Enforce multi-user ACL for sessions, settings, and workspaces.

Bridge UDS identity into DSH RPC via ALS, stamp/filter sessions, auto-provision per-empNo workspaces, and hide Settings/Add-workspace for roles that lack those permissions.

Co-authored-by: Cursor <cursoragent@cursor.com>

uds-auth/lib/session-acl.js

@@ -0,0 +1,119 @@
+/**
+ * Session ownership ACL — sessionId → empNo, persisted beside roles.json.
+ */
+import { readFile, writeFile, mkdir } from 'node:fs/promises'
+import { dirname, resolve } from 'node:path'
+import { getUserContext } from './context.js'
+import { ROLES, computePermissions } from './roles.js'
+
+export class SessionAclStore {
+  /**
+   * @param {{ ownersFile?: string }} options
+   */
+  constructor(options = {}) {
+    this._owners = new Map()
+    this._ownersFile = options.ownersFile ? resolve(options.ownersFile) : null
+    this._dirty = false
+    this._saveTimer = null
+  }
+
+  async init() {
+    if (!this._ownersFile) return
+    try {
+      const raw = await readFile(this._ownersFile, 'utf-8')
+      const data = JSON.parse(raw)
+      for (const [sessionId, empNo] of Object.entries(data.owners || {})) {
+        this._owners.set(String(sessionId), String(empNo))
+      }
+    } catch (err) {
+      if (err.code !== 'ENOENT') {
+        console.warn('[uds-auth:SessionAcl] load failed:', err.message)
+      }
+    }
+  }
+
+  _markDirty() {
+    this._dirty = true
+    if (this._saveTimer) return
+    this._saveTimer = setTimeout(() => { void this._save() }, 1500)
+  }
+
+  async _save() {
+    this._saveTimer = null
+    if (!this._dirty || !this._ownersFile) return
+    this._dirty = false
+    try {
+      await mkdir(dirname(this._ownersFile), { recursive: true })
+      await writeFile(
+        this._ownersFile,
+        JSON.stringify({
+          owners: Object.fromEntries(this._owners),
+          savedAt: new Date().toISOString(),
+        }, null, 2),
+        'utf-8',
+      )
+    } catch (err) {
+      console.warn('[uds-auth:SessionAcl] save failed:', err.message)
+    }
+  }
+
+  getOwner(sessionId) {
+    return this._owners.get(String(sessionId)) || null
+  }
+
+  setOwner(sessionId, empNo) {
+    if (!sessionId || !empNo) return
+    this._owners.set(String(sessionId), String(empNo))
+    this._markDirty()
+  }
+
+  /**
+   * Whether the current ALS identity may see this session.
+   * @param {string} sessionId
+   */
+  canViewSession(sessionId) {
+    const ctx = getUserContext()
+    const perms = ctx?.permissions || computePermissions(ctx?.role)
+    if (perms.canViewAllSessions) return true
+    const owner = this.getOwner(sessionId)
+    if (!owner) {
+      // Orphan historical sessions: super_admin only (canViewAllSessions already true above)
+      return false
+    }
+    return !!ctx?.empNo && owner === String(ctx.empNo)
+  }
+
+  /**
+   * Filter session list/search payloads shaped as { items: [...] }.
+   * @param {{ items?: Array<{ sessionId?: string }> }} value
+   */
+  filterListValue(value) {
+    if (!value || !Array.isArray(value.items)) return value
+    return {
+      ...value,
+      items: value.items.filter((row) => {
+        const id = row?.sessionId ?? row?.id
+        return id != null && this.canViewSession(id)
+      }),
+    }
+  }
+}
+
+/**
+ * Resolve identity for ACL checks (null = anonymous).
+ * @param {import('./roles.js').RolesStore} rolesStore
+ */
+export function identityFromAls(rolesStore) {
+  const ctx = getUserContext()
+  if (!ctx?.empNo) return null
+  const role = ctx.role || rolesStore.getRole(ctx.empNo)
+  return {
+    empNo: ctx.empNo,
+    role,
+    permissions: ctx.permissions || computePermissions(role),
+  }
+}
+
+export function isSuperLike(role) {
+  return role === ROLES.SUPER_ADMIN || role === ROLES.FALLBACK_ADMIN
+}