mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 22:03:13 -06:00
2f3dd80881
Agency-portal uploads previously all landed at the workspace library root, unsorted. Instead of the issue's whole-workspace folder dropdown (which would leak every folder name to an external party), bind ONE folder per agency token — admin-controlled and agency-invisible — and scope the portal picker strictly to that folder's own subtree (Hybrid-C). Fully backwards-compatible: no bound folder -> root, exactly as before. Model / multi-workspace: an agency token is bound to ONE workspace at issuance, so the token key IS that workspace's private link and the bound folder lives in that workspace. An admin with N workspaces mints one token per workspace (each with its own auto-folder). No workspace-switcher in the portal — the token is the tenant boundary. Backend: - api_tokens.upload_folder_id (additive; ON DELETE SET NULL -> deleting the folder falls back to root). - lib/agency-targets.folderSubtree(): recursive-CTE helper = the SINGLE confinement source shared by GET /api/agency/folders AND the POST /api/agency/content target check, so the set the agency can SEE and the set it may WRITE to can never drift. Workspace-guarded at the anchor row; descendants inherit the workspace (folders.js forbids cross-ws parents). - routes/agency.js: GET /folders (bound subtree only); POST /content defaults to the bound folder and 403s any folder_id outside the subtree. - routes/tokens.js: create auto-creates "Agency — <name>" (or binds a picked folder, validated same-workspace, respecting the 100-folder cap) inside the token tx; new PUT /:id/upload-folder to rebind; listing surfaces the bound folder name. - middleware/apiToken.js + lib/content-ingest.js: upload_folder_id onto req.apiToken; ingest writes folder_id. Frontend: - Agency portal: folder <select> shown only when a real subfolder choice exists (identifies the "Main folder" root client-side without learning the token's folder id). - Settings: folder pick at token creation, bound-folder display, rebind modal. - i18n: 7 new apitoken.* keys across all 5 locales. Tests (429/429): - test/agency-folder.test.js: 5 folderSubtree confinement bites (subtree in, siblings out, workspace guard, null -> root). - test/agency.test.js (+1 e2e): auto-create, default-to-bound, in-subtree pick lands there, sibling -> 403, admin-pick, unknown-pick -> 400, rebind-to-root. Closes #158. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| agency-layouts.js | ||
| agency-targets.js | ||
| apk-cache.js | ||
| apk-signature.js | ||
| app-settings.js | ||
| billing-token.js | ||
| billing.js | ||
| branding.js | ||
| chunked-prune.js | ||
| command-queue.js | ||
| content-ack-limiter.js | ||
| content-ingest.js | ||
| device-identity.js | ||
| device-sanitize.js | ||
| device-settings.js | ||
| flap-limiter.js | ||
| ghcr-check.js | ||
| image-gen.js | ||
| liveness.js | ||
| log-coalescer.js | ||
| ota-breaker.js | ||
| ota-download-guard.js | ||
| pair-lockout.js | ||
| permissions.js | ||
| player-media-health.js | ||
| reconnect-throttle.js | ||
| rolling-counter.js | ||
| safe-socket.js | ||
| schedule-eval.js | ||
| schema-check.js | ||
| secretbox.js | ||
| session-settle.js | ||
| socket-rooms.js | ||
| status-log-writer.js | ||
| tcp-keepalive.js | ||
| tenancy.js | ||
| tenant-cascade-migration.js | ||
| totp-lockout.js | ||
| totp.js | ||
| user-deletion.js | ||
| zone-validate.js | ||