@saluzi/saluzi-edu 0.2.13 → 0.2.15

package/packages/remote-control-server/src/__tests__/team-session-env.test.ts

@@ -0,0 +1,169 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
+
+mock.module('../config', () => mockConfigModule())
+
+import { Hono } from 'hono'
+import { Database } from 'bun:sqlite'
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
+import { unlinkSync, existsSync } from 'node:fs'
+import webSessions from '../routes/web/sessions'
+import webEnvironments from '../routes/web/environments'
+import { storeReset, storeCreateEnvironment, storeBindSession } from '../store'
+import { initDatabase, resetDbSingleton, getDb } from '../db/sqlite'
+import { issueSessionToken } from '../auth/session'
+
+function freshDb(): Database {
+  try { resetDbSingleton() } catch {}
+  const path = resolve(tmpdir(), `rcs-team-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`)
+  return initDatabase(path)
+}
+
+function createUser(db: Database, role = 'member'): { id: string; username: string } {
+  const id = `usr_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+  db.query(
+    `INSERT INTO users (id, username, password_hash, role, created_at) VALUES ($id, $u, 'h', $r, $now)`,
+  ).run({ $id: id, $u: `user_${id.slice(0, 6)}`, $r: role, $now: now })
+  return { id, username: `user_${id.slice(0, 6)}` }
+}
+
+function createTeam(db: Database, createdBy: string): string {
+  const id = `team_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+  db.query(
+    `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at) VALUES ($id, $n, $s, $by, $now, $now)`,
+  ).run({ $id: id, $n: 'Eng', $s: `eng-${id.slice(0, 6)}`, $by: createdBy, $now: now })
+  db.query(
+    `INSERT INTO team_members (team_id, user_id, role, added_at, added_by) VALUES ($t, $u, 'member', $now, $by)`,
+  ).run({ $t: id, $u: createdBy, $now: now, $by: createdBy })
+  return id
+}
+
+function linkEnvToTeam(db: Database, envId: string, teamId: string): void {
+  db.query(
+    `INSERT OR IGNORE INTO team_environments (team_id, environment_id) VALUES ($t, $e)`,
+  ).run({ $t: teamId, $e: envId })
+}
+
+function authHeader(token: string): Record<string, string> {
+  return { Authorization: `Bearer ${token}` }
+}
+
+function createApp(): Hono {
+  const app = new Hono()
+  app.route('/web', webSessions)
+  app.route('/web', webEnvironments)
+  return app
+}
+
+describe('团队域 session 创建与 environment 可见性', () => {
+  let db: Database
+  let app: Hono
+  let user: { id: string; username: string }
+  let accessToken: string
+  let teamId: string
+  let envId: string
+
+  beforeEach(() => {
+    db = freshDb()
+    app = createApp()
+    user = createUser(db)
+    teamId = createTeam(db, user.id)
+
+    // Register an environment and link it to the team
+    const env = storeCreateEnvironment({ secret: 'secret', machineName: 'dev', username: user.id })
+    envId = env.id
+    linkEnvToTeam(db, envId, teamId)
+
+    // Issue a session token for the user
+    const { accessToken: at } = issueSessionToken(user.id, db)
+    accessToken = at
+  })
+
+  test('团队域新建 session 应设 visibility=team 并绑 team owner', async () => {
+    const res = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...authHeader(accessToken) },
+      body: JSON.stringify({
+        title: 'Team Session',
+        environment_id: envId,
+        team_id: teamId,
+      }),
+    })
+    expect(res.status).toBe(200)
+    const session = await res.json()
+
+    // Bug A: visibility 应为 'team'，不是 'private'
+    expect(session.visibility).toBe('team')
+
+    // session_owners 应有 owner_type='team', owner_id=teamId
+    const owners = db
+      .query('SELECT owner_type, owner_id FROM session_owners WHERE session_id = $sid')
+      .all({ $sid: session.id }) as Array<{ owner_type: string; owner_id: string }>
+    const teamOwner = owners.find(o => o.owner_type === 'team')
+    expect(teamOwner).toBeDefined()
+    expect(teamOwner!.owner_id).toBe(teamId)
+  })
+
+  test('团队域 session 应被 team 成员可见', async () => {
+    // Create a session in team context
+    const createRes = await app.request('/web/sessions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...authHeader(accessToken) },
+      body: JSON.stringify({
+        title: 'Team Session',
+        environment_id: envId,
+        team_id: teamId,
+      }),
+    })
+    const session = await createRes.json()
+
+    // Add another team member
+    const member2 = createUser(db)
+    db.query(
+      `INSERT INTO team_members (team_id, user_id, role, added_at, added_by) VALUES ($t, $u, 'member', $now, $by)`,
+    ).run({ $t: teamId, $u: member2.id, $now: new Date().toISOString(), $by: user.id })
+
+    // Member2 should be able to resolve the session (not 403)
+    const { accessToken: at2 } = issueSessionToken(member2.id, db)
+    const getRes = await app.request(`/web/sessions/${session.id}`, {
+      headers: authHeader(at2),
+    })
+    expect(getRes.status).not.toBe(403)
+    // Should be 200 (session visible to team member)
+    expect(getRes.status).toBe(200)
+  })
+
+  test('团队域应能看到属于该 team 的 environment', async () => {
+    const res = await app.request('/web/environments', {
+      headers: authHeader(accessToken),
+    })
+    expect(res.status).toBe(200)
+    const envs = await res.json()
+    expect(Array.isArray(envs)).toBe(true)
+    expect(envs.length).toBeGreaterThanOrEqual(1)
+
+    // The team-linked env should have team_id and team_name
+    const teamEnv = envs.find((e: { team_id?: string }) => e.team_id === teamId)
+    expect(teamEnv).toBeDefined()
+    expect(teamEnv.team_name).toBe('Eng')
+  })
+
+  test('个人域不应看到 team 的 environment', async () => {
+    // Create a user with no team membership
+    const solo = createUser(db)
+    const { accessToken: at } = issueSessionToken(solo.id, db)
+
+    const res = await app.request('/web/environments', {
+      headers: authHeader(at),
+    })
+    expect(res.status).toBe(200)
+    const envs = await res.json()
+    // Solo user should NOT see the team's environment (only admin sees all)
+    const teamEnv = envs.find((e: { team_id?: string }) => e.team_id === teamId)
+    expect(teamEnv).toBeUndefined()
+  })
+})

package/packages/remote-control-server/src/__tests__/teams.test.ts

@@ -1479,6 +1479,13 @@ describe('POST /web/environments/:id/transfer', () => {
   })
 
   test('team admin → 200', async () => {
+    // teamAdmin must also be admin/owner in the target team (security fix)
+    addTeamMember(db, {
+      teamId: targetTeam.id,
+      userId: teamAdmin.id,
+      role: 'admin',
+      addedBy: owner.id,
+    })
     const res = await app.request(`/web/environments/${envId}/transfer`, {
       method: 'POST',
       headers: {

package/packages/remote-control-server/src/auth/csrf.ts

@@ -40,9 +40,7 @@ export async function csrfCheck(c: Context, next: Next) {
   // Support ALLOWED_ORIGINS env variable (comma-separated)
   const envOrigins =
     (c.env?.ALLOWED_ORIGINS as string | undefined) ??
-    (typeof process !== 'undefined'
-      ? process.env.ALLOWED_ORIGINS
-      : undefined)
+    (typeof process !== 'undefined' ? process.env.ALLOWED_ORIGINS : undefined)
   if (envOrigins) {
     for (const o of envOrigins.split(',')) {
       const trimmed = o.trim()

package/packages/remote-control-server/src/auth/middleware.ts

@@ -62,8 +62,8 @@ export function extractWebSocketAuthToken(c: Context): string | undefined {
 /**
  * Unified authentication middleware — supports two modes:
  *
- * 1. **Token mode** (Web UI): Bearer token resolved via server-side lookup → username injected
- * 2. **API Key mode** (CLI bridge): Valid API key + X-Username header → username injected
+ * 1. **Token mode** (Web UI): Bearer token resolved via server-side lookup → userId injected
+ * 2. **API Key mode** (CLI bridge): Valid API key + X-Username header → userId injected
  */
 export async function apiKeyAuth(c: Context, next: Next) {
   const token = extractBearerToken(c)
@@ -71,7 +71,7 @@ export async function apiKeyAuth(c: Context, next: Next) {
   // Try token authentication (Web UI)
   const tokenUsername = resolveToken(token)
   if (tokenUsername) {
-    c.set('username', tokenUsername)
+    c.set('userId', tokenUsername)
     await next()
     return
   }
@@ -81,7 +81,7 @@ export async function apiKeyAuth(c: Context, next: Next) {
     // Extract username from X-Username header or ?username= query param
     const username = c.req.header('X-Username') || c.req.query('username')
     if (username) {
-      c.set('username', username)
+      c.set('userId', username)
     }
     await next()
     return
@@ -223,6 +223,15 @@ export async function sessionAuth(c: Context, next: Next) {
       }
     } catch (err) {
       console.warn('[sessionAuth] DB resolution failed:', err)
+      return c.json(
+        {
+          error: {
+            type: 'service_unavailable',
+            message: 'Database unavailable — cannot resolve session token',
+          },
+        },
+        503,
+      )
     }
   }
 

package/packages/remote-control-server/src/index.ts

@@ -66,14 +66,17 @@ try {
   console.warn('[RCS] Failed to reap expired sessions:', err)
 }
 
-const reapInterval = setInterval(() => {
-  try {
-    const db = getDb()
-    reapExpiredSessions(db)
-  } catch {
-    // ignore — DB may not be available
-  }
-}, 60 * 60 * 1000) // every hour
+const reapInterval = setInterval(
+  () => {
+    try {
+      const db = getDb()
+      reapExpiredSessions(db)
+    } catch {
+      // ignore — DB may not be available
+    }
+  },
+  60 * 60 * 1000,
+) // every hour
 
 if (reapInterval.unref) {
   reapInterval.unref()

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -27,14 +27,14 @@ async function bridgeAuth(c: Context, next: Next) {
   if (bearer) {
     // Admin API key
     if (validateApiKey(bearer)) {
-      c.set('username', c.req.header('X-Username') || c.req.query('username'))
+      c.set('userId', c.req.header('X-Username') || c.req.query('username'))
       await next()
       return
     }
     // In-memory token
     const username = resolveToken(bearer)
     if (username) {
-      c.set('username', username)
+      c.set('userId', username)
       await next()
       return
     }
@@ -47,8 +47,9 @@ async function bridgeAuth(c: Context, next: Next) {
         await next()
         return
       }
-    } catch {
-      // DB not available
+    } catch (err) {
+      console.error('[bridge] DB error during session token resolution:', err)
+      return c.json({ error: 'Database unavailable' }, 503)
     }
   }
   // Fall back to apiKeyAuth (handles X-Username + API key from body/header)
@@ -59,7 +60,7 @@ async function bridgeAuth(c: Context, next: Next) {
 app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
   const body = await c.req.json()
   const userId = c.get('userId') as string | undefined
-  const username = (c.get('username') as string | undefined) || userId
+  const username = userId
   const teamId = c.req.header('X-Team-Id')
 
   // Validate team if X-Team-Id is provided
@@ -102,8 +103,9 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
           )
         }
       }
-    } catch {
-      // DB not available — skip team validation
+    } catch (err) {
+      console.error('[bridge] DB error during team validation:', err)
+      return c.json({ error: 'Database unavailable' }, 503)
     }
   }
 
@@ -116,8 +118,9 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
       db.query(
         'INSERT OR IGNORE INTO team_environments (team_id, environment_id) VALUES ($teamId, $envId)',
       ).run({ $teamId: teamId, $envId: result.environment_id })
-    } catch {
-      // DB not available
+    } catch (err) {
+      console.error('[bridge] DB error during team-environment link:', err)
+      return c.json({ error: 'Database unavailable' }, 503)
     }
   }
 

package/packages/remote-control-server/src/routes/v1/sessions.ts

@@ -16,7 +16,7 @@ const app = new Hono()
 /** POST /v1/sessions — Create session */
 app.post('/', acceptCliHeaders, apiKeyAuth, async c => {
   const body = await c.req.json()
-  const username = c.get('username')
+  const username = c.get('userId')
   const session = createSession({ ...body, username })
 
   // Create work item if environment is specified

package/packages/remote-control-server/src/routes/web/auth-routes.ts

@@ -452,7 +452,9 @@ app.post('/join', async c => {
       // Re-check invitation state inside the transaction (may have changed).
       // Only check uses >= max_uses — consumed_at is set conditionally below.
       const currentInv = db
-        .query('SELECT uses, max_uses FROM invitations WHERE token_hash = $hash')
+        .query(
+          'SELECT uses, max_uses FROM invitations WHERE token_hash = $hash',
+        )
         .get({ $hash: tokenHash }) as { uses: number; max_uses: number } | null
 
       if (!currentInv || currentInv.uses >= currentInv.max_uses) {

package/packages/remote-control-server/src/routes/web/auth.ts

@@ -13,7 +13,8 @@ app.all('/bind', c => {
     {
       error: {
         type: 'gone',
-        message: '/web/bind has been removed. Use authenticated session creation instead.',
+        message:
+          '/web/bind has been removed. Use authenticated session creation instead.',
       },
     },
     410,

package/packages/remote-control-server/src/routes/web/environments.ts

@@ -4,14 +4,32 @@ import { config } from '../../config'
 import { listActiveEnvironmentsResponse } from '../../services/environment'
 import { listWebSessionsByOwnerUuid } from '../../services/session'
 import { storeListActiveEnvironments } from '../../store'
+import { getDb } from '../../db/sqlite'
 
 const app = new Hono()
 
-/** GET /web/environments — List active environments (UUID-based, no user filtering) */
+/** GET /web/environments — List active environments.
+ *  Admin sees all. Non-admin sees only environments linked to teams they
+ *  belong to, plus environments with no team association (personal space). */
 app.get('/environments', sessionAuth, async c => {
-  // Environments are shared across all UUIDs for now
-  const envs = listActiveEnvironmentsResponse()
-  return c.json(envs, 200)
+  const userId = c.get('userId') as string
+  const isAdmin = c.get('isAdmin') as boolean
+
+  const allEnvs = listActiveEnvironmentsResponse()
+
+  if (isAdmin) {
+    return c.json(allEnvs, 200)
+  }
+
+  // Resolve the user's team memberships so we can filter environments.
+  const db = getDb()
+  const teamRows = db
+    .query('SELECT team_id FROM team_members WHERE user_id = $userId')
+    .all({ $userId: userId }) as Array<{ team_id: string }>
+  const teamIds = new Set(teamRows.map(r => r.team_id))
+
+  const filtered = allEnvs.filter(env => !env.team_id || teamIds.has(env.team_id))
+  return c.json(filtered, 200)
 })
 
 /** GET /web/server-info — Aggregate server status for Web UI identity panel */

package/packages/remote-control-server/src/routes/web/sessions.ts

@@ -32,18 +32,22 @@ const app = new Hono()
  * X-User-Id header for a real user identity. If no valid identity is
  * found, returns null — the session will be orphaned (admin-visible).
  */
-function resolveBindUserId(
-  c: import('hono').Context,
-): string | null {
-  const uuid = c.get('userId')!
-  if (uuid !== SYSTEM_USER_ID) return uuid
-
-  // API key auth — check X-User-Id header for real user identity
-  const headerUserId = c.req.header('X-User-Id')
-  if (headerUserId && headerUserId !== SYSTEM_USER_ID) {
-    return headerUserId
+function resolveBindUserId(c: import('hono').Context): string | null {
+  const userId = c.get('userId')
+  if (!userId || userId === SYSTEM_USER_ID) {
+    // API key auth — only admin can use X-User-Id to bind on behalf of a user
+    const isAdmin = c.get('isAdmin')
+    if (!isAdmin) {
+      return null // non-admin API key cannot create sessions as another user
+    }
+    const headerUserId = c.req.header('X-User-Id')
+    if (headerUserId && headerUserId !== SYSTEM_USER_ID) {
+      console.log(`[audit] API key created session as user ${headerUserId}`)
+      return headerUserId
+    }
+    return null // API key without X-User-Id → orphan session (admin-visible)
   }
-  return null
+  return userId
 }
 
 /** POST /web/sessions — Create a session from web UI */
@@ -81,14 +85,22 @@ app.post('/sessions', sessionAuth, async c => {
     }
   }
 
+  const teamId = typeof body.team_id === 'string' ? body.team_id : null
+
   const session = createSession({
     environment_id: body.environment_id || null,
     title: body.title || 'New Session',
     source: 'web',
     permission_mode: body.permission_mode || 'default',
+    visibility: teamId ? 'team' : 'private',
   })
 
-  // Auto-bind to creator's UUID (skip for system/API key without real user)
+  // Bind team owner first (if creating in team context), then user owner.
+  // Team ownership makes the session visible to all team members; user
+  // ownership gives the creator explicit access.
+  if (teamId) {
+    storeBindSession(session.id, teamId, 'team')
+  }
   if (bindUserId) {
     storeBindSession(session.id, bindUserId)
   }

package/packages/remote-control-server/src/routes/web/shares.ts

@@ -14,7 +14,11 @@ interface SessionOwnerRow {
 /**
  * Check if a user is a member of a given team.
  */
-function isTeamMember(userId: string, teamId: string, db: ReturnType<typeof getDb>): boolean {
+function isTeamMember(
+  userId: string,
+  teamId: string,
+  db: ReturnType<typeof getDb>,
+): boolean {
   const row = db
     .query(
       'SELECT user_id FROM team_members WHERE team_id = $teamId AND user_id = $userId',
@@ -379,7 +383,12 @@ app.get(
 
     if (!isGrantee) {
       return c.json(
-        { error: { type: 'forbidden', message: 'Not authorized for this share' } },
+        {
+          error: {
+            type: 'forbidden',
+            message: 'Not authorized for this share',
+          },
+        },
         403,
       )
     }

package/packages/remote-control-server/src/routes/web/teams.ts

@@ -154,10 +154,7 @@ app.post('/teams', withAuth, async c => {
       )
       .get() as { id: string } | null
     if (!adminUser) {
-      return c.json(
-        { error: 'No admin user available to create team' },
-        400,
-      )
+      return c.json({ error: 'No admin user available to create team' }, 400)
     }
     createdBy = adminUser.id
   }
@@ -826,11 +823,11 @@ app.post('/environments/:id/transfer', withAuth, async c => {
 
   // Check caller is owner/admin of the target team
   const targetRole = getTeamRole(toTeamId, user)
-  if (!user.isAdmin && (!targetRole || (targetRole !== 'owner' && targetRole !== 'admin'))) {
-    return c.json(
-      { error: 'Not authorized in target team' },
-      403,
-    )
+  if (
+    !user.isAdmin &&
+    (!targetRole || (targetRole !== 'owner' && targetRole !== 'admin'))
+  ) {
+    return c.json({ error: 'Not authorized in target team' }, 403)
   }
 
   // Remove from source team

package/packages/remote-control-server/src/services/environment.ts

@@ -5,6 +5,7 @@ import {
   storeGetEnvironment,
   storeUpdateEnvironment,
   storeListActiveEnvironments,
+  storeListActiveEnvironmentsWithTeam,
   storeListActiveEnvironmentsByUsername,
   storeListAcpAgentsByChannelGroup,
   storeListSessionsByEnvironment,
@@ -15,7 +16,9 @@ import type {
 } from '../types/api'
 import type { EnvironmentRecord } from '../store'
 
-function toResponse(row: EnvironmentRecord): EnvironmentResponse {
+function toResponse(
+  row: EnvironmentRecord & { teamId?: string | null; teamName?: string | null },
+): EnvironmentResponse {
   return {
     id: row.id,
     machine_name: row.machineName,
@@ -27,6 +30,8 @@ function toResponse(row: EnvironmentRecord): EnvironmentResponse {
     worker_type: row.workerType,
     channel_group_id: row.bridgeId,
     capabilities: row.capabilities,
+    team_id: row.teamId ?? null,
+    team_name: row.teamName ?? null,
   }
 }
 
@@ -136,13 +141,13 @@ export function listActiveEnvironments() {
 }
 
 export function listActiveEnvironmentsResponse(): EnvironmentResponse[] {
-  return storeListActiveEnvironments().map(toResponse)
+  return storeListActiveEnvironmentsWithTeam().map(r => toResponse(r))
 }
 
 export function listActiveEnvironmentsByUsername(
   username: string,
 ): EnvironmentResponse[] {
-  return storeListActiveEnvironmentsByUsername(username).map(toResponse)
+  return storeListActiveEnvironmentsByUsername(username).map(r => toResponse(r))
 }
 
 export function reconnectEnvironment(envId: string) {