hanzo-dev
ec32864a00
App REST surface moves from /api/* to /v1/chat/* in lockstep across server
mounts, client URL builders, SSE stream paths, OAuth redirect_uris, telemetry
route-grouping, RUM proxy, and the nginx bridge.
Namespace /v1/chat/* (not flat /v1/) to avoid colliding with the OpenAI-compat
inference surface (/v1/chat/completions, /v1/models -> router_backend) and to
match the canonical chat/openapi.yaml. Social OIDC login (/oauth/*) and /health
are unchanged (login-safe).
Levers:
- server: api/server/index.js 26 app.use('/v1/chat/*') mounts (+ experimental.js)
- client: packages/data-provider/src/api-endpoints.ts (75 builders) + config.ts
Lockstep: checkBan matcher, Files/Code download path, actions/mcp CSRF cookie
paths, ActionService + mcp/oauth handler redirect_uris, admin OpenID callback,
telemetry middleware/sdk/stream, rum proxy path, vite dev proxy + PWA denylist,
robots.txt, .env.example, pr-preview health-path (/api/health -> /health).
Third-party APIs chat CALLS are untouched (Ollama, Wolfram, Discord, GitHub
Enterprise, Mistral, OpenRouter, DataDog). Live-surface /api/: 683 -> 0.
Also untracks runtime log artifacts (api/logs, client/junit.xml; already gitignored).
123 lines
3.9 KiB
JavaScript
123 lines
3.9 KiB
JavaScript
const express = require('express');
|
|
const { ResourceType, PermissionBits } = require('librechat-data-provider');
|
|
const {
|
|
getUserEffectivePermissions,
|
|
getAllEffectivePermissions,
|
|
updateResourcePermissions,
|
|
getResourcePermissions,
|
|
getResourceRoles,
|
|
searchPrincipals,
|
|
} = require('~/server/controllers/PermissionsController');
|
|
const { requireJwtAuth, checkBan, uaParser, canAccessResource } = require('~/server/middleware');
|
|
const { checkPeoplePickerAccess } = require('~/server/middleware/checkPeoplePickerAccess');
|
|
const { checkSharePublicAccess } = require('~/server/middleware/checkSharePublicAccess');
|
|
const { findMCPServerByObjectId } = require('~/models');
|
|
|
|
const router = express.Router();
|
|
|
|
// Apply common middleware
|
|
router.use(requireJwtAuth);
|
|
router.use(checkBan);
|
|
router.use(uaParser);
|
|
|
|
/**
|
|
* Generic routes for resource permissions
|
|
* Pattern: /v1/chat/permissions/{resourceType}/{resourceId}
|
|
*/
|
|
|
|
/**
|
|
* GET /v1/chat/permissions/search-principals
|
|
* Search for users and groups to grant permissions
|
|
*/
|
|
router.get('/search-principals', checkPeoplePickerAccess, searchPrincipals);
|
|
|
|
/**
|
|
* GET /v1/chat/permissions/{resourceType}/roles
|
|
* Get available roles for a resource type
|
|
*/
|
|
router.get('/:resourceType/roles', getResourceRoles);
|
|
|
|
/**
|
|
* Middleware factory to check resource access for permission-related operations.
|
|
* SECURITY: Users must have SHARE permission to view or modify resource permissions.
|
|
* @param {string} requiredPermission - The permission bit required (e.g., SHARE)
|
|
* @returns Express middleware function
|
|
*/
|
|
const checkResourcePermissionAccess = (requiredPermission) => (req, res, next) => {
|
|
const { resourceType } = req.params;
|
|
let middleware;
|
|
|
|
if (resourceType === ResourceType.AGENT) {
|
|
middleware = canAccessResource({
|
|
resourceType: ResourceType.AGENT,
|
|
requiredPermission,
|
|
resourceIdParam: 'resourceId',
|
|
});
|
|
} else if (resourceType === ResourceType.REMOTE_AGENT) {
|
|
middleware = canAccessResource({
|
|
resourceType: ResourceType.REMOTE_AGENT,
|
|
requiredPermission,
|
|
resourceIdParam: 'resourceId',
|
|
});
|
|
} else if (resourceType === ResourceType.PROMPTGROUP) {
|
|
middleware = canAccessResource({
|
|
resourceType: ResourceType.PROMPTGROUP,
|
|
requiredPermission,
|
|
resourceIdParam: 'resourceId',
|
|
});
|
|
} else if (resourceType === ResourceType.MCPSERVER) {
|
|
middleware = canAccessResource({
|
|
resourceType: ResourceType.MCPSERVER,
|
|
requiredPermission,
|
|
resourceIdParam: 'resourceId',
|
|
idResolver: findMCPServerByObjectId,
|
|
});
|
|
} else {
|
|
return res.status(400).json({
|
|
error: 'Bad Request',
|
|
message: `Unsupported resource type: ${resourceType}`,
|
|
});
|
|
}
|
|
|
|
// Execute the middleware
|
|
middleware(req, res, next);
|
|
};
|
|
|
|
/**
|
|
* GET /v1/chat/permissions/{resourceType}/{resourceId}
|
|
* Get all permissions for a specific resource
|
|
* SECURITY: Requires SHARE permission to view resource permissions
|
|
*/
|
|
router.get(
|
|
'/:resourceType/:resourceId',
|
|
checkResourcePermissionAccess(PermissionBits.SHARE),
|
|
getResourcePermissions,
|
|
);
|
|
|
|
/**
|
|
* PUT /v1/chat/permissions/{resourceType}/{resourceId}
|
|
* Bulk update permissions for a specific resource
|
|
* SECURITY: Requires SHARE permission to modify resource permissions
|
|
* SECURITY: Requires SHARE_PUBLIC permission to enable public sharing
|
|
*/
|
|
router.put(
|
|
'/:resourceType/:resourceId',
|
|
checkResourcePermissionAccess(PermissionBits.SHARE),
|
|
checkSharePublicAccess,
|
|
updateResourcePermissions,
|
|
);
|
|
|
|
/**
|
|
* GET /v1/chat/permissions/{resourceType}/effective/all
|
|
* Get user's effective permissions for all accessible resources of a type
|
|
*/
|
|
router.get('/:resourceType/effective/all', getAllEffectivePermissions);
|
|
|
|
/**
|
|
* GET /v1/chat/permissions/{resourceType}/{resourceId}/effective
|
|
* Get user's effective permissions for a specific resource
|
|
*/
|
|
router.get('/:resourceType/:resourceId/effective', getUserEffectivePermissions);
|
|
|
|
module.exports = router;
|