Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

server: restore weak workspace web access

Browse Source
This commit is contained in:
Hare
2026-08-02 03:24:54 +09:00
parent e530150e43
commit e5f3c20f64
5 changed files with 34 additions and 368 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workspace-server/src/server.rs
+17 -75
View File
@@ -3786,27 +3786,9 @@ async fn scoped_list_runtimes(
async fn scoped_workspace_protocol_ws(
State(api): State<WorkspaceApi>,
AxumPath(workspace_id): AxumPath<String>,
headers: HeaderMap,
ws: axum::extract::ws::WebSocketUpgrade,
) -> std::result::Result<Response, Response> {
validate_workspace_scope(&api, &workspace_id).map_err(|error| error.into_response())?;
let actor = resolve_actor(&api, &headers)
.await
.map_err(|error| error.into_response())?
.ok_or_else(|| StatusCode::UNAUTHORIZED.into_response())?;
let workspace = api
.store
.get_workspace(&workspace_id)
.await
.map_err(|error| ApiError::from(error).into_response())?
.ok_or_else(|| StatusCode::NOT_FOUND.into_response())?;
if workspace
.owner_account_id
.as_deref()
.is_some_and(|owner| owner != actor.account_id.as_str())
{
return Err(StatusCode::FORBIDDEN.into_response());
}
Ok(ws
.on_upgrade(move |socket| {
crate::workspace_subscription::serve_workspace_subscription(api, socket)
@@ -5150,9 +5132,8 @@ async fn post_passkey_registration_complete(
)
})?;
let credential_id = passkey_credential_id(&passkey)?;
let registered_at = crate::auth::now_rfc3339();
api.store.upsert_passkey_and_claim_legacy_workspace_owner(
&PasskeyCredentialRecord {
api.store
.upsert_passkey_credential(&PasskeyCredentialRecord {
credential_id,
user_id: user.user_id.clone(),
public_key_cose: serde_json::to_string(&passkey).map_err(|error| {
@@ -5160,13 +5141,9 @@ async fn post_passkey_registration_complete(
})?,
transports_json: None,
sign_count: 0,
created_at: registered_at.clone(),
created_at: crate::auth::now_rfc3339(),
last_used_at: None,
},
api.workspace_id(),
&user.account_id,
&registered_at,
)?;
})?;
issue_browser_session_response(&api, user)
}
@@ -8881,7 +8858,6 @@ mod tests {
use std::{fs, sync::Arc};
use tokio_tungstenite::connect_async;
use tokio_tungstenite::tungstenite::Message;
use tokio_tungstenite::tungstenite::client::IntoClientRequest;
use tower::ServiceExt;
use worker_runtime::resource::BackendResourceClient;
use worker_runtime::working_directory::WorkingDirectoryMaterializer;
@@ -8891,9 +8867,8 @@ mod tests {
WorkerSpawnIntent,
};
use crate::store::{
AccountRecord, MemoryDocumentRecord, MemoryStagingRecord, ObjectiveRecord,
ObjectiveResourceRecord, ObjectiveTicketLinkRecord, SqliteWorkspaceStore, UserRecord,
WorkspaceRecord,
MemoryDocumentRecord, MemoryStagingRecord, ObjectiveRecord, ObjectiveResourceRecord,
ObjectiveTicketLinkRecord, SqliteWorkspaceStore, WorkspaceRecord,
};
const TEST_WORKSPACE_ID: &str = "0192f0e8-4d84-7d6e-a000-000000000001";
@@ -12791,7 +12766,7 @@ mod tests {
}
#[tokio::test]
async fn workspace_subscription_requires_browser_session() {
async fn workspace_subscription_uses_legacy_scoped_access_without_browser_session() {
let dir = tempfile::tempdir().unwrap();
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
let address = listener.local_addr().unwrap();
@@ -12799,51 +12774,20 @@ mod tests {
let server = tokio::spawn(async move {
let _ = axum::serve(listener, app).await;
});
let error = tokio_tungstenite::connect_async(format!(
let (mut socket, response) = tokio_tungstenite::connect_async(format!(
"ws://{address}/api/w/{TEST_WORKSPACE_ID}/protocol/ws"
))
.await
.unwrap_err();
let tokio_tungstenite::tungstenite::Error::Http(response) = error else {
panic!("expected HTTP authentication rejection");
};
assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
.unwrap();
assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
socket.close(None).await.unwrap();
server.abort();
}
#[tokio::test]
async fn workspace_subscription_returns_authenticated_workspace_snapshot() {
async fn workspace_subscription_returns_workspace_snapshot() {
let dir = tempfile::tempdir().unwrap();
let api = test_api(dir.path()).await;
let account = AccountRecord {
account_id: "account-test".to_string(),
kind: "user".to_string(),
handle: "tester".to_string(),
display_name: "Tester".to_string(),
created_at: TEST_CREATED_AT.to_string(),
updated_at: TEST_CREATED_AT.to_string(),
};
let user = UserRecord {
user_id: "user-test".to_string(),
account_id: account.account_id.clone(),
handle: account.handle.clone(),
display_name: account.display_name.clone(),
created_at: TEST_CREATED_AT.to_string(),
updated_at: TEST_CREATED_AT.to_string(),
};
api.store.upsert_account(&account).unwrap();
api.store.upsert_user(&user).unwrap();
let session = issue_browser_session_response(&api, user).unwrap();
let cookie = session
.headers()
.get(SET_COOKIE)
.unwrap()
.to_str()
.unwrap()
.split(';')
.next()
.unwrap()
.to_string();
let spawn_request = WorkerSpawnRequest {
intent: WorkerSpawnIntent::WorkspaceCompanion,
@@ -12874,13 +12818,11 @@ mod tests {
let server = tokio::spawn(async move {
let _ = axum::serve(listener, app).await;
});
let mut request = format!("ws://{address}/api/w/{TEST_WORKSPACE_ID}/protocol/ws")
.into_client_request()
.unwrap();
request
.headers_mut()
.insert(axum::http::header::COOKIE, cookie.parse().unwrap());
let (mut socket, _) = connect_async(request).await.unwrap();
let (mut socket, _) = connect_async(format!(
"ws://{address}/api/w/{TEST_WORKSPACE_ID}/protocol/ws"
))
.await
.unwrap();
let frame = protocol::subscription::SubscriptionFrame::new(
protocol::subscription::SubscriptionFramePayload::Request(
protocol::subscription::SubscriptionRequest::SubscribeEvents {