@fieldwangai/agentflow 0.1.45 → 0.1.47

package/bin/lib/auth.mjs

@@ -97,8 +97,11 @@ function normalizeUserAllowlistInput(value) {
   return [];
 }
 
-export function readUserAllowlist() {
-  const fromEnv = normalizeUserAllowlistInput(process.env.AGENTFLOW_USER_WHITELIST || process.env.AGENTFLOW_ALLOWED_USERS || "");
+function readUserAllowlistEnvUsers() {
+  return normalizeUserAllowlistInput(process.env.AGENTFLOW_USER_WHITELIST || process.env.AGENTFLOW_ALLOWED_USERS || "");
+}
+
+function readUserAllowlistFileUsers() {
   let fromFile = [];
   try {
     const p = userAllowlistPath();
@@ -109,8 +112,32 @@ export function readUserAllowlist() {
   } catch {
     fromFile = [];
   }
+  return fromFile;
+}
+
+export function readUserAllowlist() {
+  const fromEnv = readUserAllowlistEnvUsers();
+  const fromFile = readUserAllowlistFileUsers();
   const users = Array.from(new Set([...fromFile, ...fromEnv].map((item) => String(item || "").trim()).filter(Boolean)));
-  return { enabled: users.length > 0, users, path: userAllowlistPath() };
+  return { enabled: users.length > 0, users, fileUsers: fromFile, envUsers: fromEnv, path: userAllowlistPath() };
+}
+
+export function writeUserAllowlist(users) {
+  const normalized = [];
+  const seen = new Set();
+  for (const item of normalizeUserAllowlistInput(users)) {
+    const user = String(item || "").trim();
+    const safe = sanitizeAgentflowUserId(user);
+    if (!safe) {
+      throw new Error(`invalid username: ${user}`);
+    }
+    const key = safe.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    normalized.push(user);
+  }
+  writeJsonObject(userAllowlistPath(), { users: normalized, updatedAt: new Date().toISOString() });
+  return readUserAllowlist();
 }
 
 function userAllowlistMatchSet(users) {

package/bin/lib/ui-server.mjs

@@ -96,6 +96,7 @@ import {
   loginOrCreateUser,
   logoutRequest,
   readUserAllowlist,
+  writeUserAllowlist,
 } from "./auth.mjs";
 import { readGlobalEnvRows, readMergedEnvObject, readUserEnvRows, writeGlobalEnvRows, writeUserEnvRows } from "./user-env.mjs";
 import {
@@ -3204,6 +3205,33 @@ export function startUiServer({
       }
     }
 
+    if (url.pathname === "/api/admin/user-allowlist") {
+      if (!authUser?.isAdmin) {
+        json(res, 403, { error: "Admin permission required" });
+        return;
+      }
+      if (req.method === "GET") {
+        json(res, 200, { allowlist: readUserAllowlist() });
+        return;
+      }
+      if (req.method === "POST") {
+        let payload;
+        try {
+          payload = JSON.parse(await readBody(req));
+        } catch {
+          json(res, 400, { error: "Invalid JSON body" });
+          return;
+        }
+        try {
+          const allowlist = writeUserAllowlist(payload?.users || payload?.fileUsers || []);
+          json(res, 200, { ok: true, allowlist });
+        } catch (e) {
+          json(res, 400, { error: (e && e.message) || String(e) });
+        }
+        return;
+      }
+    }
+
     if (url.pathname === "/api/flows") {
       if (req.method === "GET") {
         try {