mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-04-03 14:27:20 +02:00
2451bf54cf
* 🛡️ fix: restrict system grants to role principals only Narrows GrantPrincipalType to PrincipalType.ROLE, rejecting GROUP and USER with 400. Removes grant cascade cleanup from group/user deletion handlers and their route wiring since only roles can hold grants. * 🛡️ fix: address review findings for grants roles-only restriction Add missing GROUP rejection test for revokeGrant (symmetric with getPrincipalGrants and assignGrant coverage), add extensibility comment to GrantPrincipalType, and document the checkRoleExists guard.
40 lines
1.7 KiB
JavaScript
40 lines
1.7 KiB
JavaScript
const express = require('express');
|
|
const { createAdminGroupsHandlers } = require('@librechat/api');
|
|
const { SystemCapabilities } = require('@librechat/data-schemas');
|
|
const { requireCapability } = require('~/server/middleware/roles/capabilities');
|
|
const { requireJwtAuth } = require('~/server/middleware');
|
|
const db = require('~/models');
|
|
|
|
const router = express.Router();
|
|
|
|
const requireAdminAccess = requireCapability(SystemCapabilities.ACCESS_ADMIN);
|
|
const requireReadGroups = requireCapability(SystemCapabilities.READ_GROUPS);
|
|
const requireManageGroups = requireCapability(SystemCapabilities.MANAGE_GROUPS);
|
|
|
|
const handlers = createAdminGroupsHandlers({
|
|
listGroups: db.listGroups,
|
|
countGroups: db.countGroups,
|
|
findGroupById: db.findGroupById,
|
|
createGroup: db.createGroup,
|
|
updateGroupById: db.updateGroupById,
|
|
deleteGroup: db.deleteGroup,
|
|
addUserToGroup: db.addUserToGroup,
|
|
removeUserFromGroup: db.removeUserFromGroup,
|
|
removeMemberById: db.removeMemberById,
|
|
findUsers: db.findUsers,
|
|
deleteConfig: db.deleteConfig,
|
|
deleteAclEntries: db.deleteAclEntries,
|
|
});
|
|
|
|
router.use(requireJwtAuth, requireAdminAccess);
|
|
|
|
router.get('/', requireReadGroups, handlers.listGroups);
|
|
router.post('/', requireManageGroups, handlers.createGroup);
|
|
router.get('/:id', requireReadGroups, handlers.getGroup);
|
|
router.patch('/:id', requireManageGroups, handlers.updateGroup);
|
|
router.delete('/:id', requireManageGroups, handlers.deleteGroup);
|
|
router.get('/:id/members', requireReadGroups, handlers.getGroupMembers);
|
|
router.post('/:id/members', requireManageGroups, handlers.addGroupMember);
|
|
router.delete('/:id/members/:userId', requireManageGroups, handlers.removeGroupMember);
|
|
|
|
module.exports = router;
|