feat(server-s3): one Linux user per account (S3) — experimental
Server mode can now run each account as its own Linux user (ah-<name>) when `agenthub server install-system` has set S3 up. The dashboard reaches a member only through sudo -u / write-as / pane-launch, reads a member's files only through owner- and type-checked opens, and hooks are authenticated by peer uid. Local mode and server mode without S3 are unchanged. EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not yet been verified on a real install with real member accounts, sudo or a real Codex login. Do not offer it to real users yet. - S3 core: provisioning, per-member tmux servers, the proxy key gateway, shared tools in /opt, dropped capabilities for children (P0–P5) - P4: plan and quota per member home - P6: ~/.claude.json seed; opt-in plugin baseline installed as the member; managed-settings spike script (not run) - P7: Codex account pool (`agenthub accounts add --tool codex`) - Roles merged with main's admin / analyst / developer: analysts write only their own rows, under S3 as well - Per-account prefs: one implementation (Chat UI + onboarding) - Security reviews F1–F49 (five rounds), each fix with a regression test: symlink/TOCTOU-safe member reads, no host writes in a member home, credentials and the data dir never served, owner and folder account must agree, pane tokens bound to the pane's uid, bounded sudo/tmux/git calls and member reads (no hang or crash from a member), async route rejections answer 500 instead of exiting - Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box); client 1162/1162; tsc clean; headers check passes. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,150 @@
|
||||
/**
|
||||
* @file server-mode-leaks.test.js
|
||||
* @description Server mode (S3 plan, P0): a member cannot read the host's AI
|
||||
* tool config files through `/api/ai-tools/:id/config[/:index]`, and the
|
||||
* member-readable `/api/cc-config/{skills,commands}` list project items only
|
||||
* from the member's own workspaces — never another user's folder, nor the
|
||||
* dashboard's own working directory when no `cwd` is given.
|
||||
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
||||
*/
|
||||
|
||||
const { describe, it, before, after } = require("node:test");
|
||||
const assert = require("node:assert/strict");
|
||||
const path = require("node:path");
|
||||
const fs = require("node:fs");
|
||||
const os = require("node:os");
|
||||
|
||||
const TMP = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "server-mode-leaks-")));
|
||||
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
|
||||
process.env.DASHBOARD_LIVENESS_PROBE = "0";
|
||||
process.env.LANES_ROOT = path.join(TMP, "lanes");
|
||||
// The user-scope skills come from CLAUDE_HOME — keep it out of the real one.
|
||||
process.env.CLAUDE_HOME = path.join(TMP, "claude-home");
|
||||
|
||||
const { createApp, startServer } = require("../index");
|
||||
const { db } = require("../db");
|
||||
const auth = require("../lib/auth");
|
||||
|
||||
let server;
|
||||
let BASE;
|
||||
const MIA_DIR = path.join(TMP, "w", "mia");
|
||||
const MAX_DIR = path.join(TMP, "w", "max");
|
||||
|
||||
function writeSkill(dir, name) {
|
||||
const d = path.join(dir, ".claude", "skills", name);
|
||||
fs.mkdirSync(d, { recursive: true });
|
||||
fs.writeFileSync(path.join(d, "SKILL.md"), `---\nname: ${name}\n---\nbody\n`);
|
||||
}
|
||||
|
||||
function writeCommand(dir, name) {
|
||||
const d = path.join(dir, ".claude", "commands");
|
||||
fs.mkdirSync(d, { recursive: true });
|
||||
fs.writeFileSync(path.join(d, `${name}.md`), "do it\n");
|
||||
}
|
||||
|
||||
async function call(p, cookie) {
|
||||
const res = await fetch(BASE + p, { headers: cookie ? { cookie } : {} });
|
||||
return { status: res.status, body: await res.json().catch(() => null) };
|
||||
}
|
||||
|
||||
async function login(username, password) {
|
||||
const res = await fetch(BASE + "/api/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username, password }),
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
return res.headers.get("set-cookie").split(";")[0];
|
||||
}
|
||||
|
||||
const names = (r) => (r.body?.items || []).map((i) => i.name);
|
||||
|
||||
before(async () => {
|
||||
writeSkill(MIA_DIR, "mia-skill");
|
||||
writeSkill(MAX_DIR, "max-skill");
|
||||
writeCommand(MAX_DIR, "max-cmd");
|
||||
server = await startServer(createApp(), 0);
|
||||
BASE = `http://127.0.0.1:${server.address().port}`;
|
||||
const mia = await auth.createUser("mia", "member-pass-1", "developer");
|
||||
const max = await auth.createUser("max", "member-pass-2", "developer");
|
||||
await auth.createUser("boss", "admin-pass-1", "admin");
|
||||
const lane = db.prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES (?, 'claude', ?)");
|
||||
lane.run(MIA_DIR, mia.id);
|
||||
lane.run(MAX_DIR, max.id);
|
||||
process.env.AGENTHUB_MODE = "server";
|
||||
});
|
||||
|
||||
after(() => {
|
||||
delete process.env.AGENTHUB_MODE;
|
||||
server?.close();
|
||||
fs.rmSync(TMP, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("server mode: AI tool config files are staff-only", () => {
|
||||
for (const p of [
|
||||
"/api/ai-tools/claude/config",
|
||||
"/api/ai-tools/claude/config/0",
|
||||
"/api/AI-Tools/claude/Config/0",
|
||||
"/api/ai-tools/claude/%63onfig/0",
|
||||
"/api/ai-tools//claude/config/0",
|
||||
]) {
|
||||
it(`refuses a member ${p}`, async () => {
|
||||
const r = await call(p, await login("mia", "member-pass-1"));
|
||||
assert.equal(r.status, 403);
|
||||
assert.equal(r.body.error.code, "EADMIN");
|
||||
});
|
||||
}
|
||||
|
||||
it("still lets an admin reach it", async () => {
|
||||
const r = await call("/api/ai-tools/claude/config", await login("boss", "admin-pass-1"));
|
||||
assert.notEqual(r.status, 403);
|
||||
});
|
||||
|
||||
it("keeps the rest of /api/ai-tools open to a member", async () => {
|
||||
const r = await call("/api/ai-tools", await login("mia", "member-pass-1"));
|
||||
assert.equal(r.status, 200);
|
||||
});
|
||||
});
|
||||
|
||||
describe("server mode: a member's skills/commands come from their own workspaces", () => {
|
||||
it("lists the project skills of the member's own workspace", async () => {
|
||||
const mia = await login("mia", "member-pass-1");
|
||||
const r = await call(`/api/cc-config/skills?cwd=${encodeURIComponent(MIA_DIR)}`, mia);
|
||||
assert.equal(r.status, 200);
|
||||
assert.ok(names(r).includes("mia-skill"));
|
||||
});
|
||||
|
||||
it("refuses another user's folder (skills and commands)", async () => {
|
||||
const mia = await login("mia", "member-pass-1");
|
||||
for (const kind of ["skills", "commands"]) {
|
||||
const r = await call(`/api/cc-config/${kind}?cwd=${encodeURIComponent(MAX_DIR)}`, mia);
|
||||
assert.equal(r.status, 403, kind);
|
||||
assert.equal(r.body.error.code, "EFOLDER");
|
||||
assert.ok(!JSON.stringify(r.body).includes("max-"));
|
||||
}
|
||||
});
|
||||
|
||||
it("refuses a path that walks out of the member's folder", async () => {
|
||||
const mia = await login("mia", "member-pass-1");
|
||||
const sneaky = path.join(MIA_DIR, "..", "max");
|
||||
const r = await call(`/api/cc-config/skills?cwd=${encodeURIComponent(sneaky)}`, mia);
|
||||
assert.equal(r.status, 403);
|
||||
});
|
||||
|
||||
it("lists no project items without a cwd (never the dashboard's own folder)", async () => {
|
||||
const mia = await login("mia", "member-pass-1");
|
||||
const r = await call("/api/cc-config/skills?scope=project", mia);
|
||||
assert.equal(r.status, 200);
|
||||
assert.deepEqual(r.body.items, []);
|
||||
const all = await call("/api/cc-config/commands", mia);
|
||||
assert.equal(all.status, 200);
|
||||
assert.ok(all.body.items.every((i) => i.scope === "user"));
|
||||
});
|
||||
|
||||
it("leaves an admin free to name any folder", async () => {
|
||||
const boss = await login("boss", "admin-pass-1");
|
||||
const r = await call(`/api/cc-config/skills?cwd=${encodeURIComponent(MAX_DIR)}`, boss);
|
||||
assert.equal(r.status, 200);
|
||||
assert.ok(names(r).includes("max-skill"));
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user