Make session visibility preference-driven and keep system-channel ACL separate.

Super/fallback can toggle view-all (default on); admin/user stay own-only while still seeing unowned system sessions. Add restore/prune helpers so empty-shell cleanup is explicit and recoverable.

uds-auth/test/session-access.test.js

@@ -1,6 +1,7 @@
 import { describe, it } from 'node:test'
 import assert from 'node:assert/strict'
 import { createSessionAccess } from '../lib/dsh-acl.js'
+import { computePermissions, RolesStore, ROLES } from '../lib/roles.js'
 
 function makeAccess(owners = {}) {
   const ownersMap = new Map(Object.entries(owners))
@@ -38,25 +39,28 @@ function makeAccess(owners = {}) {
 }
 
 describe('createSessionAccess', () => {
-  it('super_admin and administrator see all sessions', () => {
-    const { canAccessSession, canSeeAll } = makeAccess({ 's-other': 'u2' })
-    const superAdmin = {
-      empNo: 'boss',
-      role: 'super_admin',
-      permissions: { canViewAllSessions: true },
-    }
-    const fallback = {
-      empNo: 'administrator',
-      role: 'fallback_admin',
-      permissions: { canViewAllSessions: true },
-    }
+  it('super/fallback see all by default via rolesStore prefs (default on)', () => {
+    const store = new RolesStore()
+    store._roles.set('boss', ROLES.SUPER_ADMIN)
+    const { canAccessSession, canSeeAll } = createSessionAccess({
+      sessionAcl: { getOwner: () => 'u2' },
+      userWorkspaces: { get: () => null, isUserPath: () => false },
+      getWorkspaceRoot: () => '/ws',
+      getWorkspaceRegistry: () => ({ list: () => [] }),
+      rolesStore: store,
+    })
+    const superAdmin = { empNo: 'boss', role: 'super_admin', permissions: computePermissions('super_admin') }
+    const fallback = { empNo: 'administrator', role: 'fallback_admin', permissions: computePermissions('fallback_admin') }
     assert.equal(canSeeAll(superAdmin), true)
     assert.equal(canSeeAll(fallback), true)
     assert.equal(canAccessSession('s-other', superAdmin), true)
-    assert.equal(canAccessSession('s-other', fallback), true)
+
+    store.setViewAllSessions('boss', false)
+    assert.equal(canSeeAll(superAdmin), false)
+    assert.equal(canAccessSession('s-other', superAdmin), false)
   })
 
-  it('admin and user only see owned or own-workspace sessions', () => {
+  it('admin and user only see owned or own-workspace sessions by default', () => {
     const { canAccessSession, canSeeAll } = makeAccess({
       's-owned': 'u1',
       's-peer': 'u2',
@@ -64,15 +68,17 @@ describe('createSessionAccess', () => {
     const admin = {
       empNo: 'u1',
       role: 'admin',
-      permissions: { canViewAllSessions: false, canAccessSettings: true },
+      permissions: computePermissions('admin'),
     }
     const user = {
       empNo: 'u1',
       role: 'user',
-      permissions: { canViewAllSessions: false },
+      permissions: computePermissions('user'),
     }
     assert.equal(canSeeAll(admin), false)
     assert.equal(canSeeAll(user), false)
+    assert.equal(admin.permissions.canToggleViewAllSessions, false)
+    assert.equal(user.permissions.canToggleViewAllSessions, false)
 
     assert.equal(canAccessSession('s-owned', admin), true)
     assert.equal(canAccessSession('s-in-u1', user), true)
@@ -84,10 +90,106 @@ describe('createSessionAccess', () => {
     assert.equal(canAccessSession('s-cwd-peer', user, { cwd: '/ws/u2/x' }), false)
   })
 
+  it('admin cannot enable view-all even if preference flag is passed', () => {
+    const { canAccessSession, canSeeAll } = makeAccess({ 's-peer': 'u2' })
+    const admin = {
+      empNo: 'u1',
+      role: 'admin',
+      permissions: computePermissions('admin', { viewAllSessions: true }),
+    }
+    assert.equal(admin.permissions.canViewAllSessions, false)
+    assert.equal(admin.permissions.canToggleViewAllSessions, false)
+    assert.equal(canSeeAll(admin), false)
+    assert.equal(canAccessSession('s-peer', admin), false)
+  })
+
   it('missing owner does not deny when cwd is under user path', () => {
     const { canAccessSession } = makeAccess({})
-    const user = { empNo: 'u1', role: 'user', permissions: { canViewAllSessions: false } }
+    const user = { empNo: 'u1', role: 'user', permissions: computePermissions('user') }
     assert.equal(canAccessSession('legacy', user, { cwd: '/ws/u1' }), true)
     assert.equal(canAccessSession('legacy-other', user, { cwd: '/ws/u2' }), false)
   })
+
+  it('admin can see unowned channel/system sessions outside user-workspaces', () => {
+    const { canAccessSession, isVisibleWorkspace } = makeAccess({})
+    const admin = {
+      empNo: 'u1',
+      role: 'admin',
+      permissions: computePermissions('admin'),
+    }
+    const user = {
+      empNo: 'u1',
+      role: 'user',
+      permissions: computePermissions('user'),
+    }
+    assert.equal(canAccessSession('ch-1', admin, { cwd: '/bots/whatsapp' }), true)
+    assert.equal(canAccessSession('ch-1', user, { cwd: '/bots/whatsapp' }), false)
+    assert.equal(canAccessSession('s-peer', admin, { cwd: '/ws/u2/x' }), false)
+
+    const access = makeAccess({ 'ch-owned': 'u2' })
+    assert.equal(access.canAccessSession('ch-owned', admin, { cwd: '/bots/wa' }), false)
+
+    assert.equal(isVisibleWorkspace(admin, { id: 'bot-ws', path: '/bots/whatsapp' }), true)
+    assert.equal(isVisibleWorkspace(user, { id: 'bot-ws', path: '/bots/whatsapp' }), false)
+  })
+
+  it('live rolesStore prefs override stale identity.permissions', () => {
+    const store = new RolesStore()
+    store._roles.set('boss', ROLES.SUPER_ADMIN)
+    store.setViewAllSessions('boss', false)
+    const ownersMap = new Map([['s-peer', 'u2']])
+    const access = createSessionAccess({
+      sessionAcl: { getOwner: (id) => ownersMap.get(String(id)) || null },
+      userWorkspaces: {
+        get: () => null,
+        isUserPath: () => false,
+      },
+      getWorkspaceRoot: () => '/ws',
+      getWorkspaceRegistry: () => ({ list: () => [] }),
+      rolesStore: store,
+    })
+    const stale = {
+      empNo: 'boss',
+      role: 'super_admin',
+      permissions: computePermissions('super_admin', { viewAllSessions: true }),
+    }
+    assert.equal(access.canSeeAll(stale), false)
+    assert.equal(access.canAccessSession('s-peer', stale), false)
+
+    store.setViewAllSessions('boss', true)
+    assert.equal(access.canSeeAll(stale), true)
+    assert.equal(access.canAccessSession('s-peer', stale), true)
+  })
+})
+
+describe('RolesStore view-all prefs', () => {
+  it('defaults on for super_admin and can be turned off', () => {
+    const store = new RolesStore()
+    store._roles.set('boss', ROLES.SUPER_ADMIN)
+    store._roles.set('op', ROLES.ADMIN)
+
+    assert.equal(store.isViewAllSessionsEnabled('boss'), true)
+    assert.equal(store.resolvePermissions('boss').canViewAllSessions, true)
+    assert.equal(store.resolvePermissions('boss').canToggleViewAllSessions, true)
+
+    store.setViewAllSessions('boss', false)
+    assert.equal(store.isViewAllSessionsEnabled('boss'), false)
+    assert.equal(store.resolvePermissions('boss').canViewAllSessions, false)
+
+    store.setViewAllSessions('boss', true)
+    assert.equal(store.resolvePermissions('boss').canViewAllSessions, true)
+
+    assert.throws(() => store.setViewAllSessions('op', true), (err) => err.code === 'forbidden_view_all_sessions')
+    store._prefs.set('op', { viewAllSessions: true })
+    assert.equal(store.resolvePermissions('op').canViewAllSessions, false)
+    assert.equal(store.resolvePermissions('op').canToggleViewAllSessions, false)
+  })
+
+  it('rejects view-all toggle for ordinary users and admins', () => {
+    const store = new RolesStore()
+    store._roles.set('u1', ROLES.USER)
+    store._roles.set('a1', ROLES.ADMIN)
+    assert.throws(() => store.setViewAllSessions('u1', true), (err) => err.code === 'forbidden_view_all_sessions')
+    assert.throws(() => store.setViewAllSessions('a1', true), (err) => err.code === 'forbidden_view_all_sessions')
+  })
 })