fix editor

bliss-cli/live-editor/route-editor.js

@@ -1,7 +1,14 @@
-function handler(req, res) {
-  const sql = require("db")("bliss").sql;
-  const kind = "route";
-  const artifact = sql.prepare("SELECT * FROM routes WHERE id = ?").get(req.params.id);
-  if (!artifact) return res.status(404).send("Route not found");
-  res.render("inspector/artifact_editor", { kind, artifact });
+// Read a route's source through the plumbing API rather than mounting the prime
+// db directly. The prime db is no longer attachable to other structures, and
+// going through /plumbing means this read is owner-checked: forwarding the
+// caller's session cookie, plumbing 404s any route in a structure they can't
+// see, so the live editor can only open what the user is already allowed to edit.
+async function handler(req, res) {
+  const base = `${req.protocol}://${req.get("host")}`;
+  const response = await fetch(`${base}/plumbing/routes/${req.params.id}`, {
+    headers: { cookie: req.headers.cookie || "" },
+  });
+  if (!response.ok) return res.status(response.status).send("Route not found");
+  const artifact = await response.json();
+  res.render("inspector/artifact_editor", { kind: "route", artifact });
 }