kczx-user-management 1.6.0 → 1.6.2

package/README.md

@@ -88,7 +88,7 @@ node scripts/ensure-deps.mjs                     # 仅当上述解析不到 sche
 |---|---|
 | 用户增删改查 | 用户表每行一个「编辑」**全屏页**：基本资料（部门 / 角色）+ 账号操作（重置密码 / 重置两步验证 / 禁用启用 / 删除）+ 权限与配额，集中一屏；改动类走「保存」，破坏性操作仍是各自带确认的按钮 |
 | 所属部门（1.6.0 起支持多层级） | 账号资料字段，支持**多层级路径**：用 `/` 分层，例如 `和平分局/刑侦大队/一中队`（`\` 也认，存的时候统一成 `/`）。新增用户时可填，编辑页可随时改或清空；编辑时框下会把层级摊开显示，并列出**已在用的层级**供一键接续；变更写进操作日志。规则（服务端为准，界面同款提示在前面）：最多 **5 级**、每一级 ≤ **24 字**、整串 ≤ **64 字**（含分隔符）；层级里不能有 `\ / : * ? " < > |`，也不能是 `.` / `..`——因为这些层级要变成目录名。写不进去的值**报错而不是悄悄改写**（理由同长度上限） |
-| 新建账号即建工作区 | 新增用户时勾选「同时创建该用户的工作区」：路径预填 `<harness 根>/<部门各级>/<用户名>`，**一级部门一个目录**（`…\和平分局\刑侦大队\zhang`；可改成任意绝对路径）；提交后目录按需创建、登记进 dsh 工作区列表，并把该路径写进这个账号的工作区白名单。部门不合法时**先报 400，再建目录**——不会留下半棵树 |
+| 新建账号即建工作区 | 新增用户时勾选「同时创建该用户的工作区」：路径预填 `<harness 根>/workspace/<部门各级>/<用户名>`，**一级部门一个目录**（`…\workspace\和平分局\刑侦大队\zhang`；可改成任意绝对路径）；提交后目录按需创建、登记进 dsh 工作区列表，并把该路径写进这个账号的工作区白名单。部门不合法时**先报 400，再建目录**——不会留下半棵树 |
 | 工作区白名单 | **留空 = 不允许任何工作区**（白名单默认拒绝）；填写后只允许这些目录下的工作区；条目 `*` = 允许全部。Windows 路径折叠大小写，末尾斜杠自动忽略 |
 | 工作区归属跟踪 | 谁创建的工作区归谁：别人看不到、也不能删改；删除后释放，账号删除后清理 |
 | 会话可见性（1.6.0 起） | 会话按**会话自己的工作目录**判定：目录不在本账号白名单内、或落在别人认领的工作区里，这个会话就不下发。**为什么必须有**：前端把「没有被任何可见工作区认领」的会话统统塞进「未分组」那一组——只藏工作区行的话，里面的会话会带着标题、点开即读的历史原地复活。**三个入口一起堵**：① `session.list`（0.1.1）/ `session/list`（0.1.2+）的一元响应；② 0.1.1 的 `host/session-added` 实时推送（`GET /api/events.host` 的 SSE——每个新建会话都会被推给所有在线浏览器，只改一元响应的话，别人新建一条就会把行实时推回来）；③ 0.1.2+ 的 `api-session/added`（`$events` mux 流上的 emit 帧）。`session.search` 沿用列表刚藏掉的 id 清单摘命中片段。判定只看 `cwd`：`blank` **不**豁免（别人目录里的「新建会话」行也还是别人的目录），只有子代理行（`origin: subagent`，前端本来就不列）和**读不到 cwd** 的行保留——「判断不了」不等于「不该看」 |
@@ -231,7 +231,8 @@ user-management:
 
 ### 部门层级（1.6.0 起）
 
-部门的「多层级」不是一张独立的部门表，而是**一个字符串里的路径**：`和平分局/刑侦大队/一中队`。这么定有两个好处——老数据不用迁移（原来的 `平台组` 就是单级），而且它正好就是工作区目录的形状：勾了「同时创建该用户的工作区」的账号，目录会一级一个文件夹地铺开。
+部门的「多层级」不是一张独立的部门表，而是**一个字符串里的路径**：`和平分局/刑侦大队/一中队`。这么定有两个好处——老数据不用迁移（原来的 `平台组` 就是单级），而且它正好就是工作区目录的形状：勾了「同时创建该用户的工作区」的账号，目录会一级一个文件夹地铺开
+（都挂在 `<harness 根>/workspace/` 这一层下面）。
 
 | 规则 | 值 |
 |---|---|
@@ -248,7 +249,8 @@ user-management:
 ### 新建用户时一并创建工作区（1.5.0 起）
 
 「用户 → 新增用户」多了一个复选框「同时创建该用户的工作区」。勾上后出现路径框，**预填**默认路径
-`<harness 根>/<部门>/<用户名>`（部门留空就少一层，只到用户名），可以直接改成任意绝对路径；下方一行小字写着默认值，
+`<harness 根>/workspace/<部门各级>/<用户名>`（部门留空就少一层，只到用户名；所有账号都在同一个 `workspace` 目录下，
+根目录因此不会被一堆部门目录铺满），可以直接改成任意绝对路径；下方一行小字写着默认值，
 改过之后还有「恢复默认」。不勾选则一切照旧。
 
 提交时服务端按这个顺序做事，**能失败的都在写账号之前失败**：

package/client/bundle.js

@@ -309,7 +309,7 @@ window.__ModuleLoader__.load({
       cfgFieldOtpFailLimit: '两步验证失败上限',
       cfgFieldOtpLockoutSeconds: '两步验证锁定时长（秒）',
       cfgFieldWorkspaceRoot: '新账号工作区根路径',
-      cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/<部门>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
+      cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/workspace/<部门各级>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
     }
 
     const EN = {
@@ -576,7 +576,7 @@ window.__ModuleLoader__.load({
       cfgFieldOtpFailLimit: '2FA failure limit',
       cfgFieldOtpLockoutSeconds: '2FA lockout (seconds)',
       cfgFieldWorkspaceRoot: 'Workspace root for new accounts',
-      cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/<department>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
+      cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/workspace/<department levels>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
     }
 
     /** Ledger event type → locale key (also the login-log type filter). */
@@ -634,6 +634,13 @@ window.__ModuleLoader__.load({
      * one that decides.
      */
     const DEPARTMENT_MAX_DEPTH = 5
+
+    /**
+     * The directory every default workspace lives under (mirror of
+     * WORKSPACE_SUBDIR in src/workspace-create.js): the preview must name the same
+     * folder the server will build, level for level.
+     */
+    const WORKSPACE_SUBDIR = 'workspace'
     const DEPARTMENT_MAX_LEVEL_LEN = 24
     const DEPARTMENT_MAX_LEN = 64
 
@@ -676,7 +683,7 @@ window.__ModuleLoader__.load({
 
     /**
      * The default workspace path, as the create-user dialog shows it:
-     * `<root>/<一级>/<二级>/…/<username>`.
+     * `<root>/workspace/<一级>/<二级>/…/<username>`.
      *
      * This is the DISPLAY twin of the host half's rule (src/workspace-create.js):
      * one folder PER department level, each folded into a directory name, joined
@@ -689,7 +696,7 @@ window.__ModuleLoader__.load({
       // No root = no preview: the dialog then asks for an absolute path instead of
       // showing a path relative to nothing.
       if (base === '') return ''
-      const parts = [base]
+      const parts = [base, WORKSPACE_SUBDIR]
       // The username is folded by the same rule as a level: it is one segment too.
       for (const raw of [...departmentLevels(department), username]) {
         const segment = String(raw === undefined || raw === null ? '' : raw)
@@ -1576,7 +1583,8 @@ window.__ModuleLoader__.load({
      *
      * Split out from the tab that opens it because the workspace half is the part
      * worth pinning down: the checkbox reveals a path box pre-filled with the
-     * default (`<harness root>/<department>/<username>`) and left editable, so the
+     * default (`<harness root>/workspace/<department levels>/<username>`) and left
+     * editable, so the
      * admin either accepts it or types another absolute path. As a component of its
      * own it can be rendered on demand — the tab's dialog otherwise only exists
      * after a click, which a contract test cannot perform.

package/client/index.js

@@ -299,7 +299,7 @@ const ZH = {
   cfgFieldOtpFailLimit: '两步验证失败上限',
   cfgFieldOtpLockoutSeconds: '两步验证锁定时长（秒）',
   cfgFieldWorkspaceRoot: '新账号工作区根路径',
-  cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/<部门>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
+  cfgHintWorkspaceRoot: '新建用户勾选「同时创建该用户的工作区」时，默认路径为 <根路径>/workspace/<部门各级>/<用户名>。留空 = 用宿主提供的工作区根路径（dsh 默认是 harness 所在目录）。',
 }
 
 const EN = {
@@ -566,7 +566,7 @@ const EN = {
   cfgFieldOtpFailLimit: '2FA failure limit',
   cfgFieldOtpLockoutSeconds: '2FA lockout (seconds)',
   cfgFieldWorkspaceRoot: 'Workspace root for new accounts',
-  cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/<department>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
+  cfgHintWorkspaceRoot: 'When a new account is created with “also create its workspace”, the default path is <root>/workspace/<department levels>/<username>. Empty = use the host’s own workspace root (dsh defaults to the harness directory).',
 }
 
 /** Ledger event type → locale key (also the login-log type filter). */
@@ -624,6 +624,13 @@ function interpolate(template, vars) {
  * one that decides.
  */
 const DEPARTMENT_MAX_DEPTH = 5
+
+/**
+ * The directory every default workspace lives under (mirror of
+ * WORKSPACE_SUBDIR in src/workspace-create.js): the preview must name the same
+ * folder the server will build, level for level.
+ */
+const WORKSPACE_SUBDIR = 'workspace'
 const DEPARTMENT_MAX_LEVEL_LEN = 24
 const DEPARTMENT_MAX_LEN = 64
 
@@ -666,7 +673,7 @@ function departmentProblem(levels, t) {
 
 /**
  * The default workspace path, as the create-user dialog shows it:
- * `<root>/<一级>/<二级>/…/<username>`.
+ * `<root>/workspace/<一级>/<二级>/…/<username>`.
  *
  * This is the DISPLAY twin of the host half's rule (src/workspace-create.js):
  * one folder PER department level, each folded into a directory name, joined
@@ -679,7 +686,7 @@ function workspaceDefaultPath(root, sep, department, username) {
   // No root = no preview: the dialog then asks for an absolute path instead of
   // showing a path relative to nothing.
   if (base === '') return ''
-  const parts = [base]
+  const parts = [base, WORKSPACE_SUBDIR]
   // The username is folded by the same rule as a level: it is one segment too.
   for (const raw of [...departmentLevels(department), username]) {
     const segment = String(raw === undefined || raw === null ? '' : raw)
@@ -1566,7 +1573,8 @@ function EditUserPage({ user, me, departments, onClose, onDone, onTempPassword,
  *
  * Split out from the tab that opens it because the workspace half is the part
  * worth pinning down: the checkbox reveals a path box pre-filled with the
- * default (`<harness root>/<department>/<username>`) and left editable, so the
+ * default (`<harness root>/workspace/<department levels>/<username>`) and left
+ * editable, so the
  * admin either accepts it or types another absolute path. As a component of its
  * own it can be rendered on demand — the tab's dialog otherwise only exists
  * after a click, which a contract test cannot perform.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kczx-user-management",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "type": "module",
   "description": "dsh 插件 · 登录门 + 账号 / 权限 / 配额 / 审计台账（dsh-passwords 的功能已并入）：HTTPS 登录网关与自签证书、用户增删改查（可一并创建工作区）、工作区白名单与归属跟踪、每小时 token 与每日时长配额、沙盒档位下限、上传/git 开关、三本审计台账（登录/访问/操作）、IP 封禁、TOTP 两步验证。",
   "license": "MIT",

package/src/index.js

@@ -718,7 +718,8 @@ async function handleApi(req, res, deps) {
    * The root the console builds per-account workspaces under.
    *
    * Read by the create-user form so it can prefill the default path
-   * (<root>/<department levels>/<username>, one folder per level). Admin-only:
+   * (<root>/workspace/<department levels>/<username>, one folder per level).
+   * Admin-only:
    * the value is a path on the
    * host, which is exactly what a plain account must not be handed.
    */
@@ -1112,7 +1113,8 @@ const Config = z.object({
   lockoutSeconds: z.natural().min(1).default(60),
   // ── per-account workspaces (the "create user" flow) ──────────────────────
   // Root the console builds a new account's workspace under:
-  // <workspaceRoot>/<department>/<username>. Empty (the default) asks the
+  // <workspaceRoot>/workspace/<department levels>/<username>. Empty (the
+  // default) asks the
   // running host for it — the sandbox policy's own workspaceRoot, which dsh
   // defaults to the harness's process cwd — and falls back to process.cwd().
   // Set it explicitly to park every account folder on another volume.

package/src/workspace-create.js

@@ -4,8 +4,9 @@
  * Workspace provisioning for the console's "create user" flow.
  *
  * An account created by an administrator may come with its own workspace. The
- * DEFAULT home is `<harness root>/<department levels>/<username>` (one folder
- * per department level); the admin may type any other absolute path instead. This module owns the pure half of that — the
+ * DEFAULT home is `<harness root>/workspace/<department levels>/<username>`
+ * (one folder per department level, all of them under a single `workspace`
+ * directory); the admin may type any other absolute path instead. This module owns the pure half of that — the
  * path arithmetic and its validation — plus the directory step, so both are
  * verifiable without a store, a request or a running dsh.
  *
@@ -26,6 +27,16 @@ import { departmentLevels, StoreError } from './store.js'
 
 /** Longest path this module will hand to the filesystem. */
 const MAX_PATH_LEN = 1024
+/**
+ * The single directory every default workspace lives under:
+ * `<root>/workspace/<department levels>/<username>`.
+ *
+ * One level between the harness root and the accounts, so the root keeps its
+ * own files (the checkout, its config, whatever else lives there) beside a
+ * single `workspace` folder instead of being mixed with one folder per
+ * department.
+ */
+const WORKSPACE_SUBDIR = 'workspace'
 /** Longest directory name built out of free text (a department is capped at 64
  *  characters by the store, and a username at 32). */
 const MAX_SEGMENT_LEN = 64
@@ -55,10 +66,10 @@ export function sanitizeSegment(value) {
 
 /**
  * The default workspace for one account:
- * `<root>/<一级>/<二级>/…/<username>`.
+ * `<root>/workspace/<一级>/<二级>/…/<username>`.
  *
  * A multi-level department becomes NESTED folders, one per level, so the tree on
- * disk mirrors the organisation: `E:\work\和平分局\刑侦大队\zhang`. A blank
+ * disk mirrors the organisation: `E:\work\workspace\和平分局\刑侦大队\zhang`. A blank
  * department drops its segments instead of inventing a placeholder — the username
  * alone is already unique, and a folder named after nothing is worse than one
  * level less.
@@ -75,7 +86,7 @@ export function sanitizeSegment(value) {
  * @returns an absolute path built with the host separator.
  */
 export function defaultWorkspacePath(root, department, username) {
-  const parts = [String(root === undefined || root === null ? '' : root).trim()]
+  const parts = [String(root === undefined || root === null ? '' : root).trim(), WORKSPACE_SUBDIR]
   for (const level of departmentLevels(department)) {
     const segment = sanitizeSegment(level)
     if (segment !== '') parts.push(segment)
@@ -127,6 +138,12 @@ export function resolveWorkspaceTarget({ root, department, username, custom } =
   if (sameWorkspacePath(path, base)) {
     throw new StoreError('bad_workspace_path', '工作区不能就是 harness 根目录本身（该目录是所有账号工作区的父目录）')
   }
+  // The container is off limits for the same reason: a username that sanitizes
+  // away would otherwise turn the folder every account lives under into one
+  // account's workspace.
+  if (sameWorkspacePath(path, join(base, WORKSPACE_SUBDIR))) {
+    throw new StoreError('bad_workspace_path', `工作区不能就是 ${WORKSPACE_SUBDIR} 目录本身（该目录是所有账号工作区的父目录）`)
+  }
   return { path, root: base, source }
 }