chore: v2.8.15 — Oh My Pi login sharing, omp --allow-home, Markdown Preview default, first-login password
- omp-share.js: an admin's switch (S3) runs omp's own auth broker + gateway as the host on loopback; a member's omp pane reaches it as a scoped client keyed by its pane token (clients file = live omp panes only), runs on --model agenthub/<model>, never holds a credential. - omp catalog: --allow-home, so a workspace at the account's home keeps its sessions there (they were recorded under a temp dir and dropped). - Settings → Appearance → Open Markdown as: Preview (default) or Raw, for Files/Changes, the config viewer and a chat's file panel. - First-login password change and password rules, avatar URLs, Artifacts "Mine" includes installed shared skills/plugins, a member's own hook pages.
This commit is contained in:
+83
-32
@@ -25,7 +25,11 @@
|
||||
* workspace) — are an admin's only (`/users` is in ADMIN_WRITE_PREFIXES), each
|
||||
* needs the admin's own password again (`currentPassword`, `confirmPassword`),
|
||||
* an admin never demotes or disables themselves (ESELF), every change is
|
||||
* audited, and in local mode — no login to check — they all refuse.
|
||||
* audited, and in local mode — no login to check — they all refuse. A
|
||||
* password an admin gives another account (create, reset) may be anything
|
||||
* non-empty and makes that account pick its own at its next login
|
||||
* (`must_change_password`); an admin's own new password must pass every
|
||||
* rule, like Settings → Account's (`validateOwnPassword`, EWEAKPASSWORD).
|
||||
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
||||
*/
|
||||
|
||||
@@ -33,7 +37,6 @@ const { Router } = require("express");
|
||||
const { db, stmts } = require("../db");
|
||||
const auth = require("../lib/auth");
|
||||
const { listUsers } = auth;
|
||||
const { sessionWhere } = require("../lib/scope");
|
||||
const { listAudit, recordAccountChange } = require("../lib/audit");
|
||||
|
||||
const router = Router();
|
||||
@@ -54,42 +57,72 @@ const USAGE_COLS = [
|
||||
"long_cache_write_1h_tokens",
|
||||
];
|
||||
|
||||
/** $ and tokens a member's sessions spent since `sinceHour` (UTC `YYYY-MM-DDTHH`). */
|
||||
function usageSince(userId, sinceHour, rules) {
|
||||
// Which account each session belongs to — through its workspace, or a
|
||||
// dashboard run on one (server/lib/scope.js's sessionWhere, for every user at once).
|
||||
const OWNED_SESSIONS = `
|
||||
SELECT s.id AS session_id, l.owner_id AS uid
|
||||
FROM sessions s JOIN lanes l ON l.id = s.lane_id
|
||||
WHERE l.owner_id IS NOT NULL
|
||||
UNION
|
||||
SELECT s.id, l.owner_id
|
||||
FROM dashboard_runs r JOIN lanes l ON l.id = r.lane_id JOIN sessions s ON s.id = r.session_id
|
||||
WHERE l.owner_id IS NOT NULL`;
|
||||
|
||||
/** Map(user id → {cost, tokens}) every account's sessions spent since `sinceHour` (UTC `YYYY-MM-DDTHH`). */
|
||||
function usageSince(sinceHour, rules) {
|
||||
const { calculateCost } = require("./pricing");
|
||||
const w = sessionWhere({ user: { id: userId, role: "developer" } }, "s.id", "s.lane_id");
|
||||
const rows = db
|
||||
.prepare(
|
||||
`SELECT h.model, h.speed, h.inference_geo, h.service_tier,
|
||||
`WITH owned AS (${OWNED_SESSIONS})
|
||||
SELECT o.uid, h.model, h.speed, h.inference_geo, h.service_tier,
|
||||
${USAGE_COLS.map((c) => `SUM(h.${c}) AS ${c}`).join(", ")}
|
||||
FROM token_usage_hourly h JOIN sessions s ON s.id = h.session_id
|
||||
WHERE h.hour >= ? AND ${w.where}
|
||||
GROUP BY h.model, h.speed, h.inference_geo, h.service_tier`
|
||||
FROM token_usage_hourly h JOIN owned o ON o.session_id = h.session_id
|
||||
WHERE h.hour >= ?
|
||||
GROUP BY o.uid, h.model, h.speed, h.inference_geo, h.service_tier`
|
||||
)
|
||||
.all(sinceHour, ...w.params);
|
||||
const tokens = rows.reduce(
|
||||
(n, r) => n + r.input_tokens + r.output_tokens + r.cache_read_tokens + r.cache_write_tokens,
|
||||
0
|
||||
);
|
||||
return { cost: rows.length ? calculateCost(rows, rules).total_cost : 0, tokens };
|
||||
.all(sinceHour);
|
||||
const byUser = new Map();
|
||||
for (const r of rows) {
|
||||
if (!byUser.has(r.uid)) byUser.set(r.uid, []);
|
||||
byUser.get(r.uid).push(r);
|
||||
}
|
||||
const out = new Map();
|
||||
for (const [uid, list] of byUser) {
|
||||
const tokens = list.reduce(
|
||||
(n, r) => n + r.input_tokens + r.output_tokens + r.cache_read_tokens + r.cache_write_tokens,
|
||||
0
|
||||
);
|
||||
out.set(uid, { cost: calculateCost(list, rules).total_cost, tokens });
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
const hourAgo = (days) => new Date(Date.now() - days * 864e5).toISOString().slice(0, 13);
|
||||
|
||||
/** Map(key → n) from rows of `{k, n}`. */
|
||||
const counts = (rows) => new Map(rows.map((r) => [r.k, r.n]));
|
||||
|
||||
router.get("/", (_req, res) => {
|
||||
const rules = stmts.listPricing.all();
|
||||
const users = listUsers().map((u) => {
|
||||
const w = sessionWhere({ user: { id: u.id, role: "developer" } });
|
||||
return {
|
||||
...u,
|
||||
...auth.loginStats(u.id),
|
||||
workspaces: db.prepare("SELECT COUNT(*) AS n FROM lanes WHERE owner_id = ?").get(u.id).n,
|
||||
sessions: db.prepare(`SELECT COUNT(*) AS n FROM sessions WHERE ${w.where}`).get(...w.params)
|
||||
.n,
|
||||
last7d: usageSince(u.id, hourAgo(7), rules),
|
||||
last30d: usageSince(u.id, hourAgo(30), rules),
|
||||
};
|
||||
});
|
||||
// A fixed number of grouped queries, however many accounts there are.
|
||||
const logins = auth.allLoginStats();
|
||||
const workspaces = counts(
|
||||
db.prepare("SELECT owner_id AS k, COUNT(*) AS n FROM lanes GROUP BY owner_id").all()
|
||||
);
|
||||
const sessions = counts(
|
||||
db.prepare(`SELECT uid AS k, COUNT(*) AS n FROM (${OWNED_SESSIONS}) GROUP BY uid`).all()
|
||||
);
|
||||
const last7d = usageSince(hourAgo(7), rules);
|
||||
const last30d = usageSince(hourAgo(30), rules);
|
||||
const none = { cost: 0, tokens: 0 };
|
||||
const users = listUsers().map((u) => ({
|
||||
...u,
|
||||
...(logins.get(u.id) || { logins: 0, lastLoginAt: null }),
|
||||
workspaces: workspaces.get(u.id) || 0,
|
||||
sessions: sessions.get(u.id) || 0,
|
||||
last7d: last7d.get(u.id) || none,
|
||||
last30d: last30d.get(u.id) || none,
|
||||
}));
|
||||
res.json({ users });
|
||||
});
|
||||
|
||||
@@ -112,6 +145,7 @@ const STATUS = {
|
||||
EBADEMAIL: 400,
|
||||
ENOTOWNED: 409,
|
||||
EBADPASSWORD: 400,
|
||||
EWEAKPASSWORD: 400,
|
||||
EBADROLE: 400,
|
||||
EBADFIELD: 400,
|
||||
EREAUTH: 403,
|
||||
@@ -150,7 +184,9 @@ function accountChange(handler) {
|
||||
} catch (err) {
|
||||
const status = STATUS[err.code];
|
||||
if (!status) return res.status(500).json({ error: { message: err.message } });
|
||||
res.status(status).json({ error: { code: err.code, message: err.message } });
|
||||
res.status(status).json({
|
||||
error: { code: err.code, message: err.message, ...(err.rules && { rules: err.rules }) },
|
||||
});
|
||||
}
|
||||
};
|
||||
}
|
||||
@@ -196,7 +232,8 @@ router.post(
|
||||
"/",
|
||||
accountChange(async (_req, body) => {
|
||||
const role = body.role === undefined ? "developer" : body.role;
|
||||
const user = await auth.createUser(body.username, body.password, role);
|
||||
// The admin's password is a starting one: the user picks their own first.
|
||||
const user = await auth.createUser(body.username, body.password, role, { mustChange: true });
|
||||
return { status: 201, user, action: `create ${user.username} (${user.role})` };
|
||||
})
|
||||
);
|
||||
@@ -226,7 +263,13 @@ router.patch(
|
||||
if (self && body.disabled) throw ESELF("you cannot disable yourself");
|
||||
}
|
||||
const disabledChange = body.disabled !== undefined && body.disabled !== Boolean(u.disabled);
|
||||
if (body.password !== undefined) auth.validatePassword(body.password);
|
||||
if (body.password !== undefined) {
|
||||
// Your own password: every rule. Someone else's: a starting one they replace.
|
||||
if (self) {
|
||||
auth.validateOwnPassword(body.password, u.username);
|
||||
await auth.assertNotCurrent(u.id, body.password);
|
||||
} else auth.validatePassword(body.password);
|
||||
}
|
||||
if (body.signOut !== undefined && body.signOut !== true) {
|
||||
throw Object.assign(new Error("signOut: true"), { code: "EBADFIELD" });
|
||||
}
|
||||
@@ -265,7 +308,7 @@ router.patch(
|
||||
// the login they are doing it from.
|
||||
const keepToken = self ? auth.cookieToken(req) : undefined;
|
||||
if (body.password !== undefined) {
|
||||
await auth.setPassword(u.username, body.password, { keepToken });
|
||||
await auth.setPassword(u.username, body.password, { keepToken, mustChange: !self });
|
||||
done.push("password reset");
|
||||
}
|
||||
if (body.signOut) {
|
||||
@@ -375,7 +418,15 @@ router.post(
|
||||
"/:id/password",
|
||||
accountChange(async (req, body) => {
|
||||
const u = target(req);
|
||||
await auth.setPassword(u.username, body.password);
|
||||
const self = u.id === req.user.id;
|
||||
if (self) {
|
||||
auth.validateOwnPassword(body.password, u.username);
|
||||
await auth.assertNotCurrent(u.id, body.password);
|
||||
}
|
||||
await auth.setPassword(u.username, body.password, {
|
||||
keepToken: self ? auth.cookieToken(req) : undefined,
|
||||
mustChange: !self,
|
||||
});
|
||||
return { user: auth.publicUser(u), action: `${u.username}: password reset` };
|
||||
})
|
||||
);
|
||||
|
||||
Reference in New Issue
Block a user