hansjone/oclaw
1
0
Fork 0
mirror of https://github.com/hansjone/oclaw.git synced 2026-10-14 04:13:18 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Stop ACL from wiping local workspace partitions for fallback_admin.

Browse source 
workspace.follow no longer emits an empty baseline when ALS identity is missing, and administrator/fallback_admin always pass the workspace allow-list.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-09-08 11:33:46 +08:00
parent e479fe0833
commit 4a477f3513
1 changed files with 34 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

65
uds-auth/lib/dsh-acl.js
View file

@ -495,13 +495,25 @@ export function installDshAcl(ctx, {
// re-reading getUserContext() per frame would treat a logged-in super_admin // re-reading getUserContext() per frame would treat a logged-in super_admin
// as anonymous and filter away every pre-plugin workspace (sessions fall into // as anonymous and filter away every pre-plugin workspace (sessions fall into
// the ungrouped bucket). // the ungrouped bucket).
const canSeeAllWorkspaces = (identity) => {
if (!identity) return false
if (identity.permissions?.canViewAllSessions) return true
const role = identity.role || identity.userContext?.role
if (role === 'fallback_admin' || role === 'super_admin') return true
// Fallback cookie user is always administrator
if (String(identity.empNo || identity.userContext?.empNo || '') === 'administrator') return true
return false
}
const allowWorkspace = (identity, ws) => { const allowWorkspace = (identity, ws) => {
if (!identity?.empNo) return false if (!identity?.empNo && !identity?.userContext?.empNo) return false
if (identity.permissions?.canViewAllSessions) return true // super sees ALL workspaces if (canSeeAllWorkspaces(identity)) return true
const empNo = identity.empNo || identity.userContext?.empNo
const root = getWorkspaceRoot() const root = getWorkspaceRoot()
return userWorkspaces.isUserPath(identity.empNo, ws?.path, root) const wid = ws?.workspaceId ?? ws?.id
|| (userWorkspaces.get(identity.empNo)?.workspaceId return userWorkspaces.isUserPath(empNo, ws?.path, root)
&& String(userWorkspaces.get(identity.empNo).workspaceId) === String(ws?.workspaceId)) || (userWorkspaces.get(empNo)?.workspaceId
&& String(userWorkspaces.get(empNo).workspaceId) === String(wid))
} }
const filterBaseline = (identity, baseline) => { const filterBaseline = (identity, baseline) => {
@ -521,9 +533,10 @@ export function installDshAcl(ctx, {
return allowWorkspace(identity, frame.workspace) ? frame : null return allowWorkspace(identity, frame.workspace) ? frame : null
} }
if (frame.type === 'order') { if (frame.type === 'order') {
if (identity?.permissions?.canViewAllSessions) return frame if (canSeeAllWorkspaces(identity)) return frame
const empNo = identity?.empNo || identity?.userContext?.empNo
const allowed = new Set() const allowed = new Set()
const mapped = userWorkspaces.get(identity?.empNo)?.workspaceId const mapped = userWorkspaces.get(empNo)?.workspaceId
if (mapped != null) allowed.add(String(mapped)) if (mapped != null) allowed.add(String(mapped))
return { return {
...frame, ...frame,
@ -536,41 +549,31 @@ export function installDshAcl(ctx, {
const origFollow = wc.follow.bind(wc) const origFollow = wc.follow.bind(wc)
wc.follow = async function* (signal) { wc.follow = async function* (signal) {
let identity = getUserContext() let identity = getUserContext()
// Subscribe can race ahead of WS message-listener ALS bind (common right if (!identity?.empNo && !identity?.userContext?.empNo) {
// after fallback login / soft reconnect). Wait briefly before treating
// the stream as anonymous — otherwise every historical workspace is
// dropped and sessions collapse into 未分组.
if (!identity?.empNo) {
const deadline = Date.now() + 800 const deadline = Date.now() + 800
while (!identity?.empNo && Date.now() < deadline) { while (!identity?.empNo && !identity?.userContext?.empNo && Date.now() < deadline) {
await new Promise((r) => setTimeout(r, 40)) await new Promise((r) => setTimeout(r, 40))
identity = getUserContext() identity = getUserContext()
} }
} }
// Super / fallback: passthrough — never drop historical workspaces. // Missing ALS on long-lived follow generators is common. Emptying the
if (identity?.permissions?.canViewAllSessions // baseline here is what turned real partitions (harness/chatgpt) into
|| identity?.role === 'fallback_admin' // 未分组 for fallback_admin. Pass through; client hides UI when logged out.
|| identity?.role === 'super_admin') { if (!identity?.empNo && !identity?.userContext?.empNo) {
yield* origFollow(signal) yield* origFollow(signal)
return return
} }
if (!identity?.empNo) { if (canSeeAllWorkspaces(identity)) {
// Anonymous: hide all workspaces (do not leak names). yield* origFollow(signal)
for await (const frame of origFollow(signal)) {
if (frame?.type === 'baseline' && frame.value) {
yield { ...frame, value: { ...frame.value, items: [] } }
} else if (frame?.type === 'order') {
yield { ...frame, workspaceIds: [] }
} else if (frame?.type === 'upsert') {
/* drop */
} else {
yield frame
}
}
return return
} }
for await (const frame of origFollow(signal)) { for await (const frame of origFollow(signal)) {
const next = filterFrame(identity, frame) const live = getUserContext() || identity
if (canSeeAllWorkspaces(live)) {
yield frame
continue
}
const next = filterFrame(live, frame)
if (next) yield next if (next) yield next
} }
} }