i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-01 17:00:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: use intersection for user group policies

Browse Source
This commit is contained in:
fawney19
2026-05-11 16:59:35 +08:00
parent e16a225eb3
commit 9bed5e9f83
9 changed files with 294 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
apps/aether-gateway/src/data/state/auth.rs
View File

@@ -1962,6 +1962,34 @@ mod tests {
assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
}
#[test]
fn list_policy_intersects_multiple_group_restrictions() {
let groups = vec![
sample_group(
"team-a",
10,
Some(vec!["gpt-5", "gpt-4.1"]),
"specific",
None,
"system",
),
sample_group(
"team-b",
20,
Some(vec!["gpt-4.1", "gemini-2.5-pro"]),
"specific",
None,
"system",
),
];
let policy = resolve_effective_list_policy(None, "unrestricted", &groups, |group| {
(&group.allowed_models_mode, group.allowed_models.clone())
});
assert_eq!(policy, Some(vec!["gpt-4.1".to_string()]));
}
#[test]
fn user_unrestricted_does_not_bypass_group_restrictions() {
let groups = vec![sample_group(

34
apps/aether-gateway/src/handlers/admin/users/groups.rs
View File

@@ -118,11 +118,6 @@ pub(in super::super) async fn build_admin_update_user_group_response(
Ok(value) => value,
Err(detail) => return Ok(bad_request_owned(detail)),
};
if read_default_user_group_id(state).await?.as_deref() == Some(group_id.as_str())
&& !is_unrestricted_default_group_record(&record)
{
return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
}
let group = match state.update_user_group(&group_id, record).await {
Ok(Some(group)) => group,
Ok(None) => return Ok(not_found("用户分组不存在")),
@@ -275,11 +270,8 @@ pub(in super::super) async fn build_admin_set_default_user_group_response(
.map(|value| value.trim().to_string())
.filter(|value| !value.is_empty());
if let Some(group_id) = group_id.as_deref() {
let Some(group) = state.find_user_group_by_id(group_id).await? else {
if state.find_user_group_by_id(group_id).await?.is_none() {
return Ok(bad_request_owned("默认用户组不存在".to_string()));
};
if !is_unrestricted_default_group(&group) {
return Ok(bad_request_owned("默认用户组不能配置访问限制".to_string()));
}
state
.upsert_system_config_json_value(
@@ -417,30 +409,6 @@ fn normalize_ids(values: Vec<String>) -> Vec<String> {
.collect()
}
fn is_unrestricted_default_group(group: &aether_data::repository::users::StoredUserGroup) -> bool {
list_mode_has_no_restriction(&group.allowed_providers_mode)
&& list_mode_has_no_restriction(&group.allowed_api_formats_mode)
&& list_mode_has_no_restriction(&group.allowed_models_mode)
&& rate_mode_has_no_restriction(&group.rate_limit_mode)
}
fn is_unrestricted_default_group_record(
record: &aether_data::repository::users::UpsertUserGroupRecord,
) -> bool {
list_mode_has_no_restriction(&record.allowed_providers_mode)
&& list_mode_has_no_restriction(&record.allowed_api_formats_mode)
&& list_mode_has_no_restriction(&record.allowed_models_mode)
&& rate_mode_has_no_restriction(&record.rate_limit_mode)
}
fn list_mode_has_no_restriction(mode: &str) -> bool {
matches!(mode, "inherit" | "unrestricted")
}
fn rate_mode_has_no_restriction(mode: &str) -> bool {
matches!(mode, "inherit" | "system")
}
fn user_group_id_from_path(request_path: &str) -> Option<String> {
let value = request_path
.strip_prefix("/api/admin/user-groups/")?

118
apps/aether-gateway/src/tests/control/admin/users.rs
View File

@@ -6,7 +6,8 @@ use aether_data::repository::auth::{
};
use aether_data::repository::usage::InMemoryUsageReadRepository;
use aether_data::repository::users::{
InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow,
InMemoryUserReadRepository, StoredUserAuthRecord, StoredUserExportRow, UpsertUserGroupRecord,
UserReadRepository,
};
use aether_data::repository::wallet::InMemoryWalletRepository;
use aether_data::repository::wallet::StoredWalletSnapshot;
@@ -429,6 +430,121 @@ async fn gateway_handles_admin_users_root_locally_with_trusted_admin_principal()
create_gateway_handle.abort();
}
#[tokio::test]
async fn gateway_allows_default_user_group_access_policy_updates() {
let upstream_hits = Arc::new(Mutex::new(0usize));
let upstream_hits_clone = Arc::clone(&upstream_hits);
let upstream = Router::new().fallback(any(move |_request: Request| {
let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
async move {
*upstream_hits_inner.lock().expect("mutex should lock") += 1;
(StatusCode::OK, Body::from("unexpected upstream hit"))
}
}));
let user_repository = Arc::new(
InMemoryUserReadRepository::seed_auth_users(vec![
sample_admin_user("user-1"),
sample_admin_user_with_role("user-2", "user", "bob@example.com", "bob"),
])
.with_export_users(vec![
sample_admin_export_user("user-1"),
sample_admin_export_user_with("user", true, "user-2", "bob@example.com", "bob"),
]),
);
let group = user_repository
.create_user_group(UpsertUserGroupRecord {
name: "Baseline".to_string(),
description: None,
priority: 0,
allowed_providers: Some(vec!["openai".to_string()]),
allowed_providers_mode: "specific".to_string(),
allowed_api_formats: Some(vec!["openai:chat".to_string()]),
allowed_api_formats_mode: "specific".to_string(),
allowed_models: Some(vec!["gpt-4.1".to_string()]),
allowed_models_mode: "specific".to_string(),
rate_limit: Some(60),
rate_limit_mode: "custom".to_string(),
})
.await
.expect("user group should create")
.expect("user group should exist");
let group_id = group.id.clone();
let (upstream_url, upstream_handle) = start_server(upstream).await;
let gateway = build_router_with_state(
AppState::new()
.expect("gateway should build")
.with_data_state_for_tests(
GatewayDataState::with_user_reader_for_tests(user_repository.clone())
.with_system_config_values_for_tests(Vec::<(String, serde_json::Value)>::new()),
),
);
let (gateway_url, gateway_handle) = start_server(gateway).await;
let client = reqwest::Client::new();
let default_response = client
.put(format!("{gateway_url}/api/admin/user-groups/default"))
.header(GATEWAY_HEADER, "rust-phase3b")
.header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
.header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
.header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
.json(&json!({ "group_id": group_id }))
.send()
.await
.expect("request should succeed");
assert_eq!(default_response.status(), StatusCode::OK);
let default_payload: serde_json::Value = default_response
.json()
.await
.expect("json body should parse");
assert_eq!(default_payload["default_group_id"], group_id);
let members = user_repository
.list_user_group_members(&group_id)
.await
.expect("default members should list");
assert_eq!(members.len(), 2);
let update_response = client
.put(format!("{gateway_url}/api/admin/user-groups/{group_id}"))
.header(GATEWAY_HEADER, "rust-phase3b")
.header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
.header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
.header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
.json(&json!({
"name": "Baseline Limited",
"allowed_providers": ["openai", "anthropic"],
"allowed_providers_mode": "specific",
"allowed_api_formats": ["openai:chat"],
"allowed_api_formats_mode": "specific",
"allowed_models": ["gpt-4.1", "claude-sonnet-4-5"],
"allowed_models_mode": "specific",
"rate_limit": 25,
"rate_limit_mode": "custom"
}))
.send()
.await
.expect("request should succeed");
assert_eq!(update_response.status(), StatusCode::OK);
let update_payload: serde_json::Value = update_response
.json()
.await
.expect("json body should parse");
assert_eq!(update_payload["is_default"], true);
assert_eq!(update_payload["name"], "Baseline Limited");
assert_eq!(
update_payload["allowed_models"],
json!(["gpt-4.1", "claude-sonnet-4-5"])
);
assert_eq!(update_payload["rate_limit"], 25);
assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
gateway_handle.abort();
upstream_handle.abort();
}
#[tokio::test]
async fn gateway_resolves_admin_user_batch_selection_locally() {
let upstream_hits = Arc::new(Mutex::new(0usize));