@fieldwangai/agentflow 0.1.67 → 0.1.68

package/bin/lib/ui-server.mjs

@@ -97,6 +97,7 @@ import {
   isAuthUserAllowed,
   loginOrCreateUser,
   logoutRequest,
+  readAuthUsers,
   readUserAllowlist,
   writeUserAllowlist,
 } from "./auth.mjs";
@@ -257,8 +258,38 @@ function createFeedbackItem(payload, user) {
   };
 }
 
-function skillCollectionsAbs(userCtx = {}) {
-  return path.join(getAgentflowUserDataRoot(userCtx.userId), SKILL_COLLECTIONS_FILENAME);
+function skillCollectionsAbs() {
+  return path.join(getAgentflowDataRoot(), "admin", SKILL_COLLECTIONS_FILENAME);
+}
+
+function legacyAdminSkillCollectionPaths() {
+  const users = readAuthUsers();
+  return Object.entries(users || {})
+    .filter(([, user]) => user?.isAdmin)
+    .map(([userId, user]) => path.join(getAgentflowUserDataRoot(user.userId || userId), SKILL_COLLECTIONS_FILENAME));
+}
+
+function readSkillCollectionFile(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+
+function mergeSkillCollectionConfigs(configs = []) {
+  const merged = [];
+  const seen = new Set();
+  for (const config of configs) {
+    for (const collection of normalizeSkillCollectionConfig(config).collections) {
+      if (!collection.id || seen.has(collection.id)) continue;
+      seen.add(collection.id);
+      merged.push(collection);
+    }
+  }
+  return { version: 1, collections: merged };
 }
 
 function slugifySkillCollectionId(name, fallback = "collection") {
@@ -382,8 +413,12 @@ function withBuiltinSkillCollections(config, availableSkills = []) {
 function readSkillCollectionConfig(userCtx = {}, availableSkills = []) {
   const p = skillCollectionsAbs(userCtx);
   try {
-    if (!fs.existsSync(p)) return withBuiltinSkillCollections({}, availableSkills);
-    return withBuiltinSkillCollections(JSON.parse(fs.readFileSync(p, "utf-8")), availableSkills);
+    const globalConfig = readSkillCollectionFile(p);
+    if (globalConfig) return withBuiltinSkillCollections(globalConfig, availableSkills);
+    const legacyConfigs = legacyAdminSkillCollectionPaths()
+      .map((legacyPath) => readSkillCollectionFile(legacyPath))
+      .filter(Boolean);
+    return withBuiltinSkillCollections(mergeSkillCollectionConfigs(legacyConfigs), availableSkills);
   } catch {
     return withBuiltinSkillCollections({}, availableSkills);
   }
@@ -1408,6 +1443,7 @@ function readWorkspaceGraph(workspaceRoot) {
 }
 
 const DISPLAY_SHARE_FILENAME = "display-shares.json";
+const DISPLAY_SHARE_TTL_MS = 24 * 60 * 60 * 1000;
 
 function displaySharesPath() {
   return path.join(getAgentflowDataRoot(), DISPLAY_SHARE_FILENAME);
@@ -1432,6 +1468,26 @@ function createDisplayShareId() {
   return crypto.randomBytes(12).toString("base64url");
 }
 
+function displayShareExpiresAt(now = new Date()) {
+  const time = now instanceof Date ? now.getTime() : Date.now();
+  return new Date(time + DISPLAY_SHARE_TTL_MS).toISOString();
+}
+
+function isDisplayShareExpired(share) {
+  const expiresAt = Date.parse(String(share?.expiresAt || ""));
+  return Number.isFinite(expiresAt) && expiresAt <= Date.now();
+}
+
+function getDisplayShareOrExpired(id) {
+  const shares = readDisplayShares();
+  const share = shares[id];
+  if (!share) return { shares, share: null, expired: false };
+  if (!isDisplayShareExpired(share)) return { shares, share, expired: false };
+  delete shares[id];
+  writeDisplayShares(shares);
+  return { shares, share: null, expired: true };
+}
+
 function normalizeDisplayShareNodeIds(ids, graph) {
   const out = [];
   const seen = new Set();
@@ -1519,6 +1575,7 @@ function publicDisplayPayloadFromShare(root, share) {
         : null,
       createdAt: share.createdAt || "",
       updatedAt: share.updatedAt || "",
+      expiresAt: share.expiresAt || "",
     },
     nodes,
   };
@@ -3927,9 +3984,9 @@ export function startUiServer({
           json(res, 400, { error: "Missing display share id" });
           return;
         }
-        const share = readDisplayShares()[id];
+        const { share, expired } = getDisplayShareOrExpired(id);
         if (!share) {
-          json(res, 404, { error: "Display share not found" });
+          json(res, expired ? 410 : 404, { error: expired ? "Display share has expired" : "Display share not found" });
           return;
         }
         const payload = publicDisplayPayloadFromShare(root, share);
@@ -3951,9 +4008,9 @@ export function startUiServer({
           json(res, 400, { error: "Missing display share id" });
           return;
         }
-        const share = readDisplayShares()[id];
+        const { share, expired } = getDisplayShareOrExpired(id);
         if (!share) {
-          json(res, 404, { error: "Display share not found" });
+          json(res, expired ? 410 : 404, { error: expired ? "Display share has expired" : "Display share not found" });
           return;
         }
         const scoped = resolveWorkspaceScopeRoot(root, {
@@ -4394,7 +4451,8 @@ export function startUiServer({
         const shares = readDisplayShares();
         let id = createDisplayShareId();
         while (shares[id]) id = createDisplayShareId();
-        const now = new Date().toISOString();
+        const nowDate = new Date();
+        const now = nowDate.toISOString();
         const share = {
           id,
           userId: authUser.userId,
@@ -4402,10 +4460,11 @@ export function startUiServer({
           flowSource: scoped.flowSource || "user",
           archived: scoped.archived === true,
           title: String(payload.title || "").trim() || "AgentFlow Display",
-          layout: ["canvas", "gallery", "slides", "document"].includes(String(payload.layout || "")) ? String(payload.layout) : "canvas",
+          layout: ["canvas", "gallery", "slides", "document", "single"].includes(String(payload.layout || "")) ? String(payload.layout) : "canvas",
           nodeIds,
           createdAt: now,
           updatedAt: now,
+          expiresAt: displayShareExpiresAt(nowDate),
         };
         shares[id] = share;
         writeDisplayShares(shares);
@@ -5481,6 +5540,10 @@ export function startUiServer({
         json(res, 400, { error: "Missing skill slug or collection" });
         return;
       }
+      if (payload?.collection && !authUser?.isAdmin) {
+        json(res, 403, { error: "Admin required" });
+        return;
+      }
       const beforeSkills = payload?.collection ? listComposerSkills(PACKAGE_ROOT, root) : [];
       const result = await runSkillhub(args, { cwd: root, timeoutMs: 180_000, maxBuffer: 4 * 1024 * 1024 });
       if (!result.ok) {
@@ -5510,6 +5573,10 @@ export function startUiServer({
         json(res, 400, { error: "Missing skill slug or collection" });
         return;
       }
+      if (payload?.collection && !authUser?.isAdmin) {
+        json(res, 403, { error: "Admin required" });
+        return;
+      }
       const result = await runSkillhub(args, { cwd: root, timeoutMs: 120_000, maxBuffer: 4 * 1024 * 1024 });
       if (!result.ok) {
         json(res, 500, { error: result.error, stdout: result.stdout });
@@ -6499,6 +6566,10 @@ finishedAt: "${new Date().toISOString()}"
     }
 
     if (req.method === "POST" && url.pathname === "/api/skill-collections") {
+      if (!authUser?.isAdmin) {
+        json(res, 403, { error: "Admin required" });
+        return;
+      }
       let payload;
       try {
         payload = JSON.parse(await readBody(req));