ework-web 0.10.60 → 0.10.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.60",
+  "version": "0.10.62",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/giteaApi.ts

@@ -12,7 +12,7 @@
 // bg audit) plus a few cheap stubs (/version, /user, /repos/:o/:r) that
 // Gitea clients commonly hit during connection bootstrap.
 
-import { getDB } from "./db";
+import { getDB, getConfigAll } from "./db";
 import {
   StoreError,
   getProject,
@@ -32,6 +32,8 @@ import {
   listReactionsFor,
   canWriteProject,
   canReadProject,
+  ensureUser,
+  getUserByLogin,
   type UserRow,
 } from "./store";
 import {
@@ -95,6 +97,12 @@ function asContent(v: unknown): string | undefined {
   return trimmed;
 }
 
+async function canSudo(u: UserRow): Promise<boolean> {
+  const cfg = await getConfigAll();
+  const allow = (cfg["sudoLogins"] ?? "").split(",").map((s: string) => s.trim()).filter(Boolean);
+  return allow.includes(u.login);
+}
+
 export async function handleGiteaApi(
   req: Request,
   url: URL,
@@ -103,8 +111,30 @@ export async function handleGiteaApi(
   const path = url.pathname;
   if (!path.startsWith("/api/v1/")) return null;
   const origin = new URL(req.url).origin;
-  const user = ctx.user;
-  if (!user) return giteaError(401, "requires authentication");
+  const caller = ctx.user;
+  if (!caller) return giteaError(401, "requires authentication");
+
+  // ─── Sudo: Gitea convention for impersonation ───
+  // Allows bridge/integration processes to post on behalf of real users.
+  // Permission gated by config KV `sudoLogins` whitelist (not is_admin — bridges
+  // should not be admins). Sudo-Kind header controls kind for first-creation
+  // only; existing users' kind is never changed via sudo.
+  const sudoLoginRaw = req.headers.get("Sudo") ?? url.searchParams.get("sudo");
+  const sudoLogin = sudoLoginRaw?.trim() || null;
+  let user: UserRow = caller;
+  if (sudoLogin && sudoLogin !== caller.login) {
+    if (!(await canSudo(caller))) return giteaError(403, "sudo requires permission");
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/.test(sudoLogin)) return giteaError(400, "invalid sudo login");
+    const sudoKindRaw = req.headers.get("Sudo-Kind")?.trim();
+    const existing = await getUserByLogin(sudoLogin);
+    if (existing) {
+      user = existing;
+    } else {
+      const kind = sudoKindRaw === "bot" || sudoKindRaw === "system" ? sudoKindRaw : "human";
+      user = await ensureUser(sudoLogin, kind);
+    }
+    if (!user.is_active) return giteaError(403, "sudo target inactive");
+  }
 
   if (ROUTES.version.test(path) && req.method === "GET") {
     return { status: 200, body: { version: "1.22.0" } };

package/src/index.ts

@@ -1311,6 +1311,22 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     return json({ ok: true });
   }
 
+  if (url.pathname === "/api/sudo-policy" && req.method === "GET") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    const cfg = await getConfigAll();
+    const list = (k: string, d: string) => (cfg[k] ?? d).split(",").map((s) => s.trim()).filter(Boolean);
+    return json({ sudoLogins: list("sudoLogins", "") });
+  }
+
+  if (url.pathname === "/api/sudo-policy" && req.method === "POST") {
+    if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
+    const payload = await req.json().catch(() => ({} as Record<string, unknown>));
+    const join = (v: unknown) => Array.isArray(v) ? v.filter((s) => typeof s === "string").join(",") : (typeof v === "string" ? v : "");
+    const sl = join((payload as { sudoLogins?: unknown }).sudoLogins);
+    if (sl) await setConfig("sudoLogins", sl); else await deleteConfig("sudoLogins");
+    return json({ ok: true });
+  }
+
   if (url.pathname === "/api/router/daemons" && req.method === "GET") {
     if (!ctx.user || ctx.user.is_admin !== 1) return json({ error: "admin required" }, 403);
     try {

package/src/webhooks.ts

@@ -696,11 +696,15 @@ export async function emitCommentEvent(
       log.info(`webhook: issue dispatch disabled — skipping comment_created (author=${comment.author}) for ${scopeKey}#${issue.number}`);
       return;
     }
-    // Global/project-level are "default no auto-dispatch" strategies — comments can still explicitly wake AI.
-    if (cfg["dispatchEnabled"] === "false" || cfg[`dispatchOff:${scopeKey}`] === "1") {
-      log.info(`webhook: dispatch disabled but waking via comment_created (author=${comment.author}) for ${scopeKey}#${issue.number}`);
-    }
     const authorUser = await getUserByLogin(comment.author);
+    const dispatchOff = cfg["dispatchEnabled"] === "false" || cfg[`dispatchOff:${scopeKey}`] === "1";
+    if (dispatchOff && authorUser && authorUser.kind !== "human") {
+      log.info(`webhook: dispatch disabled — non-human comment blocked (author=${comment.author} kind=${authorUser.kind}) for ${scopeKey}#${issue.number}`);
+      return;
+    }
+    if (dispatchOff) {
+      log.info(`webhook: dispatch disabled but human comment waking AI (author=${comment.author}) for ${scopeKey}#${issue.number}`);
+    }
     const appCfg = await loadConfig();
     const cfgList = (k: string, d: string) =>
       (cfg[k] ?? d).split(",").map((s) => s.trim()).filter(Boolean);