kczx-user-management 1.0.0 → 1.0.1

package/README.md

@@ -98,6 +98,7 @@ user-management:
   sites: []               # 空 = 自动枚举本机 IP；配域名 + 证书则按 SNI 选择
   title: 'DSH 控制台'
   autoActivate: false     # false = 自助注册需管理员启用
+  historyMaxBytes: 67108864   # 历史改写缓冲上限（字节，默认 64 MiB，最小 1 MiB）
 ```
 
 ## 数据文件
@@ -130,7 +131,7 @@ node scripts/import-from-dsh-passwords.mjs --from E:\path\to\dsh-passwords --ove
 ## 测试
 
 ```bash
-npm test          # 83 项：策略纯函数、store、API 层、以及真实网关的端到端用例
+npm test          # 85 项：策略纯函数、store、API 层、以及真实网关的端到端用例
 npm run check     # 全量语法检查
 ```
 
@@ -151,7 +152,10 @@ dsh plugin --profile web remove kczx-user-management
 - **门只管走门的人**：若另有插件把 dsh 宿主绑到 `0.0.0.0`（例如 dsh-lan-access），直连宿主端口即可绕过登录，
   且**绕过流量不会出现在任何一本台账里**。要真正的强制约束，宿主端口必须保持回环。
 - **token 配额依赖客户端上报**：浏览器侧被禁用或页面未加载时不计费（时长配额不受影响，它在服务端计时）。
-- 上游 `@weibaohui/user-management`（0.9.5）与本包 `kczx-user-management`（1.0.0）是两个不同的包，互不覆盖，`pnpm update` 不会把两者串在一起。
+- **会话历史要缓冲后才能改写**：历史响应是**一个 JSON 文档**（长会话实测 9–16 MB），网关必须先缓冲才能做沙盒降级与隐藏字符
+  清洗，因此有 `historyMaxBytes` 上限（默认 64 MiB）。超过上限的会话会 **fail-closed 返回 502**，UI 显示「历史加载失败」——
+  调大该值即可；1.0.0 之前用代理默认的 8 MiB，长会话必然踩中。
+- 上游 `@weibaohui/user-management`（0.9.5）与本包 `kczx-user-management` 是两个不同的包，互不覆盖，`pnpm update` 不会把两者串在一起。
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",

package/src/gateway-core.js

@@ -100,6 +100,19 @@ function createGateway(options) {
   const SESSION_HISTORY_RE = /^\/api\/session[.\/]history$/
   /** Hard cap on an inspected request body; over it the request is refused. */
   const MAX_GATE_BODY = 64 * 1024
+  /**
+   * Buffer cap for the rewritten session-history response, in bytes.
+   *
+   * The history RPC answers with the whole replay window in ONE JSON document,
+   * so a long session is megabytes — and the clamp/sanitize pass can only run on
+   * a buffered body. The cap stops a runaway response from pinning unbounded
+   * memory, but it has to clear real sessions: at the proxy's 8 MiB default a
+   * multi-hour session failed closed with a 502 and its history became
+   * unreadable in the UI. Override with `user-management.historyMaxBytes`.
+   */
+  const DEFAULT_HISTORY_MAX_BYTES = 64 * 1024 * 1024
+  /** Floor accepted from config: under this the rewrite can only fail closed. */
+  const MIN_HISTORY_MAX_BYTES = 1024 * 1024
   /** workspaceId → path, harvested from workspace-list responses (see below). */
   const workspacePathById = new Map()
 
@@ -107,6 +120,19 @@ function createGateway(options) {
     try { return new URL(req.url || '/', 'http://dsh.local').pathname } catch { return '' }
   }
 
+  /**
+   * The history buffer cap as configured right now.
+   *
+   * Read per request rather than captured at construction, so a settings change
+   * rides the plugin's in-place hot reload instead of needing a listener restart.
+   */
+  function historyBufferCap() {
+    const configured = Number(options.historyMaxBytes)
+    return Number.isFinite(configured) && configured >= MIN_HISTORY_MAX_BYTES
+      ? Math.floor(configured)
+      : DEFAULT_HISTORY_MAX_BYTES
+  }
+
   /**
    * Ask the host half for an account's permissions. Kept behind deps so this
    * module stays cordis-free and testable: no store, no policy, just a lookup.
@@ -144,10 +170,10 @@ function createGateway(options) {
   /**
    * Decide whether a response must be rewritten before the client sees it.
    *
-   * Today only the workspace list qualifies: an account with a folder allow-list
-   * must not receive entries outside it. The unrestricted case (empty list, or
-   * no account match) returns null and streams through untouched, so the common
-   * path pays nothing.
+   * Two responses qualify: the workspace list (an account with a folder
+   * allow-list must not receive entries outside it — the unrestricted case
+   * returns null and streams through untouched, so it pays nothing) and the
+   * session history, which every account gets clamped and sanitized.
    */
   function rewritePlanFor(req) {
     if ((req.method || '').toUpperCase() !== 'POST') return null
@@ -186,6 +212,9 @@ function createGateway(options) {
     if (SESSION_HISTORY_RE.test(path)) {
       const allowedMode = perms && typeof perms.sandboxMode === 'string' ? perms.sandboxMode : null
       return {
+        // The whole replay window arrives as one JSON document; the cap has to
+        // be sized for a real session, not for a small test fixture.
+        maxBytes: historyBufferCap(),
         transform: (parsed) => {
           // Clamp first (it rewrites values in place), then sanitize: a hidden
           // character smuggled into a preset name must not survive the rewrite.

package/src/index.js

@@ -690,6 +690,13 @@ const Config = z.object({
   // account (first admin excepted) into the disabled state until an admin
   // enables it from the users table; true activates registrations immediately.
   autoActivate: z.boolean().default(false),
+  // Buffer cap for the rewritten session-history response, in bytes. The history
+  // RPC answers with the whole replay window in one JSON document — megabytes
+  // for a long session — and the sandbox clamp / hidden-character strip can only
+  // run on a buffered body. Too small a cap makes history fail closed (HTTP 502)
+  // and the UI shows no history at all; the default is sized for multi-hour
+  // sessions. Lower it to bound memory, raise it for monsters.
+  historyMaxBytes: z.natural().min(1024 * 1024).default(64 * 1024 * 1024),
   listenHost: z.string().default('0.0.0.0'),
   port: z.natural().min(1).max(65535).default(19843),
   sites: z
@@ -1154,6 +1161,7 @@ const plugin = {
             sites,
             certsDir,
             title: cfg.title,
+            historyMaxBytes: cfg.historyMaxBytes,
             decider,
             handleApi,
             renderLoginPage,