$ErrorActionPreference='Stop'
$controllers=Get-ChildItem -Path apps/api/src -Recurse -Filter '*.controller.ts'
$findings=@()
foreach($file in $controllers){$text=Get-Content -LiteralPath $file.FullName -Raw;if($text -match "Controller\('api/v1/admin" -and $text -notmatch 'RequireSessionChannel'){ $findings+="$($file.FullName): admin controller lacks session-channel guard" };if($text -match "Controller\('api/v1/me" -and $text -notmatch 'RequireSessionChannel'){ $findings+="$($file.FullName): me controller lacks session-channel guard" }}
if($findings.Count){$findings|ForEach-Object{Write-Error $_};exit 1}
Write-Output "Permission scan passed for $($controllers.Count) controllers"