kczx-user-management 1.0.0

package/src/login-page.js

@@ -0,0 +1,184 @@
+'use strict'
+
+/**
+ * Standalone login/register page served at `/login`.
+ *
+ * Deliberately independent of the host SPA (which the gate blocks until
+ * authenticated): one self-contained HTML string, no external assets, dark/
+ * light adaptive. Talks to /user-management/api like everything else.
+ */
+
+function esc(value) {
+  return String(value).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]))
+}
+
+const PAGE_STYLES = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body {
+  margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", sans-serif;
+  background: #f5f6f8; color: #1f2329;
+}
+@media (prefers-color-scheme: dark) {
+  body { background: #16181c; color: #e8eaed; }
+}
+.card {
+  width: 360px; max-width: calc(100vw - 32px); padding: 32px 28px 24px;
+  border-radius: 14px; background: #ffffff; border: 1px solid rgba(0,0,0,.08);
+  box-shadow: 0 8px 30px rgba(0,0,0,.08);
+}
+@media (prefers-color-scheme: dark) {
+  .card { background: #22252b; border-color: rgba(255,255,255,.08); box-shadow: 0 8px 30px rgba(0,0,0,.4); }
+}
+h1 { font-size: 18px; margin: 0 0 4px; text-align: center; }
+.sub { font-size: 12px; opacity: .6; text-align: center; margin: 0 0 20px; }
+.tabs { display: flex; gap: 4px; background: rgba(127,127,127,.12); border-radius: 8px; padding: 3px; margin-bottom: 18px; }
+.tabs button {
+  flex: 1; border: 0; background: transparent; color: inherit; font-size: 13px;
+  padding: 7px 0; border-radius: 6px; cursor: pointer;
+}
+.tabs button.active { background: #ffffff; box-shadow: 0 1px 3px rgba(0,0,0,.15); }
+@media (prefers-color-scheme: dark) { .tabs button.active { background: #3a3f47; } }
+label { display: block; font-size: 12px; opacity: .75; margin: 12px 0 4px; }
+label .opt { opacity: .8; font-weight: 400; }
+input {
+  width: 100%; padding: 9px 11px; font-size: 14px; border-radius: 8px;
+  border: 1px solid rgba(127,127,127,.35); background: transparent; color: inherit; outline: none;
+}
+input:focus { border-color: #4c6ef5; }
+.remember { display: flex; align-items: center; gap: 6px; font-size: 12px; opacity: .85; margin: 12px 0 0; cursor: pointer; user-select: none; }
+.remember input { width: auto; margin: 0; cursor: pointer; }
+.err { min-height: 18px; font-size: 12px; color: #e03131; margin: 10px 0 2px; white-space: pre-wrap; }
+.reg-note { font-size: 12px; color: #2b8a3e; margin: 10px 0 2px; white-space: pre-wrap; }
+.submit {
+  width: 100%; margin-top: 10px; padding: 10px 0; font-size: 14px; border: 0; border-radius: 8px;
+  background: #4c6ef5; color: #fff; cursor: pointer;
+}
+.submit:disabled { opacity: .55; cursor: default; }
+.hint { font-size: 12px; color: #f08c00; margin-top: 12px; text-align: center; }
+.foot { margin-top: 16px; font-size: 11px; opacity: .45; text-align: center; }
+`
+
+const PAGE_SCRIPT = `
+(function () {
+  var hasUsers = __HAS_USERS__;
+  var loginForm = document.getElementById('login-form');
+  var registerForm = document.getElementById('register-form');
+  var otpInput = document.getElementById('login-otp');
+  var remember = document.getElementById('login-remember');
+  function show(tab) {
+    loginForm.style.display = tab === 'login' ? '' : 'none';
+    registerForm.style.display = tab === 'register' ? '' : 'none';
+    document.getElementById('tab-login').classList.toggle('active', tab === 'login');
+    document.getElementById('tab-register').classList.toggle('active', tab === 'register');
+    loginForm.querySelector('.err').textContent = '';
+    registerForm.querySelector('.err').textContent = '';
+    document.getElementById('reg-note').textContent = '';
+  }
+  document.getElementById('tab-login').addEventListener('click', function () { show('login') });
+  document.getElementById('tab-register').addEventListener('click', function () { show('register') });
+  function submit(form, path, body) {
+    var errEl = form.querySelector('.err');
+    var button = form.querySelector('.submit');
+    button.disabled = true;
+    errEl.textContent = '';
+    fetch(path, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    }).then(function (res) {
+      return res.json().catch(function () { return {} }).then(function (data) { return { ok: res.ok, data: data } });
+    }).then(function (result) {
+      if (result.ok) {
+        if (form === registerForm && result.data && result.data.pending) {
+          // approval mode: registered as disabled — no session, stay and inform
+          document.getElementById('reg-note').textContent = '注册成功！账号需管理员审核启用后方可登录，请稍后再来。';
+          button.disabled = false;
+          return;
+        }
+        if (form === loginForm) {
+          try {
+            if (remember.checked) localStorage.setItem('um-last-username', body.username || '');
+            else localStorage.removeItem('um-last-username');
+          } catch (e) {}
+        }
+        location.href = '/';
+        return;
+      }
+      errEl.textContent = (result.data && result.data.error) || '请求失败';
+      button.disabled = false;
+    }).catch(function () {
+      errEl.textContent = '网络错误';
+      button.disabled = false;
+    });
+  }
+  loginForm.addEventListener('submit', function (e) {
+    e.preventDefault();
+    submit(loginForm, '/user-management/api/login', {
+      username: document.getElementById('login-username').value.trim(),
+      password: document.getElementById('login-password').value,
+      otp: otpInput.value.replace(/\\s+/g, '') || undefined,
+    });
+  });
+  registerForm.addEventListener('submit', function (e) {
+    e.preventDefault();
+    var errEl = registerForm.querySelector('.err');
+    var password = document.getElementById('reg-password').value;
+    if (password !== document.getElementById('reg-password2').value) {
+      errEl.textContent = '两次输入的密码不一致';
+      return;
+    }
+    submit(registerForm, '/user-management/api/register', {
+      username: document.getElementById('reg-username').value.trim(),
+      password: password,
+    });
+  });
+  try {
+    var remembered = localStorage.getItem('um-last-username');
+    if (remembered) document.getElementById('login-username').value = remembered;
+  } catch (e) {}
+  if (!hasUsers) {
+    document.getElementById('first-hint').style.display = '';
+    show('register');
+  }
+})();
+`
+
+/**
+ * Render the login page. `hasUsers=false` (fresh system) flips the default
+ * tab to register and reveals the first-user-becomes-admin hint.
+ */
+function renderLoginPage({ hasUsers, title = 'DSH 控制台' } = {}) {
+  return '<!doctype html>\n<html lang="zh-CN">\n<head>\n<meta charset="utf-8">\n' +
+    '<meta name="viewport" content="width=device-width, initial-scale=1">\n' +
+    `<title>${esc(title)} · 登录</title>\n` +
+    `<style>${PAGE_STYLES}</style>\n</head>\n<body>\n` +
+    '<div class="card">\n' +
+    `<h1>${esc(title)}</h1>\n<p class="sub">登录后继续访问</p>\n` +
+    '<div class="tabs">' +
+    '<button type="button" id="tab-login" class="active">登录</button>' +
+    '<button type="button" id="tab-register">注册</button></div>\n' +
+    '<form id="login-form">\n' +
+    '<label for="login-username">用户名</label>\n<input id="login-username" autocomplete="username" required>\n' +
+    '<label for="login-password">密码</label>\n<input id="login-password" type="password" autocomplete="current-password" required>\n' +
+    '<label for="login-otp">两步验证码 <span class="opt">（未开启请留空）</span></label>\n' +
+    '<input id="login-otp" inputmode="numeric" autocomplete="one-time-code" maxlength="6" placeholder="已开启两步验证？输入 6 位动态码">\n' +
+    '<label class="remember"><input type="checkbox" id="login-remember" checked> 记住用户名</label>\n' +
+    '<div class="err"></div>\n' +
+    '<button class="submit" type="submit">登录</button>\n</form>\n' +
+    '<form id="register-form" style="display:none">\n' +
+    '<label for="reg-username">用户名</label>\n<input id="reg-username" autocomplete="username" required>\n' +
+    '<label for="reg-password">密码（至少 6 位）</label>\n<input id="reg-password" type="password" autocomplete="new-password" minlength="6" required>\n' +
+    '<label for="reg-password2">确认密码</label>\n<input id="reg-password2" type="password" autocomplete="new-password" required>\n' +
+    '<div class="err"></div>\n' +
+    '<div class="reg-note" id="reg-note"></div>\n' +
+    '<button class="submit" type="submit">注册并登录</button>\n' +
+    `<div class="hint" id="first-hint" style="display:none">当前还没有任何账号，首个注册的账号将成为管理员</div>\n</form>\n` +
+    '<div class="foot">dsh 插件 · user-management</div>\n' +
+    '</div>\n' +
+    `<script>${PAGE_SCRIPT.replace('__HAS_USERS__', hasUsers ? 'true' : 'false')}</script>\n` +
+    '</body>\n</html>\n'
+}
+
+export { renderLoginPage }

package/src/permissions.js

@@ -0,0 +1,477 @@
+'use strict'
+
+/**
+ * Workspace-scope and sandbox policy — the pure half of the account model
+ * ported from dsh-passwords.
+ *
+ * Everything here is a pure function over values: no store, no request, no
+ * cordis. The enforcement layer (gateway response filtering, request clamping)
+ * calls these; keeping them separate is what makes the policy verifiable
+ * without a live gateway.
+ *
+ * Semantics are carried over verbatim, because the store and the settings UI
+ * already speak them:
+ *   - an EMPTY allow-list means \"every workspace\" (the unrestricted default);
+ *   - DENY_ALL_WORKSPACES is how an admin says \"no workspace at all\", which an
+ *     empty list cannot express;
+ *   - a path is allowed when it equals an entry or sits underneath it.
+ */
+
+import path from 'node:path'
+
+/** Sentinel entry meaning \"deny every workspace\" (distinct from \"[] = all\"). */
+const DENY_ALL_WORKSPACES = '__deny__'
+
+/** Sandbox modes from narrowest to widest; the rank decides what is a
+ *  downgrade and what would be an escalation. */
+const SANDBOX_RANK = { 'read-only': 0, 'workspace-write': 1, 'danger-full-access': 2 }
+
+/** Recursion cap for the JSON walkers: a deeply nested upstream payload must
+ *  not turn into a stack-overflow DoS. */
+const MAX_JSON_DEPTH = 8
+
+/**
+ * Canonical path form for comparisons: backslashes to slashes, posix
+ * normalization (so `..` and trailing slashes cannot smuggle a path past the
+ * allow-list), and case folding for Windows-style paths.
+ */
+function normalizePath(p) {
+  let n = String(p === undefined || p === null ? '' : p).replace(/\\/g, '/')
+  n = path.posix.normalize(n)
+  // Windows-style paths fold to lower case in FULL, not just the drive letter:
+  // the filesystem is case-insensitive, so a case-sensitive compare would
+  // reject a legitimate 'D:\\Work' allow-list entry for a workspace reported
+  // as 'd:/work'. POSIX paths keep their case sensitivity.
+  // (dsh-passwords lower-cased only the drive letter — it targets Linux hosts;
+  //  this is a deliberate divergence for Windows deployments.)
+  if (/^[a-zA-Z]:/.test(n)) n = n.toLowerCase()
+  // posix.normalize KEEPS one trailing separator ('/srv/a/' survives as
+  // written), which would break the separator-boundary prefix test below: an
+  // admin pasting 'D:\\work\\' would then silently match nothing. Fold it
+  // away — the root ('/') is kept, and a bare 'c:' still matches the drive.
+  if (n.length > 1 && n.endsWith('/')) n = n.replace(/\/+$/, '')
+  return n
+}
+
+/** Whether a list actually restricts anything (empty = unrestricted). */
+function isWorkspaceRestricted(allowedFolders) {
+  return Array.isArray(allowedFolders) && allowedFolders.length > 0
+}
+
+/** Whether `target` is inside the allow-list (or the list is unrestricted). */
+function folderAllowed(target, allowedFolders) {
+  const list = Array.isArray(allowedFolders) ? allowedFolders : []
+  if (list.length === 0) return true
+  if (list.includes(DENY_ALL_WORKSPACES)) return false
+  const p = normalizePath(target)
+  return list.some((entry) => {
+    const base = normalizePath(entry)
+    // normalize('') is '.': an empty entry and '/' both mean \"the whole disk\"
+    if (base === '.' || base === '/') return true
+    // Prefix match must respect a separator boundary, or '/srv/ab' would pass
+    // an allow-list entry of '/srv/a'.
+    return p === base || p.startsWith(base + '/')
+  })
+}
+
+/**
+ * Drop JSON entries whose path field falls outside the allow-list.
+ * Only array items carrying that field are judged; everything else is copied
+ * through recursively, so unrelated payload shapes survive untouched.
+ */
+function filterByPathFieldWithPredicate(value, field, allowed, depth = 0) {
+  // Past the cap the path field can no longer be checked reliably: drop the
+  // subtree instead of passing it through (fail closed).
+  if (depth > MAX_JSON_DEPTH) return null
+  if (value === null || value === undefined) return value === undefined ? undefined : value
+  if (Array.isArray(value)) {
+    const out = []
+    for (const item of value) {
+      if (item !== null && typeof item === 'object' && typeof item[field] === 'string' && item[field] !== '' && !allowed(item[field])) continue
+      out.push(filterByPathFieldWithPredicate(item, field, allowed, depth + 1))
+    }
+    return out
+  }
+  if (typeof value === 'object') {
+    const out = {}
+    for (const [key, nested] of Object.entries(value)) out[key] = filterByPathFieldWithPredicate(nested, field, allowed, depth + 1)
+    return out
+  }
+  return value
+}
+
+/** filterByPathField with the allow-list as the predicate. */
+function filterByPathField(value, allowedFolders, field, depth = 0) {
+  return filterByPathFieldWithPredicate(value, field, (candidate) => folderAllowed(candidate, allowedFolders), depth)
+}
+
+/**
+ * Rank a sandbox preset. An unknown value ranks as the MOST permissive, so an
+ * unrecognized preset can never be mistaken for a downgrade and silently let
+ * through (dsh-passwords' rule, kept because the reasoning holds).
+ * Own-property check, not a bare lookup: 'constructor' and friends must not
+ * resolve to anything from the prototype chain.
+ */
+function sandboxPresetRank(preset) {
+  return Object.prototype.hasOwnProperty.call(SANDBOX_RANK, preset) ? SANDBOX_RANK[preset] : 2
+}
+
+/** Request-body fields that may carry the target path, in priority order. */
+const PATH_FIELDS = [
+  'cwd',
+  'path',
+  'directory',
+  'dir',
+  'folder',
+  'workspace',
+  'root',
+  'workspacePath',
+  'absolutePath',
+  'target',
+  'targetPath',
+]
+
+/** Depth cap for the body walkers (same reasoning as the JSON filter). */
+const MAX_BODY_DEPTH = 6
+
+/**
+ * First path-looking string in a request body, walking the typert envelope
+ * ({ type, rpcId, method, payload }).
+ *
+ * `args` is skipped on purpose: it is a pseudo-field dsh does not consume, so a
+ * body of { payload: { args: { cwd: '/root/11' } } } actually creates a session
+ * in the DEFAULT workspace. Trusting args.cwd would authorize a path the host
+ * never uses — a fail-open hole rather than a strictness bug.
+ *
+ * Ported verbatim from dsh-passwords; the reasoning above is why.
+ */
+function extractPathFromBody(value, depth = 0) {
+  if (depth > MAX_BODY_DEPTH || value === null || typeof value !== 'object') return null
+  for (const field of PATH_FIELDS) {
+    const candidate = value[field]
+    if (typeof candidate === 'string' && candidate.length > 0) return candidate
+  }
+  for (const key of Object.keys(value)) {
+    if (key === 'args') continue
+    const nested = extractPathFromBody(value[key], depth + 1)
+    if (nested !== null) return nested
+  }
+  return null
+}
+
+/** Same walk, looking for a workspaceId (session.create may send one instead of cwd). */
+function extractWorkspaceId(value, depth = 0) {
+  if (depth > MAX_BODY_DEPTH || value === null || typeof value !== 'object') return null
+  if (typeof value.workspaceId === 'string' && value.workspaceId.length > 0) return value.workspaceId
+  for (const key of Object.keys(value)) {
+    if (key === 'args') continue
+    const nested = extractWorkspaceId(value[key], depth + 1)
+    if (nested !== null) return nested
+  }
+  return null
+}
+
+/**
+ * Harvest workspaceId → path pairs out of a workspace-list response, so a later
+ * session.create that carries only a workspaceId can still be checked against
+ * the allow-list. Both `workspaceId` and a top-level `id` are accepted: dsh
+ * reports the former, and a miss here means a fail-closed 403 on a legitimate
+ * request.
+ */
+function collectIdPathPairs(value, out = new Map(), depth = 0) {
+  if (depth > MAX_JSON_DEPTH || value === null) return out
+  if (Array.isArray(value)) {
+    for (const item of value) collectIdPathPairs(item, out, depth + 1)
+  } else if (typeof value === 'object') {
+    if (typeof value.path === 'string') {
+      const id = typeof value.workspaceId === 'string' ? value.workspaceId : typeof value.id === 'string' ? value.id : null
+      if (id !== null) out.set(id, value.path)
+    }
+    for (const nested of Object.values(value)) collectIdPathPairs(nested, out, depth + 1)
+  }
+  return out
+}
+
+/** First string value stored under `field` anywhere in the body (depth-capped). */
+function findStringField(value, field, depth = 0) {
+  if (depth > MAX_BODY_DEPTH || value === null || typeof value !== 'object') return null
+  const candidate = value[field]
+  if (typeof candidate === 'string' && candidate.length > 0) return candidate
+  for (const key of Object.keys(value)) {
+    const nested = findStringField(value[key], field, depth + 1)
+    if (nested !== null) return nested
+  }
+  return null
+}
+
+/**
+ * The preset named by a `/permission` slash command, or null.
+ * e.g. "/permission workspace-write" → "workspace-write".
+ */
+function permissionPresetFromCommand(line) {
+  const match = /^\/permission\s+([A-Za-z0-9_-]+)/.exec(String(line || '').trim())
+  return match ? match[1] : null
+}
+
+/**
+ * The preset written by a settings.mutate body.
+ *
+ * The field lives inside an `ops[].path` ARRAY (path: [..., 'defaultPreset'])
+ * rather than under an object key, so the generic field walker cannot find it —
+ * hence this dedicated shape match.
+ */
+function presetFromSettingsMutate(value, depth = 0) {
+  if (depth > MAX_BODY_DEPTH || value === null || typeof value !== 'object') return null
+  if (Array.isArray(value.path) && value.path.includes('defaultPreset')) {
+    if (typeof value.value === 'string' && value.value.length > 0) return value.value
+  }
+  for (const key of Object.keys(value)) {
+    const nested = presetFromSettingsMutate(value[key], depth + 1)
+    if (nested !== null) return nested
+  }
+  return null
+}
+
+/**
+ * Force every approval outcome in a response body to 'rejected'.
+ *
+ * A restricted account's agent must not be able to escalate its own sandbox by
+ * asking for permission: the user may click "allow", but the answer forwarded
+ * upstream is a denial. Only objects carrying BOTH a string approvalId and a
+ * string outcome are touched, so ask_user_question answers (which use `answer`)
+ * pass through untouched.
+ *
+ * @returns whether anything actually changed (the caller only rewrites the body
+ *          when it did).
+ */
+function forceRejectApproval(value, depth = 0) {
+  if (depth > MAX_BODY_DEPTH || value === null || typeof value !== 'object') return false
+  let changed = false
+  if (typeof value.approvalId === 'string' && typeof value.outcome === 'string' && value.outcome !== 'rejected') {
+    value.outcome = 'rejected'
+    changed = true
+  }
+  for (const key of Object.keys(value)) {
+    const nested = value[key]
+    if (nested !== null && typeof nested === 'object' && forceRejectApproval(nested, depth + 1)) changed = true
+  }
+  return changed
+}
+
+/**
+ * Invisible Unicode: zero-width joiners/spaces, bidi controls, word joiners,
+ * BOM, soft hyphen, Mongolian vowel separator, combining grapheme joiner,
+ * Arabic letter mark, Hangul fillers.
+ *
+ * These characters mean nothing to a human reader but are perfectly visible
+ * instructions to a model, which makes them a prompt-injection carrier: a file
+ * the agent reads can hide text that only comes back to the model when the
+ * session history is replayed. Stripping them loses no meaning.
+ */
+const HIDDEN_UNICODE_RE = /[\u200b-\u200f\u202a-\u202e\u2060-\u2069\ufeff\u00ad\u180e\u034f\u061c\u115f\u1160]/g
+
+/** Strip invisible Unicode from one string. */
+function sanitizeHiddenUnicode(content) {
+  return String(content).replace(HIDDEN_UNICODE_RE, '')
+}
+
+/**
+ * The same, over a whole JSON payload: every string is cleaned, structure and
+ * other types are preserved. Past the depth cap the subtree is returned as-is
+ * (this is a defense in depth, not an authorization check — refusing the
+ * response to the user would be worse than passing an unsanitized deep node).
+ */
+function sanitizeHiddenUnicodeJson(value, depth = 0) {
+  if (depth > MAX_JSON_DEPTH) return value
+  if (typeof value === 'string') return sanitizeHiddenUnicode(value)
+  if (value === null || typeof value !== 'object') return value
+  if (Array.isArray(value)) return value.map((item) => sanitizeHiddenUnicodeJson(item, depth + 1))
+  const out = {}
+  for (const [key, nested] of Object.entries(value)) out[key] = sanitizeHiddenUnicodeJson(nested, depth + 1)
+  return out
+}
+
+/**
+ * Clamp a sandbox mode wider than the account's allowance back down to it.
+ *
+ * Why this exists: a session shared by the owning account can carry
+ * permission/preset or sandbox/mode events recorded while it ran with a wider
+ * sandbox. Replaying that history into a restricted account would hand it the
+ * wider mode without a single action from anyone — an escalation with no
+ * approval step to intercept.
+ *
+ * Rewrites in place: `permission/preset` events, `sandbox/mode` events, and
+ * the projected `currentValue` the client displays as the active preset.
+ *
+ * @returns whether anything changed.
+ */
+function clampSessionHistorySandbox(value, allowedMode, depth = 0) {
+  if (depth > MAX_JSON_DEPTH || value === null || typeof value !== 'object') return false
+  if (typeof allowedMode !== 'string' || !Object.prototype.hasOwnProperty.call(SANDBOX_RANK, allowedMode)) return false
+  const allowedRank = SANDBOX_RANK[allowedMode]
+  let changed = false
+
+  const widerThan = (mode) => Object.prototype.hasOwnProperty.call(SANDBOX_RANK, mode) && SANDBOX_RANK[mode] > allowedRank
+
+  if (value.type === 'permission/preset' && value.data && typeof value.data === 'object') {
+    if (typeof value.data.preset === 'string' && widerThan(value.data.preset)) {
+      value.data.preset = allowedMode
+      changed = true
+    }
+  }
+  if (value.type === 'sandbox/mode' && value.data && typeof value.data === 'object') {
+    if (typeof value.data.mode === 'string' && widerThan(value.data.mode)) {
+      value.data.mode = allowedMode
+      changed = true
+    }
+  }
+  if (typeof value.currentValue === 'string' && widerThan(value.currentValue)) {
+    value.currentValue = allowedMode
+    changed = true
+  }
+
+  for (const key of Object.keys(value)) {
+    const nested = value[key]
+    if (nested !== null && typeof nested === 'object' && clampSessionHistorySandbox(nested, allowedMode, depth + 1)) {
+      changed = true
+    }
+  }
+  return changed
+}
+
+/** Workspace creation endpoints (gated by allowWorkspaceCreate). */
+function isWorkspaceCreate(pathname) {
+  return /^\/api\/workspace[.\/](add|create)([.\/]|$)/.test(String(pathname))
+}
+
+/** Workspace delete/rename endpoints (ownership applies as well as the switch). */
+function isWorkspaceDeleteOrRename(pathname) {
+  return /^\/api\/workspace[.\/](remove|delete|rename|update)([.\/]|$)/.test(String(pathname))
+}
+
+/**
+ * Old and new path of a rename/delete request, or null when either is missing.
+ *
+ * Callers must stay fail-closed on null: a rename whose target cannot be read is
+ * a rename that cannot be authorized.
+ */
+function extractWorkspaceRenamePaths(value, depth = 0) {
+  const oldKeys = new Set(['oldPath', 'previousPath', 'sourcePath', 'fromPath'])
+  const newKeys = new Set(['newPath', 'targetPath', 'destinationPath', 'toPath'])
+  let oldPath = null
+  let newPath = null
+  const visit = (current, level) => {
+    if (level > MAX_BODY_DEPTH || current === null || typeof current !== 'object') return
+    if (oldPath !== null && newPath !== null) return
+    if (Array.isArray(current)) {
+      for (const item of current) visit(item, level + 1)
+      return
+    }
+    for (const [key, nested] of Object.entries(current)) {
+      if (oldPath === null && oldKeys.has(key) && typeof nested === 'string' && nested !== '') oldPath = nested
+      else if (newPath === null && newKeys.has(key) && typeof nested === 'string' && nested !== '') newPath = nested
+      else visit(nested, level + 1)
+    }
+  }
+  visit(value, depth)
+  return oldPath !== null && newPath !== null ? { oldPath, newPath } : null
+}
+
+/** aionui-panel file-tree endpoints that WRITE (they mirror the upload switch). */
+const AIONUI_WRITE_PATHS = new Set([
+  '/aionui-panel/write',
+  '/aionui-panel/delete',
+  '/aionui-panel/git-stage',
+  '/aionui-panel/git-unstage',
+  '/aionui-panel/git-discard',
+])
+
+/**
+ * Endpoints that put a file INTO the host: the uploads plugin, the file-path
+ * "import into workspace" bridge, the SSH upload, and the aionui-panel writers.
+ *
+ * Ported from dsh-passwords (its isUploadRequest plus the aionui writers, which
+ * it gates through the same switch).
+ */
+function isUploadRequest(method, pathname) {
+  const m = String(method || '').toUpperCase()
+  if (m !== 'POST' && m !== 'PUT' && m !== 'DELETE') return false
+  if (AIONUI_WRITE_PATHS.has(pathname)) return true
+  if (m !== 'POST' && m !== 'PUT') return false
+  return (
+    pathname === '/api/dsh-uploads' ||
+    pathname.startsWith('/api/dsh-uploads/') ||
+    pathname === '/api/filePathBridge/importFile' ||
+    pathname === '/api/dsh-ssh/upload'
+  )
+}
+
+/**
+ * Endpoints that take data OUT of the host: the git tool RPCs, the git-graph
+ * and aionui git panels, plus the other "hand me the server's contents" doors
+ * (session export zip, SSH download/list, uploads download).
+ *
+ * Deliberately a prefix match on git RPCs only — /api/session.fetch and friends
+ * are ordinary endpoints and must not be caught here.
+ */
+function isGitRequest(pathname) {
+  return (
+    /^\/api\/git[-.\/]/i.test(pathname) ||
+    /^\/aionui-panel\/git[-.]/.test(pathname) ||
+    /^\/api\/session[.\/]export/.test(pathname) ||
+    /^\/api\/dsh-ssh[.\/](download|ls)/.test(pathname) ||
+    /^\/api\/dsh-uploads[.\/]download/.test(pathname)
+  )
+}
+
+/**
+ * Third-party "ops surfaces" that only the owning account may see: the SSH host
+ * inventory/tunnels (they carry connection details and key material), the skin
+ * centre and modlens panels (outside the permission model entirely), and the
+ * shared upload store's LIST/DELETE routes (enumerating or deleting other
+ * people's files). The uploads POST path stays governed by allowUpload and its
+ * download by allowGit, as in dsh-passwords.
+ */
+function isAdminOnlyPluginEndpoint(method, pathname) {
+  const m = String(method || 'GET').toUpperCase()
+  return (
+    pathname === '/api/dsh-ssh' ||
+    pathname.startsWith('/api/dsh-ssh/') ||
+    pathname === '/api/skin-center' ||
+    pathname.startsWith('/api/skin-center/') ||
+    pathname === '/modlens' ||
+    pathname.startsWith('/modlens/') ||
+    (pathname === '/api/dsh-uploads' && (m === 'GET' || m === 'DELETE'))
+  )
+}
+
+export {
+  isWorkspaceCreate,
+  isWorkspaceDeleteOrRename,
+  extractWorkspaceRenamePaths,
+  HIDDEN_UNICODE_RE,
+  sanitizeHiddenUnicode,
+  sanitizeHiddenUnicodeJson,
+  clampSessionHistorySandbox,
+  AIONUI_WRITE_PATHS,
+  isUploadRequest,
+  isGitRequest,
+  isAdminOnlyPluginEndpoint,
+  findStringField,
+  permissionPresetFromCommand,
+  presetFromSettingsMutate,
+  forceRejectApproval,
+  PATH_FIELDS,
+  extractPathFromBody,
+  extractWorkspaceId,
+  collectIdPathPairs,
+  DENY_ALL_WORKSPACES,
+  SANDBOX_RANK,
+  MAX_JSON_DEPTH,
+  normalizePath,
+  isWorkspaceRestricted,
+  folderAllowed,
+  filterByPathField,
+  filterByPathFieldWithPredicate,
+  sandboxPresetRank,
+}