weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(authz): close project-context ABAC gap and repair CI PG fixtures

Browse Source 
enforceChatProjectAccess before allowAnyStageAccess on GET /context/project
so activated projects are no longer readable by arbitrary authenticated users.

Align failing gate fixtures with official workflow keys, isolated TEST_DATABASE_URL,
unique project names (00057), duty membership, and in-memory bizdev-cli envs.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
weichen
2026-09-22 18:12:26 +08:00
co-authored by Cursor
parent 3c2c7f9ccc
commit c767a99807
11 changed files with 162 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/projectinstance/activation_official_pg_test.go
+2 -2
View File
@@ -40,8 +40,8 @@ func TestPG_ActivateOfficialWorkflowRuntimeMetadata(t *testing.T) {
code := "pg-official-" + time.Now().Format("150405.000")
err = pool.QueryRow(ctx, `
INSERT INTO projects (code, name, status, creator_user_id, lifecycle_status, active_workflow_key, workflow_selection_version, workflow_plan_revision)
VALUES ($1, 'PG Official Activation Test', 'active', 1, 'planning', '', 1, 0) RETURNING id
`, code).Scan(&projectID)
VALUES ($1, $2, 'active', 1, 'planning', '', 1, 0) RETURNING id
`, code, "PG Official Activation Test "+code).Scan(&projectID)
if err != nil {
t.Fatalf("insert project: %v", err)
}