rootandClaude Opus 5.5
17cf3cbf97
S-1 (/files/move, /files/organize action=move): - organize-guard: authorizeMoveEntities checks every source's media entities (declared entity plus entities of registered assets under the source); one-time approval still covers the whole request; any source that cannot be attributed to an entity only passes with an approval; denial lists every unauthorized item; optional non-consuming pre-check - transfer: entities per source (directory = registered assets beneath it) - organize: all move groups pre-checked before any group executes; any denial -> whole request 403 approval_required S-2: - api.ts: GET /files/download and POST /files/trash/purge marked auth:"session"; files routes attach requireAdminSession from the registry annotation; handler-side purge check removed, download keeps a same-rule defense check; permanent delete uses isAdminSession - DEV key rule written down: equals an admin-scope key for session-only endpoints, still admin for Move/delete approval bypass (as authorizeMove) - api-registry.test: session list updated; new reverse assertion that no non-session endpoint answers 403 to an admin-scope bearer S-5 (trash restore): - restore-to requires a writable managed library root (isWritableTarget) - in-place restore rebuilds missing parents level by level without following symlinks (mkdirWithin), realpath-checked per level - cross-volume restore capped by FILES_TRASH_CROSS_MAX_BYTES; cross-volume copies (trash in / restore out) go through fsproxy Tests: multi-entity move 403 + listing, unattributed source, organize foreign asset 403, download/purge 403 for DEV and admin-scope keys, restore target not writable, symlinked parent, rebuild parents, cross-volume cap. Co-Authored-By: Claude Opus 5.5 <[email protected]>
@umt/contracts
所有 API、SSE 事件与能力(capability)输入输出的唯一定义(zod 4 schema + 推导出的 TS 类型)。web 与 server 共用,任何一端都不得手写重复 DTO;新增接口先在这里加 schema,再由 server 用 @hono/zod-openapi 生成 OpenAPI。
| 文件 | 内容 |
|---|---|
common.ts |
Id、Timestamp、DateOnly、JsonObject、游标分页、错误码、响应信封、ApiScope、ActorType |
content.ts / identity.ts / assets.ts / sources.ts / policy.ts / execution.ts / agent.ts / ops.ts / organization.ts / instances.ts |
每张表的 Row schema(camelCase、日期为 ISO 字符串)+ XxxCreate / XxxUpdate 输入 |
organization.ts |
另含公开整理记录合同:PublicOrganizationRecord、OrganizationChangesQuery/Response(change_seq 游标)、OrganizeRequest |
settings.ts |
GlobalSettings、DEFAULT_SETTINGS、GlobalSettingsUpdate、mergeSettings() |
capability.ts / capabilities-io.ts |
CapabilityDescriptor、首批 14 个能力 ID 与目录、各能力 Input/Output schema、CAPABILITY_IO |
events.ts |
SSE 信封、EventType、EVENT_PAYLOADS、TypedEvent 判别联合 |
api.ts |
Api 端点表(method/path/scope/params/query/body/response)、buildPath()、listEndpoints() |
约定:
- Row schema 与
packages/db/src/types.ts的列一一对应(test/db-sync.test.ts校验);只在 DB 存在的列(密文、key_hash、change_xid)不对外。 - 凭证类输入(
credential、url、plaintext、apiKey)只写不回显。 - schema 不用
.default()做可部分更新对象的缺省(zod 4 在 partial 里仍会填默认值);缺省值放常量。