fix: proxy admin access writes through cloud web (#902)

Co-authored-by: Codex Agent <codex@hwlab.local>
2026-06-05 11:34:28 +08:00
parent 793d905b38
commit 45bd95e9d1
4 changed files with 159 additions and 7 deletions
@@ -46,6 +46,97 @@ test("cloud web auth requests are proxied once", async () => {
  }
 });

+test("cloud web proxies Admin Access write routes and leaves legacy grants local", async () => {
+  const upstreamRequests = [];
+  const upstream = createServer(async (request, response) => {
+    let body = "";
+    for await (const chunk of request) body += chunk;
+    upstreamRequests.push({
+      method: request.method,
+      url: request.url,
+      authorization: request.headers.authorization,
+      cookie: request.headers.cookie,
+      body
+    });
+    response.writeHead(200, { "content-type": "application/json" });
+    response.end(JSON.stringify({ ok: true, path: request.url }));
+  });
+  await listen(upstream);
+
+  const cloudWeb = createCloudWebServer({
+    serviceId: "hwlab-cloud-web",
+    cloudApiBaseUrl: serverUrl(upstream),
+    cloudApiProxyTimeoutMs: 1000,
+    healthPayload: () => ({ status: "ok" }),
+    roots: [],
+    sendJson(response, statusCode, body) {
+      const payload = JSON.stringify(body);
+      response.writeHead(statusCode, {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload)
+      });
+      response.end(payload);
+    }
+  });
+  await listen(cloudWeb);
+
+  try {
+    const checkBody = JSON.stringify({ user: "usr_alice", relation: "viewer", object: "device_pod:D601-71-FREQ" });
+    const checkResponse = await fetch(`${serverUrl(cloudWeb)}/v1/admin/access/check`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: "Bearer hwl_live_admin",
+        cookie: "hwlab_session=session-a"
+      },
+      body: checkBody
+    });
+    assert.equal(checkResponse.status, 200);
+    assert.deepEqual(await checkResponse.json(), { ok: true, path: "/v1/admin/access/check" });
+
+    const grantResponse = await fetch(`${serverUrl(cloudWeb)}/v1/admin/access/users/usr_alice/device-pods/D601-71-FREQ/viewer`, {
+      method: "PUT",
+      headers: {
+        "content-type": "application/json",
+        authorization: "Bearer hwl_live_admin"
+      },
+      body: "{}"
+    });
+    assert.equal(grantResponse.status, 200);
+
+    const legacyResponse = await fetch(`${serverUrl(cloudWeb)}/v1/admin/device-pod-grants`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ userId: "usr_alice", devicePodId: "D601-71-FREQ" })
+    });
+    assert.equal(legacyResponse.status, 404);
+    assert.deepEqual(await legacyResponse.json(), {
+      error: "not_found",
+      serviceId: "hwlab-cloud-web",
+      path: "/v1/admin/device-pod-grants"
+    });
+
+    assert.equal(upstreamRequests.length, 2);
+    assert.deepEqual(upstreamRequests[0], {
+      method: "POST",
+      url: "/v1/admin/access/check",
+      authorization: "Bearer hwl_live_admin",
+      cookie: "hwlab_session=session-a",
+      body: checkBody
+    });
+    assert.deepEqual(upstreamRequests[1], {
+      method: "PUT",
+      url: "/v1/admin/access/users/usr_alice/device-pods/D601-71-FREQ/viewer",
+      authorization: "Bearer hwl_live_admin",
+      cookie: undefined,
+      body: "{}"
+    });
+  } finally {
+    await close(cloudWeb);
+    await close(upstream);
+  }
+});
+
 test("cloud web serves access deep link through the React shell", async () => {
  const root = await mkdtemp(path.join(os.tmpdir(), "hwlab-cloud-web-runtime-"));
  await writeFile(path.join(root, "index.html"), "<div id=\"root\"></div>\n", "utf8");