mirror of
https://github.com/danny-avila/LibreChat.git
synced 2025-12-17 17:00:15 +01:00
eed43e6662
- Implement RBAC with viewer/editor/owner roles using bitwise permissions
- Add AccessRole, AclEntry, and Group models for permission management
- Create PermissionService for core permission logic and validation
- Integrate Microsoft Graph API for Entra ID user/group search
- Add middleware for resource access validation with custom ID resolvers
- Implement bulk permission updates with transaction support
- Create permission management UI with people picker and role selection
- Add public sharing capabilities for resources
- Include database migration for existing agent ownership
- Support hybrid local/Entra ID identity management
- Add comprehensive test coverage for all new services
chore: Update @librechat/data-schemas to version 0.0.9 and export common module in index.ts
fix: Update userGroup tests to mock logger correctly and change principalId expectation from null to undefined
62 lines
1.6 KiB
JavaScript
62 lines
1.6 KiB
JavaScript
const express = require('express');
|
|
const { PermissionBits } = require('@librechat/data-schemas');
|
|
const {
|
|
getUserEffectivePermissions,
|
|
updateResourcePermissions,
|
|
getResourcePermissions,
|
|
getResourceRoles,
|
|
searchPrincipals,
|
|
} = require('~/server/controllers/PermissionsController');
|
|
const { requireJwtAuth, checkBan, uaParser, canAccessResource } = require('~/server/middleware');
|
|
|
|
const router = express.Router();
|
|
|
|
// Apply common middleware
|
|
router.use(requireJwtAuth);
|
|
router.use(checkBan);
|
|
router.use(uaParser);
|
|
|
|
/**
|
|
* Generic routes for resource permissions
|
|
* Pattern: /api/permissions/{resourceType}/{resourceId}
|
|
*/
|
|
|
|
/**
|
|
* GET /api/permissions/search-principals
|
|
* Search for users and groups to grant permissions
|
|
*/
|
|
router.get('/search-principals', searchPrincipals);
|
|
|
|
/**
|
|
* GET /api/permissions/{resourceType}/roles
|
|
* Get available roles for a resource type
|
|
*/
|
|
router.get('/:resourceType/roles', getResourceRoles);
|
|
|
|
/**
|
|
* GET /api/permissions/{resourceType}/{resourceId}
|
|
* Get all permissions for a specific resource
|
|
*/
|
|
router.get('/:resourceType/:resourceId', getResourcePermissions);
|
|
|
|
/**
|
|
* PUT /api/permissions/{resourceType}/{resourceId}
|
|
* Bulk update permissions for a specific resource
|
|
*/
|
|
router.put(
|
|
'/:resourceType/:resourceId',
|
|
canAccessResource({
|
|
resourceType: 'agent',
|
|
requiredPermission: PermissionBits.SHARE,
|
|
resourceIdParam: 'resourceId',
|
|
}),
|
|
updateResourcePermissions,
|
|
);
|
|
|
|
/**
|
|
* GET /api/permissions/{resourceType}/{resourceId}/effective
|
|
* Get user's effective permissions for a specific resource
|
|
*/
|
|
router.get('/:resourceType/:resourceId/effective', getUserEffectivePermissions);
|
|
|
|
module.exports = router;
|