meleki/gott
1
0 Fork 0
Code Activity

feat: User-Zuordnung für Sessions und Agents

Browse Source 
- UserId-Feld zu SessionRecord und AgentRecord hinzugefügt
- DB-Migration: user_id Spalte + bestehende Daten dem Admin zuweisen
- Alle Endpoints filtern/prüfen nach UserId des eingeloggten Users
- HttpContextExtensions.GetUserId() Helper für konsistenten Zugriff
- Betrifft: Agent, Session, Chat, History, Workspace, Skill Endpoints
- Sessions/Agents anderer User sind nicht sichtbar/zugreifbar
This commit is contained in:
Meleki committed 2026-03-02 11:39:55 +01:00
1 parent 9a59ae686d
commit 7614141760
10 files changed
+123 -45
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Endpoints/HistoryEndpoint.cs
+12 -4
View File
@@ -1,6 +1,7 @@
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Gott.Extensions;
using Gott.Models;
using Gott.Services;
using Microsoft.AspNetCore.Builder;
@@ -23,10 +24,17 @@ public static class HistoryEndpoint
app.MapGet("/api/chains/{chainId}", HandleGetChain);
}
private static async Task<bool> VerifySessionOwner(HttpContext ctx, DatabaseService db, string sessionId)
{
if (string.IsNullOrEmpty(sessionId)) return false;
var session = await db.GetSession(sessionId);
return session != null && session.UserId == ctx.GetUserId();
}
private static async Task HandleHistory(HttpContext ctx, DatabaseService db)
{
var sessionId = ctx.Request.Query["sessionId"].FirstOrDefault();
if (string.IsNullOrEmpty(sessionId))
if (string.IsNullOrEmpty(sessionId) || !await VerifySessionOwner(ctx, db, sessionId))
{
ctx.Response.StatusCode = 400;
await ctx.Response.WriteAsJsonAsync(new { error = "sessionId required" });
@@ -84,7 +92,7 @@ public static class HistoryEndpoint
var afterStr = ctx.Request.Query["afterId"].FirstOrDefault();
var afterId = long.TryParse(afterStr, out var a) ? a : 0;
if (string.IsNullOrEmpty(sessionId))
if (string.IsNullOrEmpty(sessionId) || !await VerifySessionOwner(ctx, db, sessionId))
{
ctx.Response.StatusCode = 400;
return;
@@ -97,7 +105,7 @@ public static class HistoryEndpoint
private static async Task HandleArchive(HttpContext ctx, DatabaseService db)
{
var sessionId = ctx.Request.Query["sessionId"].FirstOrDefault();
if (string.IsNullOrEmpty(sessionId))
if (string.IsNullOrEmpty(sessionId) || !await VerifySessionOwner(ctx, db, sessionId))
{
ctx.Response.StatusCode = 400;
return;
@@ -115,7 +123,7 @@ public static class HistoryEndpoint
private static async Task HandleListArchives(HttpContext ctx, DatabaseService db)
{
var sessionId = ctx.Request.Query["sessionId"].FirstOrDefault();
if (string.IsNullOrEmpty(sessionId))
if (string.IsNullOrEmpty(sessionId) || !await VerifySessionOwner(ctx, db, sessionId))
{
ctx.Response.StatusCode = 400;
return;