kczx-user-management 1.0.3 → 1.0.4

package/README.md

@@ -87,7 +87,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 |---|---|
 | 用户增删改查 | 用户表每行一个「编辑」**全屏页**：基本资料（部门 / 角色）+ 账号操作（重置密码 / 重置两步验证 / 禁用启用 / 删除）+ 权限与配额，集中一屏；改动类走「保存」，破坏性操作仍是各自带确认的按钮 |
 | 所属部门 | 账号资料字段（trim 后 ≤ 64 字，控制字符剔除）：新增用户时可填，编辑页可随时改或清空；变更写进操作日志 |
-| 工作区白名单 | 留空 = 允许全部；填写后只允许这些目录（Windows 路径折叠大小写，末尾斜杠自动忽略） |
+| 工作区白名单 | **留空 = 不允许任何工作区**（白名单默认拒绝）；填写后只允许这些目录下的工作区；条目 `*` = 允许全部。Windows 路径折叠大小写，末尾斜杠自动忽略 |
 | 工作区归属跟踪 | 谁创建的工作区归谁：别人看不到、也不能删改；删除后释放，账号删除后清理 |
 | 每小时 token 配额 | 由浏览器上报 dsh 自身的用量投影增量，服务端按小时窗口累计并拦截 |
 | 每日时长配额 | 按真实活跃时间累计（不是请求数），限流不因轮询膨胀 |
@@ -171,6 +171,9 @@ dsh plugin --profile web remove kczx-user-management
 - **执行只对本地存在的账号生效**：签名身份 / 未知用户名按「不限制」处理，避免迁移期误锁人。
 - **门只管走门的人**：若另有插件把 dsh 宿主绑到 `0.0.0.0`（例如 dsh-lan-access），直连宿主端口即可绕过登录，
   且**绕过流量不会出现在任何一本台账里**。要真正的强制约束，宿主端口必须保持回环。
+- **工作区白名单的语义**：空名单 = 全部禁止（1.0.4 起；此前是"允许全部"）。升级时会对老记录做**一次性迁移**——把"空名单"写成显式
+  的 `*`（允许全部），保持账号原有的可达范围；迁移只跑一次（留下 `workspace-scope-migration.json` 标记），之后你手工清空白名单
+  才等于全部禁止。新建账号默认空 = 无工作区权限。
 - **token 配额依赖客户端上报**：浏览器侧被禁用或页面未加载时不计费（时长配额不受影响，它在服务端计时）。
 - **会话历史要缓冲后才能改写**：历史响应是**一个 JSON 文档**（长会话实测 9–16 MB），网关必须先缓冲才能做沙盒降级与隐藏字符
   清洗，因此有 `historyMaxBytes` 上限（默认 64 MiB）。超过上限的会话会 **fail-closed 返回 502**，UI 显示「历史加载失败」——

package/client/bundle.js

@@ -199,8 +199,11 @@ window.__ModuleLoader__.load({
       usageTokensFree: '{used} tok/h',
       permissionsTitle: '权限与配额',
       permFolders: '工作区白名单',
-      permFoldersHint: '留空 = 允许访问所有工作区；填写后只允许这些目录下的工作区。',
-      permFoldersAll: '未限制（允许全部工作区）',
+      permFoldersHint: '留空 = 不允许任何工作区；填写后只允许这些目录下的工作区；条目 * 表示允许全部。',
+      permFoldersNone: '未授权（不允许任何工作区）',
+      permFoldersAll: '允许全部（*）',
+      permFoldersAllShort: '允许全部工作区',
+      permFoldersNoneShort: '禁止所有工作区',
       permFolderPlaceholder: '例如 /srv/work 或 D:\\work',
       add: '添加',
       remove: '移除',
@@ -382,8 +385,11 @@ window.__ModuleLoader__.load({
       usageTokensFree: '{used} tok/h',
       permissionsTitle: 'Permissions & Quota',
       permFolders: 'Workspace allow-list',
-      permFoldersHint: 'Empty = every workspace is allowed; once filled, only workspaces under these folders are.',
-      permFoldersAll: 'Unrestricted (all workspaces allowed)',
+      permFoldersHint: 'Empty = no workspace at all; once filled, only workspaces under these folders are. Add * to allow every workspace.',
+      permFoldersNone: 'Not granted (no workspace allowed)',
+      permFoldersAll: 'Allow all (*)',
+      permFoldersAllShort: 'All workspaces',
+      permFoldersNoneShort: 'No workspace',
       permFolderPlaceholder: 'e.g. /srv/work or D:\\work',
       add: 'Add',
       remove: 'Remove',
@@ -874,14 +880,22 @@ window.__ModuleLoader__.load({
       return byTime || byTokens
     }
 
+    /** Whether one allow-list entry grants every workspace ('*', '/', '.' or ''). */
+    function folderAllowsEverything(entry) {
+      return entry === '*' || entry === '' || entry === '/' || entry === '.'
+    }
+
     /** One-line limits summary for the users table. */
     function permissionSummary(user, t) {
       const p = user.permissions || {}
       const bits = []
       if (p.banned) bits.push(t('permBannedShort'))
-      if (Array.isArray(p.allowedFolders) && p.allowedFolders.length > 0) {
-        bits.push(interpolate(t('permFoldersShort'), { n: p.allowedFolders.length }))
-      }
+      // The workspace field always says something: an untouched account is denied,
+      // which the table must show rather than leave blank.
+      const folders = Array.isArray(p.allowedFolders) ? p.allowedFolders : []
+      if (folders.length === 0) bits.push(t('permFoldersNoneShort'))
+      else if (folders.some(folderAllowsEverything)) bits.push(t('permFoldersAllShort'))
+      else bits.push(interpolate(t('permFoldersShort'), { n: folders.length }))
       if (p.hourlyTokenLimit != null) bits.push(interpolate(t('permTokensShort'), { n: p.hourlyTokenLimit }))
       if (p.dailyMinuteLimit != null) bits.push(interpolate(t('permMinutesShort'), { n: p.dailyMinuteLimit }))
       if (p.sandboxMode) bits.push(p.sandboxMode)
@@ -901,9 +915,10 @@ window.__ModuleLoader__.load({
      *  confirm: folding those into a save button would hide them from the operator
      *  reviewing the form before pressing it.
      *
-     *  The store's reading is surfaced verbatim: an empty folder list means every
-     *  workspace, an empty limit means no cap — clearing a field is a visible,
-     *  deliberate act rather than a silent default. */
+     *  The store's reading is surfaced verbatim: an empty folder list means NO
+     *  workspace (the whitelist denies by default, and '*' is the wide grant), an
+     *  empty limit means no cap — clearing a field is a visible, deliberate act
+     *  rather than a silent default. */
     function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
       const p = user.permissions || {}
       const isSelf = user.id === me.id
@@ -1058,7 +1073,7 @@ window.__ModuleLoader__.load({
                 h('label', null, t('permFolders')),
                 h('div', { className: 'um-muted', style: { fontSize: 11, marginTop: -4 } }, t('permFoldersHint')),
                 folders.length === 0
-                  ? h('div', { className: 'um-empty' }, t('permFoldersAll'))
+                  ? h('div', { className: 'um-empty' }, t('permFoldersNone'))
                   : folders.map((folder, index) => h('div', { key: folder, className: 'um-row' },
                     h('code', { style: { flex: 1, wordBreak: 'break-all', fontSize: 12 } }, folder),
                     h('button', {
@@ -1071,7 +1086,12 @@ window.__ModuleLoader__.load({
                     value: draft, onChange: (e) => setDraft(e.target.value),
                     onKeyDown: (e) => { if (e.key === 'Enter') { e.preventDefault(); addFolder() } },
                   }),
-                  h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add'))),
+                  h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add')),
+            // Blank now means "no workspace", so the wide grant needs its own door.
+            h('button', {
+              className: 'um-btn', style: { flex: 'none' },
+              onClick: () => { if (!folders.includes('*')) setFolders([...folders, '*']) },
+            }, t('permFoldersAll'))),
 
                 h('label', { htmlFor: 'um-perm-tokens' }, t('permTokenLimit')),
                 h('input', {

package/client/index.js

@@ -189,8 +189,11 @@ const ZH = {
   usageTokensFree: '{used} tok/h',
   permissionsTitle: '权限与配额',
   permFolders: '工作区白名单',
-  permFoldersHint: '留空 = 允许访问所有工作区；填写后只允许这些目录下的工作区。',
-  permFoldersAll: '未限制（允许全部工作区）',
+  permFoldersHint: '留空 = 不允许任何工作区；填写后只允许这些目录下的工作区；条目 * 表示允许全部。',
+  permFoldersNone: '未授权（不允许任何工作区）',
+  permFoldersAll: '允许全部（*）',
+  permFoldersAllShort: '允许全部工作区',
+  permFoldersNoneShort: '禁止所有工作区',
   permFolderPlaceholder: '例如 /srv/work 或 D:\\work',
   add: '添加',
   remove: '移除',
@@ -372,8 +375,11 @@ const EN = {
   usageTokensFree: '{used} tok/h',
   permissionsTitle: 'Permissions & Quota',
   permFolders: 'Workspace allow-list',
-  permFoldersHint: 'Empty = every workspace is allowed; once filled, only workspaces under these folders are.',
-  permFoldersAll: 'Unrestricted (all workspaces allowed)',
+  permFoldersHint: 'Empty = no workspace at all; once filled, only workspaces under these folders are. Add * to allow every workspace.',
+  permFoldersNone: 'Not granted (no workspace allowed)',
+  permFoldersAll: 'Allow all (*)',
+  permFoldersAllShort: 'All workspaces',
+  permFoldersNoneShort: 'No workspace',
   permFolderPlaceholder: 'e.g. /srv/work or D:\\work',
   add: 'Add',
   remove: 'Remove',
@@ -864,14 +870,22 @@ function overQuota(user) {
   return byTime || byTokens
 }
 
+/** Whether one allow-list entry grants every workspace ('*', '/', '.' or ''). */
+function folderAllowsEverything(entry) {
+  return entry === '*' || entry === '' || entry === '/' || entry === '.'
+}
+
 /** One-line limits summary for the users table. */
 function permissionSummary(user, t) {
   const p = user.permissions || {}
   const bits = []
   if (p.banned) bits.push(t('permBannedShort'))
-  if (Array.isArray(p.allowedFolders) && p.allowedFolders.length > 0) {
-    bits.push(interpolate(t('permFoldersShort'), { n: p.allowedFolders.length }))
-  }
+  // The workspace field always says something: an untouched account is denied,
+  // which the table must show rather than leave blank.
+  const folders = Array.isArray(p.allowedFolders) ? p.allowedFolders : []
+  if (folders.length === 0) bits.push(t('permFoldersNoneShort'))
+  else if (folders.some(folderAllowsEverything)) bits.push(t('permFoldersAllShort'))
+  else bits.push(interpolate(t('permFoldersShort'), { n: folders.length }))
   if (p.hourlyTokenLimit != null) bits.push(interpolate(t('permTokensShort'), { n: p.hourlyTokenLimit }))
   if (p.dailyMinuteLimit != null) bits.push(interpolate(t('permMinutesShort'), { n: p.dailyMinuteLimit }))
   if (p.sandboxMode) bits.push(p.sandboxMode)
@@ -891,9 +905,10 @@ function permissionSummary(user, t) {
  *  confirm: folding those into a save button would hide them from the operator
  *  reviewing the form before pressing it.
  *
- *  The store's reading is surfaced verbatim: an empty folder list means every
- *  workspace, an empty limit means no cap — clearing a field is a visible,
- *  deliberate act rather than a silent default. */
+ *  The store's reading is surfaced verbatim: an empty folder list means NO
+ *  workspace (the whitelist denies by default, and '*' is the wide grant), an
+ *  empty limit means no cap — clearing a field is a visible, deliberate act
+ *  rather than a silent default. */
 function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
   const p = user.permissions || {}
   const isSelf = user.id === me.id
@@ -1048,7 +1063,7 @@ function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
             h('label', null, t('permFolders')),
             h('div', { className: 'um-muted', style: { fontSize: 11, marginTop: -4 } }, t('permFoldersHint')),
             folders.length === 0
-              ? h('div', { className: 'um-empty' }, t('permFoldersAll'))
+              ? h('div', { className: 'um-empty' }, t('permFoldersNone'))
               : folders.map((folder, index) => h('div', { key: folder, className: 'um-row' },
                 h('code', { style: { flex: 1, wordBreak: 'break-all', fontSize: 12 } }, folder),
                 h('button', {
@@ -1061,7 +1076,12 @@ function EditUserPage({ user, me, onClose, onDone, onTempPassword, __t: t }) {
                 value: draft, onChange: (e) => setDraft(e.target.value),
                 onKeyDown: (e) => { if (e.key === 'Enter') { e.preventDefault(); addFolder() } },
               }),
-              h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add'))),
+              h('button', { className: 'um-btn', style: { flex: 'none' }, onClick: addFolder }, t('add')),
+        // Blank now means "no workspace", so the wide grant needs its own door.
+        h('button', {
+          className: 'um-btn', style: { flex: 'none' },
+          onClick: () => { if (!folders.includes('*')) setFolders([...folders, '*']) },
+        }, t('permFoldersAll'))),
 
             h('label', { htmlFor: 'um-perm-tokens' }, t('permTokenLimit')),
             h('input', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",

package/src/index.js

@@ -163,13 +163,20 @@ function readJsonBody(req) {
   })
 }
 
-// Secure because the gateway is HTTPS-only now (the shared-server HTTP gate is gone).
-function sessionCookie(token) {
-  return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=${SESSION_TTL_SECONDS}`
+/**
+ * Session cookie.
+ *
+ * `Secure` is set only when the listener actually terminates TLS: browsers
+ * silently DROP a Secure cookie received over plain HTTP, so a cleartext
+ * deployment keeping the flag would bounce the user back to the login page
+ * forever while every request looked fine on the server side.
+ */
+function sessionCookie(token, secure = true) {
+  return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax${secure ? '; Secure' : ''}; Max-Age=${SESSION_TTL_SECONDS}`
 }
 
-function clearedCookie() {
-  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=0`
+function clearedCookie(secure = true) {
+  return `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax${secure ? '; Secure' : ''}; Max-Age=0`
 }
 
 /** Normalize an API path: strip trailing slashes (keep the root). */
@@ -200,6 +207,15 @@ async function handleApi(req, res, deps) {
   const method = (req.method || 'GET').toUpperCase()
   const { store } = deps
   const apiPath = path.startsWith(`${API_PREFIX}/`) ? path.slice(API_PREFIX.length) : path
+  /**
+   * Whether cookies should carry `Secure` — i.e. the listener terminates TLS.
+   *
+   * The transport lives in the host half's config, which handleApi cannot read
+   * directly (it is a module-level function; the config is apply()'s closure), so
+   * the answer arrives through deps. Defaulting to `true` keeps the strict
+   * behaviour for callers that do not supply it.
+   */
+  const secureCookies = () => (typeof deps.secureCookies === 'function' ? deps.secureCookies() !== false : true)
 
   const authed = async () => {
     // A signature-bearing request from the co-located login gateway has no
@@ -263,7 +279,7 @@ async function handleApi(req, res, deps) {
     const { token } = await store.createSession(user)
     await store.touchLogin(user)
     await store.appendActivity({ type: 'login', username: user.username, userId: user.id, ip: deps.clientIp(req) })
-    return sendJson(res, 200, { user: store.publicUser(user) }, { 'set-cookie': sessionCookie(token) })
+    return sendJson(res, 200, { user: store.publicUser(user) }, { 'set-cookie': sessionCookie(token, secureCookies()) })
   }
 
   // Self-registration is closed. Accounts are created by an administrator on the
@@ -295,7 +311,7 @@ async function handleApi(req, res, deps) {
       await store.touchLogin(user)
       if (key && typeof key.consume === 'function') key.consume()
       await store.appendActivity({ type: 'setup', username: user.username, userId: user.id, ip: deps.clientIp(req), detail: 'owner account created' })
-      return sendJson(res, 200, { user: store.publicUser(user) }, { 'set-cookie': sessionCookie(token) })
+      return sendJson(res, 200, { user: store.publicUser(user) }, { 'set-cookie': sessionCookie(token, secureCookies()) })
     } catch (error) {
       if (error instanceof StoreError) return sendJson(res, statusForStoreError(error), { error: error.message })
       throw error
@@ -320,7 +336,7 @@ async function handleApi(req, res, deps) {
       await store.dropSession(session.token)
       await store.appendActivity({ type: 'logout', username: session.user.username, userId: session.user.id, ip: deps.clientIp(req) })
     }
-    return sendJson(res, 200, { ok: true }, { 'set-cookie': clearedCookie() })
+    return sendJson(res, 200, { ok: true }, { 'set-cookie': clearedCookie(secureCookies()) })
   }
 
   // ── authenticated self service ───────────────────────────────────────────
@@ -1163,6 +1179,8 @@ const plugin = {
      */
     // Error → status mapping lives with the store's own error types.
     deps.statusForError = (error) => statusForStoreError(error)
+    // Cookies follow the transport: Secure only when this listener speaks TLS.
+    deps.secureCookies = () => resolvedConfig().plaintext !== true
     deps.workspaceOwners = () => store.workspaceOwners()
     deps.claimWorkspace = (path, username) => store.claimWorkspace(path, username)
     deps.releaseWorkspace = (path) => store.releaseWorkspace(path)
@@ -1201,15 +1219,16 @@ const plugin = {
           // sites WITH cert/key stay independent SNI sites (real domain
           // certs). Empty cfg.sites = pure auto (zero-config default).
           const sites = resolveSites(cfg, allLocalIPs())
-          // Plaintext is legal on loopback only: it exists so the co-located
-          // dsh-passwords gateway can reach this observer through the raw TCP
-          // tunnel it uses for WebSocket upgrades. Any other bind would expose
-          // the observer unencrypted, so it is refused rather than honoured.
+          // Plaintext is honoured on any interface, because an intranet
+          // deployment may legitimately want it — but never quietly: every
+          // password, session cookie and prompt crosses the wire unencrypted.
+          // (Historically this was coerced to 127.0.0.1, when the only plaintext
+          // listener was the loopback observer for dsh-passwords.)
           if (cfg.plaintext && !isLoopbackHost(cfg.listenHost)) {
-            warn(`user-management: plaintext listener pinned to 127.0.0.1 (configured listenHost "${cfg.listenHost}" would serve it unencrypted)`)
+            warn(`user-management: PLAINTEXT gateway on ${cfg.listenHost}:${cfg.port} — passwords, session cookies and all traffic are unencrypted. Use this only on a network you trust; prefer plaintext: false otherwise.`)
           }
           const options = {
-            listenHost: cfg.plaintext ? '127.0.0.1' : cfg.listenHost,
+            listenHost: cfg.listenHost,
             plaintext: cfg.plaintext === true,
             port: cfg.port,
             upstream: resolveUpstream(cfg),
@@ -1227,7 +1246,9 @@ const plugin = {
               return renderLoginPage(params)
             },
             deps,
-            clearedCookie,
+            // The gateway's own /logout route clears the session cookie; it must
+            // follow the transport exactly like the API paths do.
+            clearedCookie: () => clearedCookie(cfg.plaintext !== true),
             auditHooks,
             log,
             warn,

package/src/permissions.js

@@ -9,19 +9,26 @@
  * calls these; keeping them separate is what makes the policy verifiable
  * without a live gateway.
  *
- * Semantics are carried over verbatim, because the store and the settings UI
- * already speak them:
- *   - an EMPTY allow-list means \"every workspace\" (the unrestricted default);
- *   - DENY_ALL_WORKSPACES is how an admin says \"no workspace at all\", which an
- *     empty list cannot express;
+ * Semantics (deliberately NOT the dsh-passwords reading any more):
+ *   - an EMPTY allow-list means "no workspace at all" — the deny default. A
+ *     field left blank must not be the widest possible grant;
+ *   - ALL_WORKSPACES ('*') is how an admin grants every workspace, which an
+ *     empty list used to express implicitly;
+ *   - DENY_ALL_WORKSPACES ('__deny__') is the explicit deny sentinel, kept for
+ *     records written under the old reading and for callers that want to say it
+ *     out loud;
  *   - a path is allowed when it equals an entry or sits underneath it.
  */
 
 import path from 'node:path'
 
-/** Sentinel entry meaning \"deny every workspace\" (distinct from \"[] = all\"). */
+/** Sentinel entry meaning "deny every workspace" (kept for records written under the old reading). */
 const DENY_ALL_WORKSPACES = '__deny__'
 
+/** Sentinel entry meaning "every workspace" — the mirror of the deny sentinel,
+ *  and the only way to grant everything now that an empty list denies. */
+const ALL_WORKSPACES = '*'
+
 /** Sandbox modes from narrowest to widest; the rank decides what is a
  *  downgrade and what would be an escalation. */
 const SANDBOX_RANK = { 'read-only': 0, 'workspace-write': 1, 'danger-full-access': 2 }
@@ -53,20 +60,34 @@ function normalizePath(p) {
   return n
 }
 
-/** Whether a list actually restricts anything (empty = unrestricted). */
+/** Whether one entry grants the whole disk. */
+function entryAllowsEveryWorkspace(entry) {
+  if (entry === ALL_WORKSPACES) return true
+  const base = normalizePath(entry)
+  // normalize('') is '.': an empty entry and '/' both mean "the whole disk".
+  return base === '.' || base === '/'
+}
+
+/** Whether a list restricts anything — which an empty list now does. */
 function isWorkspaceRestricted(allowedFolders) {
-  return Array.isArray(allowedFolders) && allowedFolders.length > 0
+  const list = Array.isArray(allowedFolders) ? allowedFolders : []
+  return !list.some(entryAllowsEveryWorkspace)
 }
 
-/** Whether `target` is inside the allow-list (or the list is unrestricted). */
+/**
+ * Whether `target` is inside the allow-list.
+ *
+ * An empty list allows NOTHING: the field is a whitelist, so leaving it blank
+ * grants no workspace rather than every workspace.
+ */
 function folderAllowed(target, allowedFolders) {
   const list = Array.isArray(allowedFolders) ? allowedFolders : []
-  if (list.length === 0) return true
+  if (list.length === 0) return false
   if (list.includes(DENY_ALL_WORKSPACES)) return false
   const p = normalizePath(target)
   return list.some((entry) => {
+    if (entry === ALL_WORKSPACES) return true
     const base = normalizePath(entry)
-    // normalize('') is '.': an empty entry and '/' both mean \"the whole disk\"
     if (base === '.' || base === '/') return true
     // Prefix match must respect a separator boundary, or '/srv/ab' would pass
     // an allow-list entry of '/srv/a'.
@@ -466,6 +487,8 @@ export {
   extractWorkspaceId,
   collectIdPathPairs,
   DENY_ALL_WORKSPACES,
+  ALL_WORKSPACES,
+  entryAllowsEveryWorkspace,
   SANDBOX_RANK,
   MAX_JSON_DEPTH,
   normalizePath,

package/src/store.js

@@ -21,7 +21,7 @@ import { promisify } from 'node:util'
 import { join, resolve } from 'node:path'
 import { homedir } from 'node:os'
 import { generateSecret, verifyTotp } from './totp.js'
-import { DENY_ALL_WORKSPACES, isWorkspaceRestricted, normalizePath } from './permissions.js'
+import { ALL_WORKSPACES, DENY_ALL_WORKSPACES, isWorkspaceRestricted, normalizePath } from './permissions.js'
 // Only used to verify hashes imported from dsh-passwords: its accounts are
 // bcrypt and a hash cannot be converted, so the record keeps its algorithm
 // marker and is transparently re-hashed to scrypt on the next sign-in.
@@ -68,7 +68,8 @@ const BCRYPT_ALGO = 'bcrypt'
 let bcryptFailureReported = false
 
 const DEFAULT_PERMISSIONS = Object.freeze({
-  /** Absolute folders this account may touch; empty = unrestricted. */
+  /** Absolute folders this account may touch. Empty = no workspace at all
+   *  (the whitelist denies by default); '*' = every workspace. */
   allowedFolders: [],
   /** Tokens per rolling hour; null = unlimited. */
   hourlyTokenLimit: null,
@@ -372,6 +373,32 @@ function createStore({ home, now = () => Date.now() } = {}) {
     // Records written before the permission model existed carry no block: fill
     // in the defaults in place so every reader sees one shape.
     for (const user of usersDoc.users) user.permissions = normalizePermissions(user.permissions)
+    // One-time semantics migration. An empty allow-list used to mean "every
+    // workspace"; it now means "no workspace". Every account still carrying the
+    // old reading is pinned to the explicit allow-all sentinel ONCE, so the rule
+    // flips without silently locking anyone out of the workspaces they can reach
+    // today. The marker file is what makes it one-time: an account left empty
+    // after the migration means exactly what it says.
+    const scopeMarker = join(dir, 'workspace-scope-migration.json')
+    const migratedBefore = await fsP.access(scopeMarker).then(() => true).catch(() => false)
+    if (!migratedBefore) {
+      const legacy = usersDoc.users.filter((user) => (user.permissions.allowedFolders || []).length === 0)
+      for (const user of legacy) {
+        user.permissions = { ...normalizePermissions(user.permissions), allowedFolders: [ALL_WORKSPACES] }
+      }
+      await fsP.writeFile(
+        scopeMarker,
+        JSON.stringify({ version: 2, migratedAt: new Date(now()).toISOString(), accounts: legacy.length }) + '\n',
+        'utf8',
+      )
+      if (legacy.length > 0) {
+        await persistUsers()
+        console.warn(
+          `[user-management] an empty workspace allow-list now denies every workspace; ` +
+            `${legacy.length} account(s) that carried the old reading were pinned to "${ALL_WORKSPACES}" (allow all)`,
+        )
+      }
+    }
     if (!sessionsDoc.tokens || typeof sessionsDoc.tokens !== 'object') sessionsDoc.tokens = {}
     if (!Array.isArray(bansDoc.bans)) bansDoc.bans = []
     if (!usageDoc || typeof usageDoc.users !== 'object' || usageDoc.users === null) usageDoc = { users: {} }
@@ -1052,7 +1079,7 @@ function createStore({ home, now = () => Date.now() } = {}) {
     // users
     createUser, verifyLogin, checkLogin, setPassword, setRole, setDisabled, setDepartment, removeUser, touchLogin,
     listUsers, findUser, findUserByUsername, countAdmins, roleForNextRegistration, publicUser,
-    setPermissions, normalizePermissions, isWorkspaceRestricted, DENY_ALL_WORKSPACES, importUser,
+    setPermissions, normalizePermissions, isWorkspaceRestricted, DENY_ALL_WORKSPACES, ALL_WORKSPACES, importUser,
     // totp
     startTotpSetup, activateTotp, disableTotp, verifyLoginOtp,
     // sessions
@@ -1080,6 +1107,7 @@ export {
   normalizePermissions,
   isWorkspaceRestricted,
   DENY_ALL_WORKSPACES,
+  ALL_WORKSPACES,
   DEFAULT_PERMISSIONS,
   SANDBOX_MODES,
   dshHome,