mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-31 21:59:10 +08:00
DarkSky
bd095495da
fix #15523 fix #15526 #### PR Dependency Tree * **PR #15528** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved search generation cleanup, provider error reporting, and reconciliation reliability. - Retired search resources are cleaned up safely, including after credential changes. - Prompt size checks now ignore tool parameters and provide clearer errors. - Reserved documents are protected from accidental cleanup, and malformed identifiers are rejected. - **Configuration** - Managed Copilot profiles require explicit, non-duplicated model assignments. - Improved managed provider profile migration. - **Performance & Reliability** - Reduced unnecessary search-history cleanup and adjusted consistency-check intervals. - Failed reconciliation jobs stop after one attempt and are removed automatically. - **Data Updates** - Updated legacy AI session prompt names to current labels. - Improved cloud load-balancer health-check configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
60 lines
1.9 KiB
Rust
60 lines
1.9 KiB
Rust
use crate::reserved_doc;
|
|
|
|
pub(crate) fn authorize(user_id: &str, workspace_id: &str, doc_id: &str) -> bool {
|
|
reserved_doc::authorize(user_id, workspace_id, doc_id)
|
|
}
|
|
|
|
pub(crate) fn doc_id(user_id: &str, workspace_id: &str, table: &str) -> Option<String> {
|
|
reserved_doc::is_userdata_table(table).then(|| format!("userdata${user_id}${workspace_id}${table}"))
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use crate::reserved_doc::ReservedDoc;
|
|
|
|
#[test]
|
|
fn userdata_subject_is_owner_only_and_closed() {
|
|
for table in ["favorite", "settings", "docIntegrationRef"] {
|
|
let id = doc_id("user-a", "workspace-a", table).unwrap();
|
|
assert!(authorize("user-a", "workspace-a", &id));
|
|
assert!(!authorize("user-b", "workspace-a", &id));
|
|
assert!(!authorize("user-a", "workspace-b", &id));
|
|
}
|
|
for id in [
|
|
"userdata$user-a$workspace-a$unknown",
|
|
"userdata$user-a$favorite",
|
|
"userdata$__local__$workspace-a$favorite",
|
|
"userdata$$workspace-a$favorite",
|
|
"userdata$user-a$workspace-a$favorite$extra",
|
|
] {
|
|
assert!(!authorize("user-a", "workspace-a", id));
|
|
}
|
|
assert!(authorize("user-a", "workspace-a", "ordinary-doc"));
|
|
|
|
for table in [
|
|
"folders",
|
|
"docProperties",
|
|
"docCustomPropertyInfo",
|
|
"pinnedCollections",
|
|
"explorerIcon",
|
|
] {
|
|
assert!(matches!(
|
|
reserved_doc::classify("workspace-a", &format!("db$workspace-a${table}")),
|
|
Some(ReservedDoc::WorkspaceDatabase)
|
|
));
|
|
assert!(authorize("user-a", "workspace-a", &format!("db$workspace-a${table}")));
|
|
}
|
|
for id in [
|
|
"db$docProperties",
|
|
"db$workspace-b$docProperties",
|
|
"db$workspace-a$unknown",
|
|
"userdata$__local__$workspace-a$favorite",
|
|
"userdata$user-a$workspace-b$favorite",
|
|
] {
|
|
assert!(reserved_doc::classify("workspace-a", id).is_none());
|
|
assert!(!authorize("user-a", "workspace-a", id));
|
|
}
|
|
}
|
|
}
|