fix auth registration and access management ui

rust/crates/mnote-web/src/routes/local_folder_source.rs

@@ -850,16 +850,40 @@ fn share_grant_payload(grant: &LocalShareGrant) -> Value {
     })
 }
 
-fn list_local_share_grants_for_context(context: &RequestContext) -> Result<Value, WebError> {
-    require_share_grants_admin(context)?;
+fn list_local_share_grants_for_context(
+    context: &RequestContext,
+    admin_required: bool,
+) -> Result<Value, WebError> {
+    let is_admin = is_local_access_policy_admin_context(context);
+    if admin_required {
+        require_share_grants_admin(context)?;
+    } else {
+        let actor_id = context.auth.actor_id.trim();
+        if actor_id.is_empty() || actor_id == "anonymous" {
+            return Err(WebError::new(
+                StatusCode::UNAUTHORIZED,
+                "local_share_grants_auth_required",
+                "查看分享授权需要先登录",
+            ));
+        }
+    }
     let store = load_local_share_grants_store()?;
     let grants = store
         .grants
         .iter()
+        .filter(|grant| {
+            if is_admin {
+                true
+            } else {
+                let actor_id = context.auth.actor_id.trim();
+                grant.owner_user_id.trim() == actor_id || grant.target_user_id.trim() == actor_id
+            }
+        })
         .map(share_grant_payload)
         .collect::<Vec<_>>();
     Ok(json!({
         "ok": true,
+        "admin": is_admin,
         "grantsPath": local_share_grants_path().display().to_string(),
         "grants": grants,
         "store": {
@@ -873,6 +897,30 @@ fn add_local_share_grant_for_context(
     request: LocalShareGrantRequest,
 ) -> Result<Value, WebError> {
     require_share_grants_admin(context)?;
+    add_local_share_grant_for_context_inner(context, request, true)
+}
+
+fn add_user_share_grant_for_context(
+    context: &RequestContext,
+    mut request: LocalShareGrantRequest,
+) -> Result<Value, WebError> {
+    let actor_id = context.auth.actor_id.trim();
+    if actor_id.is_empty() || actor_id == "anonymous" {
+        return Err(WebError::new(
+            StatusCode::UNAUTHORIZED,
+            "local_share_grants_auth_required",
+            "创建分享授权需要先登录",
+        ));
+    }
+    request.owner_user_id = actor_id.to_string();
+    add_local_share_grant_for_context_inner(context, request, false)
+}
+
+fn add_local_share_grant_for_context_inner(
+    context: &RequestContext,
+    request: LocalShareGrantRequest,
+    admin_mode: bool,
+) -> Result<Value, WebError> {
     let mut store = load_local_share_grants_store()?;
     let share_id = request.share_id.trim();
     let owner_user_id = request.owner_user_id.trim();
@@ -896,6 +944,9 @@ fn add_local_share_grant_for_context(
         ));
     }
     let canonical = canonical_root_from_admin_request(&request.root_uri, &request.root_path)?;
+    if !admin_mode {
+        ensure_local_workspace_read_access(context, &file_uri_for_path(&canonical))?;
+    }
     let permission = normalize_share_grant_permission(&request.permission)?;
     let capabilities = normalize_share_grant_capabilities(&request.capabilities)?;
     let root_uri = file_uri_for_path(&canonical);
@@ -951,6 +1002,29 @@ fn revoke_local_share_grant_for_context(
     share_id: &str,
 ) -> Result<Value, WebError> {
     require_share_grants_admin(context)?;
+    revoke_local_share_grant_for_context_inner(context, share_id, true)
+}
+
+fn revoke_user_share_grant_for_context(
+    context: &RequestContext,
+    share_id: &str,
+) -> Result<Value, WebError> {
+    let actor_id = context.auth.actor_id.trim();
+    if actor_id.is_empty() || actor_id == "anonymous" {
+        return Err(WebError::new(
+            StatusCode::UNAUTHORIZED,
+            "local_share_grants_auth_required",
+            "撤销分享授权需要先登录",
+        ));
+    }
+    revoke_local_share_grant_for_context_inner(context, share_id, false)
+}
+
+fn revoke_local_share_grant_for_context_inner(
+    context: &RequestContext,
+    share_id: &str,
+    admin_mode: bool,
+) -> Result<Value, WebError> {
     let mut store = load_local_share_grants_store()?;
     let share_id = share_id.trim();
     if share_id.is_empty() {
@@ -963,6 +1037,13 @@ fn revoke_local_share_grant_for_context(
     let mut updated = None;
     for grant in &mut store.grants {
         if grant.share_id.trim() == share_id || grant.id.trim() == share_id {
+            if !admin_mode && grant.owner_user_id.trim() != context.auth.actor_id.trim() {
+                return Err(WebError::new(
+                    StatusCode::FORBIDDEN,
+                    "local_share_grant_owner_required",
+                    "只能撤销自己创建的分享授权",
+                ));
+            }
             grant.active = false;
             grant.revoked_at = Some(now.clone());
             updated = Some(grant.clone());
@@ -1613,7 +1694,15 @@ pub async fn delete_local_access_grant(
 pub async fn get_share_grants(
     Extension(context): Extension<RequestContext>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
-    let payload = list_local_share_grants_for_context(&context)
+    let payload = list_local_share_grants_for_context(&context, true)
+        .map_err(|error| error.with_context(&context))?;
+    Ok((StatusCode::OK, Json(payload)))
+}
+
+pub async fn get_user_share_grants(
+    Extension(context): Extension<RequestContext>,
+) -> Result<(StatusCode, Json<Value>), WebError> {
+    let payload = list_local_share_grants_for_context(&context, false)
         .map_err(|error| error.with_context(&context))?;
     Ok((StatusCode::OK, Json(payload)))
 }
@@ -1636,6 +1725,24 @@ pub async fn delete_share_grant(
     Ok((StatusCode::OK, Json(payload)))
 }
 
+pub async fn create_user_share_grant(
+    Extension(context): Extension<RequestContext>,
+    Json(request): Json<LocalShareGrantRequest>,
+) -> Result<(StatusCode, Json<Value>), WebError> {
+    let payload = add_user_share_grant_for_context(&context, request)
+        .map_err(|error| error.with_context(&context))?;
+    Ok((StatusCode::OK, Json(payload)))
+}
+
+pub async fn delete_user_share_grant(
+    Extension(context): Extension<RequestContext>,
+    AxumPath(share_id): AxumPath<String>,
+) -> Result<(StatusCode, Json<Value>), WebError> {
+    let payload = revoke_user_share_grant_for_context(&context, &share_id)
+        .map_err(|error| error.with_context(&context))?;
+    Ok((StatusCode::OK, Json(payload)))
+}
+
 pub async fn record_shared_cache(
     Extension(context): Extension<RequestContext>,
     Json(request): Json<SharedCacheRecordRequest>,