hansjone/oclaw
1
0
Fork 0
mirror of https://github.com/hansjone/oclaw.git synced 2026-10-19 08:03:19 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

Hide session list for anonymous UDS users.

Browse source 
Filter session.list/search on the client when cookies are absent, ignore broadcast session-added events, and deepen host listState wrapping so ungrouped rows no longer leak while logged out.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-09-08 07:53:35 +08:00
parent 92ee170b2e
commit db907a9489
2 changed files with 107 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

37
uds-auth/lib/dsh-acl.js
View file

@ -102,6 +102,17 @@ export function patchWebServerWithIdentity(server, resolveIdentity) {
server.registerFallback = (handler) => origFallback(wrap(handler))
}
const origRegisterUpgrade = server.registerUpgrade?.bind(server)
if (origRegisterUpgrade) {
server.registerUpgrade = (route) => origRegisterUpgrade({
...route,
handler: async (req, socket, head) => {
const identity = await resolveIdentity(req)
return withUserContext(identity, () => route.handler(req, socket, head))
},
})
}
return () => {
/* leave patched — reload recreates webServer fiber */
}
@ -150,6 +161,32 @@ export function installDshAcl(ctx, {
if (!sc || sc.__udsAcl) return
sc.__udsAcl = true
// Deeper wrap: ApiSessionList.list (cold summaries)
if (sc.listState && typeof sc.listState.list === 'function' && !sc.listState.__udsAcl) {
sc.listState.__udsAcl = true
const origStateList = sc.listState.list.bind(sc.listState)
sc.listState.list = async (signal) => {
const items = await origStateList(signal)
const identity = getUserContext()
if (!identity?.empNo) return []
if (identity.permissions?.canViewAllSessions) return items
return (items || []).filter((row) => {
const id = row?.sessionId ?? row?.id
return id != null && sessionAcl.canViewSession(id)
})
}
if (typeof sc.listState.search === 'function') {
const origStateSearch = sc.listState.search.bind(sc.listState)
sc.listState.search = async (query, signal) => {
const value = await origStateSearch(query, signal)
const identity = getUserContext()
if (!identity?.empNo) return { items: [], hasMore: false }
if (identity.permissions?.canViewAllSessions) return value
return sessionAcl.filterListValue(value)
}
}
}
const origList = sc.list.bind(sc)
sc.list = async (request, signal) => {
const value = await origList(request, signal)