feat: implement automation feature

apps/api/src/routes/course/content.ts

@@ -1,13 +1,47 @@
-import { ZCourseContentDelete, ZCourseContentUpdate } from '@cio/utils/validation/course';
-import { deleteCourseContent, updateCourseContent } from '@api/services/course/content';
+import { ZCourseContentDelete, ZCourseContentReorder, ZCourseContentUpdate } from '@cio/utils/validation/course';
+import { deleteCourseContent, reorderCourseContent, updateCourseContent } from '@api/services/course/content';
 
 import { Hono } from '@api/utils/hono';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { authMiddleware } from '@api/middlewares/auth';
+import { courseTeamMemberOrAutomationKeyMiddleware } from '@api/middlewares/course-team-member-or-automation-key';
 import { courseTeamMemberMiddleware } from '@api/middlewares/course-team-member';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { handleError } from '@api/utils/errors';
 import { zValidator } from '@hono/zod-validator';
 
 export const contentRouter = new Hono()
+  .put(
+    '/reorder',
+    authOrAutomationKeyMiddleware,
+    courseTeamMemberOrAutomationKeyMiddleware(['course:write']),
+    zValidator('json', ZCourseContentReorder),
+    async (c) => {
+      try {
+        const courseId = c.req.param('courseId')!;
+        const automationKey = c.get('automationKey');
+        const payload = c.req.valid('json');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'reorder_course_content');
+        }
+
+        const result = await reorderCourseContent(courseId, payload);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'reorder_course_content', {
+            courseId,
+            sectionCount: payload.sections?.length ?? 0,
+            itemCount: payload.items?.length ?? 0
+          });
+        }
+
+        return c.json({ success: true, data: result }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to reorder course content');
+      }
+    }
+  )
   .put('/', authMiddleware, courseTeamMemberMiddleware, zValidator('json', ZCourseContentUpdate), async (c) => {
     try {
       const courseId = c.req.param('courseId')!;

apps/api/src/routes/course/course.ts

@@ -11,6 +11,7 @@ import {
   ZCourseGetBySlugParam,
   ZCourseGetParam,
   ZCourseGetQuery,
+  ZCourseLandingPageUpdate,
   ZCourseProgressParam,
   ZCourseProgressQuery,
   ZCourseUpdate,
@@ -30,9 +31,11 @@ import { getCourseTags, replaceCourseTags } from '@api/services/tag';
 import { Hono } from '@api/utils/hono';
 import { attendanceRouter } from '@api/routes/course/attendance';
 import { authMiddleware } from '@api/middlewares/auth';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { cloneCourse } from '@api/services/course/clone';
 import { contentRouter } from '@api/routes/course/content';
 import { courseMemberMiddleware } from '@api/middlewares/course-member';
+import { courseTeamMemberOrAutomationKeyMiddleware } from '@api/middlewares/course-team-member-or-automation-key';
 import { courseTeamMemberMiddleware } from '@api/middlewares/course-team-member';
 import { createRateLimiter } from '@api/middlewares/rate-limiter';
 import { enrollInCourse } from '@api/services/course/invite';
@@ -51,8 +54,10 @@ import { orgAdminMiddleware } from '@api/middlewares/org-admin';
 import { orgMemberMiddleware } from '@api/middlewares/org-member';
 import { paymentRequestRouter } from '@api/routes/course/payment-request';
 import { presignRouter } from '@api/routes/course/presign';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { sectionRouter } from '@api/routes/course/section';
 import { submissionRouter } from '@api/routes/course/submission';
+import { updateCourseLandingPageService } from '@api/services/course/landing-page';
 import { zValidator } from '@hono/zod-validator';
 
 const enrollRateLimit = createRateLimiter({
@@ -233,6 +238,45 @@ export const courseRouter = new Hono()
       }
     }
   )
+  /**
+   * PUT /course/:courseId/landing-page
+   * Updates landing-page-facing course fields such as copy, media, pricing, and reviews.
+   * Requires authentication and course team membership, or an automation key with course write scope.
+   */
+  .put(
+    '/:courseId/landing-page',
+    authOrAutomationKeyMiddleware,
+    courseTeamMemberOrAutomationKeyMiddleware(['course:write']),
+    zValidator('param', ZCourseUpdateParam),
+    zValidator('json', ZCourseLandingPageUpdate),
+    async (c) => {
+      try {
+        const { courseId } = c.req.valid('param');
+        const payload = c.req.valid('json');
+        const automationKey = c.get('automationKey');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'update_course_landing_page');
+        }
+
+        const result = await updateCourseLandingPageService(courseId, payload);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'update_course_landing_page', { courseId });
+        }
+
+        return c.json(
+          {
+            success: true,
+            data: result
+          },
+          200
+        );
+      } catch (error) {
+        return handleError(c, error, 'Failed to update course landing page');
+      }
+    }
+  )
   /**
    * PUT /course/:courseId
    * Updates a course

apps/api/src/routes/course/exercise.ts

@@ -21,24 +21,43 @@ import { getGroupMemberIdByCourseAndProfile, isCourseTeamMemberOrOrgAdmin } from
 
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { courseMemberMiddleware } from '@api/middlewares/course-member';
+import { courseMemberOrAutomationKeyMiddleware } from '@api/middlewares/course-member-or-automation-key';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { createSubmissionService, listExerciseSubmissionsOverview } from '@api/services/submission';
 import { zValidator } from '@hono/zod-validator';
 
 export const exerciseRouter = new Hono()
   // Exercise CRUD routes
-  .get('/', authMiddleware, courseMemberMiddleware, zValidator('query', ZExerciseListQuery), async (c) => {
-    try {
-      const courseId = c.req.param('courseId')!;
-      const user = c.get('user')!;
-      const { lessonId, sectionId } = c.req.valid('query');
-      const exercises = await listExercises(courseId, { lessonId, sectionId }, user.id);
+  .get(
+    '/',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:read']),
+    zValidator('query', ZExerciseListQuery),
+    async (c) => {
+      try {
+        const courseId = c.req.param('courseId')!;
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
+        const { lessonId, sectionId } = c.req.valid('query');
 
-      return c.json({ success: true, data: exercises }, 200);
-    } catch (error) {
-      return handleError(c, error, 'Failed to list exercises');
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'list_course_exercises');
+        }
+
+        const exercises = await listExercises(courseId, { lessonId, sectionId }, user?.id);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'list_course_exercises', { courseId, lessonId, sectionId });
+        }
+
+        return c.json({ success: true, data: exercises }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to list exercises');
+      }
     }
-  })
+  )
   .get('/:exerciseId/submissions', authMiddleware, courseMemberMiddleware, async (c) => {
     try {
       const courseId = c.req.param('courseId')!;
@@ -51,28 +70,65 @@ export const exerciseRouter = new Hono()
       return handleError(c, error, 'Failed to fetch exercise submissions overview');
     }
   })
-  .get('/:exerciseId', authMiddleware, courseMemberMiddleware, zValidator('param', ZExerciseGetParam), async (c) => {
-    try {
-      const { exerciseId } = c.req.valid('param');
-      const user = c.get('user')!;
-      const exercise = await getExercise(exerciseId, undefined, user.id);
+  .get(
+    '/:exerciseId',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:read']),
+    zValidator('param', ZExerciseGetParam),
+    async (c) => {
+      try {
+        const { exerciseId } = c.req.valid('param');
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
 
-      return c.json({ success: true, data: exercise }, 200);
-    } catch (error) {
-      return handleError(c, error, 'Failed to fetch exercise');
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'get_course_exercise');
+        }
+
+        const exercise = await getExercise(exerciseId, undefined, user?.id);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'get_course_exercise', {
+            courseId: c.req.param('courseId')!,
+            exerciseId
+          });
+        }
+
+        return c.json({ success: true, data: exercise }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to fetch exercise');
+      }
     }
-  })
-  .post('/', authMiddleware, courseMemberMiddleware, zValidator('json', ZExerciseCreate), async (c) => {
-    try {
-      const data = c.req.valid('json');
+  )
+  .post(
+    '/',
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
+    zValidator('json', ZExerciseCreate),
+    async (c) => {
+      try {
+        const data = c.req.valid('json');
+        const automationKey = c.get('automationKey');
 
-      const exercise = await createExercise(data);
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_exercise');
+        }
 
-      return c.json({ success: true, data: exercise }, 201);
-    } catch (error) {
-      return handleError(c, error, 'Failed to create exercise');
+        const exercise = await createExercise(data);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_exercise', {
+            courseId: c.req.param('courseId')!,
+            exerciseId: exercise.id
+          });
+        }
+
+        return c.json({ success: true, data: exercise }, 201);
+      } catch (error) {
+        return handleError(c, error, 'Failed to create exercise');
+      }
     }
-  })
+  )
   /**
    * POST /course/:courseId/exercise/from-template
    * Creates an exercise from a template
@@ -80,14 +136,19 @@ export const exerciseRouter = new Hono()
    */
   .post(
     '/from-template',
-    authMiddleware,
-    courseMemberMiddleware,
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
     zValidator('json', ZExerciseFromTemplate),
     async (c) => {
       try {
         const courseId = c.req.param('courseId')!;
+        const automationKey = c.get('automationKey');
         const { lessonId, sectionId, order, templateId } = c.req.valid('json');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_exercise_from_template');
+        }
+
         // Fetch template from database
         const template = await fetchTemplateById(templateId);
         if (!template) {
@@ -100,6 +161,14 @@ export const exerciseRouter = new Hono()
 
         const exercise = await createExerciseFromTemplate(courseId, lessonId, sectionId, order, template);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_exercise_from_template', {
+            courseId,
+            exerciseId: exercise.id,
+            templateId
+          });
+        }
+
         return c.json({ success: true, data: exercise }, 201);
       } catch (error) {
         return handleError(c, error, 'Failed to create exercise from template');
@@ -108,8 +177,8 @@ export const exerciseRouter = new Hono()
   )
   .put(
     '/:exerciseId',
-    authMiddleware,
-    courseMemberMiddleware,
+    authOrAutomationKeyMiddleware,
+    courseMemberOrAutomationKeyMiddleware(['course:exercise:write']),
     zValidator('param', ZExerciseGetParam),
     zValidator('json', ZExerciseUpdate),
     async (c) => {
@@ -117,9 +186,14 @@ export const exerciseRouter = new Hono()
         const { exerciseId } = c.req.valid('param');
         const data = c.req.valid('json');
         const courseId = c.req.param('courseId')!;
-        const user = c.get('user')!;
+        const user = c.get('user');
+        const automationKey = c.get('automationKey');
 
-        if (data.isUnlocked !== undefined) {
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'update_course_exercise');
+        }
+
+        if (!automationKey && user && data.isUnlocked !== undefined) {
           const isAuthorized = await isCourseTeamMemberOrOrgAdmin(courseId, user.id);
 
           if (!isAuthorized) {
@@ -136,6 +210,10 @@ export const exerciseRouter = new Hono()
 
         const exercise = await updateExerciseService(exerciseId, data);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'update_course_exercise', { courseId, exerciseId });
+        }
+
         return c.json({ success: true, data: exercise }, 200);
       } catch (error) {
         return handleError(c, error, 'Failed to update exercise');

apps/api/src/routes/organization/automation.ts

@@ -1,5 +1,6 @@
 import {
   ZCreateOrganizationApiKey,
+  ZOrganizationAutomationUsageQuery,
   ZListOrganizationApiKeysQuery,
   ZOrganizationApiKeyParam
 } from '@cio/utils/validation/organization';
@@ -9,6 +10,7 @@ import {
   revokeOrganizationApiKeyService,
   rotateOrganizationApiKeyService
 } from '@api/services/organization/automation-key';
+import { getOrganizationAutomationUsageSummaryService } from '@api/services/organization/automation-usage';
 
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
@@ -17,6 +19,23 @@ import { orgAdminMiddleware } from '@api/middlewares/org-admin';
 import { zValidator } from '@hono/zod-validator';
 
 export const automationRouter = new Hono()
+  .get(
+    '/usage',
+    authMiddleware,
+    orgAdminMiddleware,
+    zValidator('query', ZOrganizationAutomationUsageQuery),
+    async (c) => {
+      try {
+        const orgId = c.req.header('cio-org-id')!;
+        const query = c.req.valid('query');
+        const usage = await getOrganizationAutomationUsageSummaryService(orgId, query.type);
+
+        return c.json({ success: true, data: usage }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to load organization automation usage');
+      }
+    }
+  )
   .get('/keys', authMiddleware, orgAdminMiddleware, zValidator('query', ZListOrganizationApiKeysQuery), async (c) => {
     try {
       const orgId = c.req.header('cio-org-id')!;

apps/api/src/routes/organization/course-import.ts

@@ -1,15 +1,24 @@
+import { ZAutomationDraftTagAssignment, ZAutomationDraftTagParam } from '@cio/utils/validation/tag';
 import {
+  ZCourseImportCourseParam,
   ZCourseImportDraftCreate,
+  ZCourseImportDraftCreateFromCourse,
   ZCourseImportDraftGetParam,
   ZCourseImportDraftPublish,
+  ZCourseImportDraftPublishToCourse,
   ZCourseImportDraftUpdate
 } from '@cio/utils/validation/course-import';
 import {
+  createCourseImportDraftFromCourseService,
   createCourseImportDraftService,
   getCourseImportDraftService,
+  getCourseImportStructureService,
   publishCourseImportDraftService,
+  publishCourseImportDraftToExistingCourseService,
+  updateCourseImportDraftTagsService,
   updateCourseImportDraftService
 } from '@api/services/course-import/course-import';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 
 import { Hono } from '@api/utils/hono';
 import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
@@ -18,6 +27,33 @@ import { orgAdminOrAutomationKeyMiddleware } from '@api/middlewares/org-admin-or
 import { zValidator } from '@hono/zod-validator';
 
 export const courseImportRouter = new Hono()
+  .get(
+    '/courses/:courseId/structure',
+    authOrAutomationKeyMiddleware,
+    orgAdminOrAutomationKeyMiddleware(['course_import:draft:read']),
+    zValidator('param', ZCourseImportCourseParam),
+    async (c) => {
+      try {
+        const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
+        const { courseId } = c.req.valid('param');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'get_course_structure');
+        }
+
+        const structure = await getCourseImportStructureService(orgId, courseId);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'get_course_structure', { courseId });
+        }
+
+        return c.json({ success: true, data: structure }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to fetch course structure');
+      }
+    }
+  )
   .post(
     '/drafts',
     authOrAutomationKeyMiddleware,
@@ -27,16 +63,56 @@ export const courseImportRouter = new Hono()
       try {
         const orgId = c.get('orgId')!;
         const actorId = c.get('actorId')!;
+        const automationKey = c.get('automationKey');
         const payload = c.req.valid('json');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_draft');
+        }
+
         const draft = await createCourseImportDraftService(orgId, actorId, payload);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_draft', { draftId: draft.id });
+        }
+
         return c.json({ success: true, data: draft }, 201);
       } catch (error) {
         return handleError(c, error, 'Failed to create course import draft');
       }
     }
   )
+  .post(
+    '/drafts/from-course',
+    authOrAutomationKeyMiddleware,
+    orgAdminOrAutomationKeyMiddleware(['course_import:draft:create']),
+    zValidator('json', ZCourseImportDraftCreateFromCourse),
+    async (c) => {
+      try {
+        const orgId = c.get('orgId')!;
+        const actorId = c.get('actorId')!;
+        const automationKey = c.get('automationKey');
+        const payload = c.req.valid('json');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'create_course_draft_from_course');
+        }
+
+        const draft = await createCourseImportDraftFromCourseService(orgId, actorId, payload);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'create_course_draft_from_course', {
+            draftId: draft.id,
+            courseId: payload.courseId
+          });
+        }
+
+        return c.json({ success: true, data: draft }, 201);
+      } catch (error) {
+        return handleError(c, error, 'Failed to create course draft from existing course');
+      }
+    }
+  )
   .get(
     '/drafts/:draftId',
     authOrAutomationKeyMiddleware,
@@ -45,16 +121,54 @@ export const courseImportRouter = new Hono()
     async (c) => {
       try {
         const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
         const { draftId } = c.req.valid('param');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'get_course_draft');
+        }
+
         const draft = await getCourseImportDraftService(orgId, draftId);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'get_course_draft', { draftId });
+        }
+
         return c.json({ success: true, data: draft }, 200);
       } catch (error) {
         return handleError(c, error, 'Failed to fetch course import draft');
       }
     }
   )
+  .put(
+    '/drafts/:draftId/tags',
+    authOrAutomationKeyMiddleware,
+    orgAdminOrAutomationKeyMiddleware(['course_import:draft:update']),
+    zValidator('param', ZAutomationDraftTagParam),
+    zValidator('json', ZAutomationDraftTagAssignment),
+    async (c) => {
+      try {
+        const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
+        const { draftId } = c.req.valid('param');
+        const payload = c.req.valid('json');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'tag_course_draft');
+        }
+
+        const draft = await updateCourseImportDraftTagsService(orgId, draftId, payload.tagNames, payload.mode);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'tag_course_draft', { draftId });
+        }
+
+        return c.json({ success: true, data: draft }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to update course draft tags');
+      }
+    }
+  )
   .put(
     '/drafts/:draftId',
     authOrAutomationKeyMiddleware,
@@ -64,11 +178,20 @@ export const courseImportRouter = new Hono()
     async (c) => {
       try {
         const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
         const { draftId } = c.req.valid('param');
         const payload = c.req.valid('json');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'update_course_draft');
+        }
+
         const draft = await updateCourseImportDraftService(orgId, draftId, payload);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'update_course_draft', { draftId });
+        }
+
         return c.json({ success: true, data: draft }, 200);
       } catch (error) {
         return handleError(c, error, 'Failed to update course import draft');
@@ -85,14 +208,58 @@ export const courseImportRouter = new Hono()
       try {
         const orgId = c.get('orgId')!;
         const actorId = c.get('actorId')!;
+        const automationKey = c.get('automationKey');
         const { draftId } = c.req.valid('param');
         const payload = c.req.valid('json');
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'publish_course_draft');
+        }
+
         const result = await publishCourseImportDraftService(orgId, actorId, draftId, payload);
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'publish_course_draft', {
+            draftId,
+            courseId: result.courseId
+          });
+        }
+
         return c.json({ success: true, data: result }, 201);
       } catch (error) {
         return handleError(c, error, 'Failed to publish course import draft');
       }
     }
+  )
+  .post(
+    '/drafts/:draftId/publish-existing-course',
+    authOrAutomationKeyMiddleware,
+    orgAdminOrAutomationKeyMiddleware(['course_import:draft:publish']),
+    zValidator('param', ZCourseImportDraftGetParam),
+    zValidator('json', ZCourseImportDraftPublishToCourse),
+    async (c) => {
+      try {
+        const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
+        const { draftId } = c.req.valid('param');
+        const payload = c.req.valid('json');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'publish_course_draft_to_existing_course');
+        }
+
+        const result = await publishCourseImportDraftToExistingCourseService(orgId, draftId, payload);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'publish_course_draft_to_existing_course', {
+            draftId,
+            courseId: payload.courseId
+          });
+        }
+
+        return c.json({ success: true, data: result }, 200);
+      } catch (error) {
+        return handleError(c, error, 'Failed to publish course draft to existing course');
+      }
+    }
   );

apps/api/src/routes/organization/organization.ts

@@ -37,15 +37,19 @@ import { TOrganization } from '@db/types';
 import { automationRouter } from '@api/routes/organization/automation';
 import { assetsRouter } from '@api/routes/organization/assets';
 import { authMiddleware } from '@api/middlewares/auth';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { authOrApiKeyMiddleware } from '@api/middlewares/auth-or-api-key';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { courseImportRouter } from '@api/routes/organization/course-import';
 import { getLMSExercisesService } from '@api/services/exercise';
 import { handleError } from '@api/utils/errors';
 import { inviteTeamMembers } from '@api/services/organization/invite';
 import { orgAdminMiddleware } from '@api/middlewares/org-admin';
 import { orgMemberMiddleware } from '@api/middlewares/org-member';
+import { orgMemberOrAutomationKeyMiddleware } from '@api/middlewares/org-member-or-automation-key';
 import { quizRouter } from '@api/routes/organization/quiz';
 import { tagsRouter } from '@api/routes/organization/tags';
+import { ROLE } from '@cio/utils/constants';
 import { zValidator } from '@hono/zod-validator';
 
 export const organizationRouter = new Hono()
@@ -287,17 +291,18 @@ export const organizationRouter = new Hono()
    */
   .get(
     '/courses',
-    authMiddleware,
-    orgMemberMiddleware,
+    authOrAutomationKeyMiddleware,
+    orgMemberOrAutomationKeyMiddleware(['course:read']),
     zValidator('query', ZGetOrganizationCoursesQuery),
     async (c) => {
       try {
-        const user = c.get('user')!;
+        const user = c.get('user');
         const orgId = c.get('orgId');
         const userRole = c.get('userRole');
+        const automationKey = c.get('automationKey');
         const { tags } = c.req.valid('query');
 
-        if (!orgId || userRole === null) {
+        if (!orgId) {
           return c.json(
             {
               success: false,
@@ -308,22 +313,25 @@ export const organizationRouter = new Hono()
           );
         }
 
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'list_org_courses');
+        }
+
         const tagSlugs = tags
           ?.split(',')
           .map((value) => value.trim())
           .filter(Boolean);
-
-        console.log('user', user);
-        console.log('userRole', userRole);
-        console.log('orgId', orgId);
-        console.log('tagSlugs', tagSlugs);
         const result = await getOrganizationCourses(
           orgId,
-          user.id,
-          userRole,
+          user?.id ?? automationKey?.createdByProfileId ?? '',
+          userRole ?? ROLE.ADMIN,
           tagSlugs && tagSlugs.length > 0 ? tagSlugs : undefined
         );
 
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'list_org_courses', { tags: tagSlugs });
+        }
+
         return c.json(
           {
             success: true,

apps/api/src/routes/organization/tags.ts

@@ -1,4 +1,5 @@
 import {
+  ZAutomationCourseTagAssignment,
   ZTagCreate,
   ZTagGroupCreate,
   ZTagGroupParam,
@@ -7,6 +8,7 @@ import {
   ZTagUpdate
 } from '@cio/utils/validation/tag';
 import {
+  assignTagsToCoursesByName,
   createOrganizationTag,
   createOrganizationTagGroup,
   getPublicOrganizationTagGroups,
@@ -18,8 +20,11 @@ import { ZGetCoursesBySiteName } from '@cio/utils/validation/organization';
 
 import { Hono } from '@api/utils/hono';
 import { authMiddleware } from '@api/middlewares/auth';
+import { authOrAutomationKeyMiddleware } from '@api/middlewares/auth-or-automation-key';
 import { handleError } from '@api/utils/errors';
 import { orgAdminMiddleware } from '@api/middlewares/org-admin';
+import { orgAdminOrAutomationKeyMiddleware } from '@api/middlewares/org-admin-or-automation-key';
+import { assertMcpAutomationUsageAllowed, recordMcpAutomationUsage } from '@api/services/organization/automation-usage';
 import { zValidator } from '@hono/zod-validator';
 
 export const tagsRouter = new Hono()
@@ -72,6 +77,39 @@ export const tagsRouter = new Hono()
       return handleError(c, error, 'Failed to create tag group');
     }
   })
+  .put(
+    '/courses/assign',
+    authOrAutomationKeyMiddleware,
+    orgAdminOrAutomationKeyMiddleware(['course:tag:write']),
+    zValidator('json', ZAutomationCourseTagAssignment),
+    async (c) => {
+      try {
+        const orgId = c.get('orgId')!;
+        const automationKey = c.get('automationKey');
+        const data = c.req.valid('json');
+
+        if (automationKey?.type === 'mcp') {
+          await assertMcpAutomationUsageAllowed(automationKey, 'tag_courses');
+        }
+
+        const result = await assignTagsToCoursesByName(orgId, data);
+
+        if (automationKey?.type === 'mcp') {
+          await recordMcpAutomationUsage(automationKey, 'tag_courses', { courseIds: data.courseIds });
+        }
+
+        return c.json(
+          {
+            success: true,
+            data: result
+          },
+          200
+        );
+      } catch (error) {
+        return handleError(c, error, 'Failed to assign course tags');
+      }
+    }
+  )
   .put(
     '/groups/:groupId',
     authMiddleware,