@rubytech/create-realagent 1.0.832 → 1.0.834

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -8,6 +8,7 @@ import { resolve, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { writeKey, validateKey, hasKey, keyFilePath, deleteKey } from "../../../../lib/anthropic-key/dist/index.js";
+import { writeAdminEntry, removeAdminFromAccount } from "../../../../lib/admins-write/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
 import { substituteBrandPlaceholders } from "../../../../lib/brand-templating/dist/index.js";
 import { resolveEntitlement } from "../../../../lib/entitlement/dist/index.js";
@@ -102,7 +103,11 @@ async function readAccountConfig() {
 const STAGING_ROOT = resolve(PLATFORM_ROOT, "../premium-plugins");
 const PLUGINS_DIR = resolve(PLATFORM_ROOT, "plugins");
 const CORE_PLUGINS = ["admin", "memory", "docs", "cloudflare", "anthropic"];
-const USERS_FILE = resolve(PLATFORM_ROOT, "config", "users.json");
+// users.json lives under CONFIG_DIR (persistent) — see paths.ts comment for
+// the regression that motivated the move. Both platform/ui and this MCP plugin
+// resolve the same file via brand-aware $HOME/<configDir>, so the device-level
+// admin auth store is single-pathed across both processes (Task 904).
+const USERS_FILE = resolve(CONFIG_DIR, "users.json");
 /** Maximum number of admin users allowed per tier. */
 const MAX_ADMINS_BY_TIER = {
     solo: 1,
@@ -678,42 +683,29 @@ server.tool("admin-add", "Add a new admin user to this account. Creates a device
     }
     const pinHash = hashPin(plaintextPin);
     const userId = crypto.randomUUID();
-    // Three-store admin auth invariant (Task 850): users.json (device-level
-    // PIN auth), account.json admins[] (account-level role), Neo4j AdminUser
-    // (display + graph identity). Each leg emits a [admin-auth-store] line so
-    // a future incident can grep one log to know which leg failed; any leg
-    // failing makes the tool result is_error: true with a cause line citing
-    // what's already been written. No automatic rollback — the cause line is
-    // the manual-recovery diagnostic.
+    // Three-store admin auth invariant (Task 850 → Task 904): users.json
+    // (device-level PIN auth) and account.json admins[] (account-level role)
+    // route through the shared `admins-write` helper so the dual write has a
+    // single chokepoint. Per-leg `[admins-write]` and legacy `[admin-auth-store]`
+    // log lines fire so existing dashboards continue to grep. Neo4j AdminUser
+    // (display + graph identity) writes below remain inline because they have
+    // no dual-file invariant.
     const userIdShort = userId.slice(0, 8);
-    // 1. Write to users.json (device-level). Auth fields only — `name` lives
-    //    on the AdminUser node in Neo4j (Task 829).
-    users.push({ userId, pin: pinHash });
-    try {
-        writeUsersJson(users);
-        console.error(`[admin-auth-store] action=add userId=${userIdShort} result=ok store=users`);
-    }
-    catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
-        console.error(`[admin-auth-store] action=add userId=${userIdShort} result=fail store=users error=${errMsg}`);
-        return { content: [{ type: "text", text: `${TAG} Failed to write users.json: ${errMsg}` }], isError: true };
-    }
-    // 2. Write to account.json (account-level)
-    try {
-        const config = await readAccountConfig();
-        const admins = (config.admins ?? []);
-        if (!admins.some(a => a.userId === userId)) {
-            admins.push({ userId, role: "admin" });
-            config.admins = admins;
-            const configPath = join(getAccountDir(), "account.json");
-            await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-        }
-        console.error(`[admin-auth-store] action=add userId=${userIdShort} result=ok store=account`);
+    const authResult = writeAdminEntry({
+        userId,
+        pin: pinHash,
+        role: "admin",
+        usersFile: USERS_FILE,
+        accountDir: getAccountDir(),
+        caller: "admin-add",
+    });
+    console.error(`[admin-auth-store] action=add userId=${userIdShort} result=${authResult.usersJsonResult} store=users${authResult.usersError ? ` error=${authResult.usersError}` : ""}`);
+    if (authResult.usersJsonResult !== "ok") {
+        return { content: [{ type: "text", text: `${TAG} Failed to write users.json: ${authResult.usersError ?? "unknown error"}` }], isError: true };
     }
-    catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
-        console.error(`[admin-auth-store] action=add userId=${userIdShort} result=fail store=account error=${errMsg}`);
-        return { content: [{ type: "text", text: `${TAG} users.json updated; account.json write FAILED — manual reconciliation needed: ${errMsg}` }], isError: true };
+    console.error(`[admin-auth-store] action=add userId=${userIdShort} result=${authResult.accountJsonResult} store=account${authResult.accountError ? ` error=${authResult.accountError}` : ""}`);
+    if (authResult.accountJsonResult === "fail") {
+        return { content: [{ type: "text", text: `${TAG} users.json updated; account.json write FAILED — manual reconciliation needed: ${authResult.accountError ?? "unknown error"}` }], isError: true };
     }
     // 3. Write to Neo4j (graph-level): AdminUser + Person + OWNS atomically,
     //    plus ADMIN_OF edge to the LocalBusiness for this account.
@@ -860,15 +852,16 @@ server.tool("admin-remove", "Remove an admin from this account. Removes them fro
         }
     }
     catch { /* name lookup is best-effort */ }
-    // 1. Remove from account.json
-    admins.splice(targetIndex, 1);
-    config.admins = admins;
-    try {
-        const configPath = join(getAccountDir(), "account.json");
-        await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-    }
-    catch (err) {
-        return { content: [{ type: "text", text: `${TAG} Failed to write account.json: ${err instanceof Error ? err.message : String(err)}` }], isError: true };
+    // 1. Remove from account.json — single-file write through the shared
+    // chokepoint helper. users.json is intentionally untouched (the user may
+    // admin other accounts on this device); the helper logs `usersJsonResult=skip`.
+    const removeResult = removeAdminFromAccount({
+        userId,
+        accountDir: getAccountDir(),
+        caller: "admin-remove",
+    });
+    if (removeResult.accountJsonResult === "fail") {
+        return { content: [{ type: "text", text: `${TAG} Failed to write account.json: ${removeResult.accountError ?? "unknown error"}` }], isError: true };
     }
     // 2. Delete ADMIN_OF relationship in Neo4j — partial failure is a warning
     let neo4jWarning = "";