fix(pat): close message replay to restricted tokens, filter builtin tools, reject non-object bodies

Message tail and the ASGI reconnect stream cannot tie a message to an
allowlist, so any token with a resource filter is refused there. The tools
listing now applies the allowlist to default and builtin rows as well. Token
creation answers 400 instead of 500 for a JSON body that is not an object.

docsgpt/api/pat/routes.py

@@ -113,7 +113,11 @@ class PersonalAccessTokens(Resource):
         if not auth_type_supports_pats():
             return _error("Personal access tokens are not available on this server", 403)
 
-        body = request.get_json(silent=True) or {}
+        body = request.get_json(silent=True)
+        if body is None:
+            body = {}
+        if not isinstance(body, dict):
+            return _error("Request body must be a JSON object", 400)
         name = body.get("name")
         if not isinstance(name, str) or not name.strip():
             return _error("name is required", 400)

docsgpt/api/pat/rules.py

@@ -53,6 +53,8 @@ def _rule(scope: Optional[str] = None, *ids: Locator, any_of: tuple[str, ...] =
     return Rule(scopes=scopes, family=family, ids=tuple(ids), **kwargs)
 
 
+_ALL_FAMILIES = ("agents", "sources", "prompts", "tools", "workflows")
+
 # Ids of other families that agent create/update accept in their JSON-or-form body.
 _AGENT_BODY_REFS = (
     ("sources", (BODY, "source")),
@@ -216,8 +218,9 @@ RULES: dict[tuple[str, str], Rule] = {
     ("/api/get_conversations", "GET"): _rule("conversations:read", blocked_by=("agents",)),
     ("/api/search_conversations", "GET"): _rule("conversations:read", blocked_by=("agents",)),
     ("/api/get_single_conversation", "GET"): _rule("conversations:read", blocked_by=("agents",)),
+    # A message cannot be tied to an allowlist from here, so any restricted token is kept out.
     ("/api/messages/<string:message_id>/tail", "GET"): _rule(
-        any_of=("conversations:read", "chat:run"), family=None
+        any_of=("conversations:read", "chat:run"), family=None, blocked_by=_ALL_FAMILIES
     ),
     ("/api/delete_conversation", "POST"): _rule("conversations:write", blocked_by=("agents",)),
     ("/api/delete_all_conversations", "GET"): _rule("conversations:write", blocked_by=("agents",)),