i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-01 17:00:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: use intersection for user group policies

Browse Source
This commit is contained in:
fawney19
2026-05-11 16:59:35 +08:00
parent e16a225eb3
commit 9bed5e9f83
9 changed files with 294 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
apps/aether-gateway/src/data/state/auth.rs
View File

@@ -1962,6 +1962,34 @@ mod tests {
assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
}
#[test]
fn list_policy_intersects_multiple_group_restrictions() {
let groups = vec![
sample_group(
"team-a",
10,
Some(vec!["gpt-5", "gpt-4.1"]),
"specific",
None,
"system",
),
sample_group(
"team-b",
20,
Some(vec!["gpt-4.1", "gemini-2.5-pro"]),
"specific",
None,
"system",
),
];
let policy = resolve_effective_list_policy(None, "unrestricted", &groups, |group| {
(&group.allowed_models_mode, group.allowed_models.clone())
});
assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
}
#[test]
fn user_unrestricted_does_not_bypass_group_restrictions() {
let groups = vec![sample_group(

34
apps/aether-gateway/src/handlers/admin/users/groups.rs
View File

@@ -118,11 +118,6 @@ pub(in super::super) async fn build_admin_update_user_group_response(
Ok(value) => value,
Err(detail) => return Ok(bad_request_owned(detail)),
};
if read_default_user_group_id(state).await?.as_deref() == Some(group_id.as_str())
&& !is_unrestricted_default_group_record(&record)
{
return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
}
let group = match state.update_user_group(&group_id, record).await {
Ok(Some(group)) => group,
Ok(None) => return Ok(not_found("用户分组不存在")),
@@ -275,11 +270,8 @@ pub(in super::super) async fn build_admin_set_default_user_group_response(
.map(|value| value.trim().to_string())
.filter(|value| !value.is_empty());
if let Some(group_id) = group_id.as_deref() {
let Some(group) = state.find_user_group_by_id(group_id).await? else {
if state.find_user_group_by_id(group_id).await?.is_none() {
return Ok(bad_request_owned("默认用户组不存在".to_string()));
};
if !is_unrestricted_default_group(&group) {
return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
}
state
.upsert_system_config_json_value(
@@ -417,30 +409,6 @@ fn normalize_ids(values: Vec<String>) -> Vec<String> {
.collect()
}
fn is_unrestricted_default_group(group: &aether_data::repository::users::StoredUserGroup) -> bool {
list_mode_has_no_restriction(&group.allowed_providers_mode)
&& list_mode_has_no_restriction(&group.allowed_api_formats_mode)
&& list_mode_has_no_restriction(&group.allowed_models_mode)
&& rate_mode_has_no_restriction(&group.rate_limit_mode)
}
fn is_unrestricted_default_group_record(
record: &aether_data::repository::users::UpsertUserGroupRecord,
) -> bool {
list_mode_has_no_restriction(&record.allowed_providers_mode)
&& list_mode_has_no_restriction(&record.allowed_api_formats_mode)
&& list_mode_has_no_restriction(&record.allowed_models_mode)
&& rate_mode_has_no_restriction(&record.rate_limit_mode)
}
fn list_mode_has_no_restriction(mode: &str) -> bool {
matches!(mode, "inherit" | "unrestricted")
}
fn rate_mode_has_no_restriction(mode: &str) -> bool {
matches!(mode, "inherit" | "system")
}
fn user_group_id_from_path(request_path: &str) -> Option<String> {
let value = request_path
.strip_prefix("/api/admin/user-groups/")?

118
apps/aether-gateway/src/tests/control/admin/users.rs
View File

@@ -6,7 +6,8 @@ use aether_data::repository::auth::{
};
use aether_data::repository::usage::InMemoryUsageReadRepository;
use aether_data::repository::users::{
InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow,
InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow, UpsertUserGroupRecord,
UserReadRepository,
};
use aether_data::repository::wallet::InMemoryWalletRepository;
use aether_data::repository::wallet::StoredWalletSnapshot;
@@ -429,6 +430,121 @@ async fn gateway_handles_admin_users_root_locally_with_trusted_admin_principal()
create_gateway_handle.abort();
}
#[tokio::test]
async fn gateway_allows_default_user_group_access_policy_updates() {
let upstream_hits = Arc::new(Mutex::new(0usize));
let upstream_hits_clone = Arc::clone(&upstream_hits);
let upstream = Router::new().fallback(any(move |_request: Request| {
let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
async move {
*upstream_hits_inner.lock().expect("mutex should lock") += 1;
(StatusCode::OK, Body::from("unexpected upstream hit"))
}
}));
let user_repository = Arc::new(
InMemoryUserReadRepository::seed_auth_users(vec![
sample_admin_user("user-1"),
sample_admin_user_with_role("user-2", "user", "bob@example.com", "bob"),
])
.with_export_users(vec![
sample_admin_export_user("user-1"),
sample_admin_export_user_with("user", true, "user-2", "bob@example.com", "bob"),
]),
);
let group = user_repository
.create_user_group(UpsertUserGroupRecord {
name: "Baseline".to_string(),
description: None,
priority: 0,
allowed_providers: Some(vec!["openai".to_string()]),
allowed_providers_mode: "specific".to_string(),
allowed_api_formats: Some(vec!["openai:chat".to_string()]),
allowed_api_formats_mode: "specific".to_string(),
allowed_models: Some(vec!["gpt-4.1".to_string()]),
allowed_models_mode: "specific".to_string(),
rate_limit: Some(60),
rate_limit_mode: "custom".to_string(),
})
.await
.expect("user group should create")
.expect("user group should exist");
let group_id = group.id.clone();
let (upstream_url, upstream_handle) = start_server(upstream).await;
let gateway = build_router_with_state(
AppState::new()
.expect("gateway should build")
.with_data_state_for_tests(
GatewayDataState::with_user_reader_for_tests(user_repository.clone())
.with_system_config_values_for_tests(Vec::<(String, serde_json::Value)>::new()),
),
);
let (gateway_url, gateway_handle) = start_server(gateway).await;
let client = reqwest::Client::new();
let default_response = client
.put(format!("{gateway_url}/api/admin/user-groups/default"))
.header(GATEWAY_HEADER, "rust-phase3b")
.header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
.header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
.header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
.json(&json!({ "group_id": group_id }))
.send()
.await
.expect("request should succeed");
assert_eq!(default_response.status(), StatusCode::OK);
let default_payload: serde_json::Value = default_response
.json()
.await
.expect("json body should parse");
assert_eq!(default_payload["default_group_id"], group_id);
let members = user_repository
.list_user_group_members(&group_id)
.await
.expect("default members should list");
assert_eq!(members.len(), 2);
let update_response = client
.put(format!("{gateway_url}/api/admin/user-groups/{group_id}"))
.header(GATEWAY_HEADER, "rust-phase3b")
.header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
.header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
.header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
.json(&json!({
"name": "Baseline Limited",
"allowed_providers": ["openai", "anthropic"],
"allowed_providers_mode": "specific",
"allowed_api_formats": ["openai:chat"],
"allowed_api_formats_mode": "specific",
"allowed_models": ["gpt-4.1", "claude-sonnet-4-5"],
"allowed_models_mode": "specific",
"rate_limit": 25,
"rate_limit_mode": "custom"
}))
.send()
.await
.expect("request should succeed");
assert_eq!(update_response.status(), StatusCode::OK);
let update_payload: serde_json::Value = update_response
.json()
.await
.expect("json body should parse");
assert_eq!(update_payload["is_default"], true);
assert_eq!(update_payload["name"], "Baseline Limited");
assert_eq!(
update_payload["allowed_models"],
json!(["gpt-4.1", "claude-sonnet-4-5"])
);
assert_eq!(update_payload["rate_limit"], 25);
assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
gateway_handle.abort();
upstream_handle.abort();
}
#[tokio::test]
async fn gateway_resolves_admin_user_batch_selection_locally() {
let upstream_hits = Arc::new(Mutex::new(0usize));

4
crates/aether-data/migrations/mysql/20260509120000_add_user_groups.sql
View File

@@ -69,7 +69,7 @@ VALUES (
'00000000-0000-0000-0000-000000000001',
'Default',
'default',
'Default unrestricted group for all users',
'Default group for all users',
0,
'unrestricted',
'unrestricted',
@@ -91,7 +91,7 @@ VALUES (
'00000000-0000-0000-0000-000000000002',
'default_user_group_id',
'"00000000-0000-0000-0000-000000000001"',
'Default unrestricted user group',
'Default user group',
UNIX_TIMESTAMP(),
UNIX_TIMESTAMP()
);

4
crates/aether-data/migrations/postgres/20260509120000_add_user_groups.sql
View File

@@ -74,7 +74,7 @@ VALUES (
'00000000-0000-0000-0000-000000000001',
'Default',
'default',
'Default unrestricted group for all users',
'Default group for all users',
0,
'unrestricted',
'unrestricted',
@@ -88,7 +88,7 @@ VALUES (
'00000000-0000-0000-0000-000000000002',
'default_user_group_id',
'"00000000-0000-0000-0000-000000000001"'::json,
'Default unrestricted user group',
'Default user group',
now(),
now()
)

4
crates/aether-data/migrations/sqlite/20260509120000_add_user_groups.sql
View File

@@ -67,7 +67,7 @@ VALUES (
'00000000-0000-0000-0000-000000000001',
'Default',
'default',
'Default unrestricted group for all users',
'Default group for all users',
0,
'unrestricted',
'unrestricted',
@@ -89,7 +89,7 @@ VALUES (
'00000000-0000-0000-0000-000000000002',
'default_user_group_id',
'"00000000-0000-0000-0000-000000000001"',
'Default unrestricted user group',
'Default user group',
CAST(strftime('%s', 'now') AS INTEGER),
CAST(strftime('%s', 'now') AS INTEGER)
);

4
crates/aether-data/schema/bootstrap/postgres/006_footer.sql
View File

@@ -15,7 +15,7 @@ VALUES (
'00000000-0000-0000-0000-000000000001',
'Default',
'default',
'Default unrestricted group for all users',
'Default group for all users',
0,
'unrestricted',
'unrestricted',
@@ -29,7 +29,7 @@ VALUES (
'00000000-0000-0000-0000-000000000002',
'default_user_group_id',
'"00000000-0000-0000-0000-000000000001"'::json,
'Default unrestricted user group'
'Default user group'
)
ON CONFLICT (key) DO NOTHING;

149
crates/aether-data/src/repository/auth/types.rs
View File

@@ -154,7 +154,7 @@ pub struct ResolvedAuthApiKeySnapshot {
impl ResolvedAuthApiKeySnapshot {
pub fn from_stored(snapshot: StoredAuthApiKeySnapshot, now_unix_secs: u64) -> Self {
let currently_usable = snapshot.is_currently_usable(now_unix_secs);
Self {
let mut resolved = Self {
user_id: snapshot.user_id,
username: snapshot.username,
email: snapshot.email,
@@ -178,7 +178,9 @@ impl ResolvedAuthApiKeySnapshot {
api_key_allowed_api_formats: snapshot.api_key_allowed_api_formats,
api_key_allowed_models: snapshot.api_key_allowed_models,
currently_usable,
}
};
resolved.constrain_non_standalone_api_key_policy_to_user_policy();
resolved
}
pub fn effective_allowed_providers(&self) -> Option<&[String]> {
@@ -186,7 +188,8 @@ impl ResolvedAuthApiKeySnapshot {
return non_empty_allowed_list(self.api_key_allowed_providers.as_deref());
}
non_empty_allowed_list(self.api_key_allowed_providers.as_deref())
self.api_key_allowed_providers
.as_deref()
.or(self.user_allowed_providers.as_deref())
}
@@ -195,7 +198,8 @@ impl ResolvedAuthApiKeySnapshot {
return non_empty_allowed_list(self.api_key_allowed_api_formats.as_deref());
}
non_empty_allowed_list(self.api_key_allowed_api_formats.as_deref())
self.api_key_allowed_api_formats
.as_deref()
.or(self.user_allowed_api_formats.as_deref())
}
@@ -204,7 +208,8 @@ impl ResolvedAuthApiKeySnapshot {
return non_empty_allowed_list(self.api_key_allowed_models.as_deref());
}
non_empty_allowed_list(self.api_key_allowed_models.as_deref())
self.api_key_allowed_models
.as_deref()
.or(self.user_allowed_models.as_deref())
}
@@ -219,6 +224,25 @@ impl ResolvedAuthApiKeySnapshot {
self.user_allowed_api_formats = allowed_api_formats;
self.user_allowed_models = allowed_models;
self.user_rate_limit = rate_limit;
self.constrain_non_standalone_api_key_policy_to_user_policy();
}
fn constrain_non_standalone_api_key_policy_to_user_policy(&mut self) {
if self.api_key_is_standalone {
return;
}
constrain_api_key_list_policy_to_user_policy(
&mut self.user_allowed_providers,
&mut self.api_key_allowed_providers,
);
constrain_api_key_list_policy_to_user_policy(
&mut self.user_allowed_api_formats,
&mut self.api_key_allowed_api_formats,
);
constrain_api_key_list_policy_to_user_policy(
&mut self.user_allowed_models,
&mut self.api_key_allowed_models,
);
}
}
@@ -226,6 +250,29 @@ fn non_empty_allowed_list(values: Option<&[String]>) -> Option<&[String]> {
values.filter(|items| !items.is_empty())
}
fn constrain_api_key_list_policy_to_user_policy(
user_policy: &mut Option<Vec<String>>,
api_key_policy: &mut Option<Vec<String>>,
) {
let Some(api_key_values) = api_key_policy.as_ref() else {
return;
};
let Some(user_values) = user_policy.clone() else {
return;
};
let effective = intersect_allowed_lists(api_key_values, &user_values);
*user_policy = Some(effective.clone());
*api_key_policy = Some(effective);
}
fn intersect_allowed_lists(left: &[String], right: &[String]) -> Vec<String> {
let right_values = right.iter().collect::<std::collections::BTreeSet<_>>();
left.iter()
.filter(|value| right_values.contains(*value))
.cloned()
.collect()
}
#[async_trait]
pub trait ResolvedAuthApiKeySnapshotReader: Send + Sync {
async fn find_stored_auth_api_key_snapshot(
@@ -827,7 +874,7 @@ mod tests {
}
#[test]
fn resolved_snapshot_prefers_api_key_lists_over_user_lists() {
fn non_standalone_snapshot_intersects_api_key_and_user_allowed_lists() {
let snapshot = StoredAuthApiKeySnapshot::new(
"user-1".to_string(),
"alice".to_string(),
@@ -847,9 +894,9 @@ mod tests {
Some(60),
Some(5),
Some(200),
Some(serde_json::json!(["anthropic"])),
None,
None,
Some(serde_json::json!(["anthropic", "openai"])),
Some(serde_json::json!(["claude:messages"])),
Some(serde_json::json!(["gpt-5"])),
)
.expect("snapshot should build");
@@ -858,16 +905,56 @@ mod tests {
assert!(resolved.currently_usable);
assert_eq!(
resolved.effective_allowed_providers(),
Some(&["anthropic".to_string()][..])
Some(&["openai".to_string()][..])
);
assert_eq!(resolved.effective_allowed_api_formats(), Some(&[][..]));
assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
}
#[test]
fn applying_user_group_policy_keeps_non_standalone_key_at_intersection() {
let snapshot = StoredAuthApiKeySnapshot::new(
"user-1".to_string(),
"alice".to_string(),
None,
"user".to_string(),
"local".to_string(),
true,
false,
None,
None,
None,
"key-1".to_string(),
Some("default".to_string()),
true,
false,
false,
Some(60),
Some(5),
Some(200),
Some(serde_json::json!(["openai", "anthropic"])),
Some(serde_json::json!(["openai:chat", "claude:messages"])),
Some(serde_json::json!(["gpt-4.1", "claude-sonnet-4-5"])),
)
.expect("snapshot should build");
let mut resolved = ResolvedAuthApiKeySnapshot::from_stored(snapshot, 150);
resolved.apply_user_policy(
Some(vec!["openai".to_string(), "gemini".to_string()]),
Some(vec!["openai:chat".to_string()]),
Some(vec!["gpt-5".to_string()]),
Some(60),
);
assert_eq!(
resolved.effective_allowed_providers(),
Some(&["openai".to_string()][..])
);
assert_eq!(
resolved.effective_allowed_api_formats(),
Some(&["openai:chat".to_string()][..])
);
assert_eq!(
resolved.effective_allowed_models(),
Some(&["gpt-4.1".to_string()][..])
);
assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
}
#[test]
@@ -992,6 +1079,40 @@ mod tests {
);
}
#[test]
fn non_standalone_snapshot_keeps_empty_key_allowed_lists_as_deny_all() {
let snapshot = StoredAuthApiKeySnapshot::new(
"user-1".to_string(),
"alice".to_string(),
None,
"user".to_string(),
"local".to_string(),
true,
false,
Some(serde_json::json!(["openai"])),
Some(serde_json::json!(["openai:chat"])),
Some(serde_json::json!(["gpt-4.1"])),
"user-key".to_string(),
Some("default".to_string()),
true,
false,
false,
Some(60),
None,
None,
Some(serde_json::json!([])),
Some(serde_json::json!([])),
Some(serde_json::json!([])),
)
.expect("snapshot should build");
let resolved = ResolvedAuthApiKeySnapshot::from_stored(snapshot, 150);
assert_eq!(resolved.effective_allowed_providers(), Some(&[][..]));
assert_eq!(resolved.effective_allowed_api_formats(), Some(&[][..]));
assert_eq!(resolved.effective_allowed_models(), Some(&[][..]));
}
#[test]
fn standalone_snapshot_treats_empty_key_allowed_lists_as_unrestricted() {
let snapshot = StoredAuthApiKeySnapshot::new(

23
frontend/src/features/users/components/UserGroupsDialog.vue
View File

@@ -139,7 +139,6 @@
<div class="flex w-full items-center sm:w-auto sm:shrink-0">
<Switch
:model-value="form.allowed_providers_mode === 'unrestricted'"
:disabled="selectedGroup?.is_default"
@update:model-value="(v) => (form.allowed_providers_mode = v ? 'unrestricted' : 'specific')"
/>
</div>
@@ -148,7 +147,7 @@
v-model="form.allowed_providers"
:options="providerOptions"
:search-threshold="0"
:disabled="selectedGroup?.is_default || form.allowed_providers_mode === 'unrestricted'"
:disabled="form.allowed_providers_mode === 'unrestricted'"
:placeholder="form.allowed_providers_mode === 'unrestricted' ? '不限制所有选项' : '选择提供商'"
empty-text="暂无选项"
/>
@@ -162,7 +161,6 @@
<div class="flex w-full items-center sm:w-auto sm:shrink-0">
<Switch
:model-value="form.allowed_api_formats_mode === 'unrestricted'"
:disabled="selectedGroup?.is_default"
@update:model-value="(v) => (form.allowed_api_formats_mode = v ? 'unrestricted' : 'specific')"
/>
</div>
@@ -171,7 +169,7 @@
v-model="form.allowed_api_formats"
:options="apiFormatOptions"
:search-threshold="0"
:disabled="selectedGroup?.is_default || form.allowed_api_formats_mode === 'unrestricted'"
:disabled="form.allowed_api_formats_mode === 'unrestricted'"
:placeholder="form.allowed_api_formats_mode === 'unrestricted' ? '不限制所有选项' : '选择端点'"
empty-text="暂无选项"
/>
@@ -185,7 +183,6 @@
<div class="flex w-full items-center sm:w-auto sm:shrink-0">
<Switch
:model-value="form.allowed_models_mode === 'unrestricted'"
:disabled="selectedGroup?.is_default"
@update:model-value="(v) => (form.allowed_models_mode = v ? 'unrestricted' : 'specific')"
/>
</div>
@@ -194,7 +191,7 @@
v-model="form.allowed_models"
:options="modelOptions"
:search-threshold="0"
:disabled="selectedGroup?.is_default || form.allowed_models_mode === 'unrestricted'"
:disabled="form.allowed_models_mode === 'unrestricted'"
:placeholder="form.allowed_models_mode === 'unrestricted' ? '不限制所有选项' : '选择模型'"
empty-text="暂无选项"
/>
@@ -208,7 +205,6 @@
<div class="flex w-full items-center sm:w-auto sm:shrink-0">
<Switch
:model-value="form.rate_limit_mode === 'system'"
:disabled="selectedGroup?.is_default"
@update:model-value="(v) => (form.rate_limit_mode = v ? 'system' : 'custom')"
/>
</div>
@@ -219,7 +215,7 @@
min="0"
max="10000"
class="h-10"
:disabled="selectedGroup?.is_default || form.rate_limit_mode === 'system'"
:disabled="form.rate_limit_mode === 'system'"
:placeholder="form.rate_limit_mode === 'system' ? '使用系统默认' : '0 = 不限速'"
@update:model-value="(value) => form.rate_limit = parseNumberInput(value, { min: 0, max: 10000 })"
/>
@@ -240,7 +236,7 @@
关闭
</Button>
<Button
:disabled="saving || !form.name.trim() || defaultGroupHasRestrictions"
:disabled="saving || !form.name.trim()"
@click="saveGroup"
>
保存
@@ -299,7 +295,6 @@ const {
const loading = ref(false)
const saving = ref(false)
const groups = ref<UserGroup[]>([])
const defaultGroupId = ref<string | null>(null)
const editingGroupId = ref<string | null>(null)
const memberUserIds = ref<string[]>([])
@@ -316,13 +311,6 @@ const form = ref({
})
const selectedGroup = computed(() => groups.value.find((group) => group.id === editingGroupId.value) ?? null)
const defaultGroupHasRestrictions = computed(() => {
if (!selectedGroup.value?.is_default) return false
return form.value.allowed_providers_mode !== 'unrestricted'
|| form.value.allowed_api_formats_mode !== 'unrestricted'
|| form.value.allowed_models_mode !== 'unrestricted'
|| form.value.rate_limit_mode !== 'system'
})
const userOptions = computed(() => props.users.map((user) => ({
label: `${user.username}${user.email ? ` (${user.email})` : ''}`,
value: user.id,
@@ -348,7 +336,6 @@ async function loadDialogData(): Promise<void> {
try {
const response = await usersStore.listUserGroups()
groups.value = response.items
defaultGroupId.value = response.default_group_id ?? null
if (editingGroupId.value && !groups.value.some((group) => group.id === editingGroupId.value)) {
editingGroupId.value = null
}