ework-web 0.10.34 → 0.10.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.34",
+  "version": "0.10.36",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/config.ts

@@ -93,6 +93,13 @@ export const configSchema = z.object({
     if (!Number.isFinite(n) || n < 1 || n > 64) return 6;
     return Math.floor(n);
   }, z.number().int().min(1).max(64)),
+  // Space-separated list of origins (e.g. "https://ework-web.taobao.net http://ework-web.taobao.net")
+  // injected into CSP form-action + connect-src. For reverse-proxy/gateway deployments
+  // where the browser sees a different scheme/host than the app's 'self'.
+  publicOrigins: z
+    .string()
+    .default("")
+    .transform((s) => s.split(/\s+/).filter(Boolean)),
 });
 
 export type Config = z.infer<typeof configSchema>;
@@ -188,6 +195,7 @@ export async function loadConfig(): Promise<Config> {
     defaultModel: db.defaultModel ?? process.env.WORK_DEFAULT_MODEL,
     autowireActive: process.env.WORK_AUTOWIRE_ACTIVE !== "false",
     webhookMaxConcurrent: Number(process.env.WORK_WEBHOOK_MAX_CONCURRENT ?? "6"),
+    publicOrigins: process.env.WORK_PUBLIC_ORIGINS ?? "",
   });
 }
 

package/src/db.ts

@@ -117,6 +117,9 @@ function migrateProjectsTable(db: Database): void {
   if (!have.has("model")) {
     db.exec(applyPrefix("ALTER TABLE {{projects}} ADD COLUMN model TEXT NOT NULL DEFAULT ''"));
   }
+  if (!have.has("visibility")) {
+    db.exec(applyPrefix("ALTER TABLE {{projects}} ADD COLUMN visibility TEXT NOT NULL DEFAULT 'public'"));
+  }
 }
 
 function migrateIssuesTable(db: Database): void {
@@ -298,7 +301,8 @@ function translateForMysql(sql: string): string {
   return sql
     .replace(/INSERT OR IGNORE INTO/g, "INSERT IGNORE INTO")
     .replace(/ON CONFLICT\((\w+)\) DO UPDATE SET/g, "ON DUPLICATE KEY UPDATE")
-    .replace(/excluded\.(\w+)/g, "VALUES($1)");
+    .replace(/excluded\.(\w+)/g, "VALUES($1)")
+    .replace(/LIKE \? ESCAPE '\\'/g, "LIKE ?");
 }
 
 async function migrateMysqlSurrogateId(pool: Pool): Promise<void> {
@@ -338,6 +342,18 @@ async function migrateMysqlSurrogateId(pool: Pool): Promise<void> {
   }
 }
 
+async function migrateMysqlProjectsVisibility(pool: Pool): Promise<void> {
+  const [cols] = await pool.query(
+    applyPrefix("SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = '{{projects}}' AND COLUMN_NAME = 'visibility'")
+  );
+  if (Array.isArray(cols) && cols.length > 0) return;
+  try {
+    await pool.query(applyPrefix("ALTER TABLE {{projects}} ADD COLUMN visibility VARCHAR(16) NOT NULL DEFAULT 'public'"));
+  } catch (e) {
+    console.warn("[db] MySQL projects visibility column add failed:", (e as Error).message);
+  }
+}
+
 class MysqlDriver implements AsyncDatabase {
   readonly dialect = "mysql" as const;
   private readonly pool: Pool;
@@ -381,6 +397,7 @@ class MysqlDriver implements AsyncDatabase {
         }
       }
       await migrateMysqlSurrogateId(pool);
+      await migrateMysqlProjectsVisibility(pool);
     }
     return new MysqlDriver(pool);
   }

package/src/giteaApi.ts

@@ -31,6 +31,7 @@ import {
   removeReaction,
   listReactionsFor,
   canWriteProject,
+  canReadProject,
   type UserRow,
 } from "./store";
 import {
@@ -122,7 +123,7 @@ export async function handleGiteaApi(
     const limitRaw = Number(url.searchParams.get("limit") ?? 50);
     const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 200) : 50;
     try {
-      const rows = await listAllIssues({ q, state, limit });
+      const rows = await listAllIssues({ q, state, limit, viewerLogin: user.login, viewerIsAdmin: user.is_admin === 1 });
       const body = [];
       for (const row of rows) {
         const project = await getProject(row.project_owner, row.project_name);
@@ -144,6 +145,7 @@ export async function handleGiteaApi(
     if (!(owner && repo)) return giteaError(404, "not found");
     const project = await getProject(owner, repo);
     if (!project) return giteaError(404, "repository not found");
+    if (!(await canReadProject(project.id, user))) return giteaError(404, "repository not found");
     return { status: 200, body: buildRepository(project, origin) };
   }
 
@@ -187,6 +189,7 @@ export async function handleGiteaApi(
       if (!issue) return giteaError(404, "issue not found");
 
       if (req.method === "GET") {
+        if (!(await canReadProject(project.id, user))) return giteaError(404, "repository not found");
         return { status: 200, body: buildIssuePayload(issue, project, await countComments(issue.id), origin) };
       }
       if (req.method === "PATCH") {
@@ -227,6 +230,7 @@ export async function handleGiteaApi(
       if (!issue) return giteaError(404, "issue not found");
 
       if (req.method === "GET") {
+        if (!(await canReadProject(project.id, user))) return giteaError(404, "repository not found");
         const comments = await listCommentsForIssue(issue.id);
         return {
           status: 200,
@@ -269,6 +273,7 @@ export async function handleGiteaApi(
     try {
       const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
+      if (!(await canReadProject(project.id, user))) return giteaError(404, "repository not found");
 
       if (req.method === "GET") {
         const comment = await getComment(cid);
@@ -306,6 +311,7 @@ export async function handleGiteaApi(
     try {
       const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
+      if (!(await canReadProject(project.id, user))) return giteaError(404, "repository not found");
 
       if (req.method === "GET") {
         return { status: 200, body: await reactionsList(cid, origin) };

package/src/index.ts

@@ -27,7 +27,7 @@ import { buildAdminTokensPage } from "./views/adminTokens";
 import { buildSessionList, buildSessionView, renderNewMessages, renderBatchHTML } from "./views/sessionLog";
 import { buildFileView, FileViewError, readFileSince, serveRawFile } from "./fileview";
 import { translateText, translateTextStream, TranslateError } from "./translate";
-import { rateLimit } from "./ratelimit";
+import { rateLimit, clearRateLimit } from "./ratelimit";
 import {
   StoreError,
   getProject,
@@ -53,6 +53,8 @@ import {
   listAllPatsWithUsers,
   canWriteProject,
   canAdminProject,
+  canReadProject,
+  updateProjectVisibility,
   ensureProjectBootstrapAdmin,
   addProjectMember,
   setProjectMemberRole,
@@ -183,13 +185,20 @@ async function autoWireAllProjects(origin: string): Promise<void> {
 void autoWireAllProjects(`http://${cfg.host}:${cfg.port}`);
 
 const SEC_HEADERS: Record<string, string> = {
-  "content-security-policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'`,
+  "content-security-policy": buildCsp(cfg),
   "x-content-type-options": "nosniff",
   "x-frame-options": "DENY",
   "referrer-policy": "same-origin",
   "permissions-policy": "()",
 };
 
+function buildCsp(cfg: Config): string {
+  const origins = cfg.publicOrigins.join(" ");
+  const formAction = origins ? `'self' ${origins}` : "'self'";
+  const connectSrc = origins ? `'self' ${origins}` : "'self'";
+  return `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src ${connectSrc}; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action ${formAction}`;
+}
+
 const hlCss = loadHighlightCss();
 
 function loadHighlightCss(): string {
@@ -359,6 +368,7 @@ const REPO_WEBHOOKS_RE = /^\/([^/]+)\/([^/]+)\/settings\/webhooks$/;
 const REPO_MEMBERS_RE = /^\/([^/]+)\/([^/]+)\/settings\/members$/;
 const REPO_MEMBER_ACTION_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/([^/]+)\/(role|remove)$/;
 const REPO_MEMBER_ADD_RE = /^\/([^/]+)\/([^/]+)\/settings\/members\/add$/;
+const REPO_VISIBILITY_RE = /^\/([^/]+)\/([^/]+)\/settings\/visibility$/;
 const REPO_UPSTREAMS_RE = /^\/([^/]+)\/([^/]+)\/settings\/upstreams$/;
 const REPO_MODEL_RE = /^\/([^/]+)\/([^/]+)\/settings\/model$/;
 const REPO_LABELS_RE = /^\/([^/]+)\/([^/]+)\/settings\/labels$/;
@@ -480,14 +490,18 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     if (req.method === "POST") {
       const form = await req.formData().catch(() => new FormData());
       const next = sanitizeNext(String(form.get("next") ?? "/"));
-      if (!rateLimit(`login:${ip}`, 5, 5 / (15 * 60))) {
-        return html(loginHTML(next, "尝试过多，15 分钟后再试", cfg), 429);
-      }
       const login = String(form.get("login") ?? "").trim();
       const password = String(form.get("password") ?? "");
       const token = String(form.get("token") ?? "").trim();
 
-      // Token wins over login/password if both supplied (migration path).
+      const rlKey = `login:${ip}:${login || token || "?"}`;
+      if (!rateLimit(rlKey, 5, 5 / (15 * 60))) {
+        return new Response(loginHTML(next, "尝试过多，15 分钟后再试", cfg), {
+          status: 429,
+          headers: { "content-type": "text/html; charset=utf-8", "retry-after": "900" },
+        });
+      }
+
       let resolvedLogin: string | null = null;
       if (token && token === cfg.authToken) {
         resolvedLogin = cfg.operatorLogin;
@@ -505,6 +519,7 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       }
 
       if (resolvedLogin) {
+        clearRateLimit(rlKey);
         const setCookie = await makeAuthCookieHeader(cfg, resolvedLogin);
         return new Response(null, {
           status: 302,
@@ -613,7 +628,7 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     const q = url.searchParams.get("q")?.trim() ?? "";
     const label = url.searchParams.get("label")?.trim() ?? "";
     try {
-      return html(await buildIssuesFeed(state, q, label));
+      return html(await buildIssuesFeed(state, q, label, ctx.user));
     } catch (e) {
       return html(errorPage("加载失败", errMsg(e)), e instanceof StoreError ? e.status : 500);
     }
@@ -1731,6 +1746,25 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       }
     }
 
+    const visMatch = url.pathname.match(REPO_VISIBILITY_RE);
+    if (visMatch) {
+      const [, owner, repo] = visMatch;
+      if (!(owner && repo)) return html(errorPage("bad path", ""), 400);
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("项目不存在", ""), 404);
+      const back = `${url.origin}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/members`;
+      if (!(await canAdminProject(project.id, ctx.user))) {
+        return Response.redirect(`${back}?err=${encodeURIComponent("无权限")}`, 303);
+      }
+      const fd = await req.formData();
+      const visibility = fd.get("visibility");
+      if (visibility !== "public" && visibility !== "private") {
+        return Response.redirect(`${back}?err=${encodeURIComponent("无效的可见性")}`, 303);
+      }
+      await updateProjectVisibility(project.id, visibility);
+      return Response.redirect(`${back}?ok=1&ok_msg=${encodeURIComponent(`可见性已更新为 ${visibility === "public" ? "公开" : "私有"}`)}`, 303);
+    }
+
     const whAction = url.pathname.match(WH_ACTION_RE);
     if (whAction) {
       const [, idStr, action] = whAction;
@@ -1900,6 +1934,9 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     if (!(owner && repo && numStr)) return html(errorPage("404", "bad path"), 404);
     const number = Number(numStr);
     try {
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("404", "项目不存在"), 404);
+      if (!(await canReadProject(project.id, ctx.user))) return html(errorPage("404", "项目不存在"), 404);
       const { html: body } = await buildIssueThread(cfg, owner, repo, number, ctx.user?.login);
       return html(body);
     } catch (e) {
@@ -1912,6 +1949,9 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
   if (list) {
     const [, owner, repo] = list;
     if (!(owner && repo)) return html(errorPage("404", "bad path"), 404);
+    const project = await getProject(owner, repo);
+    if (!project) return html(errorPage("404", "项目不存在"), 404);
+    if (!(await canReadProject(project.id, ctx.user))) return html(errorPage("404", "项目不存在"), 404);
     const state = parseState(url.searchParams.get("state"));
     const q = url.searchParams.get("q")?.trim() ?? "";
     const label = url.searchParams.get("label")?.trim() ?? "";

package/src/ratelimit.ts

@@ -33,3 +33,7 @@ export function clientIp(req: Request): string {
   if (xff) return (xff.split(",")[0] ?? "").trim();
   return req.headers.get("x-real-ip") ?? "unknown";
 }
+
+export function clearRateLimit(id: string): void {
+  buckets.delete(id);
+}

package/src/schema-mysql.sql

@@ -28,6 +28,7 @@ CREATE TABLE IF NOT EXISTS {{projects}} (
   description   VARCHAR(2048) NOT NULL DEFAULT '',
   upstream_urls VARCHAR(4096) NOT NULL DEFAULT '[]',
   model         VARCHAR(128) NOT NULL DEFAULT '',
+  visibility    VARCHAR(16) NOT NULL DEFAULT 'public',
   created_at    VARCHAR(40) NOT NULL,
   updated_at    VARCHAR(40) NOT NULL,
   UNIQUE (owner, name)

package/src/schema.sql

@@ -30,6 +30,9 @@ CREATE TABLE IF NOT EXISTS {{projects}} (
   -- `opencode run --model <X>` by ework-daemon. Empty = inherit global
   -- defaultModel from the config table.
   model         TEXT NOT NULL DEFAULT '',
+  -- 'public' = any logged-in user can read; 'private' = requires project
+  -- membership (reader+). Enforced by canReadProject().
+  visibility  TEXT NOT NULL DEFAULT 'public' CHECK (visibility IN ('public','private')),
   created_at  TEXT NOT NULL,
   updated_at  TEXT NOT NULL,
   UNIQUE (owner, name)

package/src/store.ts

@@ -36,6 +36,7 @@ export interface ProjectRow {
   description: string;
   upstream_urls: string;
   model: string;
+  visibility: string;
   created_at: string;
   updated_at: string;
 }
@@ -175,15 +176,27 @@ export interface ProjectWithCounts extends ProjectRow {
   total_count: number;
 }
 
-export async function listProjectsWithCounts(): Promise<ProjectWithCounts[]> {
+export async function listProjectsWithCounts(
+  viewer?: { login: string; is_admin: number } | null,
+): Promise<ProjectWithCounts[]> {
+  const isAdmin = viewer?.is_admin === 1;
+  const login = viewer?.login;
+  const visibilityFilter = isAdmin
+    ? ""
+    : login
+      ? ` AND (p.visibility != 'private' OR EXISTS (SELECT 1 FROM {{project_members}} pm WHERE pm.project_id = p.id AND pm.user_login = ?))`
+      : ` AND p.visibility != 'private'`;
+  const args = !isAdmin && login ? [login] : [];
   return await getDB().all<ProjectWithCounts>(
     `SELECT p.*,
        COALESCE(SUM(CASE WHEN i.state = 'open' THEN 1 ELSE 0 END), 0) AS open_count,
        COUNT(i.id) AS total_count
      FROM {{projects}} p
      LEFT JOIN {{issues}} i ON i.project_id = p.id
+     WHERE 1=1${visibilityFilter}
      GROUP BY p.id
-     ORDER BY p.updated_at DESC`
+     ORDER BY p.updated_at DESC`,
+    args,
   );
 }
 
@@ -211,6 +224,10 @@ export async function touchProject(projectId: number): Promise<void> {
   await getDB().run("UPDATE {{projects}} SET updated_at = ? WHERE id = ?", [now(), projectId]);
 }
 
+export async function updateProjectVisibility(projectId: number, visibility: "public" | "private"): Promise<void> {
+  await getDB().run("UPDATE {{projects}} SET visibility = ?, updated_at = ? WHERE id = ?", [visibility, now(), projectId]);
+}
+
 const MAX_UPSTREAM_URLS = 10;
 const UPSTREAM_URL_RE = /^(https?|ssh|git):\/\/[^\s]+$/i;
 const GIT_SCP_RE = /^[A-Za-z0-9_./-]+@[A-Za-z0-9._-]+:.+$/;
@@ -332,6 +349,8 @@ export interface ListIssuesOpts {
   q?: string;
   label?: string;
   limit?: number;
+  viewerLogin?: string;
+  viewerIsAdmin?: boolean;
 }
 
 export async function listIssues(projectId: number, opts: ListIssuesOpts = {}): Promise<IssueWithMeta[]> {
@@ -385,6 +404,14 @@ export async function listAllIssues(opts: ListIssuesOpts = {}): Promise<IssueWit
     sql += " AND EXISTS (SELECT 1 FROM {{issue_labels}} il JOIN {{labels}} l ON l.id = il.label_id WHERE il.issue_id = i.id AND l.name = ?)";
     args.push(label);
   }
+  if (!opts.viewerIsAdmin) {
+    sql += " AND (p.visibility != 'private'";
+    if (opts.viewerLogin) {
+      sql += " OR EXISTS (SELECT 1 FROM {{project_members}} pm WHERE pm.project_id = p.id AND pm.user_login = ?)";
+      args.push(opts.viewerLogin);
+    }
+    sql += ")";
+  }
   sql += " ORDER BY i.updated_at DESC LIMIT ?";
   args.push(limit);
   return await getDB().all<IssueWithMeta>(sql, args);
@@ -1208,6 +1235,16 @@ export async function canAdminProject(projectId: number, user: { login: string;
   return r === "admin";
 }
 
+export async function canReadProject(projectId: number, user: { login: string; is_admin: number } | null): Promise<boolean> {
+  if (!user) return false;
+  if (user.is_admin === 1) return true;
+  const project = await getProjectById(projectId);
+  if (!project) return false;
+  if (project.visibility !== "private") return true;
+  const r = await getRoleOnProject(projectId, user);
+  return r !== null;
+}
+
 export async function addProjectMember(projectId: number, userLogin: string, role: ProjectRole): Promise<ProjectMembership> {
   const login = userLogin.trim();
   if (!(await getUserByLogin(login))) throw new StoreError(404, `用户 ${login} 不存在`);

package/src/views/home.ts

@@ -33,7 +33,7 @@ export async function buildHome(
   viewer: UserRow | null,
   flash: { kind: "ok" | "err"; msg: string } | null = null
 ): Promise<string> {
-  const projects = await listProjectsWithCounts();
+  const projects = await listProjectsWithCounts(viewer);
   const cards = await Promise.all(projects.map((p) => projectCard(p, viewer)));
   const list = projects.length
     ? cards.join("")

package/src/views/issues.ts

@@ -26,8 +26,13 @@ export async function buildIssuesFeed(
   state: "open" | "closed" | "all",
   q: string,
   label: string = "",
+  viewer?: { login: string; is_admin: number } | null,
 ): Promise<string> {
-  const issues = await listAllIssues({ state, q, label, limit: FEED_PAGE_SIZE });
+  const issues = await listAllIssues({
+    state, q, label, limit: FEED_PAGE_SIZE,
+    viewerLogin: viewer?.login,
+    viewerIsAdmin: viewer?.is_admin === 1,
+  });
   const labelMap = await listLabelsForIssues(issues.map((it) => it.id));
   const matchesFirst = q
     ? [...issues].sort((a, b) => Number(containsCI(b.title, q)) - Number(containsCI(a.title, q)))

package/src/views/projectMembers.ts

@@ -107,6 +107,21 @@ ${tabNavHTML("projects")}
 ${projectSettingsTabsHTML(project.owner, project.name, "members")}
 ${flashHtml}
 
+<form class="card" method="POST" action="${escapeAttr(`/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/visibility`)}}">
+<h2>可见性</h2>
+<div class="form-grid">
+<div>
+<label for="vis">项目可见性</label>
+<select id="vis" name="visibility">
+<option value="public"${project.visibility === "public" ? " selected" : ""}>🌐 公开 — 所有登录用户可见</option>
+<option value="private"${project.visibility === "private" ? " selected" : ""}>🔒 私有 — 仅项目成员可见</option>
+</select>
+</div>
+</div>
+<div class="hint">公开 = 任何登录用户都能查看 issue 和评论；私有 = 需要项目成员（reader+）权限。Bot 用户已自动获得 writer 角色，不受影响。</div>
+<button class="primary" type="submit">保存</button>
+</form>
+
 <div class="card">
 <h2>当前成员（${members.length}）</h2>
 ${rowsHtml}