mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-16 01:50:47 +08:00
Unify admin-class workspace create and restore Add-workspace UI.
Give admin the same permissions as super/fallback, occupy directoryFlow at priority 1 so the button renders without colliding with the native picker, and inject uiWorkspace for pickDirectory. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
parent
060500360d
commit
91d2515205
9 changed files with 211 additions and 146 deletions
|
|
@ -60,7 +60,7 @@ describe('createSessionAccess', () => {
|
|||
assert.equal(canAccessSession('s-other', superAdmin), false)
|
||||
})
|
||||
|
||||
it('admin and user only see owned or own-workspace sessions by default', () => {
|
||||
it('admin-class sees all by default; user only owned or own-workspace sessions', () => {
|
||||
const { canAccessSession, canSeeAll } = makeAccess({
|
||||
's-owned': 'u1',
|
||||
's-peer': 'u2',
|
||||
|
|
@ -68,39 +68,48 @@ describe('createSessionAccess', () => {
|
|||
const admin = {
|
||||
empNo: 'u1',
|
||||
role: 'admin',
|
||||
permissions: computePermissions('admin'),
|
||||
permissions: computePermissions('admin', { viewAllSessions: true }),
|
||||
}
|
||||
const user = {
|
||||
empNo: 'u1',
|
||||
role: 'user',
|
||||
permissions: computePermissions('user'),
|
||||
}
|
||||
assert.equal(canSeeAll(admin), false)
|
||||
assert.equal(canSeeAll(admin), true)
|
||||
assert.equal(canSeeAll(user), false)
|
||||
assert.equal(admin.permissions.canToggleViewAllSessions, false)
|
||||
assert.equal(admin.permissions.canToggleViewAllSessions, true)
|
||||
assert.equal(user.permissions.canToggleViewAllSessions, false)
|
||||
|
||||
assert.equal(canAccessSession('s-owned', admin), true)
|
||||
assert.equal(canAccessSession('s-peer', admin), true)
|
||||
assert.equal(canAccessSession('s-in-u1', user), true)
|
||||
assert.equal(canAccessSession('s-cwd', user, { cwd: '/ws/u1/project' }), true)
|
||||
|
||||
assert.equal(canAccessSession('s-peer', admin), false)
|
||||
assert.equal(canAccessSession('s-in-u2', user), false)
|
||||
assert.equal(canAccessSession('s-shared', user), false)
|
||||
assert.equal(canAccessSession('s-cwd-peer', user, { cwd: '/ws/u2/x' }), false)
|
||||
})
|
||||
|
||||
it('admin cannot enable view-all even if preference flag is passed', () => {
|
||||
const { canAccessSession, canSeeAll } = makeAccess({ 's-peer': 'u2' })
|
||||
it('admin can turn off view-all via preference (same as super_admin)', () => {
|
||||
const store = new RolesStore()
|
||||
store._roles.set('op', ROLES.ADMIN)
|
||||
store.setViewAllSessions('op', false)
|
||||
const ownersMap = new Map([['s-peer', 'u2']])
|
||||
const access = createSessionAccess({
|
||||
sessionAcl: { getOwner: (id) => ownersMap.get(String(id)) || null },
|
||||
userWorkspaces: { get: () => null, isUserPath: () => false },
|
||||
getWorkspaceRoot: () => '/ws',
|
||||
getWorkspaceRegistry: () => ({ list: () => [] }),
|
||||
rolesStore: store,
|
||||
})
|
||||
const admin = {
|
||||
empNo: 'u1',
|
||||
empNo: 'op',
|
||||
role: 'admin',
|
||||
permissions: computePermissions('admin', { viewAllSessions: true }),
|
||||
}
|
||||
assert.equal(admin.permissions.canViewAllSessions, false)
|
||||
assert.equal(admin.permissions.canToggleViewAllSessions, false)
|
||||
assert.equal(canSeeAll(admin), false)
|
||||
assert.equal(canAccessSession('s-peer', admin), false)
|
||||
assert.equal(access.canSeeAll(admin), false)
|
||||
assert.equal(access.canAccessSession('s-peer', admin), false)
|
||||
assert.equal(store.resolvePermissions('op').canToggleViewAllSessions, true)
|
||||
})
|
||||
|
||||
it('missing owner does not deny when cwd is under user path', () => {
|
||||
|
|
@ -111,26 +120,45 @@ describe('createSessionAccess', () => {
|
|||
})
|
||||
|
||||
it('admin can see unowned channel/system sessions outside user-workspaces', () => {
|
||||
const { canAccessSession, isVisibleWorkspace } = makeAccess({})
|
||||
const store = new RolesStore()
|
||||
store._roles.set('u1', ROLES.ADMIN)
|
||||
store.setViewAllSessions('u1', false)
|
||||
const accessOff = createSessionAccess({
|
||||
sessionAcl: { getOwner: () => null },
|
||||
userWorkspaces: {
|
||||
get: () => null,
|
||||
isUserPath: () => false,
|
||||
},
|
||||
getWorkspaceRoot: () => '/ws',
|
||||
getWorkspaceRegistry: () => ({ list: () => [] }),
|
||||
rolesStore: store,
|
||||
})
|
||||
const admin = {
|
||||
empNo: 'u1',
|
||||
role: 'admin',
|
||||
permissions: computePermissions('admin'),
|
||||
permissions: computePermissions('admin', { viewAllSessions: false }),
|
||||
}
|
||||
const user = {
|
||||
empNo: 'u1',
|
||||
role: 'user',
|
||||
permissions: computePermissions('user'),
|
||||
}
|
||||
assert.equal(canAccessSession('ch-1', admin, { cwd: '/bots/whatsapp' }), true)
|
||||
assert.equal(canAccessSession('ch-1', user, { cwd: '/bots/whatsapp' }), false)
|
||||
assert.equal(canAccessSession('s-peer', admin, { cwd: '/ws/u2/x' }), false)
|
||||
assert.equal(accessOff.canAccessSession('ch-1', admin, { cwd: '/bots/whatsapp' }), true)
|
||||
assert.equal(accessOff.canAccessSession('ch-1', user, { cwd: '/bots/whatsapp' }), false)
|
||||
assert.equal(accessOff.canAccessSession('s-peer', admin, { cwd: '/ws/u2/x' }), false)
|
||||
|
||||
const access = makeAccess({ 'ch-owned': 'u2' })
|
||||
assert.equal(access.canAccessSession('ch-owned', admin, { cwd: '/bots/wa' }), false)
|
||||
const ownersMap = new Map([['ch-owned', 'u2']])
|
||||
const accessOwned = createSessionAccess({
|
||||
sessionAcl: { getOwner: (id) => ownersMap.get(String(id)) || null },
|
||||
userWorkspaces: { get: () => null, isUserPath: () => false },
|
||||
getWorkspaceRoot: () => '/ws',
|
||||
getWorkspaceRegistry: () => ({ list: () => [] }),
|
||||
rolesStore: store,
|
||||
})
|
||||
assert.equal(accessOwned.canAccessSession('ch-owned', admin, { cwd: '/bots/wa' }), false)
|
||||
|
||||
assert.equal(isVisibleWorkspace(admin, { id: 'bot-ws', path: '/bots/whatsapp' }), true)
|
||||
assert.equal(isVisibleWorkspace(user, { id: 'bot-ws', path: '/bots/whatsapp' }), false)
|
||||
assert.equal(accessOff.isVisibleWorkspace(admin, { id: 'bot-ws', path: '/bots/whatsapp' }), true)
|
||||
assert.equal(accessOff.isVisibleWorkspace(user, { id: 'bot-ws', path: '/bots/whatsapp' }), false)
|
||||
})
|
||||
|
||||
it('live rolesStore prefs override stale identity.permissions', () => {
|
||||
|
|
@ -163,7 +191,7 @@ describe('createSessionAccess', () => {
|
|||
})
|
||||
|
||||
describe('RolesStore view-all prefs', () => {
|
||||
it('defaults on for super_admin and can be turned off', () => {
|
||||
it('defaults on for admin-class and can be turned off', () => {
|
||||
const store = new RolesStore()
|
||||
store._roles.set('boss', ROLES.SUPER_ADMIN)
|
||||
store._roles.set('op', ROLES.ADMIN)
|
||||
|
|
@ -179,24 +207,28 @@ describe('RolesStore view-all prefs', () => {
|
|||
store.setViewAllSessions('boss', true)
|
||||
assert.equal(store.resolvePermissions('boss').canViewAllSessions, true)
|
||||
|
||||
assert.throws(() => store.setViewAllSessions('op', true), (err) => err.code === 'forbidden_view_all_sessions')
|
||||
store._prefs.set('op', { viewAllSessions: true })
|
||||
assert.equal(store.resolvePermissions('op').canToggleViewAllSessions, true)
|
||||
assert.equal(store.resolvePermissions('op').canViewAllSessions, true)
|
||||
store.setViewAllSessions('op', false)
|
||||
assert.equal(store.resolvePermissions('op').canViewAllSessions, false)
|
||||
assert.equal(store.resolvePermissions('op').canToggleViewAllSessions, false)
|
||||
})
|
||||
|
||||
it('rejects view-all toggle for ordinary users and admins', () => {
|
||||
it('rejects view-all toggle for ordinary users', () => {
|
||||
const store = new RolesStore()
|
||||
store._roles.set('u1', ROLES.USER)
|
||||
store._roles.set('a1', ROLES.ADMIN)
|
||||
assert.throws(() => store.setViewAllSessions('u1', true), (err) => err.code === 'forbidden_view_all_sessions')
|
||||
assert.throws(() => store.setViewAllSessions('a1', true), (err) => err.code === 'forbidden_view_all_sessions')
|
||||
})
|
||||
|
||||
it('lets admin, super_admin, and fallback_admin create workspaces', () => {
|
||||
assert.equal(computePermissions(ROLES.SUPER_ADMIN).canCreateWorkspace, true)
|
||||
assert.equal(computePermissions(ROLES.FALLBACK_ADMIN).canCreateWorkspace, true)
|
||||
assert.equal(computePermissions(ROLES.ADMIN).canCreateWorkspace, true)
|
||||
it('admin-class roles share create-workspace and manage-users permissions', () => {
|
||||
for (const role of [ROLES.SUPER_ADMIN, ROLES.FALLBACK_ADMIN, ROLES.ADMIN]) {
|
||||
const p = computePermissions(role, { viewAllSessions: true })
|
||||
assert.equal(p.canCreateWorkspace, true)
|
||||
assert.equal(p.canManageUsers, true)
|
||||
assert.equal(p.canAccessSettings, true)
|
||||
assert.equal(p.canToggleViewAllSessions, true)
|
||||
assert.equal(p.canViewAllSessions, true)
|
||||
}
|
||||
assert.equal(computePermissions(ROLES.USER).canCreateWorkspace, false)
|
||||
assert.equal(computePermissions(ROLES.USER).canManageUsers, false)
|
||||
})
|
||||
})
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue