openlearn-next 0.2.3 → 0.2.6

package/dist/server.cjs

@@ -973,8 +973,8 @@ function wrapCommandBus(commandBus, tracker, pluginId, manifestId) {
         throw e;
       }
     }),
-    setInterceptor: createSafeFunction((interceptor) => {
-      return commandBus.setInterceptor(interceptor);
+    setInterceptor: createSafeFunction((_interceptor) => {
+      throw new Error("[Security] setInterceptor cannot be configured from PluginContext");
     }),
     unregisterHandler: createSafeFunction((commandType) => {
       return commandBus.unregisterHandler(resolveType(commandType));
@@ -2506,8 +2506,8 @@ parentPort.on('message', async function(msg) {
         createCommand: function(type, payload, actorId, metadata) {
           return rawCommandBus.createCommand(type, payload, actorId, metadata);
         },
-        setInterceptor: function(interceptor) {
-          return rawCommandBus.setInterceptor(interceptor);
+        setInterceptor: function(_interceptor) {
+          throw new Error('[Security] setInterceptor cannot be configured from Worker PluginContext');
         }
       } : undefined;
 
@@ -2659,6 +2659,21 @@ parentPort.on('message', async function(msg) {
         },
         db: dbApi,
         require: function(moduleName) {
+          var BLOCKED_NATIVE_MODULES = [
+            'child_process', 'node:child_process',
+            'fs', 'node:fs', 'fs/promises', 'node:fs/promises',
+            'net', 'node:net',
+            'http', 'node:http', 'https', 'node:https', 'http2', 'node:http2',
+            'dgram', 'node:dgram', 'dns', 'node:dns',
+            'cluster', 'node:cluster',
+            'worker_threads', 'node:worker_threads',
+            'vm', 'node:vm',
+            'v8', 'node:v8',
+            'wasi', 'node:wasi'
+          ];
+          if (BLOCKED_NATIVE_MODULES.indexOf(moduleName) !== -1) {
+            throw new Error('[SecurityError] Direct access to Node.js native module "' + moduleName + '" is forbidden in plugin worker sandbox.');
+          }
           if (PLUGIN_SHARED_MODULES.indexOf(moduleName) !== -1) {
             try {
               return requireFn(moduleName);
@@ -3374,7 +3389,16 @@ var CapabilityGuard = class {
   constructor() {
     this.actorCapabilities = /* @__PURE__ */ new Map();
     this.actorCapabilities.set("user-demo", ["*:*:*"]);
-    this.actorCapabilities.set("user-frontend", ["*:*:*"]);
+    this.actorCapabilities.set("user-frontend", [
+      "lesson:*",
+      "whiteboard:*",
+      "management:*",
+      "quiz:*",
+      "vfs:*",
+      "process:*",
+      "plugin:*"
+    ]);
+    this.actorCapabilities.set("anonymous", []);
     this.actorCapabilities.set("agent-system-0", [
       "lesson:write",
       "lesson:delete",
@@ -3388,8 +3412,8 @@ var CapabilityGuard = class {
       "process:write",
       "process:read"
     ]);
-    this.actorCapabilities.set("teacher-demo", ["lesson:write", "lesson:read"]);
-    this.actorCapabilities.set("student-demo", ["student:write"]);
+    this.actorCapabilities.set("teacher-demo", ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*"]);
+    this.actorCapabilities.set("student-demo", ["student:write", "lesson:read", "whiteboard:read"]);
   }
   grant(actorId, cap) {
     const caps = this.actorCapabilities.get(actorId) || [];
@@ -3402,8 +3426,28 @@ var CapabilityGuard = class {
     this.actorCapabilities.delete(actorId);
   }
   check(actorId, requiredCap) {
-    const isAdmin = actorId === "role:administrator" || actorId?.endsWith(":administrator") || actorId === "admin-demo";
+    const isAdmin = actorId === "role:administrator" || actorId?.endsWith(":administrator") || actorId === "admin" || actorId === "usr_admin" || actorId === "admin-demo";
     if (isAdmin) return true;
+    if (actorId?.endsWith(":teacher")) {
+      const teacherCaps = ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*", "process:*", "plugin:*"];
+      const [reqRes2, reqAct2] = requiredCap.split(":");
+      if (teacherCaps.some((c) => {
+        const [res, act] = c.split(":");
+        return (res === reqRes2 || res === "*") && (act === reqAct2 || act === "*");
+      })) {
+        return true;
+      }
+    }
+    if (actorId?.endsWith(":student")) {
+      const studentCaps = ["student:write", "lesson:read", "whiteboard:read"];
+      const [reqRes2, reqAct2] = requiredCap.split(":");
+      if (studentCaps.some((c) => {
+        const [res, act] = c.split(":");
+        return (res === reqRes2 || res === "*") && (act === reqAct2 || act === "*");
+      })) {
+        return true;
+      }
+    }
     const caps = this.actorCapabilities.get(actorId) || [];
     if (caps.includes("*:*:*") || caps.includes("*")) return true;
     if (caps.includes(requiredCap)) return true;
@@ -3638,7 +3682,7 @@ var classroomToolSchema = import_zod.z.object({
   icon: import_zod.z.string().optional(),
   description: import_zod.z.string().optional(),
   commandType: import_zod.z.string().min(1),
-  payload: import_zod.z.record(import_zod.z.unknown()).optional()
+  payload: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 var contributesSchema = import_zod.z.object({
   "classroom.tool": import_zod.z.array(classroomToolSchema).optional(),
@@ -3665,7 +3709,10 @@ var contributesSchema = import_zod.z.object({
     label: import_zod.z.string().min(1),
     icon: import_zod.z.string().optional()
   })).optional()
-}).optional();
+  // v0.2.6: 锚点槽位（anchor:*）为开放命名空间，由宿主公布锚点 id。
+  // .passthrough() 保留任意 anchor:* 键（运行时透传），避免被 zod 默认 strip。
+  // 锚点条目的运行时校验由前端注册时（ExtensionPointConfig）完成。
+}).passthrough().optional();
 var deploySchema = import_zod.z.object({
   script: import_zod.z.string().min(1, { error: "deploy.script \u4E0D\u80FD\u4E3A\u7A7A" }).optional(),
   staticRoute: import_zod.z.string().optional(),
@@ -3689,7 +3736,7 @@ var manifestSchema = import_zod.z.object({
   pluginDependencies: import_zod.z.array(import_zod.z.string().min(1)).optional(),
   provides: import_zod.z.array(import_zod.z.string().min(1)).optional(),
   configuration: import_zod.z.object({
-    properties: import_zod.z.record(import_zod.z.object({
+    properties: import_zod.z.record(import_zod.z.string(), import_zod.z.object({
       type: import_zod.z.enum(["string", "number", "boolean", "integer"]),
       default: import_zod.z.unknown().optional(),
       description: import_zod.z.string().optional(),
@@ -4116,6 +4163,17 @@ db.exec(`
     status TEXT NOT NULL DEFAULT 'draft',
     graded_at INTEGER
   );
+
+  -- Performance Indexes
+  CREATE INDEX IF NOT EXISTS idx_whiteboard_lesson ON whiteboard_elements(lesson_id);
+  CREATE INDEX IF NOT EXISTS idx_class_students_class ON class_students(class_id);
+  CREATE INDEX IF NOT EXISTS idx_class_students_student ON class_students(student_id);
+  CREATE INDEX IF NOT EXISTS idx_schedules_class_date ON schedules(class_id, scheduled_date);
+  CREATE INDEX IF NOT EXISTS idx_courseware_attempt_cw_st ON courseware_attempt(courseware_id, student_id);
+  CREATE INDEX IF NOT EXISTS idx_submission_result_attempt ON submission_result(attempt_id);
+  CREATE INDEX IF NOT EXISTS idx_events_type_time ON events(type, timestamp);
+  CREATE INDEX IF NOT EXISTS idx_assignments_class ON assignments(class_id);
+  CREATE INDEX IF NOT EXISTS idx_attendance_schedule ON attendance(schedule_id);
 `);
 try {
   db.exec(`ALTER TABLE plugins ADD COLUMN execution_mode TEXT DEFAULT 'inline'`);
@@ -4250,7 +4308,7 @@ var VfsPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["vfs:read", "vfs:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -4416,7 +4474,7 @@ var ProcessPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["process:read", "process:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -4547,7 +4605,7 @@ var ManagementPlugin = {
       "@openlearn/core:IDatabase@^1.0.0"
     ],
     capabilitiesProposed: ["class:read", "class:write", "student:read", "student:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -5446,7 +5504,7 @@ var AiSubmitInjectorPlugin = {
       "@openlearn/core:IAIService@^1.0.0"
     ],
     capabilitiesProposed: [],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const eventBus = ctx.services.eventBus;
@@ -5538,7 +5596,7 @@ var BuiltinPlugin = {
       "@openlearn/core:IPluginHost@^1.0.0"
     ],
     capabilitiesProposed: ["lesson:read", "lesson:write", "whiteboard:read", "whiteboard:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -6923,7 +6981,7 @@ var AiPlannerPlugin = {
       "@openlearn/core:IEventBusService@^1.0.0"
     ],
     capabilitiesProposed: ["process:write", "lesson:write", "assignment:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -7109,7 +7167,7 @@ var AssignmentEvalPlugin = {
       "@openlearn/core:ISemesterGradeService@^1.0.0"
     ],
     capabilitiesProposed: ["lesson:read", "lesson:write"],
-    engines: { openlearn: "^2.5.0" }
+    engines: { openlearn: "^0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
@@ -7695,7 +7753,7 @@ var ContributionRegistry = class {
   register(pluginId, contributes) {
     this.unregister(pluginId);
     for (const [slot, configs] of Object.entries(contributes)) {
-      if (!configs || configs.length === 0) continue;
+      if (!Array.isArray(configs) || configs.length === 0) continue;
       if (!this.contributions.has(slot)) {
         this.contributions.set(slot, /* @__PURE__ */ new Map());
       }
@@ -8057,7 +8115,7 @@ var PluginRuntimeComposition = class {
     this.workerManager = workerManager;
     this.id = "srv_plugin_runtime_composition";
     this.name = "PluginRuntimeComposition";
-    this.version = "2.5.0";
+    this.version = "0.2.5";
     this._isStarted = false;
   }
   get isStarted() {
@@ -8111,7 +8169,7 @@ var PluginLifecycleManager = class {
     this.pluginHost = pluginHost;
     this.id = "srv_plugin_lifecycle_manager";
     this.name = "PluginLifecycleManager";
-    this.version = "2.5.0";
+    this.version = "0.2.5";
   }
   getPluginState(pluginId) {
     return this.pluginHost.getPluginState(pluginId);
@@ -8158,7 +8216,7 @@ var PluginCapabilityGateway = class {
     this.capabilityRegistry = capabilityRegistry;
     this.id = "srv_plugin_capability_gateway";
     this.name = "PluginCapabilityGateway";
-    this.version = "2.5.0";
+    this.version = "0.2.5";
   }
   listCapabilities() {
     const rawCaps = this.capabilityRegistry.listCapabilities();
@@ -8212,7 +8270,7 @@ var UnifiedExtensionRegistry = class {
   constructor() {
     this.id = "srv_unified_extension_registry";
     this.name = "UnifiedExtensionRegistry";
-    this.version = "2.5.0";
+    this.version = "0.2.5";
     this._extensions = /* @__PURE__ */ new Map();
   }
   registerExtension(category, id, impl, meta) {
@@ -8317,7 +8375,7 @@ var PluginDistributionManager = class {
     this.pluginHost = pluginHost;
     this.id = "srv_plugin_distribution_manager";
     this.name = "PluginDistributionManager";
-    this.version = "2.5.0";
+    this.version = "0.2.5";
     this._repositories = /* @__PURE__ */ new Map();
   }
   registerRepository(repo) {
@@ -8406,7 +8464,7 @@ function validatePluginStateTransition(currentState, nextState, pluginId) {
 }
 var ACTIVATION_TIMEOUT_MS = 5e3;
 var DEACTIVATION_TIMEOUT_MS = 5e3;
-var OPENLEARN_VERSION = "2.5.0";
+var OPENLEARN_VERSION = "0.2.5";
 var PluginHost = class {
   constructor(serviceRegistry, esmLoader, db2, pluginsDir) {
     this.serviceRegistry = serviceRegistry;
@@ -10431,7 +10489,7 @@ var HotReloadController = class {
     }
     if (this.enabled) return;
     this.enabled = true;
-    await this.fileWatcher.startWatch(this.watchDir, (event) => {
+    await this.fileWatcher.startWatch(this.watchDir, async (event) => {
       this.handleFileChange(event.pluginId, event.filePath);
     });
     console.log("[HotReload] Hot reload enabled \u2014 watching for plugin changes");
@@ -16020,7 +16078,7 @@ var StartupTimeoutError = class extends PlatformBootstrapError {
     this.name = "StartupTimeoutError";
   }
 };
-var PLATFORM_VERSION = "2.5.0";
+var PLATFORM_VERSION = "0.2.5";
 var BOOTSTRAP_STAGE_NAMES = Object.freeze([
   "Created" /* Created */,
   "Configuring" /* Configuring */,
@@ -16722,10 +16780,10 @@ var PluginCompositionModule = class {
     const realPluginHost = options?.infrastructureRefs?.get("pluginHost") ?? { name: "PluginHostService", isReady: true, pluginsCount: 0 };
     const realContributionRegistry = options?.infrastructureRefs?.get("contributionRegistry") ?? { name: "ContributionRegistry", slotsCount: 0 };
     const realRuntimeComposition = options?.infrastructureRefs?.get("runtimeComposition") ?? { name: "PluginRuntimeComposition", isStarted: true };
-    const realLifecycleManager = options?.infrastructureRefs?.get("lifecycleManager") ?? { name: "PluginLifecycleManager", version: "2.5.0" };
-    const realCapabilityGateway = options?.infrastructureRefs?.get("capabilityGateway") ?? { name: "PluginCapabilityGateway", version: "2.5.0" };
-    const realExtensionRegistry = options?.infrastructureRefs?.get("extensionRegistry") ?? { name: "UnifiedExtensionRegistry", version: "2.5.0" };
-    const realDistributionManager = options?.infrastructureRefs?.get("distributionManager") ?? { name: "PluginDistributionManager", version: "2.5.0" };
+    const realLifecycleManager = options?.infrastructureRefs?.get("lifecycleManager") ?? { name: "PluginLifecycleManager", version: "0.2.5" };
+    const realCapabilityGateway = options?.infrastructureRefs?.get("capabilityGateway") ?? { name: "PluginCapabilityGateway", version: "0.2.5" };
+    const realExtensionRegistry = options?.infrastructureRefs?.get("extensionRegistry") ?? { name: "UnifiedExtensionRegistry", version: "0.2.5" };
+    const realDistributionManager = options?.infrastructureRefs?.get("distributionManager") ?? { name: "PluginDistributionManager", version: "0.2.5" };
     registerOrReplace({
       id: "srv_plugin_host",
       lifetime: "Singleton",
@@ -16893,7 +16951,7 @@ var Kernel = class {
             throw new Error(`[PayloadValidationError] Invalid command payload for ${command.type}: ${errors.join("; ")}`);
           }
         }
-        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || command.actorId?.endsWith(":administrator") || command.actorId?.endsWith(":admin") || command.actorId?.includes(":administrator") || command.actorId?.includes(":admin");
+        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || command.actorId?.endsWith(":administrator") || command.actorId?.endsWith(":admin");
         if (action.capabilityRequired && !isAdmin) {
           const allowed = this.capabilityGuard.check(command.actorId, action.capabilityRequired);
           if (!allowed) {
@@ -18367,10 +18425,10 @@ function getCookieToken(req) {
 }
 function getActorId(req) {
   const token = getCookieToken(req);
-  if (!token) return "user-frontend";
+  if (!token) return "anonymous";
   try {
     const session = getValidSession(token);
-    if (!session) return "user-frontend";
+    if (!session) return "anonymous";
     let role = session.subRole || session.role;
     if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
       role = "administrator";
@@ -18378,11 +18436,31 @@ function getActorId(req) {
     if (role) {
       return `user:${session.userId || "demo"}:${role}`;
     }
-    return "user-frontend";
+    return "anonymous";
   } catch {
-    return "user-frontend";
+    return "anonymous";
   }
 }
+function requireAuth(...roles) {
+  return (req, res, next) => {
+    const token = getCookieToken(req);
+    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
+    const session = getValidSession(token);
+    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
+    if (roles.length > 0) {
+      let userRole = session.role;
+      if (session.username === "admin" || session.userId === "usr_admin" || userRole === "admin") {
+        userRole = "administrator";
+      }
+      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
+      if (!effectiveRoles.includes(userRole)) {
+        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
+      }
+    }
+    req.session = session;
+    next();
+  };
+}
 function checkIsTeacherOrAdmin(req) {
   const token = getCookieToken(req);
   if (!token) return false;
@@ -19143,7 +19221,7 @@ function registerOsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/commands", async (req, res) => {
+  app.post("/api/commands", requireAuth(), async (req, res) => {
     try {
       const { commandType, payload } = req.body;
       const cmd = kernelContainer.commandBus.createCommand(
@@ -20860,7 +20938,7 @@ function registerAdminRoutes(ctx) {
     runGeminiAgentChat: runGeminiAgentChat2,
     runOpenAIAgentChat: runOpenAIAgentChat2
   } = ctx;
-  app.post("/api/admin/seed-demo", (req, res) => {
+  app.post("/api/admin/seed-demo", requireAuth("administrator"), (req, res) => {
     try {
       const db2 = kernelContainer.db;
       const DEMO_CLASS_ID = "demo-class";
@@ -20876,7 +20954,7 @@ function registerAdminRoutes(ctx) {
         db2.prepare("INSERT INTO classes (id, name, description, created_at) VALUES (?, ?, ?, ?)").run(
           DEMO_CLASS_ID,
           "\u4EBA\u5DE5\u667A\u80FD\u4E0E\u521B\u610F\u7F16\u7A0B\u793A\u8303\u73ED",
-          "\u8FD9\u662F\u7CFB\u7EDF\u521D\u59CB\u5316\u7684\u793A\u4F8B\u8BFE\u7A0B\u73ED\u7EA7\uFF0C\u7528\u4E8E\u6559\u5B66\u4F53\u9A8C\uFFFD?",
+          "\u8FD9\u662F\u7CFB\u7EDF\u521D\u59CB\u5316\u7684\u793A\u4F8B\u8BFE\u7A0B\u73ED\u7EA7\uFF0C\u7528\u4E8E\u6559\u5B66\u4F53\u9A8C?",
           Date.now()
         );
       }
@@ -20904,7 +20982,7 @@ function registerAdminRoutes(ctx) {
         lessonId = "demo-lesson";
         db2.prepare("INSERT INTO lessons (id, title, content, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(
           lessonId,
-          "\u521D\u8BC6 Python\uFF1A\u667A\u80FD\u767D\u677F\u521B\u610F\u7F16\uFFFD?",
+          "\u521D\u8BC6 Python\uFF1A\u667A\u80FD\u767D\u677F\u521B\u610F\u7F16?",
           JSON.stringify({ elements: [] }),
           Date.now(),
           Date.now()
@@ -20926,7 +21004,7 @@ function registerAdminRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/import", (req, res) => {
+  app.post("/api/classes/import", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { classes } = req.body;
       if (!classes || !Array.isArray(classes)) {
@@ -20976,7 +21054,7 @@ function registerAdminRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/students/import", (req, res) => {
+  app.post("/api/students/import", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { students } = req.body;
       if (!students || !Array.isArray(students)) {
@@ -21575,16 +21653,16 @@ function registerRosterRoutes(ctx) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.get("/api/users", async (req, res) => {
+  app.get("/api/users", requireAuth("administrator"), async (req, res) => {
     try {
-      const cmd = kernelContainer.commandBus.createCommand("user.list", {}, "user-demo");
+      const cmd = kernelContainer.commandBus.createCommand("user.list", {}, getActorId(req));
       const users = await kernelContainer.commandBus.execute(cmd);
       res.json(users);
     } catch (e) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.post("/api/users", async (req, res) => {
+  app.post("/api/users", requireAuth("administrator"), async (req, res) => {
     try {
       const { username, password, role, name, status = "active" } = req.body;
       const cmd = kernelContainer.commandBus.createCommand("user.create", {
@@ -21593,14 +21671,14 @@ function registerRosterRoutes(ctx) {
         role,
         name,
         status
-      }, "user-demo");
+      }, getActorId(req));
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.put("/api/users/:id", async (req, res) => {
+  app.put("/api/users/:id", requireAuth("administrator"), async (req, res) => {
     try {
       const { username, role, name, password, status } = req.body;
       const cmd = kernelContainer.commandBus.createCommand("user.update", {
@@ -21610,18 +21688,18 @@ function registerRosterRoutes(ctx) {
         name,
         password,
         status
-      }, "user-demo");
+      }, getActorId(req));
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.delete("/api/users/:id", async (req, res) => {
+  app.delete("/api/users/:id", requireAuth("administrator"), async (req, res) => {
     try {
       const cmd = kernelContainer.commandBus.createCommand("user.delete", {
         userId: req.params.id
-      }, "user-demo");
+      }, getActorId(req));
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
@@ -21636,7 +21714,7 @@ function registerRosterRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/labs", (req, res) => {
+  app.post("/api/labs", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { room_number, rows, cols } = req.body;
       const id = "lab_" + Math.random().toString(36).slice(2, 10);
@@ -21648,7 +21726,7 @@ function registerRosterRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.put("/api/labs/:id", (req, res) => {
+  app.put("/api/labs/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { room_number, rows, cols } = req.body;
       kernelContainer.db.prepare(
@@ -21659,7 +21737,7 @@ function registerRosterRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.delete("/api/labs/:id", (req, res) => {
+  app.delete("/api/labs/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM computer_labs WHERE id = ?").run(req.params.id);
       kernelContainer.db.prepare("DELETE FROM student_seats WHERE lab_id = ?").run(req.params.id);
@@ -21678,7 +21756,7 @@ function registerRosterRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/seats", (req, res) => {
+  app.post("/api/classes/:classId/seats", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { lab_id, seats } = req.body;
       kernelContainer.db.prepare("UPDATE classes SET lab_id = ? WHERE id = ?").run(lab_id || null, req.params.classId);
@@ -21876,7 +21954,7 @@ function registerRosterRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:id/students/bulk-enroll", (req, res) => {
+  app.post("/api/classes/:id/students/bulk-enroll", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { students } = req.body;
       const classId = req.params.id;
@@ -23058,7 +23136,7 @@ function registerGradingRoutes(ctx) {
       if (!lessonId || !studentId || grade === void 0) {
         return res.status(400).json({ success: false, error: "lessonId, studentId, and grade are required" });
       }
-      const gradeService = await kernelContainer.registry.resolve(ISemesterGradeServiceToken);
+      const gradeService = await kernelContainer.serviceRegistry.resolve(ISemesterGradeServiceToken);
       await gradeService.saveSemesterGrade(lessonId, studentId, Math.round(Number(grade)));
       res.json({ success: true });
     } catch (e) {
@@ -23067,7 +23145,7 @@ function registerGradingRoutes(ctx) {
   });
   app.get("/api/classes/:classId/points-dimensions", async (req, res) => {
     try {
-      const dimensionRegistry = await kernelContainer.registry.resolve(IPointsDimensionRegistryToken);
+      const dimensionRegistry = await kernelContainer.serviceRegistry.resolve(IPointsDimensionRegistryToken);
       const dimensions = dimensionRegistry.listDimensions();
       res.json({ success: true, dimensions });
     } catch (e) {
@@ -23084,7 +23162,7 @@ function registerGradingRoutes(ctx) {
       if (!classId || !dimensionId || deltaPoints === void 0 || !reason) {
         return res.status(400).json({ success: false, error: "classId, dimensionId, deltaPoints, and reason are required" });
       }
-      const ledgerService = await kernelContainer.registry.resolve(IPointsLedgerServiceToken);
+      const ledgerService = await kernelContainer.serviceRegistry.resolve(IPointsLedgerServiceToken);
       const logItem = await ledgerService.addPoints(studentId, classId, dimensionId, Number(deltaPoints), reason, pluginId);
       kernelContainer.eventBus.publish({
         id: logItem.id,
@@ -23102,7 +23180,7 @@ function registerGradingRoutes(ctx) {
     try {
       const { studentId } = req.params;
       const { classId } = req.query;
-      const ledgerService = await kernelContainer.registry.resolve(IPointsLedgerServiceToken);
+      const ledgerService = await kernelContainer.serviceRegistry.resolve(IPointsLedgerServiceToken);
       const logs = await ledgerService.getLogs(studentId, classId);
       const summary = await ledgerService.getStudentDimensionSummary(studentId, classId || "");
       res.json({ success: true, logs, summary });
@@ -23421,6 +23499,28 @@ async function checkVersion(source, installedVersion) {
 }
 
 // server/routes/plugins.ts
+function isSafeExternalUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { safe: false, reason: "Only HTTP and HTTPS protocols are allowed" };
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname === "0.0.0.0" || hostname === "::1" || hostname === "[::1]") {
+      return { safe: false, reason: "Access to loopback/local addresses is forbidden" };
+    }
+    const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4Match) {
+      const octets = ipv4Match.slice(1).map(Number);
+      if (octets[0] === 127 || octets[0] === 10 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168 || octets[0] === 169 && octets[1] === 254 || octets[0] === 0 || octets[0] >= 224) {
+        return { safe: false, reason: "Access to private or link-local IP addresses is forbidden" };
+      }
+    }
+    return { safe: true };
+  } catch (e) {
+    return { safe: false, reason: `Invalid URL format: ${e.message}` };
+  }
+}
 function registerPluginsRoutes(ctx) {
   const {
     app,
@@ -23568,12 +23668,19 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/plugins/:id(*)/one-click-update", async (req, res) => {
+  app.post("/api/plugins/:id(*)/one-click-update", requireAuth("administrator"), async (req, res) => {
     try {
       const targetPluginId = decodeURIComponent(req.params.id);
       const { downloadUrl } = req.body || {};
       let zipBuffer;
       if (downloadUrl) {
+        const urlCheck = isSafeExternalUrl(downloadUrl);
+        if (!urlCheck.safe) {
+          return res.status(400).json({
+            success: false,
+            error: `\u5B89\u5168\u62E6\u622A: \u975E\u6CD5\u4E0B\u8F7D\u5730\u5740 (${urlCheck.reason})`
+          });
+        }
         try {
           const resp = await fetch(downloadUrl, {
             headers: { "User-Agent": "OpenLearnV2-PluginUpdater/1.0" },
@@ -23651,7 +23758,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/plugins/:id(*)/config", (req, res) => {
+  app.post("/api/plugins/:id(*)/config", requireAuth("administrator"), (req, res) => {
     try {
       const rawId = decodeURIComponent(req.params.id);
       const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
@@ -23670,7 +23777,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/plugins/:id(*)/toggle", async (req, res) => {
+  app.post("/api/plugins/:id(*)/toggle", requireAuth("administrator"), async (req, res) => {
     try {
       const rawId = decodeURIComponent(req.params.id);
       const cmd = kernelContainer.commandBus.createCommand(
@@ -23684,7 +23791,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.delete("/api/plugins/:id(*)", async (req, res) => {
+  app.delete("/api/plugins/:id(*)", requireAuth("administrator"), async (req, res) => {
     try {
       const rawId = decodeURIComponent(req.params.id);
       const cmd = kernelContainer.commandBus.createCommand(
@@ -23712,7 +23819,7 @@ function registerPluginsRoutes(ctx) {
       res.status(404).json({ success: false, error: err.message });
     }
   });
-  app.post("/api/plugins", async (req, res) => {
+  app.post("/api/plugins", requireAuth("administrator"), async (req, res) => {
     try {
       const { sourceCode } = req.body;
       const cmd = kernelContainer.commandBus.createCommand(
@@ -23727,7 +23834,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.post("/api/plugins/upload-zip", async (req, res) => {
+  app.post("/api/plugins/upload-zip", requireAuth("administrator"), async (req, res) => {
     try {
       const { base64Data, filename, executionMode } = req.body;
       const cmd = kernelContainer.commandBus.createCommand(
@@ -23742,7 +23849,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.post("/api/plugins/upload-zip-raw", import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }), async (req, res) => {
+  app.post("/api/plugins/upload-zip-raw", requireAuth("administrator"), import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }), async (req, res) => {
     try {
       const zipBuffer = req.body;
       const filename = req.headers["x-filename"] ? decodeURIComponent(req.headers["x-filename"]) : "plugin.zip";
@@ -23786,6 +23893,7 @@ function registerPluginsRoutes(ctx) {
   });
   app.post(
     "/api/plugins/:id(*)/update-zip-raw",
+    requireAuth("administrator"),
     import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }),
     async (req, res) => {
       try {
@@ -23872,7 +23980,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/ai-providers", (req, res) => {
+  app.post("/api/ai-providers", requireAuth("administrator"), (req, res) => {
     try {
       const { name, api_url, api_key, model_name } = req.body;
       if (!name || !api_url || !model_name) {
@@ -23887,7 +23995,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.put("/api/ai-providers/:id", (req, res) => {
+  app.put("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
     try {
       const { name, api_url, api_key, model_name } = req.body;
       if (!name || !api_url || !model_name) {
@@ -23907,7 +24015,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.delete("/api/ai-providers/:id", (req, res) => {
+  app.delete("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
       res.json({ success: true });
@@ -23927,7 +24035,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.put("/api/site-settings", (req, res) => {
+  app.put("/api/site-settings", requireAuth("administrator"), (req, res) => {
     try {
       const { siteName, slogan, logoUrl } = req.body || {};
       kernelContainer.db.prepare(
@@ -23942,7 +24050,7 @@ function registerPluginsRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/ai-providers/test", async (req, res) => {
+  app.post("/api/ai-providers/test", requireAuth("administrator"), async (req, res) => {
     try {
       const { api_url, api_key: providedKey, model_name } = req.body;
       if (!api_url || !model_name) {
@@ -23963,6 +24071,10 @@ function registerPluginsRoutes(ctx) {
       if (!cleanUrl.endsWith("/chat/completions")) {
         cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
       }
+      const urlSafety = isSafeExternalUrl(cleanUrl);
+      if (!urlSafety.safe) {
+        return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
+      }
       const response = await fetch(cleanUrl, {
         method: "POST",
         headers: {
@@ -24043,8 +24155,8 @@ async function startServer() {
     standardHeaders: true,
     legacyHeaders: false
   });
-  app.use(import_express3.default.json({ limit: "400mb" }));
-  app.use(import_express3.default.urlencoded({ limit: "400mb", extended: true }));
+  app.use(import_express3.default.json({ limit: "10mb" }));
+  app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
   app.use("/uploads", import_express3.default.static(import_path14.default.join(process.cwd(), "uploads")));
   app.use("/plugins", import_express3.default.static(import_path14.default.join(process.cwd(), "plugins")));
   app.use((req, res, next) => {