access.

Current state

• Proto and HTTP API define: CreateSession, RequestGrant, ApproveGrant, DenyGrant, RevokeGrant, RevokeSession, ExecuteGitHubProxy, RegisterBrowserRelay, UnwrapArtifact
• No Get or List endpoints for any entity
• No way to check grant status after issuance
• No way to enumerate active sessions per tenant

Required work

• Add proto messages and RPCs: GetSession, GetGrant, GetApproval, GetArtifact
• Add proto messages and RPCs: ListSessions, ListGrants, ListApprovals, ListArtifacts with pagination (cursor-based)
• Add filtering: by tenant, by state, by session, by time range
• Add corresponding JSON/HTTP endpoints
• Add repository interface methods: GetSession, ListSessions, ListGrants, etc.
• Implement in memory, Postgres, and (where applicable) Redis stores
• Add authorization: only allow tenant-scoped queries with valid session tokens (or a separate admin auth path)

Files

• proto/asb/v1/broker.proto — new messages and RPCs
• internal/core/types.go — new repository interface methods
• internal/app/service.go — new service methods
• internal/api/httpapi/server.go — new HTTP handlers
• internal/api/connectapi/server.go — new ConnectRPC handlers
• internal/store/*/ — implement new query methods

Priority

Medium — needed for admin UI and operational tooling.

🤖 Generated with Claude Code