Hub stage 6: blocking and cache actions on several servers

One endpoint, hub/servers/run (operate), runs a fixed set of actions on
the chosen servers in parallel with each server's admin token: add or
remove a domain in Blocked or Allowed, disable blocking for a time or
enable it, update block lists, replace the block list URLs, flush the
cache or delete a domain from it. Each server gets its own result and
the console offers Retry failed.

In "All servers", Blocking, Cache and Query Logs rows open this flow
instead of being disabled. The hub validates domains, minutes and the
server's list grammar (allow lists with !, switched-off lines with #)
and logs no URL list. Operators can now use the blocking switch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hub/routes.ts

@@ -1,7 +1,8 @@
 /*
 What each `/api/<path>` does and who may call it. `kind` says what it touches:
 `read` (no change), `write-one` (changes one server) and `write-all` (changes every server).
-A path that is not listed is refused. The app writes need `apps.write`.
+A path that is not listed is refused. The app writes need `apps.write`. `hub/servers/run` (blocking, Blocked/Allowed and cache on several
+servers at once) needs `operate`.
 
 The sections a server is managed from (stage 5) are listed by what the console calls. A
 write there goes to ONE server (`node=<id>`) with that server's admin token. Capabilities:
@@ -116,7 +117,7 @@ export const ROUTES: Record<string, Route> = {
   'dnsClient/resolve': readOne(),
   // Settings. `settings/get` (above) is not `perServer`: the header's blocking mark reads it without a node.
   'settings/getTsigKeyNames': readOne(),
-  'settings/set': writeOne('admin'),
+  'settings/set': writeOne('admin'), // see `effectiveRoute` for the blocking switch
   'settings/temporaryDisableBlocking': writeOne('operate'),
   'settings/forceUpdateBlockLists': writeOne('operate'),
   // Logs (no delete).
@@ -156,6 +157,8 @@ export const ROUTES: Record<string, Route> = {
   'hub/apps/import': writeAll('apps.write'),
   'hub/apps/run': writeAll('apps.write'),
   'hub/apps/upload': writeAll('apps.write'),
+  // The same change on several servers, outside Apps (servers-run.ts). One endpoint with a fixed list of actions.
+  'hub/servers/run': writeAll('operate'),
 }
 
 export function routeFor(apiPath: string): Route | undefined {
@@ -173,6 +176,15 @@ export function effectiveRoute(apiPath: string, params: Record<string, string>):
     const flag = (params.import ?? '').trim().toLowerCase()
     if (flag !== '' && flag !== 'false') return writeOne('admin')
   }
+  /*
+  The blocking switch is blocking, not server settings: a `settings/set` that carries nothing but
+  `enableBlocking` needs `operate`, as the temporary switch does. Any other field in the call
+  makes it the usual `admin` write. (`node` and `token` are the hub's own.)
+  */
+  if (apiPath === 'settings/set') {
+    const fields = Object.keys(params).filter((k) => k !== 'node' && k !== 'token')
+    if (fields.length === 1 && fields[0] === 'enableBlocking') return writeOne('operate')
+  }
   return routeFor(apiPath)
 }