officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove the dead multi-user surface

Browse Source 
Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
brunorezio
2026-07-25 23:30:20 +01:00
co-authored by Claude Opus 5
parent 92de996412
commit 044aacf4d5
85 changed files with 2761 additions and 2121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/_middlewares/index.ts
-1
View File
@@ -3,4 +3,3 @@ export * from './user-middleware';
export * from './origin-middleware';
export * from './origin-validation';
export * from './rate-limiter';
export * from './super-admin-middleware';
src/servers/_middlewares/super-admin-middleware.ts
-8
View File
@@ -1,8 +0,0 @@
import type { MiddlewareHandler } from 'hono';
import * as errors from '@@/custom-errors';
export const superAdminMiddleware: MiddlewareHandler = function (ctx, next) {
const user = ctx.get('user');
if (user?.role !== 'Super Admin') throw errors.FORBIDDEN();
return next();
};
src/servers/_middlewares/user-middleware.ts
-19
View File
@@ -5,22 +5,6 @@ import { isOriginAllowed } from './origin-validation';
import { isLockdown, noteBlocked } from '../api/auth/panic';
import { getUserById, isTokenBlacklisted } from 'officerdb';
// Role permissions: which HTTP methods each role can use
// Roles not listed here are denied by default (fail-safe)
const ROLE_PERMISSIONS: Record<string, string[]> = {
Member: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
Admin: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
Owner: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
'Super Admin': ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
};
function isMethodAllowed(role: string | null, method: string): boolean {
if (!role) return false;
const allowedMethods = ROLE_PERMISSIONS[role];
if (!allowedMethods) return false; // Unknown role = no access
return allowedMethods.includes(method);
}
export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
// Duress lockdown: reject every authenticated request, cutting off all existing sessions.
if (isLockdown()) {
@@ -68,9 +52,6 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
}
}
if (!isMethodAllowed(user.role, ctx.req.method)) {
throw errors.FORBIDDEN('Insufficient permissions');
}
ctx.set('user', user);
return next();
} catch (ex) {