officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove the dead multi-user surface

Browse Source 
Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
brunorezio
2026-07-25 23:30:20 +01:00
co-authored by Claude Opus 5
parent 92de996412
commit 044aacf4d5
85 changed files with 2761 additions and 2121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/apps/officer-web/Screens/Dashboard/CapabilityPage.tsx
+2 -2
View File
@@ -135,7 +135,7 @@ inputs: # optional — parameters the user fills in before runni
- No triggers → task is only runnable from the Automation page
## Notes
- Tasks run inside the user's sandboxed container
- Tasks run on the host as the server owner
- The markdown body after the frontmatter should contain step-by-step instructions for the agent
</task-creation-guide>`;
@@ -243,7 +243,7 @@ inputs:
- \`object\` — JSON object
## Notes
- Tools run inside the user's sandboxed container
- Tools run on the host as the server owner
- The \`name\` field uses snake_case (this is the function name the agent calls)
- The \`label\` field is the human-readable display name
- Mark parameters as \`optional: true\` when they have sensible defaults
src/apps/officer-web/Screens/Dashboard/Layout/Dock.tsx
+16 -4
View File
@@ -7,7 +7,6 @@ export type DockItem = {
to: string;
icon: LucideIcon;
color: string;
role?: string;
};
type DockProps = {
@@ -109,8 +108,21 @@ export const Dock = ({ items, className }: DockProps) => {
);
};
import { Home, MessageCircle, FileText, FolderOpen, Code, LayoutGrid, ScrollText, FolderKanban, Monitor, Mail, Globe, MonitorSmartphone, Workflow } from 'lucide-react';
import {
Home,
MessageCircle,
FileText,
FolderOpen,
Code,
LayoutGrid,
ScrollText,
FolderKanban,
Monitor,
Mail,
Globe,
MonitorSmartphone,
Workflow,
} from 'lucide-react';
export const ALL_DOCK_ITEMS: DockItem[] = [
{ label: 'Home', to: '/', icon: Home, color: '#f59e0b' },
@@ -124,7 +136,7 @@ export const ALL_DOCK_ITEMS: DockItem[] = [
{ label: 'Terminal', to: '/terminal', icon: Monitor, color: '#f97316' },
{ label: 'Projects', to: '/projects', icon: FolderKanban, color: '#10b981' },
{ label: 'Browser', to: '/browser', icon: Globe, color: '#06b6d4' },
{ label: 'Desktop', to: '/desktop', icon: MonitorSmartphone, color: '#ec4899', role: 'Super Admin' },
{ label: 'Desktop', to: '/desktop', icon: MonitorSmartphone, color: '#ec4899' },
{ label: 'Dashboards', to: '/dashboards', icon: LayoutGrid, color: '#8b5cf6' },
];
src/apps/officer-web/Screens/Dashboard/Layout/Header/UserMenu.tsx
+13 -27
View File
@@ -1,7 +1,7 @@
import { Link } from 'react-router';
import * as Dropdown from '@/components/ui/dropdown-menu';
import { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar';
import { User, Users, LogOut, Settings, Package, Puzzle, Rocket, Sun, Moon, Bot } from 'lucide-react';
import { User, LogOut, Settings, Package, Puzzle, Rocket, Sun, Moon, Bot } from 'lucide-react';
import { useAuth } from 'hooks/useAuth';
import { useTranslation } from '@/lib/i18n';
import { useColorMode } from '@/components/ui/ThemeProvider';
@@ -16,8 +16,6 @@ export function UserMenu() {
const { settings, saveSettings } = useSettings();
if (isLoading) return null;
const isAdmin = user?.role !== 'Member';
const toggleColorMode = () => {
const next = colorMode === 'dark' ? 'light' : 'dark';
setColorMode(next);
@@ -43,22 +41,18 @@ export function UserMenu() {
{t('header.userMenu.profile')}
</Link>
</DropdownMenuItem>
{isAdmin && (
<>
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/system">
<Settings className="mr-2 h-4 w-4" />
{t('header.userMenu.systemSettings')}
</Link>
</DropdownMenuItem>
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/resources">
<Package className="mr-2 h-4 w-4" />
{t('header.userMenu.resources')}
</Link>
</DropdownMenuItem>
</>
)}
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/system">
<Settings className="mr-2 h-4 w-4" />
{t('header.userMenu.systemSettings')}
</Link>
</DropdownMenuItem>
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/resources">
<Package className="mr-2 h-4 w-4" />
{t('header.userMenu.resources')}
</Link>
</DropdownMenuItem>
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/ai">
<Bot className="mr-2 h-4 w-4" />
@@ -77,14 +71,6 @@ export function UserMenu() {
Apps
</Link>
</DropdownMenuItem>
{user?.role === 'Super Admin' && (
<DropdownMenuItem asChild className="cursor-pointer">
<Link to="/settings/users">
<Users className="mr-2 h-4 w-4" />
Users
</Link>
</DropdownMenuItem>
)}
<DropdownMenuSeparator />
<DropdownMenuItem onClick={toggleColorMode} className="cursor-pointer">
{colorMode === 'dark' ? <Sun className="mr-2 h-4 w-4" /> : <Moon className="mr-2 h-4 w-4" />}
src/apps/officer-web/Screens/Dashboard/Settings/AISettings.tsx
+23 -39
View File
@@ -104,12 +104,8 @@ const DropZone = ({ label, children, onDrop }: DropZoneProps) => {
// --- My Models Section (per-user hidden models) ---
function MyModelsSection() {
const { user } = useAuth();
const { settings, saveSettings } = useSettings();
const allModels = useModels();
const policyModels = useVisibleModels();
const isAdmin = user?.role !== 'Member';
const visibleModels = isAdmin ? allModels : policyModels;
const visibleModels = useModels();
const [activeProvider, setActiveProvider] = useUserState<string>('my-models-provider', '');
const hiddenModels = settings.chat.hiddenModels ?? [];
@@ -411,12 +407,7 @@ function MemberModelsSection() {
// // ... full implementation for future use
// }
// --- Build groups based on role ---
function useAISettingsGroups(): SettingsSectionGroup[] {
const { user } = useAuth();
const isAdmin = user?.role !== 'Member';
return useMemo(() => {
const modelsGroup: SettingsSectionGroup = {
label: 'Models',
@@ -429,17 +420,13 @@ function useAISettingsGroups(): SettingsSectionGroup[] {
description: 'Show or hide models for yourself',
content: <MyModelsSection />,
},
...(isAdmin
? [
{
key: 'member-models',
icon: Eye,
title: 'Member Models',
description: 'Enable or disable models for members',
content: <MemberModelsSection />,
},
]
: []),
{
key: 'member-models',
icon: Eye,
title: 'Channel Models',
description: 'Models reachable from Telegram, WhatsApp and Discord',
content: <MemberModelsSection />,
},
],
};
@@ -457,25 +444,22 @@ function useAISettingsGroups(): SettingsSectionGroup[] {
],
};
if (isAdmin) {
const providersGroup: SettingsSectionGroup = {
label: 'Providers',
icon: Terminal,
sections: [
{
key: 'ai-harnesses',
icon: Terminal,
title: 'Providers',
description: 'Remote and local AI providers',
content: <AIHarnessesSection />,
},
],
};
return [providersGroup, modelsGroup, defaultsGroup];
}
const providersGroup: SettingsSectionGroup = {
label: 'Providers',
icon: Terminal,
sections: [
{
key: 'ai-harnesses',
icon: Terminal,
title: 'Providers',
description: 'Remote and local AI providers',
content: <AIHarnessesSection />,
},
],
};
return [modelsGroup, defaultsGroup];
}, [isAdmin]);
return [providersGroup, modelsGroup, defaultsGroup];
}, []);
}
const layout: LayoutNode = {
src/apps/officer-web/Screens/Dashboard/Settings/IntegrationsSettings/index.tsx
+14 -20
View File
@@ -108,9 +108,7 @@ const personalSections: SettingsSection[] = [
];
const IntegrationsSidebar = () => {
const { user } = useAuth();
const isSuperAdmin = user?.role === 'Super Admin';
const [tab, setTab] = useGlobal<string>(TAB_KEY, isSuperAdmin ? 'enterprise' : 'personal');
const [tab, setTab] = useGlobal<string>(TAB_KEY, 'enterprise');
const sections = tab === 'enterprise' ? enterpriseSections : personalSections;
return (
@@ -121,29 +119,25 @@ const IntegrationsSidebar = () => {
Integrations
</div>
</div>
{isSuperAdmin && (
<div className="px-3 pb-2">
<Tabs value={tab} onValueChange={setTab}>
<TabsList className="w-full">
<TabsTrigger value="enterprise" className="flex-1 cursor-pointer">
Enterprise
</TabsTrigger>
<TabsTrigger value="personal" className="flex-1 cursor-pointer">
Personal
</TabsTrigger>
</TabsList>
</Tabs>
</div>
)}
<div className="px-3 pb-2">
<Tabs value={tab} onValueChange={setTab}>
<TabsList className="w-full">
<TabsTrigger value="enterprise" className="flex-1 cursor-pointer">
Enterprise
</TabsTrigger>
<TabsTrigger value="personal" className="flex-1 cursor-pointer">
Personal
</TabsTrigger>
</TabsList>
</Tabs>
</div>
<SettingsSidebar globalKey={GLOBAL_KEY} icon={Puzzle} label="Integrations" sections={sections} hideHeader />
</div>
);
};
const IntegrationsContent = () => {
const { user } = useAuth();
const isSuperAdmin = user?.role === 'Super Admin';
const [tab] = useGlobal<string>(TAB_KEY, isSuperAdmin ? 'enterprise' : 'personal');
const [tab] = useGlobal<string>(TAB_KEY, 'enterprise');
const sections = tab === 'enterprise' ? enterpriseSections : personalSections;
return <SettingsContent globalKey={GLOBAL_KEY} sections={sections} />;
src/apps/officer-web/Screens/Dashboard/Settings/SystemSettings.tsx
+1 -7
View File
@@ -124,13 +124,7 @@ const SystemTerminalPanel = () => {
<X className="h-3.5 w-3.5 text-duck-dark/50 dark:text-foreground/50" />
</button>
</div>
<TerminalView
className="flex-1"
sandboxed={false}
command={session.command}
sessionId={session.id}
onCommandDone={onCommandDone}
/>
<TerminalView className="flex-1" command={session.command} sessionId={session.id} onCommandDone={onCommandDone} />
</div>
);
};
src/apps/officer-web/Screens/Dashboard/Settings/UserSettings/InviteUserDialog.tsx
-86
View File
@@ -1,86 +0,0 @@
import { useState } from 'react';
import { toast } from 'sonner';
import { useClient } from 'hooks/useClient';
import { useForm } from 'hooks/useForm';
import { Button } from '@/components/ui/button';
import { Input } from '@/components/ui/input';
import { Label } from '@/components/ui/label';
import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from '@/components/ui/dialog';
type InviteUserDialogProps = {
open: boolean;
onOpenChange: (open: boolean) => void;
onSuccess: () => void;
};
type InviteFormState = {
email: string;
role: string;
};
const ROLES = ['Member', 'Admin', 'Owner'] as const;
export const InviteUserDialog = ({ open, onOpenChange, onSuccess }: InviteUserDialogProps) => {
const client = useClient();
const { state, formRef, update, reset } = useForm<InviteFormState>({ email: '', role: 'Member' });
const [loading, setLoading] = useState(false);
const handleSubmit = async (ev: React.FormEvent) => {
ev.preventDefault();
const email = state.email?.trim();
if (!email) return;
setLoading(true);
try {
await client.post('/users/invite', { email, role: state.role });
toast.success(`Invitation sent to ${email}`);
reset();
onOpenChange(false);
onSuccess();
} catch {
toast.error('Failed to send invitation');
} finally {
setLoading(false);
}
};
const handleRoleChange = (value: string) => {
update((prev) => ({ ...prev, role: value }));
};
return (
<Dialog open={open} onOpenChange={onOpenChange}>
<DialogContent>
<DialogHeader>
<DialogTitle>Invite User</DialogTitle>
<DialogDescription>Send an invitation email to a new user.</DialogDescription>
</DialogHeader>
<form ref={formRef} onSubmit={handleSubmit} className="flex flex-col gap-4">
<div className="flex flex-col gap-2">
<Label htmlFor="invite-email">Email</Label>
<Input id="invite-email" type="email" name="email" placeholder="user@example.com" required />
</div>
<div className="flex flex-col gap-2">
<Label htmlFor="invite-role">Role</Label>
<Select value={state.role ?? 'Member'} onValueChange={handleRoleChange}>
<SelectTrigger id="invite-role">
<SelectValue />
</SelectTrigger>
<SelectContent>
{ROLES.map((r) => (
<SelectItem key={r} value={r}>
{r}
</SelectItem>
))}
</SelectContent>
</Select>
</div>
<Button type="submit" disabled={loading || !state.email?.trim()}>
{loading ? 'Sending...' : 'Send Invitation'}
</Button>
</form>
</DialogContent>
</Dialog>
);
};
src/apps/officer-web/Screens/Dashboard/Settings/UserSettings/UsersTable.tsx
-95
View File
@@ -1,95 +0,0 @@
import { useState } from 'react';
import { useQuery } from '@tanstack/react-query';
import { toast } from 'sonner';
import type { UserSelect } from 'officerdb/types';
import { useClient } from 'hooks/useClient';
import { useAuth } from 'hooks/useAuth';
import { DataTable, useDataControl } from '@/components/DataTable';
import { SearchInput } from '@/components/SearchInput';
import { Button } from '@/components/ui/button';
import { Badge } from '@/components/ui/badge';
import { UserPlus, Trash2, MailPlus } from 'lucide-react';
import { InviteUserDialog } from './InviteUserDialog';
type SafeUser = Omit<UserSelect, 'password'>;
export const UsersTable = () => {
const client = useClient();
const { user: currentUser } = useAuth();
const [inviteOpen, setInviteOpen] = useState(false);
const { data: users, refetch } = useQuery({
queryKey: ['users'],
queryFn: () => client.get<SafeUser[]>('/users'),
});
const dataController = useDataControl<SafeUser>(users ?? []);
const handleResendInvite = async (user: SafeUser) => {
try {
await client.post(`/users/${user.id}/resend-invite`);
toast.success(`Invitation resent to ${user.email}`);
} catch {
toast.error('Failed to resend invitation');
}
};
const handleDelete = async (user: SafeUser) => {
if (!confirm(`Delete ${user.name || user.email}?`)) return;
try {
await client.delete(`/users/${user.id}`);
toast.success('User deleted');
refetch();
} catch {
toast.error('Failed to delete user');
}
};
return (
<div className="flex flex-col gap-4">
<div className="flex items-center justify-between gap-4">
<SearchInput value={dataController.searchQuery} handleSearch={dataController.setSearchQuery} />
<Button size="sm" onClick={() => setInviteOpen(true)}>
<UserPlus className="mr-2 h-4 w-4" />
Invite User
</Button>
</div>
<DataTable<SafeUser>
dataController={dataController}
pageSize={20}
columns={[
{ field: 'name', label: 'Name', sortKey: 'name' },
{ field: 'email', label: 'Email', sortKey: 'email' },
{ field: 'role', label: 'Role', sortKey: 'role' },
{
field: 'status',
label: 'Status',
sortKey: 'status',
format: ({ value }) => (
<Badge variant={value === 'Active' ? 'default' : 'secondary'}>{value as string}</Badge>
),
},
{
label: '',
format: ({ item }) =>
item.id !== currentUser?.id ? (
<div className="flex items-center gap-1">
{item.status === 'Invited' && (
<Button variant="ghost" size="icon" className="h-8 w-8" onClick={() => handleResendInvite(item)}>
<MailPlus className="h-4 w-4" />
</Button>
)}
<Button variant="ghost" size="icon" className="h-8 w-8 text-destructive" onClick={() => handleDelete(item)}>
<Trash2 className="h-4 w-4" />
</Button>
</div>
) : null,
},
]}
/>
<InviteUserDialog open={inviteOpen} onOpenChange={setInviteOpen} onSuccess={refetch} />
</div>
);
};
src/apps/officer-web/Screens/Dashboard/Settings/UserSettings/index.tsx
-46
View File
@@ -1,46 +0,0 @@
import { useMemo } from 'react';
import { Users } from 'lucide-react';
import type { LayoutNode, PanelComponents } from 'officerdev';
import { WorkspaceLayout } from 'officerdev';
import { createSettingsPanelComponents, type SettingsSection } from '../SettingsPanel';
import { UsersTable } from './UsersTable';
const GLOBAL_KEY = 'USER_SETTINGS_SELECTED';
const sections: SettingsSection[] = [
{ key: 'all-users', icon: Users, title: 'All Users', description: 'View and manage users', content: <UsersTable /> },
];
const { Sidebar, Content } = createSettingsPanelComponents({
globalKey: GLOBAL_KEY,
sidebarIcon: Users,
sidebarLabel: 'Users',
sections,
});
const layout: LayoutNode = {
type: 'group',
id: 'users-root',
direction: 'horizontal',
children: [
{ node: { type: 'panel', id: 'users-left', appType: null }, size: 20 },
{ node: { type: 'panel', id: 'users-right', appType: null }, size: 80 },
],
};
export const UserSettings = () => {
const panelComponents: PanelComponents = useMemo(
() => ({
'users-left': Sidebar,
'users-right': Content,
}),
[],
);
return (
<div className="h-full w-full pt-2">
<WorkspaceLayout layout={layout} onLayoutChange={() => {}} components={panelComponents} />
</div>
);
};
src/apps/officer-web/Screens/Dashboard/Settings/index.tsx
-1
View File
@@ -1,6 +1,5 @@
export * from './ProfileSettings';
export * from './SystemSettings';
export * from './AISettings';
export * from './UserSettings';
export * from './IntegrationsSettings';
export * from './AppsSettings';