weichen/Agent-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,090 Commits 10 Branches 15 Tags
9a4ccf404014d1b5f6f54de9f00aef11df32941d
Commit Graph
18 Commits
Author SHA1 Message Date
WeiCHEN 6d3efdf4d7 feat(auth): show real names in duty pickers and enable profile edits 
Add a login-visible user directory API and admin/self profile update
paths so project duty selectors stop falling back to "用户 N", and so
users can persist display fields with an admin-edit tip.
 2026-09-23 09:39:41 +08:00
weichenandCursor 0ebcabf7df fix(auth): tolerate concurrent demo-user seed unique conflicts 
Parallel NewServer bootstrap raced with goose fixed-id user rows and
sequence drift, panicking the server package on wangzong insert. Treat
unique violations as success when the demo username exists (or retry once).

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-22 18:18:33 +08:00
weichenandCursor 3c2c7f9ccc test+arch: unblock production gate (import SSOT + isolated test DSN) 
arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.

7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-22 18:04:02 +08:00
weichenandCursor 5cd22c7327 fix(authz): harden permissions, chat gate, and project create idempotency 
Add project:manage_members, CSP frame-src, task-run member view, CreateUser
tx error handling, ERR_NO_PROJECT chat gate, and creator-scoped project
name/client_key uniqueness to stop duplicate creates and auth gaps.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-20 07:04:57 +00:00
weichenandCursor 32d838285d fix(auth): resolve session and user status once per request 
/auth/me was authenticating again after the middleware had already done it, and the session lookup queried user status in a second round trip. Reuse the request principal and join status into the session read so a revoked token still fails on the next request.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-19 09:54:10 +00:00
weichenandCursor 025ffe0ab3 feat(authz): full route inventory, session interrupt test, 410/R13 freeze 
Close FEATURE-MATRIX IAM partial with v3 inventory and policy docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 15:33:18 +00:00
weichenandCursor 514db3a086 feat(auth): fail-closed IAM store unless dev/test opt-in 
Refuse MemoryStore fallback for main/empty/unknown env or missing
ALLOW_IN_MEMORY so production cannot silently use in-memory authority.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-16 09:42:07 +00:00
weichen 53bb71adae fix(auth): respect SEED_DEMO_USERS=false to prevent re-seeding demo users 2026-09-16 03:12:31 +00:00
weichenandCursor f189ce9ff9 fix(auth): surface BootstrapAdminFromConfig UpdateUserRole failures 
Do not ignore role promotion errors when ensuring the configured admin
account holds role-admin; cover success and failure with unit tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 11:37:03 +00:00
weichenandCursor 90f77eac93 feat(authz): implement six-phase permissions, settings and workflow v2 
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor c7aba86376 fix(test): stabilize PG seed users and CI short test suite. 
Reactivate dev seed users after auth PG tests, use unique session tokens, fix import guard and coordinator assertions, and skip flaky E2E in short mode; add pg_restore CI drill job.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:23 +00:00
weichenandCursor 016c3a9791 test(docs): Phase 1 completion gates, PG integration tests, and report 
Add disabled-user 401, admin roles/sessions handler tests, optional PG store
integration, cross-project 403 fixture, and update the Phase 1 test report to
reflect completion status.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichenandCursor 6219caf690 feat(authz): complete Phase 1 admin roles, sessions, and unified admin gate 
Add roles CRUD backed by system_roles tables, session list/revoke APIs,
capabilities fallback for memory mode, and route all admin checks through
AuthorizationService instead of hardcoded role-admin checks.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:22 +00:00
weichen d8c445bfd5 feat(auth): persist sessions and accounts via PostgresAuthStore 
Add PgStore with hashed token sessions, IAM bootstrap, and store factory wiring; remove in-memory token map and allow_dev_switch from login payload.
 2026-09-13 02:50:22 +00:00
weichen e96ade076a fix(auth): restrict demo seed users to dev/test environments 
Main no longer creates fixed-password demo accounts and legacy anonymous
fallback is limited to explicit dev/test in-memory fixtures.
 2026-09-13 02:50:22 +00:00
WeiCHEN f87a6ee28d feat(workflow): Phase 1 & 2 数据库迁移、项目创建人权威化与多工作流控制面 2026-09-13 02:50:21 +00:00
WeiCHENandCursor 2047c85ba5 feat(api): add auth and admin management endpoints 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:20 +00:00
WeiCHENandCursor 6c9ad6b61d feat(auth): add auth data models, config and store engine 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-13 02:50:20 +00:00