@pixelbyte-software/pixcode 1.51.3 → 1.51.5

package/server/routes/live-view.js

@@ -5,13 +5,14 @@ import express from 'express';
 
 import { extractProjectDirectory } from '../projects.js';
 import { getTunnelState } from '../services/external-access.js';
-import {
-  getLiveViewSessionByShareId,
-  getLiveViewState,
-  restartLiveView,
-  startLiveView,
-  stopLiveView,
-} from '../services/live-view.js';
+import {
+  getLiveViewSessionByShareId,
+  getLiveViewState,
+  restartLiveView,
+  startLiveView,
+  stopLiveView,
+} from '../services/live-view.js';
+import { userHasProjectPathAccess } from '../services/platformization.js';
 
 const router = express.Router();
 
@@ -210,20 +211,36 @@ function sendLiveViewDiagnostic(req, res, session, statusCode, options = {}) {
   res.json(payload);
 }
 
-async function resolveProjectPath(projectName) {
+async function resolveProjectPath(projectName) {
   const projectPath = await extractProjectDirectory(projectName);
   if (!projectPath || typeof projectPath !== 'string') {
     const error = new Error('Project path could not be resolved.');
     error.statusCode = 404;
     throw error;
   }
-  return projectPath;
-}
-
-router.get('/:projectName/status', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+  return projectPath;
+}
+
+function requireLiveViewProjectAccess(capability) {
+  return async (req, res, next) => {
+    try {
+      const { projectName } = req.params;
+      const projectPath = await resolveProjectPath(projectName);
+      if (!userHasProjectPathAccess(req.user, { name: projectName, projectName, fullPath: projectPath, path: projectPath }, projectPath, capability)) {
+        return res.status(403).json({ error: 'Project access denied.' });
+      }
+      req.projectPath = projectPath;
+      return next();
+    } catch (error) {
+      return res.status(error.statusCode || 500).json({ error: error.message || 'Failed to resolve project access' });
+    }
+  };
+}
+
+router.get('/:projectName/status', requireLiveViewProjectAccess('viewFiles'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, state.session);
     const tunnel = getTunnelState();
@@ -238,10 +255,13 @@ router.get('/:projectName/status', async (req, res) => {
   }
 });
 
-router.post('/:projectName/start', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+router.post('/:projectName/start', requireLiveViewProjectAccess('useShell'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
+    if (req.body?.customCommand && !['admin', 'owner'].includes(req.user?.role)) {
+      return res.status(403).json({ error: 'Custom Live View commands require admin access.' });
+    }
     const session = await startLiveView(projectName, projectPath, req.body || {});
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, session);
@@ -259,10 +279,13 @@ router.post('/:projectName/start', async (req, res) => {
   }
 });
 
-router.post('/:projectName/restart', async (req, res) => {
-  try {
-    const { projectName } = req.params;
-    const projectPath = await resolveProjectPath(projectName);
+router.post('/:projectName/restart', requireLiveViewProjectAccess('useShell'), async (req, res) => {
+  try {
+    const { projectName } = req.params;
+    const projectPath = req.projectPath;
+    if (req.body?.customCommand && !['admin', 'owner'].includes(req.user?.role)) {
+      return res.status(403).json({ error: 'Custom Live View commands require admin access.' });
+    }
     const session = await restartLiveView(projectName, projectPath, req.body || {});
     const state = await getLiveViewState(projectName, projectPath);
     const urls = buildUrls(req, session);
@@ -279,7 +302,7 @@ router.post('/:projectName/restart', async (req, res) => {
   }
 });
 
-router.post('/:projectName/stop', async (req, res) => {
+router.post('/:projectName/stop', requireLiveViewProjectAccess('useShell'), async (req, res) => {
   try {
     const session = await stopLiveView(req.params.projectName);
     const urls = buildUrls(req, session);

package/server/routes/messages.js

@@ -9,11 +9,30 @@
  * @module routes/messages
  */
 
-import express from 'express';
+import path from 'node:path';
+
+import express from 'express';
+
+import { sessionsService } from '../modules/providers/services/sessions.service.js';
+import { userHasProjectAccess } from '../services/platformization.js';
+import { appConfigDb } from '../database/db.js';
 
-import { sessionsService } from '../modules/providers/services/sessions.service.js';
-
-const router = express.Router();
+const router = express.Router();
+const SESSION_OWNERSHIP_KEY = 'session_ownership';
+
+function readSessionOwnership() {
+  try {
+    return JSON.parse(appConfigDb.get(SESSION_OWNERSHIP_KEY) || '{}');
+  } catch {
+    return {};
+  }
+}
+
+function canUserReadSession(user, provider, sessionId) {
+  if (['admin', 'owner'].includes(user?.role)) return true;
+  const owner = readSessionOwnership()[`${provider || 'claude'}:${sessionId}`];
+  return Boolean(owner?.userId && Number(owner.userId) === Number(user?.id ?? user?.userId));
+}
 
 /**
  * GET /api/sessions/:sessionId/messages
@@ -31,8 +50,8 @@ router.get('/:sessionId/messages', async (req, res) => {
   try {
     const { sessionId } = req.params;
     const provider = String(req.query.provider || 'claude').trim().toLowerCase();
-    const projectName = req.query.projectName || '';
-    const projectPath = req.query.projectPath || '';
+    const projectName = req.query.projectName || '';
+    const projectPath = req.query.projectPath || '';
     const limitParam = req.query.limit;
     const limit = limitParam !== undefined && limitParam !== null && limitParam !== ''
       ? parseInt(limitParam, 10)
@@ -40,12 +59,28 @@ router.get('/:sessionId/messages', async (req, res) => {
     const offset = parseInt(req.query.offset || '0', 10);
 
     const availableProviders = sessionsService.listProviderIds();
-    if (!availableProviders.includes(provider)) {
-      const available = availableProviders.join(', ');
-      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
-    }
-
-    const result = await sessionsService.fetchHistory(provider, sessionId, {
+    if (!availableProviders.includes(provider)) {
+      const available = availableProviders.join(', ');
+      return res.status(400).json({ error: `Unknown provider: ${provider}. Available: ${available}` });
+    }
+
+    if (!projectName && !projectPath) {
+      return res.status(400).json({ error: 'projectName or projectPath is required' });
+    }
+
+    const projectRef = projectName
+      ? { name: String(projectName), projectName: String(projectName) }
+      : { fullPath: path.resolve(String(projectPath)), path: path.resolve(String(projectPath)), projectPath: path.resolve(String(projectPath)) };
+
+    if (!userHasProjectAccess(req.user, projectRef, 'viewFiles')) {
+      return res.status(403).json({ error: 'Project access denied.' });
+    }
+
+    if (!canUserReadSession(req.user, provider, sessionId)) {
+      return res.status(403).json({ error: 'Session access denied.' });
+    }
+
+    const result = await sessionsService.fetchHistory(provider, sessionId, {
       projectName,
       projectPath,
       limit,

package/server/routes/network.js

@@ -2,12 +2,13 @@ import os from 'os';
 
 import express from 'express';
 
-import {
-  getTunnelState,
-  getUpnpState,
-  startTunnel,
-  stopTunnel,
-} from '../services/external-access.js';
+import {
+  getTunnelState,
+  getUpnpState,
+  startTunnel,
+  stopTunnel,
+} from '../services/external-access.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -93,7 +94,7 @@ router.delete('/upnp', (_req, res) => {
   });
 });
 
-router.post('/tunnel', async (req, res) => {
+router.post('/tunnel', requireAdmin, async (req, res) => {
   const port = resolveServerPort();
   try {
     const state = await startTunnel({ port, persistPreference: true });
@@ -112,7 +113,7 @@ router.post('/tunnel', async (req, res) => {
   }
 });
 
-router.delete('/tunnel', async (req, res) => {
+router.delete('/tunnel', requireAdmin, async (req, res) => {
   try {
     const state = await stopTunnel({ persistPreference: true });
     res.json({ success: true, tunnel: state });

package/server/routes/platformization.js

@@ -1,6 +1,7 @@
-import express from 'express';
-
-import {
+import express from 'express';
+
+import { requireAdmin } from '../middleware/auth.js';
+import {
   checkRemoteAccessHealth,
   createAdminUser,
   createEvaluationRun,
@@ -66,20 +67,20 @@ router.patch('/team/members/:id', (req, res) => {
   res.json({ success: true, member });
 });
 
-router.get('/admin/users', (_req, res) => {
-  res.json({ success: true, users: getPlatformizationState().adminUsers });
-});
-
-router.post('/admin/users', async (req, res) => {
-  try {
-    res.status(201).json({ success: true, user: await createAdminUser(req.body || {}, userId(req)) });
-  } catch (error) {
+router.get('/admin/users', requireAdmin, (_req, res) => {
+  res.json({ success: true, users: getPlatformizationState().adminUsers });
+});
+
+router.post('/admin/users', requireAdmin, async (req, res) => {
+  try {
+    res.status(201).json({ success: true, user: await createAdminUser(req.body || {}, userId(req)) });
+  } catch (error) {
     handleError(res, error);
   }
 });
 
-router.patch('/admin/users/:id', (req, res) => {
-  const user = updateAdminUser(req.params.id, req.body || {}, userId(req));
+router.patch('/admin/users/:id', requireAdmin, (req, res) => {
+  const user = updateAdminUser(req.params.id, req.body || {}, userId(req));
   if (!user) {
     res.status(404).json({ success: false, error: 'Admin user not found.' });
     return;
@@ -87,20 +88,20 @@ router.patch('/admin/users/:id', (req, res) => {
   res.json({ success: true, user });
 });
 
-router.get('/project-collaborators', (_req, res) => {
-  res.json({ success: true, collaborators: getPlatformizationState().projectCollaborators });
-});
-
-router.post('/project-collaborators', (req, res) => {
-  try {
+router.get('/project-collaborators', requireAdmin, (_req, res) => {
+  res.json({ success: true, collaborators: getPlatformizationState().projectCollaborators });
+});
+
+router.post('/project-collaborators', requireAdmin, (req, res) => {
+  try {
     res.status(201).json({ success: true, collaborator: createProjectCollaborator(req.body || {}, userId(req)) });
   } catch (error) {
     handleError(res, error);
   }
 });
 
-router.patch('/project-collaborators/:id', (req, res) => {
-  const collaborator = updateProjectCollaborator(req.params.id, req.body || {}, userId(req));
+router.patch('/project-collaborators/:id', requireAdmin, (req, res) => {
+  const collaborator = updateProjectCollaborator(req.params.id, req.body || {}, userId(req));
   if (!collaborator) {
     res.status(404).json({ success: false, error: 'Project collaborator not found.' });
     return;

package/server/routes/projects.js

@@ -3,9 +3,10 @@ import path from 'path';
 import { spawn } from 'child_process';
 import os from 'os';
 
-import express from 'express';
-
-import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import express from 'express';
+
+import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -302,7 +303,7 @@ async function projectHasAnySessions(workspacePath) {
  * composer and surface a "directory deleted" warning instead of letting
  * the user fire prompts into a void.
  */
-router.get('/:projectName/dir-status', async (req, res) => {
+router.get('/:projectName/dir-status', requireAdmin, async (req, res) => {
   const { projectName } = req.params;
   try {
     const actualPath = await extractProjectDirectory(projectName);
@@ -340,7 +341,7 @@ router.get('/:projectName/dir-status', async (req, res) => {
  * matches ChatGPT's "New chat" which reuses the empty canvas until the
  * user actually commits a message.
  */
-router.post('/quick-start', async (req, res) => {
+router.post('/quick-start', requireAdmin, async (req, res) => {
   try {
     await fs.mkdir(WORKSPACES_BASE, { recursive: true });
 
@@ -424,7 +425,7 @@ router.post('/quick-start', async (req, res) => {
  * - githubTokenId?: number (optional, ID of stored token)
  * - newGithubToken?: string (optional, one-time token)
  */
-router.post('/create-workspace', async (req, res) => {
+router.post('/create-workspace', requireAdmin, async (req, res) => {
   try {
     const { workspaceType, path: workspacePath, githubUrl, githubTokenId, newGithubToken, subfolderName } = req.body;
 

package/server/routes/remote.js

@@ -5,10 +5,11 @@ import {
   getPublicRemoteConnectionConfig,
   saveRemoteConnectionConfig,
 } from '../services/remote-connection.js';
-import {
-  buildControlRoomSnapshot,
-  buildMobileConsoleLayout,
-} from '../services/control-room.js';
+import {
+  buildControlRoomSnapshot,
+  buildMobileConsoleLayout,
+} from '../services/control-room.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -16,7 +17,7 @@ router.get('/config', (req, res) => {
   res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
 
-router.put('/config', (req, res) => {
+router.put('/config', requireAdmin, (req, res) => {
   try {
     const connection = saveRemoteConnectionConfig(req.body || {});
     res.json({ success: true, connection });

package/server/services/platformization.js

@@ -1,6 +1,7 @@
-import crypto from 'node:crypto';
-import os from 'node:os';
-import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import bcrypt from 'bcryptjs';
@@ -116,10 +117,14 @@ function writeStore(store) {
   appConfigDb.set(CONFIG_KEY, JSON.stringify(store));
 }
 
-function compact(text, max = 120) {
-  const value = String(text || '').replace(/\s+/g, ' ').trim();
-  return value.length > max ? value.slice(0, max).replace(/[-_\s]+$/g, '') : value;
-}
+function compact(text, max = 120) {
+  const value = String(text || '').replace(/\s+/g, ' ').trim();
+  return value.length > max ? value.slice(0, max).replace(/[-_\s]+$/g, '') : value;
+}
+
+function compactProjectIdentifier(value) {
+  return String(value || '').replace(/\s+/g, ' ').trim();
+}
 
 function slugify(value) {
   const slug = compact(value, 72)
@@ -140,9 +145,132 @@ function addAudit(store, action, actorId, details = {}) {
   store.auditLog = store.auditLog.slice(0, 250);
 }
 
-function normalizeRole(role) {
-  return TEAM_ROLES[role] ? role : 'viewer';
-}
+function normalizeRole(role) {
+  return TEAM_ROLES[role] ? role : 'viewer';
+}
+
+export function isAdminUser(user = {}) {
+  return user?.role === 'admin' || user?.role === 'owner';
+}
+
+function resolveUser(input = {}) {
+  const users = userDb.listUsers();
+  const userId = Number(input.userId);
+  if (Number.isFinite(userId)) {
+    return users.find((user) => user.id === userId && user.is_active) || null;
+  }
+
+  const userRef = compact(input.userRef || input.email || input.username || '').toLowerCase();
+  if (!userRef) return null;
+  return users.find((user) => user.is_active && String(user.username).toLowerCase() === userRef) || null;
+}
+
+function projectMatches(collaborator, project = {}) {
+  const projectName = compactProjectIdentifier(project.name || project.projectName || project);
+  const projectPath = compactProjectIdentifier(project.fullPath || project.path || project.projectPath || '');
+
+  return Boolean(
+    (projectName && collaborator.projectName === projectName) ||
+    (projectPath && collaborator.projectPath === projectPath)
+  );
+}
+
+function isPathInside(basePath, targetPath) {
+  const relative = path.relative(path.resolve(basePath), path.resolve(targetPath));
+  return relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function normalizeAllowedRoots(input) {
+  const roots = Array.isArray(input) ? input : [];
+  const normalized = roots
+    .filter((entry) => typeof entry === 'string')
+    .map((entry) => entry.trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/g, ''))
+    .map((entry) => entry || '.')
+    .filter((entry) => !entry.includes('..'));
+  return Array.from(new Set(normalized.length > 0 ? normalized : ['.']));
+}
+
+function collaboratorAllowedRoots(collaborator) {
+  return normalizeAllowedRoots(collaborator.allowedRoots || collaborator.allowedFolders || ['.']);
+}
+
+export function userHasProjectAccess(user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) return true;
+  if (!user?.id && !user?.userId) return false;
+
+  const userId = Number(user.id ?? user.userId);
+  const username = String(user.username || '').toLowerCase();
+  const store = readStore();
+
+  return store.projectCollaborators.some((collaborator) => {
+    if (collaborator.status === 'disabled') return false;
+    if (!projectMatches(collaborator, project)) return false;
+
+    const sameUser = Number(collaborator.userId) === userId ||
+      String(collaborator.userRef || '').toLowerCase() === username;
+    if (!sameUser) return false;
+
+    if (capability === 'viewFiles') {
+      return collaborator.capabilities?.viewFiles !== false;
+    }
+
+    return collaborator.capabilities?.[capability] === true;
+  });
+}
+
+export function getProjectAccessForUser(user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) {
+    return { unrestricted: true, allowedRoots: ['.'] };
+  }
+  if (!user?.id && !user?.userId) return { unrestricted: false, allowedRoots: [] };
+
+  const userId = Number(user.id ?? user.userId);
+  const username = String(user.username || '').toLowerCase();
+  const store = readStore();
+  const allowedRoots = [];
+
+  for (const collaborator of store.projectCollaborators) {
+    if (collaborator.status === 'disabled') continue;
+    if (!projectMatches(collaborator, project)) continue;
+    const sameUser = Number(collaborator.userId) === userId ||
+      String(collaborator.userRef || '').toLowerCase() === username;
+    if (!sameUser) continue;
+    const capabilityAllowed = capability === 'viewFiles'
+      ? collaborator.capabilities?.viewFiles !== false
+      : collaborator.capabilities?.[capability] === true;
+    if (!capabilityAllowed) continue;
+    allowedRoots.push(...collaboratorAllowedRoots(collaborator));
+  }
+
+  return { unrestricted: false, allowedRoots: Array.from(new Set(allowedRoots)) };
+}
+
+export function userHasProjectPathAccess(user, project, targetPath, capability = 'viewFiles') {
+  if (isAdminUser(user)) return true;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath || !targetPath) return false;
+  const access = getProjectAccessForUser(user, project, capability);
+  return access.allowedRoots.some((root) => {
+    const allowedPath = root === '.' ? projectPath : path.resolve(projectPath, root);
+    return isPathInside(allowedPath, targetPath);
+  });
+}
+
+export function filterFileTreeForUser(files = [], user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) return files;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath) return [];
+  return files.filter((entry) => {
+    const entryPath = entry?.path || entry?.fullPath || entry?.relativePath || '';
+    const absoluteEntryPath = path.isAbsolute(entryPath) ? entryPath : path.resolve(projectPath, entryPath);
+    return userHasProjectPathAccess(user, { ...project, fullPath: projectPath }, absoluteEntryPath, capability);
+  });
+}
+
+export function filterProjectsForUser(projects = [], user) {
+  if (isAdminUser(user)) return projects;
+  return projects.filter((project) => userHasProjectAccess(user, project, 'viewFiles'));
+}
 
 function normalizeScope(scope) {
   return SECRET_SCOPES.includes(scope) ? scope : 'project';
@@ -338,13 +466,18 @@ export function updateAdminUser(userId, patch = {}, actorId = null) {
   };
 }
 
-export function createProjectCollaborator(input = {}, actorId = null) {
-  const projectName = compact(input.projectName || input.project || '');
-  const projectPath = input.projectPath || null;
-  const userRef = compact(input.userRef || input.email || input.username || '');
-  if (!projectName || !userRef) {
-    throw new Error('Project collaborator requires a project name and user reference.');
-  }
+export function createProjectCollaborator(input = {}, actorId = null) {
+  const projectName = compactProjectIdentifier(input.projectName || input.project || '');
+  const projectPath = input.projectPath || null;
+  const targetUser = resolveUser(input);
+  const userRef = compact(input.userRef || input.email || input.username || targetUser?.username || '');
+  if (!projectName || !userRef) {
+    throw new Error('Project collaborator requires a project name and user reference.');
+  }
+
+  if (!targetUser) {
+    throw new Error('Create the user account before assigning project access.');
+  }
 
   const role = ['partner', 'worker', 'reviewer', 'viewer'].includes(input.role) ? input.role : 'worker';
   const capabilities = {
@@ -357,16 +490,18 @@ export function createProjectCollaborator(input = {}, actorId = null) {
     manageProjectSettings: role === 'partner',
   };
   const collaborator = {
-    id: crypto.randomUUID(),
-    projectName,
-    projectPath,
-    userRef,
+    id: crypto.randomUUID(),
+    projectName,
+    projectPath,
+    userId: targetUser.id,
+    userRef,
     role,
-    capabilities: {
-      ...capabilities,
-      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
-    },
-    status: input.status || 'active',
+    capabilities: {
+      ...capabilities,
+      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
+    },
+    allowedRoots: normalizeAllowedRoots(input.allowedRoots || input.allowedFolders || ['.']),
+    status: input.status || 'active',
     createdAt: nowIso(),
     updatedAt: nowIso(),
   };
@@ -386,11 +521,14 @@ export function updateProjectCollaborator(collaboratorId, patch = {}, actorId =
       ...collaborator,
       ...patch,
       id: collaborator.id,
-      capabilities: {
-        ...collaborator.capabilities,
-        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
-      },
-      updatedAt: nowIso(),
+      capabilities: {
+        ...collaborator.capabilities,
+        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
+      },
+      allowedRoots: patch.allowedRoots || patch.allowedFolders
+        ? normalizeAllowedRoots(patch.allowedRoots || patch.allowedFolders)
+        : collaboratorAllowedRoots(collaborator),
+      updatedAt: nowIso(),
     };
     return updated;
   });