@pixelbyte-software/pixcode 1.51.4 → 1.51.5

package/server/routes/projects.js

@@ -3,9 +3,10 @@ import path from 'path';
 import { spawn } from 'child_process';
 import os from 'os';
 
-import express from 'express';
-
-import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import express from 'express';
+
+import { addProjectManually, extractProjectDirectory } from '../projects.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -302,7 +303,7 @@ async function projectHasAnySessions(workspacePath) {
  * composer and surface a "directory deleted" warning instead of letting
  * the user fire prompts into a void.
  */
-router.get('/:projectName/dir-status', async (req, res) => {
+router.get('/:projectName/dir-status', requireAdmin, async (req, res) => {
   const { projectName } = req.params;
   try {
     const actualPath = await extractProjectDirectory(projectName);
@@ -340,7 +341,7 @@ router.get('/:projectName/dir-status', async (req, res) => {
  * matches ChatGPT's "New chat" which reuses the empty canvas until the
  * user actually commits a message.
  */
-router.post('/quick-start', async (req, res) => {
+router.post('/quick-start', requireAdmin, async (req, res) => {
   try {
     await fs.mkdir(WORKSPACES_BASE, { recursive: true });
 
@@ -424,7 +425,7 @@ router.post('/quick-start', async (req, res) => {
  * - githubTokenId?: number (optional, ID of stored token)
  * - newGithubToken?: string (optional, one-time token)
  */
-router.post('/create-workspace', async (req, res) => {
+router.post('/create-workspace', requireAdmin, async (req, res) => {
   try {
     const { workspaceType, path: workspacePath, githubUrl, githubTokenId, newGithubToken, subfolderName } = req.body;
 

package/server/routes/remote.js

@@ -5,10 +5,11 @@ import {
   getPublicRemoteConnectionConfig,
   saveRemoteConnectionConfig,
 } from '../services/remote-connection.js';
-import {
-  buildControlRoomSnapshot,
-  buildMobileConsoleLayout,
-} from '../services/control-room.js';
+import {
+  buildControlRoomSnapshot,
+  buildMobileConsoleLayout,
+} from '../services/control-room.js';
+import { requireAdmin } from '../middleware/auth.js';
 
 const router = express.Router();
 
@@ -16,7 +17,7 @@ router.get('/config', (req, res) => {
   res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
 
-router.put('/config', (req, res) => {
+router.put('/config', requireAdmin, (req, res) => {
   try {
     const connection = saveRemoteConnectionConfig(req.body || {});
     res.json({ success: true, connection });

package/server/services/platformization.js

@@ -1,6 +1,7 @@
-import crypto from 'node:crypto';
-import os from 'node:os';
-import { execFile } from 'node:child_process';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 import bcrypt from 'bcryptjs';
@@ -174,6 +175,25 @@ function projectMatches(collaborator, project = {}) {
   );
 }
 
+function isPathInside(basePath, targetPath) {
+  const relative = path.relative(path.resolve(basePath), path.resolve(targetPath));
+  return relative === '' || (relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function normalizeAllowedRoots(input) {
+  const roots = Array.isArray(input) ? input : [];
+  const normalized = roots
+    .filter((entry) => typeof entry === 'string')
+    .map((entry) => entry.trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/g, ''))
+    .map((entry) => entry || '.')
+    .filter((entry) => !entry.includes('..'));
+  return Array.from(new Set(normalized.length > 0 ? normalized : ['.']));
+}
+
+function collaboratorAllowedRoots(collaborator) {
+  return normalizeAllowedRoots(collaborator.allowedRoots || collaborator.allowedFolders || ['.']);
+}
+
 export function userHasProjectAccess(user, project, capability = 'viewFiles') {
   if (isAdminUser(user)) return true;
   if (!user?.id && !user?.userId) return false;
@@ -198,6 +218,55 @@ export function userHasProjectAccess(user, project, capability = 'viewFiles') {
   });
 }
 
+export function getProjectAccessForUser(user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) {
+    return { unrestricted: true, allowedRoots: ['.'] };
+  }
+  if (!user?.id && !user?.userId) return { unrestricted: false, allowedRoots: [] };
+
+  const userId = Number(user.id ?? user.userId);
+  const username = String(user.username || '').toLowerCase();
+  const store = readStore();
+  const allowedRoots = [];
+
+  for (const collaborator of store.projectCollaborators) {
+    if (collaborator.status === 'disabled') continue;
+    if (!projectMatches(collaborator, project)) continue;
+    const sameUser = Number(collaborator.userId) === userId ||
+      String(collaborator.userRef || '').toLowerCase() === username;
+    if (!sameUser) continue;
+    const capabilityAllowed = capability === 'viewFiles'
+      ? collaborator.capabilities?.viewFiles !== false
+      : collaborator.capabilities?.[capability] === true;
+    if (!capabilityAllowed) continue;
+    allowedRoots.push(...collaboratorAllowedRoots(collaborator));
+  }
+
+  return { unrestricted: false, allowedRoots: Array.from(new Set(allowedRoots)) };
+}
+
+export function userHasProjectPathAccess(user, project, targetPath, capability = 'viewFiles') {
+  if (isAdminUser(user)) return true;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath || !targetPath) return false;
+  const access = getProjectAccessForUser(user, project, capability);
+  return access.allowedRoots.some((root) => {
+    const allowedPath = root === '.' ? projectPath : path.resolve(projectPath, root);
+    return isPathInside(allowedPath, targetPath);
+  });
+}
+
+export function filterFileTreeForUser(files = [], user, project, capability = 'viewFiles') {
+  if (isAdminUser(user)) return files;
+  const projectPath = project?.fullPath || project?.path || project?.projectPath;
+  if (!projectPath) return [];
+  return files.filter((entry) => {
+    const entryPath = entry?.path || entry?.fullPath || entry?.relativePath || '';
+    const absoluteEntryPath = path.isAbsolute(entryPath) ? entryPath : path.resolve(projectPath, entryPath);
+    return userHasProjectPathAccess(user, { ...project, fullPath: projectPath }, absoluteEntryPath, capability);
+  });
+}
+
 export function filterProjectsForUser(projects = [], user) {
   if (isAdminUser(user)) return projects;
   return projects.filter((project) => userHasProjectAccess(user, project, 'viewFiles'));
@@ -427,11 +496,12 @@ export function createProjectCollaborator(input = {}, actorId = null) {
     userId: targetUser.id,
     userRef,
     role,
-    capabilities: {
-      ...capabilities,
-      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
-    },
-    status: input.status || 'active',
+    capabilities: {
+      ...capabilities,
+      ...(input.capabilities && typeof input.capabilities === 'object' ? input.capabilities : {}),
+    },
+    allowedRoots: normalizeAllowedRoots(input.allowedRoots || input.allowedFolders || ['.']),
+    status: input.status || 'active',
     createdAt: nowIso(),
     updatedAt: nowIso(),
   };
@@ -451,11 +521,14 @@ export function updateProjectCollaborator(collaboratorId, patch = {}, actorId =
       ...collaborator,
       ...patch,
       id: collaborator.id,
-      capabilities: {
-        ...collaborator.capabilities,
-        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
-      },
-      updatedAt: nowIso(),
+      capabilities: {
+        ...collaborator.capabilities,
+        ...(patch.capabilities && typeof patch.capabilities === 'object' ? patch.capabilities : {}),
+      },
+      allowedRoots: patch.allowedRoots || patch.allowedFolders
+        ? normalizeAllowedRoots(patch.allowedRoots || patch.allowedFolders)
+        : collaboratorAllowedRoots(collaborator),
+      updatedAt: nowIso(),
     };
     return updated;
   });