lix/mnote
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

同步 MNote 授权目录到 OpenHub

Browse Source
This commit is contained in:
Agent Board
2026-06-26 21:02:51 +08:00
parent e433c07061
commit 3b0e12455e
3 changed files with 139 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/crates/mnote-web/src/provider_identity_sync.rs
+93 -4
View File
@@ -1,5 +1,5 @@
use crate::error::WebError;
use control_plane::UserRecord;
use control_plane::{ControlPlaneStore, DirectoryGrantRecord, UserRecord};
use reqwest::header::{HeaderMap, HeaderValue};
use serde_json::{json, Value};
use std::collections::hash_map::DefaultHasher;
@@ -96,6 +96,7 @@ fn sync_disabled() -> bool {
pub async fn sync_provider_identities(
user: &UserRecord,
password: &str,
directory_grants: &[DirectoryGrantRecord],
) -> Vec<ProviderIdentitySyncResult> {
if sync_disabled() {
return vec![ProviderIdentitySyncResult {
@@ -112,12 +113,12 @@ pub async fn sync_provider_identities(
match (sync_openhub, sync_weknora) {
(true, true) => {
let (openhub, weknora) = tokio::join!(
sync_openhub_identity(user, password),
sync_openhub_identity(user, password, directory_grants),
sync_weknora_identity(user, password)
);
vec![openhub, weknora]
}
(true, false) => vec![sync_openhub_identity(user, password).await],
(true, false) => vec![sync_openhub_identity(user, password, directory_grants).await],
(false, true) => vec![sync_weknora_identity(user, password).await],
(false, false) => vec![ProviderIdentitySyncResult {
provider: "all",
@@ -128,6 +129,59 @@ pub async fn sync_provider_identities(
}
}
pub async fn sync_openhub_directory_permissions_for_user_id(
control_plane: &dyn ControlPlaneStore,
user_id: &str,
) -> ProviderIdentitySyncResult {
if sync_disabled() || !env_flag("MNOTE_PROVIDER_IDENTITY_SYNC_OPENHUB", true) {
return ProviderIdentitySyncResult {
provider: "openhub",
ok: true,
message: "provider identity sync disabled".to_string(),
provider_user_id: None,
};
}
let user_id = user_id.trim();
let provider_user_id = stable_openhub_user_id(user_id);
let directory_grants = match control_plane.list_directory_grants_for_actor(user_id) {
Ok(grants) => grants,
Err(error) => {
return ProviderIdentitySyncResult {
provider: "openhub",
ok: false,
message: format!("mnote directory grants read failed: {error}"),
provider_user_id: Some(provider_user_id.to_string()),
};
}
};
let payload = json!({
"mnote_user_id": user_id,
"allowedRoots": openhub_allowed_roots_payload(&directory_grants),
});
match post_json(
join_url(
&openhub_base_url(),
&format!("/api/internal/mnote/users/{provider_user_id}/directory-permissions/sync"),
),
payload,
)
.await
{
Ok(_) => ProviderIdentitySyncResult {
provider: "openhub",
ok: true,
message: "directory permissions synced".to_string(),
provider_user_id: Some(provider_user_id.to_string()),
},
Err(error) => ProviderIdentitySyncResult {
provider: "openhub",
ok: false,
message: error.message().to_string(),
provider_user_id: Some(provider_user_id.to_string()),
},
}
}
async fn post_json(url: String, body: Value) -> Result<Value, WebError> {
let client = reqwest::Client::builder()
.timeout(Duration::from_millis(PROVIDER_IDENTITY_SYNC_TIMEOUT_MS))
@@ -156,7 +210,11 @@ async fn post_json(url: String, body: Value) -> Result<Value, WebError> {
Ok(payload)
}
async fn sync_openhub_identity(user: &UserRecord, password: &str) -> ProviderIdentitySyncResult {
async fn sync_openhub_identity(
user: &UserRecord,
password: &str,
directory_grants: &[DirectoryGrantRecord],
) -> ProviderIdentitySyncResult {
let provider_user_id = stable_openhub_user_id(&user.id);
let payload = json!({
"provider_user_id": provider_user_id,
@@ -165,6 +223,7 @@ async fn sync_openhub_identity(user: &UserRecord, password: &str) -> ProviderIde
"email": fallback_email(user),
"password": password,
"workspace_path": default_workspace_path(user),
"allowedRoots": openhub_allowed_roots_payload(directory_grants),
"disabled": user.status != "active",
"is_admin": false,
});
@@ -189,6 +248,36 @@ async fn sync_openhub_identity(user: &UserRecord, password: &str) -> ProviderIde
}
}
fn openhub_allowed_roots_payload(directory_grants: &[DirectoryGrantRecord]) -> Vec<Value> {
directory_grants
.iter()
.filter(|grant| !is_default_workspace_auto_grant(grant))
.filter(|grant| grant.status.trim() == "active")
.filter(|grant| !grant.root_path.trim().is_empty())
.map(|grant| {
json!({
"grantId": grant.id,
"rootUri": grant.root_uri,
"rootPath": grant.root_path,
"permission": grant.permission,
"recursive": grant.recursive,
"capabilities": serde_json::from_str::<Vec<String>>(&grant.capabilities_json).unwrap_or_default(),
"source": grant.source,
})
})
.collect()
}
fn is_default_workspace_auto_grant(grant: &DirectoryGrantRecord) -> bool {
grant.source.trim() == "auto"
&& grant.permission.trim() == "write"
&& grant.recursive
&& grant.created_by.as_deref().map(str::trim) == Some(grant.user_id.as_str())
&& grant.workspace_id.is_some()
&& grant.root_uri.starts_with("local://users/")
&& grant.root_uri.ends_with("/workspaces/my-space")
}
async fn sync_weknora_identity(user: &UserRecord, password: &str) -> ProviderIdentitySyncResult {
let payload = json!({
"mnote_user_id": user.id,
rust/crates/mnote-web/src/routes/gateway.rs
+10 -1
View File
@@ -2203,7 +2203,16 @@ async fn handle_sqlite_auth_action(
});
let provider_sync_results = if flow == "signUp" {
let results = sync_provider_identities(&resolved.user, &password_for_provider_sync).await;
let directory_grants = state
.control_plane()
.list_directory_grants_for_actor(&resolved.user.id)
.unwrap_or_default();
let results = sync_provider_identities(
&resolved.user,
&password_for_provider_sync,
&directory_grants,
)
.await;
let _ = state.control_plane().append_audit(AppendAuditInput {
actor_user_id: Some(resolved.user.id.clone()),
action: "control.auth.provider_identities_synced".to_string(),
rust/crates/mnote-web/src/routes/local_folder_source.rs
+36
View File
@@ -5,6 +5,7 @@ use crate::page_aggregate::{
PageAggregate, PageAggregateSource, PageBody, PageHead, PageIdentity, PageLayout, PageOptions,
PagePermissions, PageStats, PageTree,
};
use crate::provider_identity_sync::sync_openhub_directory_permissions_for_user_id;
use crate::routes::local_markdown_parser::{
file_stem_title, parse_markdown_attachment_refs, parse_markdown_page, split_frontmatter,
};
@@ -2124,6 +2125,7 @@ fn delete_sqlite_local_access_grant_for_context(
"默认空间的系统授权不能撤销",
));
}
let revoked_user_id = grants.first().map(|grant| grant.user_id.clone());
state
.control_plane()
.revoke_directory_grant(grant_id, None)
@@ -2154,6 +2156,7 @@ fn delete_sqlite_local_access_grant_for_context(
"controlPlane": "sqlite",
"policyPath": local_access_policy_path().display().to_string(),
"deletedGrantId": grant_id,
"revokedUserId": revoked_user_id,
"policy": {
"grants": state
.control_plane()
@@ -2371,6 +2374,14 @@ pub async fn create_local_access_grant(
) -> Result<(StatusCode, Json<Value>), WebError> {
let payload = add_sqlite_local_access_grant_for_context(&state, &context, request)
.map_err(|error| error.with_context(&context))?;
if let Some(user_id) = payload
.pointer("/grant/userId")
.and_then(Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
{
sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
}
Ok((StatusCode::OK, Json(payload)))
}
@@ -2381,6 +2392,14 @@ pub async fn create_user_access_grant(
) -> Result<(StatusCode, Json<Value>), WebError> {
let payload = add_sqlite_user_access_grant_for_context(&state, &context, request)
.map_err(|error| error.with_context(&context))?;
if let Some(user_id) = payload
.pointer("/grant/userId")
.and_then(Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
{
sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
}
Ok((StatusCode::OK, Json(payload)))
}
@@ -2391,6 +2410,14 @@ pub async fn delete_local_access_grant(
) -> Result<(StatusCode, Json<Value>), WebError> {
let payload = delete_sqlite_local_access_grant_for_context(&state, &context, &grant_id)
.map_err(|error| error.with_context(&context))?;
if let Some(user_id) = payload
.get("revokedUserId")
.and_then(Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
{
sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
}
Ok((StatusCode::OK, Json(payload)))
}
@@ -2401,6 +2428,14 @@ pub async fn delete_user_access_grant(
) -> Result<(StatusCode, Json<Value>), WebError> {
let payload = delete_sqlite_user_access_grant_for_context(&state, &context, &grant_id)
.map_err(|error| error.with_context(&context))?;
if let Some(user_id) = payload
.get("revokedUserId")
.and_then(Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
{
sync_openhub_directory_permissions_for_user_id(state.control_plane(), user_id).await;
}
Ok((StatusCode::OK, Json(payload)))
}
@@ -11244,6 +11279,7 @@ fn main() {}
.await
.expect("owner can revoke self-created grant");
assert_eq!(deleted["deletedGrantId"], grant_id);
assert_eq!(deleted["revokedUserId"], "user_target");
let revoked_error = ensure_local_workspace_write_access_with_state(
&state,
&request_context("user_target", "user"),