@aalis/plugin-webui-server 0.4.1 → 0.5.0

package/dist/gate.js

@@ -1,36 +1,18 @@
 /**
- * REST 路由能力闸工厂。
+ * REST 路由 owner 闸工厂（单 owner 终态）。
  *
- * 连接级认证（auth middleware）只回答"是否登录"；本闸回答"该身份能否做这件事"——
- * 每条 REST 路由声明一个 capability 与默认可见性，过 authorize 统一闸
- * （deny > owner(*) > public > granted）。owner 拥有一切；可对单账户 grant 某条
- * restricted capability（如 `webui:files:read`）做细粒度委托。
+ * 单 token 模式下「持 token ⟺ webui:console ⟺ owner」，故连接级认证（auth.middleware
+ * 校验 token，未认证一律 401）即等价于 owner 鉴权。本闸是 REST 层的显式 owner 复核
+ * （防御纵深，与 auth.middleware 同义）：身份解析得到即放行，否则 403。
  *
- * 可见性约定（颗粒度由 capability 字符串本身承载，owner 之外的细分靠委托 grant）：
- * - 'public'：公共读（status / pages / 模型列表等，聊天面板可用即可）。
- * - 'restricted'：管理读（插件清单含原始配置、日志、文件浏览——可能含密钥）与
- *   一切变更操作（配置写、插件启停装卸、服务偏好、文件删改）；默认禁，须 owner /
- *   被委托授予。
- *
- * authority 服务缺席时：public 放行、restricted 503（fail-closed，不在权限服务缺位时裸奔）。
+ * 多账户 / 能力委托已剥离，故不再有 per-route capability 与档位裁决——所有需登录的
+ * REST 路由统一是 owner-only。页面/状态等只读路由同样在 auth.middleware 之后，对
+ * 单 owner 无区别。
  */
-export function createRouteGate(ctx, identify) {
-    return (capability, visibility) => (req, res, next) => {
-        const authority = ctx.getService('authority');
-        if (!authority) {
-            // authority 缺席（未配置/启动失败/bounce 窗口期）→ 无法裁决。
-            // 公共读放行，受限操作 503（区别于 403：服务暂不可用，非权限不足）。
-            if (visibility === 'restricted') {
-                res.status(503).json({ error: '权限服务不可用，受限操作暂时被拒绝' });
-                return;
-            }
-            next();
-            return;
-        }
-        const caller = identify(req) ?? { platform: 'webui', userId: 'console' };
-        const denied = authority.authorize(caller, { capability, visibility });
-        if (denied) {
-            res.status(403).json({ error: denied });
+export function createRouteGate(identify) {
+    return () => (req, res, next) => {
+        if (!identify(req)) {
+            res.status(403).json({ error: '需要 owner 权限' });
             return;
         }
         next();

package/dist/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,QAAoB;IAChE,OAAO,CAAC,UAAkB,EAAE,UAAgC,EAAkB,EAAE,CAC9E,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,2CAA2C;YAC3C,wCAAwC;YACxC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAgBA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAoB;IAClD,OAAO,GAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -16,7 +16,6 @@ export declare const defaultConfig: {
     fixedToken: string;
     relationGraphDefaultSpacing: number;
     marketplaceRegistry: string;
-    client: string;
 };
 export { type WSIncoming, WSIncomingSchema } from './protocol.js';
 export declare function apply(ctx: Context, config: Record<string, unknown>): Promise<void>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAc,YAAY,EAAE,OAAO,EAAkC,MAAM,aAAa,CAAC;AAqCrG,eAAO,MAAM,IAAI,+BAA+B,CAAC;AACjD,eAAO,MAAM,WAAW,6BAAc,CAAC;AACvC,eAAO,MAAM,SAAS,aAAa,CAAC;AACpC,eAAO,MAAM,QAAQ,UAA+B,CAAC;AACrD,eAAO,MAAM,MAAM;;CAMlB,CAAC;AAWF,eAAO,MAAM,YAAY,EAAE,YAuD1B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;CAUzB,CAAC;AAsBF,OAAO,EAAE,KAAK,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAqIlE,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAs3CxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAc,YAAY,EAAE,OAAO,EAAkC,MAAM,aAAa,CAAC;AAyCrG,eAAO,MAAM,IAAI,+BAA+B,CAAC;AACjD,eAAO,MAAM,WAAW,6BAAc,CAAC;AACvC,eAAO,MAAM,SAAS,aAAa,CAAC;AACpC,eAAO,MAAM,QAAQ,UAA+B,CAAC;AACrD,eAAO,MAAM,MAAM;;CAMlB,CAAC;AAWF,eAAO,MAAM,YAAY,EAAE,YAiD1B,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;CASzB,CAAC;AAoBF,OAAO,EAAE,KAAK,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA6IlE,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4yCxF"}