mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-07-02 20:32:58 +00:00
86fe79c37d
* feat: Add granular access control to shared links via ACL system * fix(shared-links): preserve isPublic on failed migration grants Transient ACL failures during auto-migration permanently stranded links — $unset ran unconditionally, removing the legacy flag that triggers retry. Now only $unset isPublic after all grants succeed. * fix(config): skip isPublic unset for failed ACL grants Bulk migration unconditionally removed isPublic from all links, even those whose ACL writes failed. Failed links then lost the legacy marker needed for auto-migration retry. Now tracks failed link IDs per-batch and excludes them from the $unset step. Also adds sharedLink to AccessRole resourceType schema enum — was missing, only worked because seedDefaultRoles uses findOneAndUpdate which bypasses validation. * ci(config): add jest config and PR workflow for migration tests config/__tests__/ specs depend on api/jest.config.js module mappings but had no dedicated runner. Adds config/jest.config.js extending api config with absolutized paths, npm test:config script, and a GitHub Actions workflow triggered by changes to config/, api/models/, api/db/, or packages/ ACL code. * fix(permissions): honor boolean sharedLinks config SHARED_LINKS has no USE permission, so boolean config produced an empty update payload — gate conditions only matched object form, making `sharedLinks: false` a no-op on existing perms. * fix(share): resolve role before creating shared link Role lookup between create and grant left an orphaned link without ACL entries if getRoleByName threw — retry then hit "Share already exists" with no recovery path. * fix: Restore Public ACL Access Checks * fix: Type Public ACL Lookup * fix: Preserve Private Legacy Shared Links * chore: Promote Shared Link Permission Migration * fix: Address Shared Link Review Findings * fix: Repair Shared Link CI Follow-Up * fix: Narrow Shared Link Mongoose Test Mock * fix: Address Shared Link Review Follow-Ups * fix: Close Shared Link Review Gaps * fix: Guard Missing Shared Link Permission Backfill * test: Add Shared Link Mock E2E * test: Stabilize Shared Link Mock E2E --------- Co-authored-by: Danny Avila <danny@librechat.ai>
88 lines
4.2 KiB
TypeScript
88 lines
4.2 KiB
TypeScript
import { AccessRoleIds, ResourceType } from 'librechat-data-provider';
|
|
|
|
export interface ResourceConfig {
|
|
resourceType: ResourceType;
|
|
defaultViewerRoleId: AccessRoleIds;
|
|
defaultEditorRoleId: AccessRoleIds;
|
|
defaultOwnerRoleId: AccessRoleIds;
|
|
getResourceUrl?: (resourceId: string) => string;
|
|
getResourceName: (resourceName?: string) => string;
|
|
getShareMessage: (resourceName?: string) => string;
|
|
getManageMessage: (resourceName?: string) => string;
|
|
getCopyUrlMessage: () => string;
|
|
}
|
|
|
|
export const RESOURCE_CONFIGS: Record<ResourceType, ResourceConfig> = {
|
|
[ResourceType.AGENT]: {
|
|
resourceType: ResourceType.AGENT,
|
|
defaultViewerRoleId: AccessRoleIds.AGENT_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.AGENT_EDITOR,
|
|
defaultOwnerRoleId: AccessRoleIds.AGENT_OWNER,
|
|
getResourceUrl: (agentId: string) => `${window.location.origin}/c/new?agent_id=${agentId}`,
|
|
getResourceName: (name?: string) => (name && name !== '' ? name : 'agent'),
|
|
getShareMessage: (name?: string) => (name && name !== '' ? name : 'agent'),
|
|
getManageMessage: (name?: string) =>
|
|
`Manage permissions for ${name && name !== '' ? name : 'agent'}`,
|
|
getCopyUrlMessage: () => 'Agent URL copied',
|
|
},
|
|
[ResourceType.PROMPTGROUP]: {
|
|
resourceType: ResourceType.PROMPTGROUP,
|
|
defaultViewerRoleId: AccessRoleIds.PROMPTGROUP_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.PROMPTGROUP_EDITOR,
|
|
defaultOwnerRoleId: AccessRoleIds.PROMPTGROUP_OWNER,
|
|
getResourceName: (name?: string) => (name && name !== '' ? name : 'prompt'),
|
|
getShareMessage: (name?: string) => (name && name !== '' ? name : 'prompt'),
|
|
getManageMessage: (name?: string) =>
|
|
`Manage permissions for ${name && name !== '' ? name : 'prompt'}`,
|
|
getCopyUrlMessage: () => 'Prompt URL copied',
|
|
},
|
|
[ResourceType.MCPSERVER]: {
|
|
resourceType: ResourceType.MCPSERVER,
|
|
defaultViewerRoleId: AccessRoleIds.MCPSERVER_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.MCPSERVER_EDITOR,
|
|
defaultOwnerRoleId: AccessRoleIds.MCPSERVER_OWNER,
|
|
getResourceName: (name?: string) => (name && name !== '' ? name : 'MCP server'),
|
|
getShareMessage: (name?: string) => (name && name !== '' ? name : 'MCP server'),
|
|
getManageMessage: (name?: string) =>
|
|
`Manage permissions for ${name && name !== '' ? name : 'MCP server'}`,
|
|
getCopyUrlMessage: () => 'MCP Server URL copied',
|
|
},
|
|
[ResourceType.REMOTE_AGENT]: {
|
|
resourceType: ResourceType.REMOTE_AGENT,
|
|
defaultViewerRoleId: AccessRoleIds.REMOTE_AGENT_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.REMOTE_AGENT_EDITOR,
|
|
defaultOwnerRoleId: AccessRoleIds.REMOTE_AGENT_OWNER,
|
|
getResourceUrl: () => `${window.location.origin}/api/v1/responses`,
|
|
getResourceName: (name?: string) => (name && name !== '' ? `"${name}"` : 'remote agent'),
|
|
getShareMessage: (name?: string) =>
|
|
name && name !== '' ? `"${name}" (API Access)` : 'remote agent access',
|
|
getManageMessage: (name?: string) =>
|
|
`Manage API access for ${name && name !== '' ? `"${name}"` : 'agent'}`,
|
|
getCopyUrlMessage: () => 'API endpoint copied',
|
|
},
|
|
[ResourceType.SKILL]: {
|
|
resourceType: ResourceType.SKILL,
|
|
defaultViewerRoleId: AccessRoleIds.SKILL_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.SKILL_EDITOR,
|
|
defaultOwnerRoleId: AccessRoleIds.SKILL_OWNER,
|
|
getResourceName: (name?: string) => (name && name !== '' ? name : 'skill'),
|
|
getShareMessage: (name?: string) => (name && name !== '' ? name : 'skill'),
|
|
getManageMessage: (name?: string) =>
|
|
`Manage permissions for ${name && name !== '' ? name : 'skill'}`,
|
|
getCopyUrlMessage: () => 'Skill URL copied',
|
|
},
|
|
[ResourceType.SHARED_LINK]: {
|
|
resourceType: ResourceType.SHARED_LINK,
|
|
defaultViewerRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
|
|
defaultEditorRoleId: AccessRoleIds.SHARED_LINK_VIEWER,
|
|
defaultOwnerRoleId: AccessRoleIds.SHARED_LINK_OWNER,
|
|
getResourceName: (name?: string) => name || 'shared link',
|
|
getShareMessage: (name?: string) => name || 'shared link',
|
|
getManageMessage: (name?: string) => `Manage access for ${name || 'shared link'}`,
|
|
getCopyUrlMessage: () => 'Share link copied',
|
|
},
|
|
};
|
|
|
|
export const getResourceConfig = (resourceType: ResourceType): ResourceConfig | undefined => {
|
|
return RESOURCE_CONFIGS[resourceType];
|
|
};
|