@fieldwangai/agentflow 0.1.56 → 0.1.58

package/bin/lib/marketplace.mjs

@@ -113,11 +113,32 @@ function manifestOwnerUserId(manifest) {
   return String(manifest?.ownerUserId || manifest?.createdBy || "").trim();
 }
 
-function canAccessMarketplaceNode(manifest, opts = {}) {
+function isAdminRequest(opts = {}) {
+  return Boolean(opts?.isAdmin);
+}
+
+function shouldFilterMarketplaceOwner(opts = {}) {
+  return opts?.marketplaceScope === "owned";
+}
+
+function canAccessMarketplaceOwner(ownerUserId, opts = {}) {
+  if (!shouldFilterMarketplaceOwner(opts)) return true;
   const requestedUserId = String(opts.userId || "").trim();
   if (!requestedUserId) return true;
+  if (isAdminRequest(opts)) return true;
+  return Boolean(ownerUserId) && ownerUserId === requestedUserId;
+}
+
+function canManageMarketplaceOwner(ownerUserId, opts = {}) {
+  const requestedUserId = String(opts.userId || "").trim();
+  if (!requestedUserId) return false;
+  if (isAdminRequest(opts)) return true;
+  return Boolean(ownerUserId) && ownerUserId === requestedUserId;
+}
+
+function canAccessMarketplaceNode(manifest, opts = {}) {
   if ((manifest?.source || "marketplace") !== "marketplace") return true;
-  return manifestOwnerUserId(manifest) === requestedUserId;
+  return canAccessMarketplaceOwner(manifestOwnerUserId(manifest), opts);
 }
 
 function sortVersionsDesc(versions) {
@@ -422,7 +443,7 @@ export function listMarketplaceFlowSnippets(workspaceRoot, opts = {}) {
       if (!manifest) continue;
       const snippet = manifest.snippet && typeof manifest.snippet === "object" ? manifest.snippet : {};
       const ownerUserId = String(manifest.ownerUserId || manifest.createdBy || "").trim();
-      if (requestedUserId && ownerUserId !== requestedUserId) continue;
+      if (requestedUserId && !canAccessMarketplaceOwner(ownerUserId, opts)) continue;
       snippets.push({
         id: manifest.id || entry.name,
         version: manifest.version || version,
@@ -454,8 +475,7 @@ export function deleteMarketplaceNodePackage(workspaceRoot, id, version, opts =
     return { ok: false, error: `Marketplace node package not found: ${id}@${version}` };
   }
   const manifest = normalizeManifest(readYamlObject(manifestPath), packageDir, "marketplace");
-  const requestedUserId = String(opts.userId || "").trim();
-  if (!requestedUserId || !manifest || manifestOwnerUserId(manifest) !== requestedUserId) {
+  if (!manifest || !canManageMarketplaceOwner(manifestOwnerUserId(manifest), opts)) {
     return { ok: false, error: "Marketplace node permission denied" };
   }
   const usage = listMarketplaceNodeUsages(workspaceRoot, id, version, opts);
@@ -483,8 +503,7 @@ export function deleteMarketplaceFlowSnippetPackage(workspaceRoot, id, version,
   }
   const manifest = readYamlObject(manifestPath) || {};
   const ownerUserId = String(manifest.ownerUserId || manifest.createdBy || "").trim();
-  const requestedUserId = String(opts.userId || "").trim();
-  if (!requestedUserId || ownerUserId !== requestedUserId) {
+  if (!canManageMarketplaceOwner(ownerUserId, opts)) {
     return { ok: false, error: "Flow snippet permission denied" };
   }
   fs.rmSync(packageDir, { recursive: true, force: true });
@@ -719,7 +738,7 @@ export function publishNodeFromInstance(workspaceRoot, payload = {}, options = {
   const existingManifest = readYamlObject(path.join(dest, NODE_MANIFEST));
   if (existingManifest) {
     const existingOwner = manifestOwnerUserId(existingManifest);
-    if (existingOwner !== ownerUserId) return { ok: false, error: "Marketplace node permission denied" };
+    if (!canManageMarketplaceOwner(existingOwner, options)) return { ok: false, error: "Marketplace node permission denied" };
   }
   const now = new Date().toISOString();
   fs.mkdirSync(path.dirname(dest), { recursive: true });
@@ -797,7 +816,7 @@ export function publishFlowSnippet(workspaceRoot, payload = {}, opts = {}) {
   const existingManifest = readYamlObject(path.join(dest, FLOW_SNIPPET_MANIFEST));
   if (existingManifest) {
     const existingOwner = String(existingManifest.ownerUserId || existingManifest.createdBy || "").trim();
-    if (existingOwner !== ownerUserId) return { ok: false, error: "Flow snippet permission denied" };
+    if (!canManageMarketplaceOwner(existingOwner, opts)) return { ok: false, error: "Flow snippet permission denied" };
   }
   fs.mkdirSync(path.dirname(dest), { recursive: true });
   fs.rmSync(dest, { recursive: true, force: true });

package/bin/lib/ui-server.mjs

@@ -3271,7 +3271,7 @@ export function startUiServer({
     }
 
     const authUser = getAuthUserFromRequest(req);
-    const userCtx = authUser ? { userId: authUser.userId } : {};
+    const userCtx = authUser ? { userId: authUser.userId, isAdmin: Boolean(authUser.isAdmin) } : {};
     if (req.method === "GET" && url.pathname === "/api/display/share") {
       try {
         const id = String(url.searchParams.get("id") || "").trim();
@@ -4763,6 +4763,7 @@ export function startUiServer({
       const flowId = url.searchParams.get("flowId");
       const flowSource = url.searchParams.get("flowSource") || "user";
       const lang = url.searchParams.get("lang") || "en";
+      const marketplaceScope = url.searchParams.get("scope") === "owned" ? "owned" : "all";
       if (flowId && !isValidFlowSourceRead(flowSource)) {
         json(res, 400, { error: "Invalid flowSource" });
         return;
@@ -4771,7 +4772,7 @@ export function startUiServer({
       try {
         const { setLanguage } = await import("./i18n.mjs");
         setLanguage(lang);
-        json(res, 200, listNodesJson(root, flowId || "", flowId ? flowSource : "", { archived: nodesArchived, ...userCtx }));
+        json(res, 200, listNodesJson(root, flowId || "", flowId ? flowSource : "", { archived: nodesArchived, ...userCtx, marketplaceScope }));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -4833,7 +4834,8 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/marketplace/nodes") {
       try {
-        json(res, 200, listMarketplacePackages(root, userCtx));
+        const marketplaceScope = url.searchParams.get("scope") === "owned" ? "owned" : "all";
+        json(res, 200, listMarketplacePackages(root, { ...userCtx, marketplaceScope }));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }
@@ -4842,7 +4844,8 @@ export function startUiServer({
 
     if (req.method === "GET" && url.pathname === "/api/marketplace/flow-snippets") {
       try {
-        json(res, 200, listMarketplaceFlowSnippets(root, userCtx));
+        const marketplaceScope = url.searchParams.get("scope") === "owned" ? "owned" : "all";
+        json(res, 200, listMarketplaceFlowSnippets(root, { ...userCtx, marketplaceScope }));
       } catch (e) {
         json(res, 500, { error: (e && e.message) || String(e) });
       }