hansjone/oclaw
1
0
Fork 0
mirror of https://github.com/hansjone/oclaw.git synced 2026-10-16 15:30:47 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix local fallback_admin workspace list on HTTP.

Browse source 
Drop Secure cookies when not HTTPS so WS upgrades keep UDS_FALLBACK_*, and accept UDS_FALLBACK_UI for ACL identity.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-09-08 11:20:10 +08:00
parent 93526e7d45
commit 3e5c1f846e
2 changed files with 24 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
uds-auth/lib/dsh-acl.js
View file

@ -124,12 +124,14 @@ export function resolveIdentityFromRequestSync(req, deps) {
const empNo = parseCookie(cookie, 'PORTALSSOUser')
|| parseCookie(cookie, 'ZTEDPGSSOUser')
|| parseCookie(cookie, 'UDS_FALLBACK_USER')
|| parseCookie(cookie, 'UDS_FALLBACK_UI')
if (!empNo) return null
const token = parseCookie(cookie, 'PORTALSSOCookie')
|| parseCookie(cookie, 'ZTEDPGSSOCookie')
const isFallback = empNo === 'administrator'
|| !!parseCookie(cookie, 'UDS_FALLBACK_USER')
|| !!parseCookie(cookie, 'UDS_FALLBACK_UI')
// Bare portal empNo without token is NOT enough — otherwise logout/未登录
// still leaks workspace names via leftover SSO cookies on the WebSocket.
@ -157,6 +159,7 @@ export async function resolveIdentityFromRequest(req, deps) {
const empNo = parseCookie(cookie, 'PORTALSSOUser')
|| parseCookie(cookie, 'ZTEDPGSSOUser')
|| parseCookie(cookie, 'UDS_FALLBACK_USER')
|| parseCookie(cookie, 'UDS_FALLBACK_UI')
if (!empNo) return null
const { sessionStore, rolesStore } = deps
@ -171,6 +174,7 @@ export async function resolveIdentityFromRequest(req, deps) {
|| parseCookie(cookie, 'ZTEDPGSSOCookie')
const isFallback = empNo === 'administrator'
|| !!parseCookie(cookie, 'UDS_FALLBACK_USER')
|| !!parseCookie(cookie, 'UDS_FALLBACK_UI')
if (!userContext) {
// Require session, token, or fallback cookie — never empNo alone.