officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shared group provisioning, upload context menu, go path fix

Browse Source 
- provision linux users with pastilhas:officerdev ownership so server
  can always read/write, terminal users get group access
- add officerdev shared group setup to setup.sh
- move go install to ~/.local/go with GOPATH at ~/.local/go-path
- add upload file/folder items to file browser context menu

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-03-05 02:34:38 +00:00
co-authored by Claude Opus 4.6
parent 74894b0c35
commit 3df47bb48d
3 changed files with 76 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/api/users/provision.ts
+27 -16
View File
@@ -4,6 +4,7 @@ import { DATA_PATH, getHomeDir, toShellUsername } from '@@/data-path';
import { generateContainerContext, generateClaudeSettings } from '@@/generate-container-context';
const TEMPLATE_DIR = join(import.meta.dir, '../terminal/templates');
const SHARED_GROUP = 'officerdev';
const run = (cmd: string[], opts?: { cwd?: string }): boolean => {
const result = Bun.spawnSync({ cmd, stdout: 'ignore', stderr: 'pipe', ...opts });
@@ -18,12 +19,27 @@ const linuxUserExists = (username: string): boolean => {
return result.exitCode === 0;
};
const groupExists = (group: string): boolean => {
const result = Bun.spawnSync({ cmd: ['getent', 'group', group], stdout: 'ignore', stderr: 'ignore' });
return result.exitCode === 0;
};
const copyTemplate = async (src: string, dest: string) => {
if (existsSync(dest)) return;
const content = await Bun.file(src).text();
await Bun.write(dest, content);
};
export function ensureSharedGroup(): void {
if (groupExists(SHARED_GROUP)) return;
run(['sudo', 'groupadd', SHARED_GROUP]);
const serviceUser = process.env.USER ?? '';
if (serviceUser) {
run(['sudo', 'usermod', '-aG', SHARED_GROUP, serviceUser]);
}
console.log(`[provision] created shared group ${SHARED_GROUP} and added ${serviceUser}`);
}
export async function provisionLinuxUser(email: string, username: string): Promise<boolean> {
const shellUsername = toShellUsername(username, email);
const homeDir = getHomeDir(email);
@@ -31,33 +47,27 @@ export async function provisionLinuxUser(email: string, username: string): Promi
console.log(`[provision] provisioning Linux user ${shellUsername} for ${email}`);
// Ensure shared group exists
ensureSharedGroup();
// Ensure data directories exist
mkdirSync(userRoot, { recursive: true });
mkdirSync(homeDir, { recursive: true });
// Create Linux user if not exists
if (!linuxUserExists(shellUsername)) {
const ok = run(['sudo', 'useradd', '-d', homeDir, '-s', '/bin/zsh', '-M', shellUsername]);
const ok = run(['sudo', 'useradd', '-d', homeDir, '-s', '/bin/zsh', '-G', SHARED_GROUP, '-M', shellUsername]);
if (!ok) {
console.error(`[provision] failed to create Linux user ${shellUsername}`);
return false;
}
console.log(`[provision] created Linux user ${shellUsername}`);
} else {
// Ensure existing user is in the shared group
run(['sudo', 'usermod', '-aG', SHARED_GROUP, shellUsername]);
console.log(`[provision] Linux user ${shellUsername} already exists`);
}
// Set ownership and permissions on user data directory
// chmod 770 so only owner and group can access (service user is added to group below)
run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
run(['sudo', 'chmod', '-R', '770', userRoot]); // Recursive chmod to fix all subdirectories
// Add the service user to the new user's group so server jobs can access user data
const serviceUser = process.env.USER ?? '';
if (serviceUser && serviceUser !== shellUsername) {
run(['sudo', 'usermod', '-aG', shellUsername, serviceUser]);
}
// Seed shell config files
await seedShellConfigs(homeDir);
@@ -66,7 +76,6 @@ export async function provisionLinuxUser(email: string, username: string): Promi
const claudeDir = join(homeDir, '.claude');
mkdirSync(claudeDir, { recursive: true });
// Copy context to user's .claude dir
const contextContent = await Bun.file(contextFile).text();
await Bun.write(join(claudeDir, 'CLAUDE.md'), contextContent);
@@ -74,9 +83,11 @@ export async function provisionLinuxUser(email: string, username: string): Promi
const settingsContent = await Bun.file(settingsFile).text();
await Bun.write(join(claudeDir, 'settings.json'), settingsContent);
// Fix ownership and permissions after seeding
run(['sudo', 'chown', '-R', `${shellUsername}:${shellUsername}`, userRoot]);
run(['sudo', 'chmod', '-R', '770', userRoot]);
// Service user (pastilhas) owns everything — server can always read/write.
// Linux user gets group access via officerdev for terminal sessions only.
const serviceUser = process.env.USER ?? 'pastilhas';
run(['sudo', 'chown', '-R', `${serviceUser}:${SHARED_GROUP}`, userRoot]);
run(['sudo', 'chmod', '-R', '2775', userRoot]);
console.log(`[provision] provisioning complete for ${shellUsername}`);
return true;