@saluzi/saluzi-edu 0.2.65 → 0.2.67

package/packages/remote-control-server/src/routes/v1/sessions.ts

@@ -13,6 +13,7 @@ import { createWorkItem } from '../../services/work-dispatch'
 import { publishSessionEvent } from '../../services/transport'
 import { loadPersistedEvents } from '../../services/event-persistence'
 import { getEventBus } from '../../transport/event-bus'
+import { touchEnvironmentActivity } from '../../services/environment'
 import { acceptCliHeaders, apiKeyAuth } from '../../auth/middleware'
 import {
   bridgeAuth,
@@ -157,6 +158,19 @@ app.post('/', acceptCliHeaders, apiKeyAuth, async c => {
   const body = await c.req.json()
   const username = c.get('userId')
 
+  // Worker liveness: this route is the claim-wait loop's only traffic (an
+  // unowned env retries POST /v1/sessions every 5s until the claim URL is
+  // opened, up to 24h). Without touching the env here the disconnect monitor
+  // flips it to 'disconnected' after RCS_DISCONNECT_TIMEOUT, and when the
+  // claim finally lands the session is created but createWorkItem rejects
+  // the non-active env — a session that exists yet never receives work, so
+  // the CLI polls 204s forever and never connects. Touch BEFORE the unowned
+  // 409 so the retry loop itself keeps the env alive; touchEnvironmentActivity
+  // also reactivates an env the monitor already flipped.
+  if (typeof body.environment_id === 'string' && body.environment_id) {
+    touchEnvironmentActivity(body.environment_id)
+  }
+
   // Resolve env ownership to bind session_owners.
   let envOwnerUserId: string | null = null
   let envTeamId: string | null = null
@@ -439,18 +453,34 @@ async function performAttach(
   // owns (the env it just registered). Admin may attach on behalf.
   const ownership = storeGetEnvironmentOwnership(envId)
   if (!ownership?.ownerUserId) {
-    return c.json(
-      {
-        error: {
-          type: 'environment_unowned',
-          message:
-            'Environment has no owner yet; claim it via the printed URL before attaching sessions',
+    // The documented self-hosted worker setup authenticates with a bare
+    // RCS_API_KEYS admin key (SALUZI_BRIDGE_OAUTH_TOKEN, no
+    // SALUZI_BRIDGE_USERNAME) — its env is unowned until claimed, so a hard
+    // 409 here made `/rc --attach <id>` fail out of the box with a claim URL
+    // the direct-attach path never prints. Bare admin keys are trusted
+    // credentials (ensureAttachAccess already audited their session-manage
+    // bypass) — allow the bind. Identity callers still get the claim-flow
+    // guidance (the wait-mode CLI prints the URL).
+    if (!caller.isApiAdmin || caller.hasIdentity) {
+      return c.json(
+        {
+          error: {
+            type: 'environment_unowned',
+            message:
+              'Environment has no owner yet; claim it via the printed URL before attaching sessions',
+          },
         },
-      },
-      409,
+        409,
+      )
+    }
+    log(
+      `[audit] Bare admin API key attached session ${sessionId} to unowned env ${envId}`,
     )
   }
-  if (!caller.isApiAdmin && ownership.ownerUserId !== caller.uuid) {
+  // Optional chain: the bare-admin fallthrough above leaves ownership
+  // possibly-null/unowned here — but isApiAdmin is true on that path, so the
+  // short-circuit keeps the semantics identical.
+  if (!caller.isApiAdmin && ownership?.ownerUserId !== caller.uuid) {
     return c.json(
       {
         error: {

package/packages/remote-control-server/src/routes/web/artifacts.ts

@@ -0,0 +1,249 @@
+import { Hono } from 'hono'
+import { getDb } from '../../db/sqlite'
+import { sessionAuth } from '../../auth/middleware'
+import { SYSTEM_USER_ID } from '../../auth/constants'
+import { isSessionVisibleToUser } from '../../services/session'
+import {
+  ArtifactError,
+  ARTIFACT_ALLOWED_TTLS,
+  canManageArtifact,
+  createArtifact,
+  deleteArtifact,
+  getArtifactRow,
+  isArtifactVisibleToUser,
+  listArtifactsForUser,
+  type ArtifactTtl,
+} from '../../services/artifacts'
+
+const app = new Hono()
+
+/**
+ * Web-UI artifact routes (mounted under /web with CSRF protection).
+ *
+ * - GET  /web/artifacts          — artifacts visible to the caller
+ *                                  (optionally filtered by ?session_id= / ?team_id=)
+ * - POST /web/artifacts          — create from the gallery editor
+ * - GET  /web/artifacts/:id      — metadata (visibility-checked)
+ * - DELETE /web/artifacts/:id    — remove (creator / session owner / team admin)
+ */
+
+/** Team membership check reused for ?team_id= filtering. */
+function isTeamMember(
+  userId: string,
+  teamId: string,
+  db: ReturnType<typeof getDb>,
+): boolean {
+  const row = db
+    .query(
+      'SELECT 1 FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: userId })
+  return !!row
+}
+
+type ArtifactResponseRow = {
+  id: string
+  session_id: string | null
+  team_id: string | null
+  title: string | null
+  content_type: string
+  size: number
+  version: number
+  created_by: string | null
+  created_at: string
+  updated_at: string
+  expires_at: string | null
+}
+
+function toResponse(row: ArtifactResponseRow) {
+  return {
+    id: row.id,
+    session_id: row.session_id,
+    team_id: row.team_id,
+    title: row.title,
+    content_type: row.content_type,
+    size: row.size,
+    version: row.version,
+    created_by: row.created_by,
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+    expires_at: row.expires_at,
+    url: `/v1/artifacts/${row.id}/content`,
+  }
+}
+
+app.get('/artifacts', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const db = getDb()
+
+  const sessionId = c.req.query('session_id')
+  const teamId = c.req.query('team_id')
+
+  // Explicit filters narrow the result set but must not leak cross-team rows.
+  if (sessionId) {
+    if (!isAdmin && !isSessionVisibleToUser(sessionId, userId, db)) {
+      return c.json(
+        {
+          error: {
+            type: 'forbidden',
+            message: 'Not authorized for this session',
+          },
+        },
+        403,
+      )
+    }
+  }
+  if (teamId) {
+    if (!isAdmin && !isTeamMember(userId, teamId, db)) {
+      return c.json(
+        { error: { type: 'forbidden', message: 'Not a member of this team' } },
+        403,
+      )
+    }
+  }
+
+  const rows = listArtifactsForUser(userId, { sessionId, teamId }, isAdmin)
+  return c.json(
+    rows.map(row => toResponse(row)),
+    200,
+  )
+})
+
+app.get('/artifacts/:id', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const id = c.req.param('id')!
+
+  const row = getArtifactRow(id)
+  if (!row) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Artifact not found' } },
+      404,
+    )
+  }
+  if (!isArtifactVisibleToUser(id, userId, isAdmin)) {
+    return c.json(
+      {
+        error: {
+          type: 'forbidden',
+          message: 'Not authorized for this artifact',
+        },
+      },
+      403,
+    )
+  }
+  return c.json(toResponse(row), 200)
+})
+
+app.post('/artifacts', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json(
+      { error: { type: 'bad_request', message: 'Invalid JSON' } },
+      400,
+    )
+  }
+
+  const html = typeof body.html === 'string' ? body.html : ''
+  if (!html.trim()) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'html is required' } },
+      400,
+    )
+  }
+
+  const title =
+    typeof body.title === 'string' && body.title.trim()
+      ? body.title.trim()
+      : undefined
+
+  let ttl: ArtifactTtl | undefined
+  if (body.ttl !== undefined) {
+    const n =
+      typeof body.ttl === 'number'
+        ? body.ttl
+        : Number.parseInt(String(body.ttl), 10)
+    if (!ARTIFACT_ALLOWED_TTLS.includes(n as ArtifactTtl)) {
+      return c.json(
+        { error: { type: 'bad_request', message: 'ttl must be 7 or 30' } },
+        400,
+      )
+    }
+    ttl = n as ArtifactTtl
+  }
+
+  // Optional session binding — caller must be able to see the session.
+  let sessionId: string | undefined
+  if (typeof body.session_id === 'string' && body.session_id) {
+    const db = getDb()
+    if (!isSessionVisibleToUser(body.session_id, userId, db)) {
+      return c.json(
+        {
+          error: {
+            type: 'forbidden',
+            message: 'Not authorized for this session',
+          },
+        },
+        403,
+      )
+    }
+    sessionId = body.session_id
+  }
+
+  try {
+    const result = createArtifact({
+      html,
+      ttl,
+      sessionId,
+      title,
+      createdBy: userId,
+    })
+    const row = getArtifactRow(result.id)
+    return c.json(
+      row
+        ? toResponse(row)
+        : { id: result.id, expires_at: result.expiresAt },
+      201,
+    )
+  } catch (err) {
+    if (err instanceof ArtifactError) {
+      const status = err.code === 'payload_too_large' ? 413 : 400
+      return c.json({ error: { type: err.code, message: err.message } }, status)
+    }
+    throw err
+  }
+})
+
+app.delete('/artifacts/:id', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const id = c.req.param('id')!
+
+  if (!getArtifactRow(id)) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Artifact not found' } },
+      404,
+    )
+  }
+  if (!canManageArtifact(id, userId, isAdmin)) {
+    return c.json(
+      {
+        error: {
+          type: 'forbidden',
+          message: 'Not authorized to delete this artifact',
+        },
+      },
+      403,
+    )
+  }
+
+  deleteArtifact(id)
+  return c.json({ ok: true }, 200)
+})
+
+export default app

package/packages/remote-control-server/src/routes/web/sessions.ts

@@ -96,6 +96,31 @@ app.post('/sessions', sessionAuth, async c => {
       const session = getSession(sessionId)
       return c.json(toWebSessionResponse(session!), 200)
     }
+
+    // In-process (replBridge) workers register with workerType='repl' and
+    // maxSessions=1 — they can only serve one session at a time. Reject
+    // multi-session creation with a helpful error guiding the user to
+    // `slz rc` (spawn mode). MUST run before createSession: the new session
+    // is created WITH body.environment_id, so checking after would always
+    // see the just-created session and 409 every request (leaving a stray
+    // bound-but-never-dispatched session behind on each retry).
+    if (env?.workerType === 'repl') {
+      const existing = storeListSessionsByEnvironment(env.id).filter(
+        s => !isSessionClosedStatus(s.status),
+      )
+      if (existing.length > 0) {
+        return c.json(
+          {
+            error: {
+              type: 'worker_at_capacity',
+              message:
+                '该 worker 为 in-process 模式（slz 默认），只支持单会话。请用 `slz rc` 启动 spawn 模式 worker 支持多会话。',
+            },
+          },
+          409,
+        )
+      }
+    }
   }
 
   const teamId = typeof body.team_id === 'string' ? body.team_id : null
@@ -120,28 +145,6 @@ app.post('/sessions', sessionAuth, async c => {
 
   // Dispatch work to environment if specified
   if (body.environment_id) {
-    // In-process (replBridge) workers register with workerType='repl' and
-    // maxSessions=1 — they can only serve one session at a time. Reject
-    // multi-session creation with a helpful error guiding the user to
-    // `slz rc` (spawn mode).
-    const env = storeGetEnvironment(body.environment_id)
-    if (env?.workerType === 'repl') {
-      const existing = storeListSessionsByEnvironment(env.id).filter(
-        s => !isSessionClosedStatus(s.status),
-      )
-      if (existing.length > 0) {
-        return c.json(
-          {
-            error: {
-              type: 'worker_at_capacity',
-              message:
-                '该 worker 为 in-process 模式（slz 默认），只支持单会话。请用 `slz rc` 启动 spawn 模式 worker 支持多会话。',
-            },
-          },
-          409,
-        )
-      }
-    }
     try {
       const spawnMode =
         body.spawn_mode === 'worktree' || body.spawn_mode === 'same-dir'