@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/routes/web/environments.ts

@@ -1,44 +1,22 @@
 import { Hono } from 'hono'
-import { uuidAuth, verifyWorkerTokenForEnv } from '../../auth/middleware'
+import { sessionAuth } from '../../auth/middleware'
 import { config } from '../../config'
 import { listActiveEnvironmentsResponse } from '../../services/environment'
 import { listWebSessionsByOwnerUuid } from '../../services/session'
-import { storeGetEnvironment, storeListActiveEnvironments } from '../../store'
+import { storeListActiveEnvironments } from '../../store'
 
 const app = new Hono()
 
 /** GET /web/environments — List active environments (UUID-based, no user filtering) */
-app.get('/environments', uuidAuth, async c => {
+app.get('/environments', sessionAuth, async c => {
   // Environments are shared across all UUIDs for now
   const envs = listActiveEnvironmentsResponse()
   return c.json(envs, 200)
 })
 
-/** POST /web/environments/:id/test-worker-token — Verify a worker token for an environment */
-app.post('/environments/:id/test-worker-token', uuidAuth, async c => {
-  const envId = c.req.param('id')
-  if (!envId) {
-    return c.json(
-      { error: { type: 'bad_request', message: 'Missing environment id' } },
-      400,
-    )
-  }
-  const env = storeGetEnvironment(envId)
-  if (!env) {
-    return c.json(
-      { error: { type: 'not_found', message: 'Environment not found' } },
-      404,
-    )
-  }
-  const body = await c.req.json().catch(() => ({}))
-  const token = typeof body?.token === 'string' ? body.token : undefined
-  const valid = verifyWorkerTokenForEnv(env, token)
-  return c.json({ valid, env_id: envId }, 200)
-})
-
 /** GET /web/server-info — Aggregate server status for Web UI identity panel */
-app.get('/server-info', uuidAuth, async c => {
-  const uuid = c.get('uuid')!
+app.get('/server-info', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const envs = storeListActiveEnvironments()
   const sessions = listWebSessionsByOwnerUuid(uuid)
   return c.json(

package/packages/remote-control-server/src/routes/web/sessions.ts

@@ -1,10 +1,6 @@
 import { log, error as logError } from '../../logger'
 import { Hono } from 'hono'
-import {
-  uuidAuth,
-  requireWorkerToken,
-  verifyWorkerTokenForEnv,
-} from '../../auth/middleware'
+import { sessionAuth } from '../../auth/middleware'
 import { getAutomationStateSnapshot } from '../../services/automationState'
 import {
   archiveSession,
@@ -30,29 +26,13 @@ import { getEventBus } from '../../transport/event-bus'
 const app = new Hono()
 
 /** POST /web/sessions — Create a session from web UI */
-app.post('/sessions', uuidAuth, async c => {
-  const uuid = c.get('uuid')!
+app.post('/sessions', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const body = await c.req.json()
 
-  // Pre-validate worker token BEFORE creating the session record. If the
-  // environment has a workerTokenHash, the user must supply the matching
-  // plaintext token (body.worker_token or X-Worker-Token header). Returning
-  // 403 here avoids creating an orphaned empty session the user can't access.
+  // Pre-validate BEFORE creating the session record.
   if (body.environment_id) {
     const env = storeGetEnvironment(body.environment_id)
-    const workerToken =
-      body.worker_token || c.req.header('X-Worker-Token') || undefined
-    if (!verifyWorkerTokenForEnv(env, workerToken)) {
-      return c.json(
-        {
-          error: {
-            type: 'forbidden',
-            message: 'Worker token 不匹配，无法创建会话',
-          },
-        },
-        403,
-      )
-    }
 
     // ACP environments: registerEnvironment already auto-created a
     // source:'acp' session for this env. acp-link workers don't poll work
@@ -127,22 +107,22 @@ app.post('/sessions', uuidAuth, async c => {
 })
 
 /** GET /web/sessions — List sessions owned by the requesting UUID */
-app.get('/sessions', uuidAuth, async c => {
-  const uuid = c.get('uuid')!
+app.get('/sessions', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessions = listWebSessionsByOwnerUuid(uuid)
   return c.json(sessions, 200)
 })
 
 /** GET /web/sessions/all — List sessions owned by the requesting UUID (unowned sessions excluded) */
-app.get('/sessions/all', uuidAuth, async c => {
-  const uuid = c.get('uuid')!
+app.get('/sessions/all', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessions = listWebSessionSummariesByOwnerUuid(uuid)
   return c.json(sessions, 200)
 })
 
 /** GET /web/sessions/:id — Session detail */
-app.get('/sessions/:id', uuidAuth, requireWorkerToken, async c => {
-  const uuid = c.get('uuid')!
+app.get('/sessions/:id', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid)
   if (!sessionId) {
     return c.json(
@@ -189,7 +169,6 @@ app.get('/sessions/:id', uuidAuth, requireWorkerToken, async c => {
         ? {
             id: env.id,
             machine_name: env.machineName,
-            has_worker_token: env.workerTokenHash !== null,
             worker_type: env.workerType,
           }
         : null,
@@ -199,8 +178,8 @@ app.get('/sessions/:id', uuidAuth, requireWorkerToken, async c => {
 })
 
 /** GET /web/sessions/:id/history — Historical events for session */
-app.get('/sessions/:id/history', uuidAuth, requireWorkerToken, async c => {
-  const uuid = c.get('uuid')!
+app.get('/sessions/:id/history', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid)
   if (!sessionId) {
     return c.json(
@@ -222,8 +201,8 @@ app.get('/sessions/:id/history', uuidAuth, requireWorkerToken, async c => {
 })
 
 /** SSE /web/sessions/:id/events — Real-time event stream */
-app.get('/sessions/:id/events', uuidAuth, requireWorkerToken, async c => {
-  const uuid = c.get('uuid')!
+app.get('/sessions/:id/events', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid)
   if (!sessionId) {
     return c.json(
@@ -256,12 +235,11 @@ app.get('/sessions/:id/events', uuidAuth, requireWorkerToken, async c => {
 })
 
 /** DELETE /web/sessions/:id — Archive (soft-delete) a session.
- *  Requires worker token (same as other session routes). Archived sessions
- *  disappear from the list but remain in storage for audit. Also stops the
- *  associated work item so the worker's heartbeat detects 410 and kills the
- *  child process, releasing capacity. */
-app.delete('/sessions/:id', uuidAuth, requireWorkerToken, async c => {
-  const uuid = c.get('uuid')!
+ *  Archived sessions disappear from the list but remain in storage for audit.
+ *  Also stops the associated work item so the worker's heartbeat detects 410
+ *  and kills the child process, releasing capacity. */
+app.delete('/sessions/:id', sessionAuth, async c => {
+  const uuid = c.get('userId')!
   const sessionId = resolveOwnedWebSessionId(c.req.param('id')!, uuid)
   if (!sessionId) {
     return c.json(

package/packages/remote-control-server/src/routes/web/shares.ts

@@ -0,0 +1,371 @@
+import { Hono } from 'hono'
+import { randomUUID } from 'node:crypto'
+import { getDb } from '../../db/sqlite'
+import { sessionAuth } from '../../auth/middleware'
+import { SYSTEM_USER_ID } from '../../auth/constants'
+
+const app = new Hono()
+
+interface SessionOwnerRow {
+  owner_type: string
+  owner_id: string
+}
+
+interface ShareRow {
+  id: string
+  session_id: string
+  granted_to_user: string | null
+  granted_to_team: string | null
+  permission: string
+  expires_at: string | null
+  granted_by: string
+  granted_at: string
+}
+
+/**
+ * Helper: check if the current user is the session owner.
+ * Returns the userId on success, or a Response on failure.
+ */
+function checkSessionOwnership(
+  c: import('hono').Context,
+  sessionId: string,
+): { userId: string } | Response {
+  const userId = c.get('userId') as string | undefined
+  const isAdmin = c.get('isAdmin') as boolean | undefined
+
+  if (!userId) {
+    return c.json(
+      {
+        error: { type: 'unauthorized', message: 'Not authenticated' },
+      },
+      401,
+    )
+  }
+
+  const db = getDb()
+
+  // Check session exists
+  const session = db
+    .query('SELECT id FROM sessions WHERE id = $id')
+    .get({ $id: sessionId })
+  if (!session) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Session not found' } },
+      404,
+    )
+  }
+
+  // System admin bypasses ownership check
+  if (isAdmin || userId === SYSTEM_USER_ID) {
+    return { userId }
+  }
+
+  // Check ownership: user owns the session directly
+  const ownerRow = db
+    .query(
+      `SELECT owner_type, owner_id FROM session_owners
+       WHERE session_id = $sid
+         AND owner_type = 'user'
+         AND owner_id = $uid`,
+    )
+    .get({ $sid: sessionId, $uid: userId }) as SessionOwnerRow | null
+
+  if (ownerRow) {
+    return { userId }
+  }
+
+  // Check ownership: user's team owns the session
+  const teamOwner = db
+    .query(
+      `SELECT so.owner_id FROM session_owners so
+       JOIN team_members tm ON tm.team_id = so.owner_id
+       WHERE so.session_id = $sid
+         AND so.owner_type = 'team'
+         AND tm.user_id = $uid`,
+    )
+    .get({ $sid: sessionId, $uid: userId })
+
+  if (teamOwner) {
+    return { userId }
+  }
+
+  return c.json(
+    { error: { type: 'forbidden', message: 'Not session owner' } },
+    403,
+  )
+}
+
+/**
+ * POST /sessions/:id/share — Create a share for a session.
+ */
+app.post(
+  '/sessions/:id/share',
+  async (c, next) => {
+    const result = await sessionAuth(c, next)
+    if (result) return result
+  },
+  async c => {
+    const sessionId = c.req.param('id')
+    const ownership = checkSessionOwnership(c, sessionId)
+    if (ownership instanceof Response) return ownership
+    const { userId } = ownership
+
+    let body: Record<string, unknown>
+    try {
+      body = await c.req.json()
+    } catch {
+      return c.json(
+        { error: { type: 'bad_request', message: 'Invalid JSON' } },
+        400,
+      )
+    }
+
+    const grantedTo = body.grantedTo as
+      | { userId?: string; teamId?: string }
+      | undefined
+    const permission = body.permission as string | undefined
+    const expiresAt = (body.expiresAt || body.expires_at) as string | undefined
+
+    // Validate permission
+    if (!permission) {
+      return c.json(
+        {
+          error: {
+            type: 'bad_request',
+            message: 'permission is required',
+          },
+        },
+        400,
+      )
+    }
+    if (permission !== 'read' && permission !== 'write') {
+      return c.json(
+        {
+          error: {
+            type: 'bad_request',
+            message: 'permission must be "read" or "write"',
+          },
+        },
+        400,
+      )
+    }
+
+    // Validate grantedTo
+    if (!grantedTo) {
+      return c.json(
+        {
+          error: {
+            type: 'bad_request',
+            message: 'grantedTo is required',
+          },
+        },
+        400,
+      )
+    }
+
+    const db = getDb()
+
+    // Validate target user/team exists
+    if (grantedTo.userId) {
+      const user = db
+        .query('SELECT id FROM users WHERE id = $id')
+        .get({ $id: grantedTo.userId })
+      if (!user) {
+        return c.json(
+          {
+            error: { type: 'not_found', message: 'User not found' },
+          },
+          404,
+        )
+      }
+    } else if (grantedTo.teamId) {
+      const team = db
+        .query('SELECT id FROM teams WHERE id = $id AND deleted_at IS NULL')
+        .get({ $id: grantedTo.teamId })
+      if (!team) {
+        return c.json(
+          {
+            error: { type: 'not_found', message: 'Team not found' },
+          },
+          404,
+        )
+      }
+    }
+
+    // Generate share token (same as id)
+    const shareId = `shr_${randomUUID().replace(/-/g, '')}`
+    const now = new Date().toISOString()
+
+    db.query(
+      `INSERT INTO session_shares
+         (id, session_id, granted_to_user, granted_to_team,
+          permission, expires_at, granted_by, granted_at)
+       VALUES ($id, $sid, $gtu, $gtt, $perm, $exp, $by, $now)`,
+    ).run({
+      $id: shareId,
+      $sid: sessionId,
+      $gtu: grantedTo.userId || null,
+      $gtt: grantedTo.teamId || null,
+      $perm: permission,
+      $exp: expiresAt || null,
+      $by: userId,
+      $now: now,
+    })
+
+    return c.json(
+      {
+        id: shareId,
+        shareToken: shareId,
+        share_token: shareId,
+        permission,
+        expiresAt: expiresAt || null,
+        expires_at: expiresAt || null,
+      },
+      201,
+    )
+  },
+)
+
+/**
+ * GET /sessions/:id/shares — List all shares for a session.
+ */
+app.get(
+  '/sessions/:id/shares',
+  async (c, next) => {
+    const result = await sessionAuth(c, next)
+    if (result) return result
+  },
+  async c => {
+    const sessionId = c.req.param('id')
+    const ownership = checkSessionOwnership(c, sessionId)
+    if (ownership instanceof Response) return ownership
+
+    const db = getDb()
+    const shares = db
+      .query(
+        `SELECT id, session_id, granted_to_user, granted_to_team,
+                permission, expires_at, granted_by, granted_at
+         FROM session_shares
+         WHERE session_id = $sid`,
+      )
+      .all({ $sid: sessionId }) as ShareRow[]
+
+    return c.json(shares, 200)
+  },
+)
+
+/**
+ * DELETE /sessions/:id/shares/:shareId — Revoke a share.
+ */
+app.delete(
+  '/sessions/:id/shares/:shareId',
+  async (c, next) => {
+    const result = await sessionAuth(c, next)
+    if (result) return result
+  },
+  async c => {
+    const sessionId = c.req.param('id')
+    const shareId = c.req.param('shareId')
+
+    const ownership = checkSessionOwnership(c, sessionId)
+    if (ownership instanceof Response) return ownership
+
+    const db = getDb()
+
+    // Check share exists and belongs to this session
+    const share = db
+      .query(
+        `SELECT id FROM session_shares
+         WHERE id = $id AND session_id = $sid`,
+      )
+      .get({ $id: shareId, $sid: sessionId })
+
+    if (!share) {
+      return c.json(
+        { error: { type: 'not_found', message: 'Share not found' } },
+        404,
+      )
+    }
+
+    // Delete the share
+    db.query('DELETE FROM session_shares WHERE id = $id').run({
+      $id: shareId,
+    })
+
+    return c.json({ ok: true }, 200)
+  },
+)
+
+/**
+ * GET /sessions/s/:shareToken — Resolve a share token to session info.
+ */
+app.get(
+  '/sessions/s/:shareToken',
+  async (c, next) => {
+    const result = await sessionAuth(c, next)
+    if (result) return result
+  },
+  async c => {
+    const shareToken = c.req.param('shareToken')
+
+    // Validate format: must start with shr_
+    if (!shareToken || !shareToken.startsWith('shr_')) {
+      return c.json(
+        {
+          error: { type: 'not_found', message: 'Invalid share token' },
+        },
+        404,
+      )
+    }
+
+    const db = getDb()
+
+    // Look up the share
+    const share = db
+      .query(
+        `SELECT id, session_id, expires_at
+         FROM session_shares WHERE id = $id`,
+      )
+      .get({ $id: shareToken }) as {
+      id: string
+      session_id: string
+      expires_at: string | null
+    } | null
+
+    if (!share) {
+      return c.json(
+        { error: { type: 'not_found', message: 'Share not found' } },
+        404,
+      )
+    }
+
+    // Check expiry
+    if (share.expires_at && new Date(share.expires_at).getTime() < Date.now()) {
+      return c.json(
+        { error: { type: 'unauthorized', message: 'Share expired' } },
+        401,
+      )
+    }
+
+    // Check session still exists — return only public-safe fields
+    const session = db
+      .query(
+        `SELECT id, title, status, source, created_at, updated_at
+         FROM sessions WHERE id = $id`,
+      )
+      .get({ $id: share.session_id }) as Record<string, unknown> | null
+
+    if (!session) {
+      return c.json(
+        {
+          error: { type: 'not_found', message: 'Session not found' },
+        },
+        404,
+      )
+    }
+
+    return c.json(session, 200)
+  },
+)
+
+export default app