feat(gateway,security): WS 下行帧角色门 — 内容帧仅 owner+admin，viewer 只收状态机信号
design/11 §7.1（主人 2026-10-03 拍板）。此前 hub.broadcast 是全连接广播，而任意角色
（含 viewer）都能连 /ws/chat ⇒ viewer 能收到角色回复正文（message.*）、推理内容
（thinking.*）、消息增量、graph_update、mood 等。这与 design/19 §1/§3「flow 可视化仅
owner/admin 可见」冲突，也与 GET /sessions/{id}/messages 的 owner/admin 档位不一致。
收口：唯一分类点 internal/services/gateway/ws_frame_scope.go 的 frameReachesAll(typ)
（fail-closed switch，默认 false）；hub.broadcast 投递前查表，白名单外对非 owner/admin
连接直接跳过。**不给 broadcast 加 bool 参数、不让调用点自己判断** —— 那正是"漏一处就是
泄漏"的形状。全包只有一个 fan-out 循环，14 个 .broadcast( 调用点全部落进该入口。
- 白名单只有 7 个状态机信号帧（不含任何内容）：session_busy / pending_ack / pending_drain /
session_idle / session_interrupted / pending_full / session_read
- 其余全部（流式 message/thinking/tool_call、message_persisted/edited/deleted、graph_update、
subagent_event/result、task_output/task_done、automation_result、tool_used、capacity_awaken、
mode_switch、mood、device_update、reminder）仅 owner+admin
- 语义澄清：本门管「谁被主动推送」，数据可见性仍由 REST 决定（viewer 的 12 条只读监控端点
不变，含 GET /personas 的 mood）；/ws/chat 连接鉴权与 voice_output 定向帧不动
契约：Docs/api-client.md → v0.48（对 viewer 是收紧；owner/admin 零变化；无端点/字段形状变更）
验证：go build/vet 绿；go test ./... = 58 包 ok / 0 FAIL；-race ./internal/services/gateway/... ok；
linux/amd64 + darwin/arm64 交叉编译绿。真 httptest WS + 真 JWT 按角色逐帧实测 37 帧：
viewer 只收到 7 个状态信号，owner/admin 37/37。
变异验证：① graph_update 加回白名单 → 真 WS 抓到 viewer 收到 graph_update，3 个测试 FAIL；
② session_idle 移出白名单 → 3 个测试 FAIL（viewer 等不到哨兵帧而超时）。均已还原。
遗留（已登记，待主人裁决）：① 握手 history 回放对任意角色照发（viewer 连上即得主会话最近
50 条正文）；② /ws/chat 上行未按角色授权（viewer 可发 chat = 真驱动模型并落库；
subagent_ask / task_output_query 的定向应答绕过本门）。
This commit is contained in:
AskaEth committed
1 parent
28b663231e
commit
bc0047b449
13 files changed
+453
-34
No files matched your search
@@ -897,7 +897,7 @@ func TestServerCloseShutsHub(t *testing.T) {
|
||||
func TestHubStreamChat(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(&stubRunner{res: &loop.Result{Text: "hi", Steps: 2, StopReason: "stop"}}, nil)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
hb.streamChat(context.Background(), map[string]any{"sessionId": "s1", "text": "hello"})
|
||||
@@ -943,7 +943,7 @@ func TestHubStreamChatPersistsMode(t *testing.T) {
|
||||
func TestHubBroadcastStream(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(nil, nil)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
// A text_delta StreamEvent on the OnStream→bus→relay path becomes a typed
|
||||
@@ -982,7 +982,7 @@ func TestHubBroadcastStream(t *testing.T) {
|
||||
func TestServerBroadcastCapacityAwaken(t *testing.T) {
|
||||
t.Parallel()
|
||||
env := newEnv(t, nil, false)
|
||||
c := newFakeConn(env.srv.hub, 32)
|
||||
c := newOwnerConn(env.srv.hub, 32)
|
||||
env.srv.hub.register(c)
|
||||
|
||||
env.srv.BroadcastCapacityAwaken("web", "quiet", "awake", "web_search")
|
||||
@@ -1007,7 +1007,7 @@ func TestServerBroadcastCapacityAwaken(t *testing.T) {
|
||||
func TestServerBroadcastPersistedSplit(t *testing.T) {
|
||||
t.Parallel()
|
||||
env := newEnv(t, nil, false)
|
||||
c := newFakeConn(env.srv.hub, 32)
|
||||
c := newOwnerConn(env.srv.hub, 32)
|
||||
env.srv.hub.register(c)
|
||||
|
||||
cases := []struct {
|
||||
@@ -1050,7 +1050,7 @@ func TestServerBroadcastPersistedSplit(t *testing.T) {
|
||||
func TestHubStreamChatIdle(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(nil, nil) // nil runner
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
hb.streamChat(context.Background(), map[string]any{"sessionId": "s1", "text": ""})
|
||||
@@ -1062,7 +1062,7 @@ func TestHubStreamChatIdle(t *testing.T) {
|
||||
func TestHubStreamChatError(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(&stubRunner{err: errors.New("boom")}, nil)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
hb.streamChat(context.Background(), map[string]any{"sessionId": "s1", "text": "hi"})
|
||||
@@ -1074,7 +1074,7 @@ func TestHubStreamChatError(t *testing.T) {
|
||||
func TestHubRelayChatBranch(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(&stubRunner{res: &loop.Result{Text: "hi", Steps: 1, StopReason: "stop"}}, nil)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
if err := hb.relay(context.Background(), bus.Event{Subject: wsChatSubject, Payload: map[string]any{"sessionId": "s1", "text": "hi"}}); err != nil {
|
||||
@@ -1099,7 +1099,7 @@ func TestHubRoute(t *testing.T) {
|
||||
hb.taskOutputs = &stubTaskOutputs{ev: task.OutputEvent{
|
||||
ID: "task-1", Status: task.StatusDone, Output: task.Output{Stdout: "out", Stderr: "err"},
|
||||
}}
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
// subagent_ask → subagent_event (real audit data, not a hardcoded pending).
|
||||
@@ -1161,7 +1161,7 @@ func TestHubVoiceInputTurn(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(&stubRunner{res: &loop.Result{Text: "你好", Steps: 1, StopReason: "stop"}}, nil)
|
||||
hb.voice = &stubVoice{sttText: "你好", tts: voice.Audio{Format: "wav", Data: []byte("audio-bytes")}}
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
// "aGVsbG8=" decodes to "hello" — a valid base64 audio payload.
|
||||
@@ -1187,7 +1187,7 @@ func TestHubBridgeDeviceUpdate(t *testing.T) {
|
||||
t.Parallel()
|
||||
b := bus.New()
|
||||
hb := newTestHub(nil, b)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
hb.start()
|
||||
t.Cleanup(hb.close)
|
||||
@@ -1203,7 +1203,7 @@ func TestHubBridgeDeviceUpdate(t *testing.T) {
|
||||
func TestHubBridgeSubagentProgress(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(nil, nil)
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
hb.register(c)
|
||||
|
||||
if err := hb.relay(context.Background(), bus.Event{
|
||||
@@ -1233,7 +1233,7 @@ func TestHubBridgeSubagentProgress(t *testing.T) {
|
||||
func TestPublishPublicNilBus(t *testing.T) {
|
||||
t.Parallel()
|
||||
hb := newTestHub(nil, nil) // nil bus
|
||||
c := newFakeConn(hb, 32)
|
||||
c := newOwnerConn(hb, 32)
|
||||
// Must not panic and must not enqueue anything.
|
||||
c.publishPublic(wsChatSubject, map[string]any{"text": "hi"})
|
||||
}
|
||||
@@ -1396,6 +1396,17 @@ func newFakeConn(hb *hub, buf int) *wsConn {
|
||||
}
|
||||
}
|
||||
|
||||
// newOwnerConn is a fake connection carrying owner claims: the design/11 §7.1 frame
|
||||
// gate sends every content frame (message.*, thinking.*, tool_*, graph_update, mood,
|
||||
// persisted-message frames, …) to owner/admin only, so a hub unit test that reads
|
||||
// one has to connect as the role it is gated to. A nil-claims conn (newFakeConn) is
|
||||
// the fail-closed bare connection — always reachable by the state signals only.
|
||||
func newOwnerConn(hb *hub, buf int) *wsConn {
|
||||
c := newFakeConn(hb, buf)
|
||||
c.claims = &auth.Claims{Role: auth.RoleOwner}
|
||||
return c
|
||||
}
|
||||
|
||||
func readFakeFrame(t *testing.T, c *wsConn) wsEvent {
|
||||
t.Helper()
|
||||
select {
|
||||
|
||||
Reference in new issue
Block a user