feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins
Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged) - Login for every page and API call (server/lib/auth.js, routes/auth.js, AuthGate), roles admin / analyst / member, accounts made only from the host's shell: `agenthub server setup|off|status`, `agenthub users list|add|passwd|role|disable|enable|assign|audit` - Rows are owned: a member sees only their own workspaces, sessions and what hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience); staff reads of a member's session are audited (server/lib/audit.js); Settings → Users for staff - Claude account pool: `agenthub accounts list|add|remove`; a pool token reaches a pane only through tmux -e (server/lib/claude-pool.js) - A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback, live pane only); writes pass an Origin check; named locks per member - docs/SERVER-MODE.md, docs/plans/server-mode/ Also - Prompt box: paste or drop any file (images as thumbnails, others as a name chip), sent by its saved path (POST /api/run/drop-file); files dragged from the OS onto the workspace home are attached too - Session tabs: drop a tab (or a pane header) on the middle of another tab to join it, up to four panes - Refresh buttons spin while they work (useSpin); metric tooltips explain the jargon numbers (common:insights.help.*) - Light palette retuned for contrast; IntelliJ Light theme removed - CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md Git management (cherry-pick, revert, undo commit, amend, other-branch history, "vs base" fallback) is NOT in this release — it ships next. Committed --no-verify: both full suites run on this exact tree (server 2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev; client 1086/1086), tsc clean, prettier applied by hand.
This commit is contained in:
@@ -0,0 +1,262 @@
|
||||
/**
|
||||
* @file scope.test.js
|
||||
* @description Server mode's row ownership helpers (server/lib/scope.js): a
|
||||
* member sees only sessions/agents/events/runs of the workspaces they own
|
||||
* (stamped `sessions.lane_id`, or a `dashboard_runs` row of theirs holding the
|
||||
* session), an admin/analyst/local request sees everything, and a member's
|
||||
* workspace folder stays inside `AGENTHUB_USERS_ROOT/<username>`.
|
||||
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
||||
*/
|
||||
|
||||
const { describe, it, before, after } = require("node:test");
|
||||
const assert = require("node:assert/strict");
|
||||
const path = require("node:path");
|
||||
const fs = require("node:fs");
|
||||
const os = require("node:os");
|
||||
|
||||
const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "scope-test-"));
|
||||
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
|
||||
|
||||
const { db } = require("../db");
|
||||
const scope = require("../lib/scope");
|
||||
|
||||
const member = (id, username = `u${id}`) => ({ user: { id, username, role: "member" } });
|
||||
const admin = { user: { id: 99, username: "boss", role: "admin" } };
|
||||
const analyst = { user: { id: 98, username: "ana", role: "analyst" } };
|
||||
const local = {};
|
||||
|
||||
before(() => {
|
||||
const lane = db.prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES (?, 'claude', ?)");
|
||||
lane.run("/w/one", 1); // id 1, user 1
|
||||
lane.run("/w/two", 2); // id 2, user 2
|
||||
lane.run("/w/host", null); // id 3, nobody's
|
||||
const s = db.prepare(
|
||||
"INSERT INTO sessions (id, name, status, cwd, lane_id) VALUES (?, ?, 'active', '/w', ?)"
|
||||
);
|
||||
s.run("s1", "one", 1);
|
||||
s.run("s2", "two", 2);
|
||||
s.run("s3", "host", 3);
|
||||
s.run("s-unstamped", "pending", null);
|
||||
s.run("s-free", "outside", null);
|
||||
db.prepare(
|
||||
"INSERT INTO dashboard_runs (id, session_id, mode, cwd, status, lane_id) VALUES ('agenthub-lane-1-2', 's-unstamped', 'interactive', '/w', 'running', 1)"
|
||||
).run();
|
||||
db.prepare(
|
||||
"INSERT INTO agents (id, session_id, name, type) VALUES ('a2', 's2', 'Main', 'main')"
|
||||
).run();
|
||||
});
|
||||
|
||||
after(() => fs.rmSync(TMP, { recursive: true, force: true }));
|
||||
|
||||
function visibleSessions(req) {
|
||||
const w = scope.sessionWhere(req);
|
||||
return db
|
||||
.prepare(`SELECT id FROM sessions WHERE ${w.where} ORDER BY id`)
|
||||
.all(...w.params)
|
||||
.map((r) => r.id);
|
||||
}
|
||||
|
||||
describe("scope", () => {
|
||||
it("shows a member only their own workspaces' sessions, unstamped ones included", () => {
|
||||
assert.deepEqual(visibleSessions(member(1)), ["s-unstamped", "s1"]);
|
||||
assert.deepEqual(visibleSessions(member(2)), ["s2"]);
|
||||
assert.deepEqual(visibleSessions(member(3)), []);
|
||||
});
|
||||
|
||||
it("shows admin, analyst and local mode everything", () => {
|
||||
for (const req of [admin, analyst, local]) {
|
||||
assert.equal(visibleSessions(req).length, 5);
|
||||
assert.equal(scope.canSeeLane(req, 2), true);
|
||||
assert.equal(scope.visibleLaneIds(req), null);
|
||||
}
|
||||
});
|
||||
|
||||
it("answers per-id checks for lanes, sessions, agents and runs", () => {
|
||||
const m = member(1);
|
||||
assert.equal(scope.canSeeLane(m, 1), true);
|
||||
assert.equal(scope.canSeeLane(m, 2), false);
|
||||
assert.equal(scope.canSeeLane(m, 3), false);
|
||||
assert.equal(scope.canSeeLane(m, 404), false);
|
||||
assert.equal(scope.canSeeSession(m, "s1"), true);
|
||||
assert.equal(scope.canSeeSession(m, "s-unstamped"), true);
|
||||
assert.equal(scope.canSeeSession(m, "s2"), false);
|
||||
assert.equal(scope.canSeeSession(m, "nope"), false);
|
||||
assert.equal(scope.canSeeAgent(m, "a2"), false);
|
||||
assert.equal(scope.canSeeAgent(member(2), "a2"), true);
|
||||
assert.equal(scope.canSeeRun(m, "agenthub-lane-1"), true);
|
||||
assert.equal(scope.canSeeRun(m, "agenthub-lane-1-2"), true);
|
||||
assert.equal(scope.canSeeRun(m, "agenthub-lane-2"), false);
|
||||
assert.equal(scope.canSeeRun(m, "agenthub-lane-12"), false);
|
||||
assert.deepEqual(scope.visibleLaneIds(m), [1]);
|
||||
});
|
||||
|
||||
it("scopes tables keyed by session id", () => {
|
||||
const w = scope.bySessionWhere(member(2));
|
||||
const rows = db.prepare(`SELECT id FROM agents WHERE ${w.where}`).all(...w.params);
|
||||
assert.deepEqual(
|
||||
rows.map((r) => r.id),
|
||||
["a2"]
|
||||
);
|
||||
const none = scope.bySessionWhere(member(1));
|
||||
assert.equal(
|
||||
db.prepare(`SELECT id FROM agents WHERE ${none.where}`).all(...none.params).length,
|
||||
0
|
||||
);
|
||||
});
|
||||
|
||||
it("keeps a member's workspace folder inside their own root", () => {
|
||||
process.env.AGENTHUB_USERS_ROOT = "/srv/agenthub/users";
|
||||
try {
|
||||
const m = member(1, "alice");
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/alice"), true);
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/alice/repo"), true);
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/alice/..x"), true);
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/bob"), false);
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/alice/../bob"), false);
|
||||
assert.equal(scope.folderAllowed(m, "/srv/agenthub/users/alicex"), false);
|
||||
assert.equal(scope.folderAllowed(admin, "/etc"), true);
|
||||
} finally {
|
||||
delete process.env.AGENTHUB_USERS_ROOT;
|
||||
}
|
||||
assert.equal(scope.folderAllowed(member(1), "/anywhere"), true);
|
||||
});
|
||||
|
||||
it("never lets a request choose the owner", () => {
|
||||
assert.equal(scope.ownerFor(member(7)), 7);
|
||||
assert.equal(scope.ownerFor(local), null);
|
||||
});
|
||||
});
|
||||
|
||||
describe("scopeGuard", () => {
|
||||
const run = (req) => {
|
||||
let status = 200;
|
||||
let passed = false;
|
||||
const res = {
|
||||
status(s) {
|
||||
status = s;
|
||||
return this;
|
||||
},
|
||||
json() {
|
||||
return this;
|
||||
},
|
||||
};
|
||||
scope.scopeGuard({ method: "GET", query: {}, body: {}, ...req }, res, () => (passed = true));
|
||||
return passed ? 200 : status;
|
||||
};
|
||||
const m1 = member(1).user;
|
||||
|
||||
it("refuses a member another user's row named in the path", () => {
|
||||
assert.equal(run({ user: m1, path: "/sessions/s1" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/sessions/s2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions/s2/transcript" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions/facets" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/agents/a2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/1/git/changes" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/workspaces/2/start", method: "POST" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/3" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/ensure", method: "POST" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/run/agenthub-lane-2-3" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/run/agenthub-lane-1" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/pricing/cost/s2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions/s%32" }), 404); // encoded "s2"
|
||||
});
|
||||
|
||||
it("refuses a member another user's row named in the query or body", () => {
|
||||
assert.equal(run({ user: m1, path: "/sessions", query: { lane: "2" } }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions", query: { lane: "1" } }), 200);
|
||||
assert.equal(run({ user: m1, path: "/agents", query: { session_ids: "s1,s2" } }), 404);
|
||||
assert.equal(run({ user: m1, path: "/run", method: "POST", body: { laneId: 2 } }), 404);
|
||||
assert.equal(
|
||||
run({ user: m1, path: "/lanes/1/start", method: "POST", body: { resumeSessionId: "s2" } }),
|
||||
404
|
||||
);
|
||||
assert.equal(run({ user: m1, path: "/lanes/1/git/changes", query: { session: "s2" } }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions", query: { lane: "1 OR 1" } }), 404);
|
||||
// `?session_id[]=…` / `?lane[]=…` arrive as arrays, and a JSON body may
|
||||
// carry objects: a member's request with one is refused outright.
|
||||
assert.equal(run({ user: m1, path: "/agents", query: { session_id: ["s2"] } }), 404);
|
||||
assert.equal(run({ user: m1, path: "/agents", query: { session_ids: ["s1", "s2"] } }), 404);
|
||||
assert.equal(run({ user: m1, path: "/sessions", query: { lane: ["1", "2"] } }), 404);
|
||||
assert.equal(
|
||||
run({ user: m1, path: "/agents", method: "POST", body: { session_id: { $ne: 1 } } }),
|
||||
404
|
||||
);
|
||||
});
|
||||
|
||||
it("lets admin, analyst and local requests through", () => {
|
||||
for (const user of [admin.user, analyst.user, undefined]) {
|
||||
assert.equal(run({ user, path: "/sessions/s2" }), 200);
|
||||
assert.equal(run({ user, path: "/run", method: "POST", body: { laneId: 2 } }), 200);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("broadcastAudience", () => {
|
||||
const m1 = member(1).user;
|
||||
const m2 = member(2).user;
|
||||
const reaches = (type, data, user) =>
|
||||
scope.audienceIncludes(scope.broadcastAudience(type, data), user);
|
||||
|
||||
it("sends a session's updates only to its owner (and staff)", () => {
|
||||
assert.equal(reaches("session_updated", { id: "s1" }, m1), true);
|
||||
assert.equal(reaches("session_updated", { id: "s1" }, m2), false);
|
||||
assert.equal(reaches("session_updated", { id: "s-unstamped" }, m1), true);
|
||||
assert.equal(reaches("new_event", { session_id: "s2" }, m2), true);
|
||||
assert.equal(reaches("new_event", { session_id: "s2" }, m1), false);
|
||||
assert.equal(reaches("agent_updated", { session_id: "s3" }, m1), false);
|
||||
assert.equal(reaches("new_event", { session_id: "s2" }, admin.user), true);
|
||||
assert.equal(reaches("new_event", { session_id: "s2" }, undefined), true);
|
||||
});
|
||||
|
||||
it("routes workspace messages by owner and keeps unknown types from members", () => {
|
||||
assert.equal(reaches("lane_update", { lane: { id: 1 } }, m1), true);
|
||||
assert.equal(reaches("lane_update", { lane: { id: 1 } }, m2), false);
|
||||
assert.equal(reaches("lane_update", { removed: 2 }, m1), true);
|
||||
assert.equal(reaches("lane_runtime", { laneId: 2 }, m1), false);
|
||||
assert.equal(reaches("alert_triggered", { session_id: null }, m1), false);
|
||||
assert.equal(reaches("alert_triggered", { session_id: null }, analyst.user), true);
|
||||
assert.equal(reaches("update_status", {}, m1), true);
|
||||
assert.equal(reaches("import.progress", {}, m1), false);
|
||||
assert.equal(reaches("some_future_type", {}, m1), false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("scopeGuard against the router's own leniency", () => {
|
||||
const run = (req) => {
|
||||
let status = 200;
|
||||
let passed = false;
|
||||
const res = {
|
||||
status(s) {
|
||||
status = s;
|
||||
return this;
|
||||
},
|
||||
json() {
|
||||
return this;
|
||||
},
|
||||
};
|
||||
scope.scopeGuard({ method: "GET", query: {}, body: {}, ...req }, res, () => (passed = true));
|
||||
return passed ? 200 : status;
|
||||
};
|
||||
const m1 = member(1).user;
|
||||
|
||||
it("matches case-insensitively and on decoded segments, like Express routes", () => {
|
||||
assert.equal(run({ user: m1, path: "/Lanes/2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/WORKSPACES/2/start" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/%32" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/Sessions/s2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "//sessions/s2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/run/%61genthub-lane-2" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/Pricing/Cost/s2" }), 404);
|
||||
});
|
||||
|
||||
it("reads a lane id the way SQLite will, and fails closed on odd ones", () => {
|
||||
assert.equal(run({ user: m1, path: "/lanes/2.0" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/02" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/01" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/lanes/1.0" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/1e1/sources" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/abc" }), 404);
|
||||
assert.equal(run({ user: m1, path: "/lanes/Ensure", method: "POST" }), 200);
|
||||
assert.equal(run({ user: m1, path: "/lanes/pipeline-stats" }), 200);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user