YueGuobin ee36a9aec2

feat: fix permission check logic to properly handle ACE and user isolation ...

Implement the correct three-step permission check logic:
- Step 1: ACE check - basic access permission (get projects user has ACE for)
- Step 2: Filter ace_projects by created_by - user's own projects (project sharing only through resource pools)
- Step 3: Resource pool projects (projects shared through resource pools)

This fixes the design flaw where:
- ACE check could bypass user isolation with broad ACE configurations
- seen_project_ids mechanism prevented proper layered checking
- Project sharing was confused with direct ACE configuration

The new logic ensures:
- User isolation works even with broad ACE (path='/', propagate=True)
- Project sharing is only available through resource pools (clear design)
- Proper layered checking without seen blocking mechanism

2026-05-26 12:33:08 +08:00

..

routes

feat: fix permission check logic to properly handle ACE and user isolation

2026-05-26 12:33:08 +08:00

__init__.py

Move endpoints to routes & preparations to use a database.

2020-11-19 15:21:03 +10:30

server.py

fix: handle directory access for static web-ui routes

2026-05-03 17:21:03 +08:00