officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

let members sign in to the platform, which is the entire point

Browse Source 
signin refused any non-owner arriving through the web or mobile platform
origin: "This account can only sign in through its app." so a member could
hold a gitea grant and still never reach a page — verified as a live 403
before this change.

that rule was correct while single-user was the invariant. the only
non-owner accounts were music-app accounts, and there was no way to say
"this person may use the platform, but only these parts of it", so keeping
them out entirely was the honest answer. capabilities say exactly that now,
per feature, at both doors and on every request.

so superAdminOnly is retired rather than patched. the web origin and the
platform app get no path scoping — what their caller may reach is decided by
their role, not by their Origin. per-app path scoping stays for the
single-feature apps (music, vault, tail), where it still means something.

note this WIDENS who may sign in: any Active account can now authenticate
through the browser. that is the intended product change, and it is only
safe because the capability backstop runs on every request behind it —
which is why it lands after that, not before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-07 01:36:07 +00:00
co-authored by Claude Opus 5
parent f283ebcba3
commit d8ee678ec4
2 changed files with 24 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/api/auth/signin.ts
+4 -7
View File
@@ -3,8 +3,6 @@ import { getUserByEmail, getPasskeysByUserIdAndOrigin } from 'officerdb';
import { sign } from '@@/jwt';
import argon2 from 'argon2';
import * as errors from '@@/custom-errors';
import { isSuperAdminOnlyOrigin } from '@@/_middlewares';
import { isSuperAdmin } from '@@/super-admin';
import { isLockdown, noteBlocked } from './panic';
const TEST_USERS: number[] = [];
@@ -36,11 +34,10 @@ export const signinHandler: Handler = async function (ctx) {
const isValidPassword = TEST_USERS.includes(dbUser.id) || (await argon2.verify(dbUser.password, password));
if (!isValidPassword) throw errors.UNAUTHORIZED();
// A non-owner account may authenticate only through an app origin (e.g. the music app), never the
// Super-Admin-only web/mobile origins — so its credentials can't open the full platform in a browser.
if (isSuperAdminOnlyOrigin(origin) && !(await isSuperAdmin({ id: dbUser.id }))) {
throw errors.FORBIDDEN('This account can only sign in through its app.');
}
// There used to be a check here refusing any non-owner signing in through the web or mobile platform
// origin. It is gone deliberately: onboarding members who use the platform in a browser is the point,
// and what they can reach once inside is decided by their role's capabilities at every request. A rule
// that let a member hold a Gitea grant they could never sign in to use was not defence, just a wall.
const { id, name, username } = dbUser;