mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-10-07 16:09:43 +02:00
Codeman maintainer
ccb3afc9ee
The opt-in multi-user feature's only enforcement is web-layer scoping (all sessions share one OS account). An adversarial review found 8 critical + 7 high cross-user holes that defeated it, plus mediums; all fixed here. Single-user (flag-off) behavior stays byte-identical apart from documented consistency deltas. Ownership / confinement: - DELETE /api/sessions (bulk) + /:id now owner-scope / findSessionOrFail - quick-start, cron (create+fire), scheduled runs confine workingDir to the owner's space; case link/docker-link/docker-import confine the host path - resolveCasePath no longer resolves linked cases for non-admins; foreign remote/docker cases are skipped (fall through to the caller's own local case) - history, subagents/workflows, mux-sessions, orchestrator, cron run-history, away-digest, and remote/docker host reads are owner- or admin-scoped Permission policy (section 6.3): - non-granted users are downgraded at every spawn site incl. legacy /api/scheduled, PlanOrchestrator one-shots, remote launch, and the cron-fire gemini/codex bypass switches; resolveClaudeModeForUsername now fails closed Auth / store: - verify-first login throttle (a correct password is never locked out), /ws terminal subject to the change-password lockbox, cookie fast-path re-validates identity live, role/grant changes revoke sessions, admin delete runs the last-admin guard before any teardown - users.json: distinguish missing (ENOENT) from corrupt/unreadable so a bad read can't overwrite all accounts; unique per-process temp write path Event streams: - debounced session:updated + batched task:updated, clipboard, and push notifications route by owner (fail closed); getLightState hides machine-wide globalStats from non-admins Tests: two suites updated to assert the fixed (secure) behavior. tsc, eslint, and test:ci all green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
1.3 KiB
TypeScript
34 lines
1.3 KiB
TypeScript
/**
|
|
* @fileoverview Auth port — capabilities for authentication state.
|
|
* Route modules that need access to auth sessions or QR rate limiting depend on this port.
|
|
*/
|
|
|
|
import type { StaleExpirationMap } from '../../utils/index.js';
|
|
|
|
/** Enhanced session record with device context for audit logging */
|
|
export interface AuthSessionRecord {
|
|
ip: string;
|
|
ua: string;
|
|
createdAt: number;
|
|
method: 'qr' | 'basic';
|
|
/**
|
|
* Multi-user identity carried by the cookie (single-user leaves these unset).
|
|
* Snapshotted at mint time. Authorization-relevant admin changes (password reset,
|
|
* disable, delete, role change, bypass-grant change) revoke the user's sessions so
|
|
* a stale snapshot can't outlive the change; additionally the cookie fast-path
|
|
* re-reads role/disabled/mustChangePassword live from the store each request, so an
|
|
* out-of-band CLI mutation also takes effect promptly. See docs/multi-user-plan.md
|
|
* section 5.
|
|
*/
|
|
username?: string;
|
|
role?: 'admin' | 'user';
|
|
/** Whether this user must change their password before other actions are allowed. */
|
|
mustChangePassword?: boolean;
|
|
}
|
|
|
|
export interface AuthPort {
|
|
readonly authSessions: StaleExpirationMap<string, AuthSessionRecord> | null;
|
|
readonly qrAuthFailures: StaleExpirationMap<string, number> | null;
|
|
readonly https: boolean;
|
|
}
|