@saluzi/saluzi-edu 0.2.20 → 0.2.21

package/packages/remote-control-server/src/__tests__/teams.test.ts

@@ -1587,6 +1587,125 @@ describe('POST /web/environments/:id/transfer', () => {
     expect([200, 201]).toContain(res.status)
     // Detailed session visibility is tested in session-visibility.test.ts
   })
+
+  test('personal env (no source team) → target team admin can claim → 200', async () => {
+    // Use a fresh env id that's not in any team
+    const personalEnvId = `env_${randomUUID().replace(/-/g, '')}`
+    const res = await app.request(
+      `/web/environments/${personalEnvId}/transfer`,
+      {
+        method: 'POST',
+        headers: {
+          ...authHeader(owner.accessToken),
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ toTeamId: targetTeam.id }),
+      },
+    )
+    expect(res.status).toBe(200)
+    // Verify the link exists
+    const linkRow = db
+      .query(
+        'SELECT team_id FROM team_environments WHERE environment_id = $envId',
+      )
+      .get({ $envId: personalEnvId }) as { team_id: string } | null
+    expect(linkRow?.team_id).toBe(targetTeam.id)
+  })
+
+  test('personal env → target team member (non-admin) → 403', async () => {
+    const personalEnvId = `env_${randomUUID().replace(/-/g, '')}`
+    // teamMember is only a 'member' of sourceTeam, not targetTeam at all
+    const res = await app.request(
+      `/web/environments/${personalEnvId}/transfer`,
+      {
+        method: 'POST',
+        headers: {
+          ...authHeader(teamMember.accessToken),
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ toTeamId: targetTeam.id }),
+      },
+    )
+    expect(res.status).toBe(403)
+  })
+})
+
+describe('DELETE /web/teams/:id/environments/:envId', () => {
+  let app: Hono
+  let db: Database
+  let admin: TestUser
+  let owner: TestUser
+  let teamMember: TestUser
+  let team: { id: string }
+  let envId: string
+
+  beforeEach(async () => {
+    db = freshDb()
+    app = createApp()
+    admin = await setupAdmin(app)
+    owner = await createAndLoginUser(db, app, {
+      username: 'owner2',
+      role: 'member',
+    })
+    teamMember = await createAndLoginUser(db, app, {
+      username: 'tmember2',
+      role: 'member',
+    })
+    team = createTeamDirectly(db, {
+      name: 'Team2',
+      slug: 'team2',
+      createdBy: owner.id,
+    })
+    addTeamMember(db, {
+      teamId: team.id,
+      userId: teamMember.id,
+      role: 'member',
+      addedBy: owner.id,
+    })
+    envId = `env_${randomUUID().replace(/-/g, '')}`
+    db.query(
+      `INSERT INTO team_environments (team_id, environment_id) VALUES ($teamId, $envId)`,
+    ).run({ $teamId: team.id, $envId: envId })
+  })
+
+  test('team owner → 200, link removed', async () => {
+    const res = await app.request(
+      `/web/teams/${team.id}/environments/${envId}`,
+      {
+        method: 'DELETE',
+        headers: authHeader(owner.accessToken),
+      },
+    )
+    expect(res.status).toBe(200)
+    const row = db
+      .query(
+        'SELECT team_id FROM team_environments WHERE environment_id = $envId',
+      )
+      .get({ $envId: envId })
+    expect(row).toBeNull()
+  })
+
+  test('team member (non-admin) → 403', async () => {
+    const res = await app.request(
+      `/web/teams/${team.id}/environments/${envId}`,
+      {
+        method: 'DELETE',
+        headers: authHeader(teamMember.accessToken),
+      },
+    )
+    expect(res.status).toBe(403)
+  })
+
+  test('system admin → 200', async () => {
+    const res = await app.request(
+      `/web/teams/${team.id}/environments/${envId}`,
+      {
+        method: 'DELETE',
+        headers: authHeader(admin.accessToken),
+      },
+    )
+    expect(res.status).toBe(200)
+  })
 })
 
 // ===========================================================================

package/packages/remote-control-server/src/config.ts

@@ -12,6 +12,9 @@ export const config = {
     .split(',')
     .map(origin => origin.trim())
     .filter(Boolean),
+  /** Whether the web UI allows open user self-registration (POST /web/auth/register).
+   *  When false, only admin invitation (/join) can create new users. Default true. */
+  allowRegistration: process.env.RCS_ALLOW_REGISTRATION !== 'false',
   /** Bun WebSocket idle timeout (seconds). Bun sends protocol-level pings after
    *  this many seconds of no received data. Must be shorter than any reverse
    *  proxy's idle timeout (nginx default 60s, Cloudflare 100s). Default 30s. */

package/packages/remote-control-server/src/db/schema.sql

@@ -87,7 +87,10 @@ CREATE TABLE IF NOT EXISTS environments (
   worker_type TEXT NOT NULL DEFAULT 'claude_code',
   status TEXT NOT NULL DEFAULT 'active',
   last_poll_at TEXT,
-  created_at TEXT NOT NULL
+  created_at TEXT NOT NULL,
+  owner_user_id TEXT,
+  claim_token TEXT,
+  claim_expires_at TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -114,3 +117,5 @@ CREATE INDEX IF NOT EXISTS idx_sessions_visibility ON sessions(visibility);
 CREATE INDEX IF NOT EXISTS idx_sessions_environment ON sessions(environment_id);
 CREATE INDEX IF NOT EXISTS idx_session_tokens_user ON session_tokens(user_id);
 CREATE INDEX IF NOT EXISTS idx_environments_team ON environments(team_id);
+CREATE INDEX IF NOT EXISTS idx_environments_owner_user ON environments(owner_user_id);
+CREATE INDEX IF NOT EXISTS idx_environments_claim_token ON environments(claim_token);

package/packages/remote-control-server/src/db/sqlite.ts

@@ -11,7 +11,9 @@ let _dbPath: string | null = null
 
 /**
  * Run all schema migrations on the given database.
- * Idempotent — uses CREATE TABLE IF NOT EXISTS.
+ * Idempotent — uses CREATE TABLE IF NOT EXISTS for new tables, plus
+ * ALTER TABLE ADD COLUMN for columns added to existing tables (gated by
+ * PRAGMA table_info so re-running on an already-migrated DB is a no-op).
  * Reads schema.sql and executes as a single db.exec() call,
  * which correctly handles semicolons inside CHECK constraints.
  */
@@ -20,9 +22,52 @@ export function migrateDatabase(db: Database): void {
   const schema = readFileSync(schemaPath, 'utf8')
 
   db.exec('PRAGMA foreign_keys = ON')
+  // Run ALTER TABLE migrations BEFORE db.exec(schema) — schema.sql's
+  // CREATE INDEX statements reference the new columns, so the columns
+  // must exist before the indexes can be created. CREATE TABLE IF NOT
+  // EXISTS skips existing tables (so the ALTER adds the missing columns
+  // to pre-existing tables); on a fresh DB the ALTER is a no-op because
+  // the table doesn't exist yet, then db.exec(schema) creates it with
+  // all columns.
+  migrateEnvironmentsColumns(db)
   db.exec(schema)
 }
 
+/**
+ * Add columns to pre-existing `environments` tables that were created
+ * before owner_user_id / claim_token / claim_expires_at existed.
+ * CREATE TABLE IF NOT EXISTS skips existing tables entirely, so without
+ * this the new columns would never appear on upgraded DBs. Must run
+ * BEFORE db.exec(schema) because schema.sql's CREATE INDEX statements
+ * reference the new columns. On a fresh DB (table doesn't exist yet),
+ * skip entirely — db.exec(schema) will create the table with all columns.
+ */
+function migrateEnvironmentsColumns(db: Database): void {
+  // Check if environments table exists at all. On a fresh DB it won't,
+  // and ALTER TABLE on a non-existent table throws. PRAGMA table_info
+  // returns empty for non-existent tables, but ALTER still errors — so
+  // gate on table existence via sqlite_master.
+  const tableExists = db
+    .query(
+      "SELECT 1 FROM sqlite_master WHERE type='table' AND name='environments'",
+    )
+    .get() as { 1: number } | undefined
+  if (!tableExists) return
+
+  const cols = db.query('PRAGMA table_info(environments)').all() as Array<{
+    name: string
+  }>
+  const names = new Set(cols.map(c => c.name))
+  const addIfMissing = (name: string, defn: string): void => {
+    if (!names.has(name)) {
+      db.exec(`ALTER TABLE environments ADD COLUMN ${name} ${defn}`)
+    }
+  }
+  addIfMissing('owner_user_id', 'TEXT')
+  addIfMissing('claim_token', 'TEXT')
+  addIfMissing('claim_expires_at', 'TEXT')
+}
+
 /**
  * Resolve the default database path.
  * - Uses RCS_DB_PATH env var if set

package/packages/remote-control-server/src/registerRoutes.ts

@@ -56,6 +56,10 @@ export function registerRoutes(
   app.get('/code', ss({ root: webDir, path: 'index.html' }))
   app.get('/code/', ss({ root: webDir, path: 'index.html' }))
   app.get('/code/:sessionId', ss({ root: webDir, path: 'index.html' }))
+  // /code/s/:shareToken — share landing page (two-segment path, not matched by /code/:sessionId)
+  app.get('/code/s/:shareToken', ss({ root: webDir, path: 'index.html' }))
+  // /code/claim/:claimToken — environment claim landing page
+  app.get('/code/claim/:claimToken', ss({ root: webDir, path: 'index.html' }))
 
   // v1 Environment routes
   app.route('/v1/environments', v1Environments)
@@ -107,9 +111,21 @@ export function registerRoutes(
 
   // SPA fallback — serve index.html for frontend routes handled by React Router.
   // Must be registered AFTER all API routes to avoid intercepting /web/*, /v1/*, /acp/* etc.
-  const spaPaths = ['/login', '/setup', '/join', '/settings', '/teams']
+  const spaPaths = [
+    '/login',
+    '/register',
+    '/setup',
+    '/join',
+    '/settings',
+    '/teams',
+    '/admin',
+    '/share',
+  ]
   for (const p of spaPaths) {
     app.get(p, ss({ root: webDir, path: 'index.html' }))
     app.get(`${p}/*`, ss({ root: webDir, path: 'index.html' }))
   }
+
+  // Root redirect → /code/ (main dashboard entry point)
+  app.get('/', c => c.redirect('/code/'))
 }

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -1,5 +1,6 @@
 import { Hono } from 'hono'
 import type { Context, Next } from 'hono'
+import { randomUUID } from 'node:crypto'
 import {
   registerEnvironment,
   deregisterEnvironment,
@@ -62,6 +63,18 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
   const userId = c.get('userId') as string | undefined
   const username = userId
   const teamId = c.req.header('X-Team-Id')
+  const headerUserId = c.req.header('X-User-Id')
+
+  // X-User-Id explicitly sets env.owner_user_id. If both X-User-Id and
+  // X-Team-Id are absent, the env is "unowned" — a claim_token is generated
+  // and returned so the worker can print a /code/claim/<token> URL for the
+  // first logged-in user to claim ownership.
+  const ownerUserId = headerUserId || null
+  const needsClaim = !ownerUserId && !teamId
+  const claimToken = needsClaim ? `clm_${randomUUID().replace(/-/g, '')}` : null
+  const claimExpiresAt = claimToken
+    ? new Date(Date.now() + 24 * 60 * 60 * 1000)
+    : null
 
   // Validate team if X-Team-Id is provided
   if (teamId && userId) {
@@ -109,7 +122,13 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
     }
   }
 
-  const result = registerEnvironment({ ...body, username })
+  const result = registerEnvironment({
+    ...body,
+    username,
+    ownerUserId,
+    claimToken,
+    claimExpiresAt,
+  })
 
   // Link environment to team if X-Team-Id was provided
   if (teamId) {
@@ -124,6 +143,21 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
     }
   }
 
+  // Append claim info to response so worker can print the claim URL.
+  // Worker reads `claim_url` and prints it to terminal; first logged-in
+  // user to visit claims the env.
+  if (claimToken) {
+    const host = c.req.header('host') || ''
+    const proto = c.req.header('x-forwarded-proto') || 'http'
+    const claimUrl = host
+      ? `${proto}://${host}/code/claim/${claimToken}`
+      : `/code/claim/${claimToken}`
+    return c.json(
+      { ...result, claim_token: claimToken, claim_url: claimUrl },
+      200,
+    )
+  }
+
   return c.json(result, 200)
 })
 

package/packages/remote-control-server/src/routes/v1/sessions.ts

@@ -10,14 +10,60 @@ import {
 import { createWorkItem } from '../../services/work-dispatch'
 import { apiKeyAuth, acceptCliHeaders } from '../../auth/middleware'
 import { publishSessionEvent } from '../../services/transport'
+import { storeBindSession, storeGetEnvironmentOwnership } from '../../store'
 
 const app = new Hono()
 
-/** POST /v1/sessions — Create session */
+/** POST /v1/sessions — Create session.
+ *  Used by replBridge/ACP workers to auto-create their initial session.
+ *  Session ownership: user owner = env.owner_user_id, team owner = env.team_id
+ *  (auto-inherited). If env has no owner_user_id yet (claim flow pending),
+ *  returns 409 so the worker can retry after claim completes. */
 app.post('/', acceptCliHeaders, apiKeyAuth, async c => {
   const body = await c.req.json()
   const username = c.get('userId')
-  const session = createSession({ ...body, username })
+
+  // Resolve env ownership to bind session_owners.
+  let envOwnerUserId: string | null = null
+  let envTeamId: string | null = null
+  if (body.environment_id) {
+    const ownership = storeGetEnvironmentOwnership(body.environment_id)
+    if (ownership) {
+      envOwnerUserId = ownership.ownerUserId
+      envTeamId = ownership.teamId
+      // Claim flow pending: env exists but has no user owner yet. Worker
+      // should retry after claim completes (Q4 = option A).
+      if (!ownership.ownerUserId) {
+        return c.json(
+          {
+            error: {
+              type: 'environment_unowned',
+              message:
+                'Environment has no owner yet; claim it via the printed URL before creating sessions',
+            },
+          },
+          409,
+        )
+      }
+    }
+  }
+
+  const session = createSession({
+    ...body,
+    username,
+    visibility: envTeamId ? 'team' : 'private',
+  })
+
+  // Write session_owners: team owner inherited from env, user owner = env owner.
+  // This is the key fix for the "not your sessions" bug — previously /v1/sessions
+  // only set sessions.username, never wrote session_owners, so the Web UI list
+  // (which filters by session_owners) never showed these sessions.
+  if (envTeamId) {
+    storeBindSession(session.id, envTeamId, 'team')
+  }
+  if (envOwnerUserId) {
+    storeBindSession(session.id, envOwnerUserId, 'user')
+  }
 
   // Create work item if environment is specified
   if (body.environment_id) {

package/packages/remote-control-server/src/routes/web/auth-routes.ts

@@ -377,6 +377,70 @@ app.post('/logout', async c => {
   return c.json({ ok: true })
 })
 
+// GET /register-status — Whether self-registration is open
+app.get('/register-status', c => {
+  return c.json({ allowed: config.allowRegistration })
+})
+
+// POST /register — Self-register a new member account (no team association).
+// Only available when RCS_ALLOW_REGISTRATION !== 'false'.
+app.post('/register', async c => {
+  if (!config.allowRegistration) {
+    return c.json({ error: 'Registration is disabled' }, 403)
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json({ error: 'Invalid JSON' }, 400)
+  }
+
+  const { username, password } = body as {
+    username?: string
+    password?: string
+  }
+
+  if (!username || typeof username !== 'string') {
+    return c.json({ error: 'Username is required' }, 400)
+  }
+  if (!password || typeof password !== 'string') {
+    return c.json({ error: 'Password is required' }, 400)
+  }
+  if (password.length < 8) {
+    return c.json({ error: 'Password must be at least 8 characters' }, 400)
+  }
+
+  const db = getDb()
+  const userId = `usr_${randomUUID().replace(/-/g, '')}`
+  const passwordHash = await hashPasswordAsync(password)
+  const now = new Date().toISOString()
+
+  try {
+    const result = db
+      .query(
+        `INSERT OR IGNORE INTO users (id, username, password_hash, role, created_at)
+         VALUES ($id, $username, $passwordHash, 'member', $now)`,
+      )
+      .run({
+        $id: userId,
+        $username: username,
+        $passwordHash: passwordHash,
+        $now: now,
+      })
+
+    if (result.changes === 0) {
+      return c.json({ error: 'Username already taken' }, 409)
+    }
+  } catch (err) {
+    console.warn('[/register] insert failed:', err)
+    return c.json({ error: 'Registration failed' }, 500)
+  }
+
+  const isHttps = isSecureRequest(c)
+  return issueAndRespond(c, userId, isHttps)
+})
+
 // POST /join — Join via invitation token
 app.post('/join', async c => {
   let body: Record<string, unknown>

package/packages/remote-control-server/src/routes/web/environments.ts

@@ -9,8 +9,9 @@ import { getDb } from '../../db/sqlite'
 const app = new Hono()
 
 /** GET /web/environments — List active environments.
- *  Admin sees all. Non-admin sees only environments linked to teams they
- *  belong to, plus environments with no team association (personal space). */
+ *  Admin sees all. Non-admin sees only environments they own (owner_user_id = me)
+ *  OR environments linked to teams they belong to. Unowned personal envs (no
+ *  owner, no team) are invisible — they're in claim flow pending state. */
 app.get('/environments', sessionAuth, async c => {
   const userId = c.get('userId') as string
   const isAdmin = c.get('isAdmin') as boolean
@@ -28,8 +29,11 @@ app.get('/environments', sessionAuth, async c => {
     .all({ $userId: userId }) as Array<{ team_id: string }>
   const teamIds = new Set(teamRows.map(r => r.team_id))
 
+  // Visible if: env.owner_user_id is me OR env.team_id is one of my teams.
   const filtered = allEnvs.filter(
-    env => !env.team_id || teamIds.has(env.team_id),
+    env =>
+      env.owner_user_id === userId ||
+      (env.team_id !== null && teamIds.has(env.team_id)),
   )
   return c.json(filtered, 200)
 })

package/packages/remote-control-server/src/routes/web/shares.ts

@@ -27,17 +27,6 @@ function isTeamMember(
   return !!row
 }
 
-interface ShareRow {
-  id: string
-  session_id: string
-  granted_to_user: string | null
-  granted_to_team: string | null
-  permission: string
-  expires_at: string | null
-  granted_by: string
-  granted_at: string
-}
-
 /**
  * Helper: check if the current user is the session owner.
  * Returns the userId on success, or a Response on failure.
@@ -112,10 +101,10 @@ function checkSessionOwnership(
 }
 
 /**
- * POST /sessions/:id/share — Create a share for a session.
+ * POST /sessions/:id/shares — Create a share for a session.
  */
 app.post(
-  '/sessions/:id/share',
+  '/sessions/:id/shares',
   async (c, next) => {
     const result = await sessionAuth(c, next)
     if (result) return result
@@ -228,17 +217,18 @@ app.post(
       $now: now,
     })
 
-    return c.json(
-      {
-        id: shareId,
-        shareToken: shareId,
-        share_token: shareId,
-        permission,
-        expiresAt: expiresAt || null,
-        expires_at: expiresAt || null,
-      },
-      201,
-    )
+    // Return { share, shareToken } to match frontend CreateShareResponse type.
+    const share = {
+      id: shareId,
+      session_id: sessionId,
+      granted_to_user: grantedTo.userId || null,
+      granted_to_team: grantedTo.teamId || null,
+      permission,
+      expires_at: expiresAt || null,
+      created_at: now,
+      created_by: userId,
+    }
+    return c.json({ share, shareToken: shareId }, 201)
   },
 )
 
@@ -260,11 +250,12 @@ app.get(
     const shares = db
       .query(
         `SELECT id, session_id, granted_to_user, granted_to_team,
-                permission, expires_at, granted_by, granted_at
+                permission, expires_at,
+                granted_by AS created_by, granted_at AS created_at
          FROM session_shares
          WHERE session_id = $sid`,
       )
-      .all({ $sid: sessionId }) as ShareRow[]
+      .all({ $sid: sessionId })
 
     return c.json(shares, 200)
   },