From 2c6e29fa0d32a7649acf8fbaae09e2015ff8cbae Mon Sep 17 00:00:00 2001 From: Lemon-miaow Date: Sun, 27 Sep 2026 15:57:31 +0800 Subject: [PATCH] =?UTF-8?q?fix(panel):=20=E6=94=B6=E5=88=B0=E8=A7=92?= =?UTF-8?q?=E8=89=B2=E6=8B=92=E7=BB=9D=E7=9A=84=20403=20=E6=97=B6=E9=99=90?= =?UTF-8?q?=E9=A2=91=E9=87=8D=E8=AF=BB=E8=BA=AB=E4=BB=BD=EF=BC=8C=E8=A2=AB?= =?UTF-8?q?=E9=99=8D=E6=9D=83=E7=9A=84=E7=AE=A1=E7=90=86=E5=91=98=E9=9A=8F?= =?UTF-8?q?=E5=8D=B3=E5=A4=B1=E5=8E=BB=E7=AE=A1=E7=90=86=E9=A1=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- panel/src/lib/api.test.ts | 17 +++++++++++++- panel/src/lib/api.ts | 13 ++++++++++ panel/src/lib/tier.test.tsx | 47 +++++++++++++++++++++++++++++++++++-- panel/src/lib/tier.tsx | 19 +++++++++++---- 4 files changed, 89 insertions(+), 7 deletions(-) diff --git a/panel/src/lib/api.test.ts b/panel/src/lib/api.test.ts index a1bbd05..f3b8745 100644 --- a/panel/src/lib/api.test.ts +++ b/panel/src/lib/api.test.ts @@ -12,7 +12,7 @@ vi.mock("./config", () => ({ })); // Imported after the mock so api.ts picks up the mocked loadConfig. -const { api, SETUP_REQUIRED_EVENT, SESSION_EXPIRED_EVENT, CONNECTION_EVENT, humanizeError, isConnectionLost, clientError } = +const { api, SETUP_REQUIRED_EVENT, SESSION_EXPIRED_EVENT, ACCESS_REFUSED_EVENT, CONNECTION_EVENT, humanizeError, isConnectionLost, clientError } = await import("./api"); function fakeFetch(body: unknown, init?: { ok?: boolean; status?: number }) { @@ -1099,6 +1099,21 @@ describe("session and connection signals", () => { expect(seen).toHaveLength(0); }); + it("announces a role refusal, and no other 403", async () => { + const seen = listen(ACCESS_REFUSED_EVENT); + const refuse = async (status: number, code: string) => { + vi.stubGlobal("fetch", fakeFetch({ error: { code, message: "x" } }, { ok: false, status })); + await expect(api.myServers()).rejects.toMatchObject({ status, code }); + }; + for (const code of ["reauth_required", "setup_required", "quota_exceeded", "local_auth_disabled"]) await refuse(403, code); + await refuse(409, "forbidden"); + expect(seen).toHaveLength(0); + + await refuse(403, "forbidden"); + await refuse(403, "not_admin"); + expect(seen).toHaveLength(2); + }); + it("reports a fetch that got no response, and the next one that did", async () => { const seen = listen(CONNECTION_EVENT); vi.stubGlobal( diff --git a/panel/src/lib/api.ts b/panel/src/lib/api.ts index d63b2c1..5dec024 100644 --- a/panel/src/lib/api.ts +++ b/panel/src/lib/api.ts @@ -79,6 +79,18 @@ function announceSessionExpired(err: ApiError, path: string): void { window.dispatchEvent(new Event(SESSION_EXPIRED_EVENT)); } +// A 403 forbidden or not_admin is the role gate refusing the call. The account +// may have been demoted since /me was read, which leaves admin pages and buttons +// up that every call now refuses. TierProvider hears this and re-reads /me, which +// takes them down; a refusal the current role explains changes nothing there. +export const ACCESS_REFUSED_EVENT = "felis:access-refused"; +const ROLE_REFUSALS = new Set(["forbidden", "not_admin"]); + +function announceAccessRefused(err: ApiError): void { + if (err.status !== 403 || !ROLE_REFUSALS.has(err.code) || typeof window === "undefined") return; + window.dispatchEvent(new Event(ACCESS_REFUSED_EVENT)); +} + // CONNECTION_EVENT reports when requests stop reaching the API (detail.ok = // false) and when one gets through again (true). A fetch that rejects never // saw a response: the network is down, or Cloudflare Access redirected the @@ -178,6 +190,7 @@ function failed(path: string, status: number, statusText: string, text: string): }; announceSetupRequired(err); announceSessionExpired(err, path); + announceAccessRefused(err); return err; } diff --git a/panel/src/lib/tier.test.tsx b/panel/src/lib/tier.test.tsx index 9e1262f..2e8b5e4 100644 --- a/panel/src/lib/tier.test.tsx +++ b/panel/src/lib/tier.test.tsx @@ -1,7 +1,8 @@ // @vitest-environment jsdom -import { describe, it, expect, vi, beforeEach } from "vitest"; +import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"; import { act, render, screen } from "@testing-library/react"; -import { TierProvider, useTier } from "./tier"; +import { ACCESS_RECHECK_MS, TierProvider, useTier } from "./tier"; +import { ACCESS_REFUSED_EVENT } from "./api"; import type { Identity } from "./types"; const calls = vi.hoisted(() => ({ me: vi.fn() })); @@ -31,6 +32,9 @@ async function boot() { beforeEach(() => { calls.me.mockReset(); }); +afterEach(() => { + vi.useRealTimers(); +}); describe("TierProvider after a /me that failed with anything but a 401", () => { it("exposes the failure, and a revalidate that succeeds clears it without a reload", async () => { @@ -67,3 +71,42 @@ describe("TierProvider after a /me that failed with anything but a 401", () => { expect(tier.unauthenticated).toBe(false); }); }); + +// An admin demoted while the page is open keeps the admin pages up until /me is +// read again; the first refused call does that, at most once per interval. +describe("TierProvider after a role refusal", () => { + const demoted: Identity = { ...admin, role: "user", is_admin: false }; + const refuse = () => + act(async () => { + window.dispatchEvent(new Event(ACCESS_REFUSED_EVENT)); + }); + + it("re-reads /me and takes the admin view down once the account was demoted", async () => { + vi.useFakeTimers({ shouldAdvanceTime: true }); + calls.me.mockResolvedValue(admin); + await boot(); + expect(screen.getByText("admin")).toBeTruthy(); + + calls.me.mockResolvedValue(demoted); + await act(() => vi.advanceTimersByTimeAsync(ACCESS_RECHECK_MS)); + await refuse(); + expect(await screen.findByText("not admin")).toBeTruthy(); + expect(calls.me).toHaveBeenCalledTimes(2); + }); + + it("re-reads at most once per interval", async () => { + vi.useFakeTimers({ shouldAdvanceTime: true }); + calls.me.mockResolvedValue(admin); + await boot(); + + await act(() => vi.advanceTimersByTimeAsync(ACCESS_RECHECK_MS / 2)); + await refuse(); + expect(calls.me).toHaveBeenCalledTimes(1); + + await act(() => vi.advanceTimersByTimeAsync(ACCESS_RECHECK_MS / 2)); + await refuse(); + await refuse(); + expect(calls.me).toHaveBeenCalledTimes(2); + expect(screen.getByText("admin")).toBeTruthy(); + }); +}); diff --git a/panel/src/lib/tier.tsx b/panel/src/lib/tier.tsx index 6755a04..d45220e 100644 --- a/panel/src/lib/tier.tsx +++ b/panel/src/lib/tier.tsx @@ -8,7 +8,7 @@ import { type ReactNode, } from "react"; import type { Identity } from "./types"; -import { api, SESSION_EXPIRED_EVENT } from "./api"; +import { ACCESS_REFUSED_EVENT, api, SESSION_EXPIRED_EVENT } from "./api"; import { deriveAuth, isUnauthorized, type AuthState } from "./auth"; // TierProvider fetches GET /me at boot and re-fetches on demand (refresh), exposing @@ -32,10 +32,12 @@ import { deriveAuth, isUnauthorized, type AuthState } from "./auth"; // re-reads /me after a login / logout so the gate re-evaluates without a reload. // // 4. Session-aware while open: a 401 from any protected call (api.ts announces -// SESSION_EXPIRED_EVENT), the tab coming back into view, or the window +// SESSION_EXPIRED_EVENT), a role refusal (ACCESS_REFUSED_EVENT, at most once +// per ACCESS_RECHECK_MS), the tab coming back into view, or the window // regaining focus re-reads /me through `revalidate()`. It leaves `loading` -// alone, so the app stays mounted during the check; only a 401 changes what -// is shown, and `sessionEnded` tells the login page why the person landed there. +// alone, so the app stays mounted during the check; a 401 signs the person +// out, a changed role redraws the gates (a demoted admin loses the admin +// pages), and `sessionEnded` tells the login page why the person landed there. // // Rules 1–2 are UX truth, not a security control — see DESIGN-WEB-3SIDES §1. @@ -56,6 +58,9 @@ export interface TierState extends AuthState { // A tab returning to view re-checks /me at most this often; a 401 from a real // call re-checks at once. const REVALIDATE_EVERY_MS = 60_000; +// A role refusal from a real call re-checks at most this often, so a page that +// keeps polling a refused route does not re-read /me on every tick. +export const ACCESS_RECHECK_MS = 10_000; const TierContext = createContext({ identity: null, @@ -153,11 +158,17 @@ export function TierProvider({ children }: { children: ReactNode }) { if (Date.now() - lastCheck.current < REVALIDATE_EVERY_MS) return; void revalidate(); }; + const onRefused = () => { + if (Date.now() - lastCheck.current < ACCESS_RECHECK_MS) return; + void revalidate(); + }; window.addEventListener(SESSION_EXPIRED_EVENT, onExpired); + window.addEventListener(ACCESS_REFUSED_EVENT, onRefused); window.addEventListener("focus", onReturn); document.addEventListener("visibilitychange", onReturn); return () => { window.removeEventListener(SESSION_EXPIRED_EVENT, onExpired); + window.removeEventListener(ACCESS_REFUSED_EVENT, onRefused); window.removeEventListener("focus", onReturn); document.removeEventListener("visibilitychange", onReturn); };