mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-13 13:53:12 -06:00
2f3dd80881
Agency-portal uploads previously all landed at the workspace library root, unsorted. Instead of the issue's whole-workspace folder dropdown (which would leak every folder name to an external party), bind ONE folder per agency token — admin-controlled and agency-invisible — and scope the portal picker strictly to that folder's own subtree (Hybrid-C). Fully backwards-compatible: no bound folder -> root, exactly as before. Model / multi-workspace: an agency token is bound to ONE workspace at issuance, so the token key IS that workspace's private link and the bound folder lives in that workspace. An admin with N workspaces mints one token per workspace (each with its own auto-folder). No workspace-switcher in the portal — the token is the tenant boundary. Backend: - api_tokens.upload_folder_id (additive; ON DELETE SET NULL -> deleting the folder falls back to root). - lib/agency-targets.folderSubtree(): recursive-CTE helper = the SINGLE confinement source shared by GET /api/agency/folders AND the POST /api/agency/content target check, so the set the agency can SEE and the set it may WRITE to can never drift. Workspace-guarded at the anchor row; descendants inherit the workspace (folders.js forbids cross-ws parents). - routes/agency.js: GET /folders (bound subtree only); POST /content defaults to the bound folder and 403s any folder_id outside the subtree. - routes/tokens.js: create auto-creates "Agency — <name>" (or binds a picked folder, validated same-workspace, respecting the 100-folder cap) inside the token tx; new PUT /:id/upload-folder to rebind; listing surfaces the bound folder name. - middleware/apiToken.js + lib/content-ingest.js: upload_folder_id onto req.apiToken; ingest writes folder_id. Frontend: - Agency portal: folder <select> shown only when a real subfolder choice exists (identifies the "Main folder" root client-side without learning the token's folder id). - Settings: folder pick at token creation, bound-folder display, rebind modal. - i18n: 7 new apitoken.* keys across all 5 locales. Tests (429/429): - test/agency-folder.test.js: 5 folderSubtree confinement bites (subtree in, siblings out, workspace guard, null -> root). - test/agency.test.js (+1 e2e): auto-create, default-to-bound, in-subtree pick lands there, sibling -> 403, admin-pick, unknown-pick -> 400, rebind-to-root. Closes #158. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.8 KiB
JavaScript
54 lines
2.8 KiB
JavaScript
'use strict';
|
|
|
|
// #158 (Hybrid-C): an agency token uploads into a bound folder + its descendants and NOTHING
|
|
// else. folderSubtree() in lib/agency-targets.js IS that confinement — it backs both the portal
|
|
// dropdown (GET /api/agency/folders) and the upload target check (POST /api/agency/content), so
|
|
// if it over-returns, the agency can both SEE and WRITE outside its area. Every way it could
|
|
// leak is asserted here; the workspace guard on the anchor row and the parent-join recursion are
|
|
// the two lines that make these bites go red.
|
|
|
|
const { test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const Database = require('better-sqlite3');
|
|
const { folderSubtree } = require('../lib/agency-targets');
|
|
|
|
const db = new Database(':memory:');
|
|
db.exec(`
|
|
CREATE TABLE content_folders (id TEXT PRIMARY KEY, parent_id TEXT, name TEXT, workspace_id TEXT);
|
|
INSERT INTO content_folders (id, parent_id, name, workspace_id) VALUES
|
|
('root', NULL, 'Agency — Acme', 'wsA'), -- the bound folder
|
|
('sub1', 'root', 'Campaign Q1', 'wsA'), -- child -> in
|
|
('sub2', 'root', 'Campaign Q2', 'wsA'), -- child -> in
|
|
('deep', 'sub1', 'Drafts', 'wsA'), -- grandchild -> in
|
|
('sibling',NULL, 'Internal', 'wsA'), -- other root in same ws -> OUT (sibling leak)
|
|
('sibkid', 'sibling','Confidential', 'wsA'), -- under the sibling -> OUT
|
|
('foreign',NULL, 'Other tenant', 'wsB'); -- another workspace -> OUT
|
|
`);
|
|
|
|
const ids = (root, ws) => folderSubtree(db, root, ws).map(r => r.id).sort();
|
|
|
|
test('#158 folderSubtree: bound folder + all descendants, nothing else', () => {
|
|
assert.deepEqual(ids('root', 'wsA'), ['deep', 'root', 'sub1', 'sub2'],
|
|
'root sees itself + children + grandchild, NOT the sibling tree');
|
|
});
|
|
|
|
test('#158 folderSubtree: a deeper bound folder is confined to its own subtree', () => {
|
|
assert.deepEqual(ids('sub1', 'wsA'), ['deep', 'sub1'], 'sub1 sees itself + its child only');
|
|
assert.deepEqual(ids('sub2', 'wsA'), ['sub2'], 'a leaf folder sees only itself');
|
|
});
|
|
|
|
test('#158 folderSubtree: workspace guard — a foreign-workspace anchor returns nothing', () => {
|
|
assert.deepEqual(ids('root', 'wsB'), [], 'root anchored to the wrong workspace -> empty (no cross-ws upload area)');
|
|
assert.deepEqual(ids('foreign', 'wsA'), [], 'a wsB folder claimed under wsA -> empty');
|
|
});
|
|
|
|
test('#158 folderSubtree: no bound folder -> root uploads, empty subtree', () => {
|
|
assert.deepEqual(folderSubtree(db, null, 'wsA'), [], 'null bound folder -> [] (uploads default to library root)');
|
|
});
|
|
|
|
test('#158 folderSubtree: the sibling subtree is never reachable from root', () => {
|
|
const got = ids('root', 'wsA');
|
|
assert.ok(!got.includes('sibling') && !got.includes('sibkid'),
|
|
'neither the sibling folder nor its child may appear in the bound subtree');
|
|
});
|