mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
1f4cb65ca6
Storage, flag and request path of the approval gate for asset targets. The
gate itself is not wired into the tool hook yet (steps 1.5 to 1.7): with this
change nothing is extracted, resolved or blocked, whatever the flag says.
Schema and store (1.2)
- tasks.target_gate, conversations.target_gate (default false).
- intercept_pending.target_key and a partial unique index: one open request
per scope (task or conversation) and host:port.
- target_pins (no foreign keys: a pin outlives its task, its conversation and
its request row) and target_gate_exemption_log. All DDL is idempotent; no
CHECK constraints; the cascade on intercept_pending.conversation_id stays.
- db/target_pins.go: pin lookup with port precedence, list, revoke,
find-or-create of a request, and ResolveTargetRequest, which settles the
row, supersedes the old pin and writes the new version in one transaction.
- Deleting a task or an archive stub revokes its pins and settles its open
target requests in the delete transaction. DeleteConversation and
DeleteConversations revoke the pins of the removed conversations in the
same transaction as the delete.
Opt-in flag (1.3)
- Per task through the create and metadata-patch paths, per conversation
through create and patch; exposed in the task DTO. A retest conversation
takes the flag of the finding's task, never its pins. A spawned task starts
with the gate off.
- The task flag is atomic and read on every call through TargetScope.Enabled.
TargetScope now carries the Interceptor that owns the gate.
Request, wait, decide (1.4)
- pendingManager keeps a list of waiters per request; resolve wakes all.
- RequestTargets: find-or-create per target, one card per request, wait on
channel, poll, context and wait bound. A plain request is never settled by
a call that leaves. A request merged with an ask is bound to its creating
call and a timeout never allows it.
- Decide records the approver (subject of the session token) and the remote
address for every human decision, classic asks included. On a target
request "allowed" pins the displayed addresses; that is the only writer of
pins.
- A request raised while the global egress proxy is set says the approval is
name-only and its pin is stored with name_only_effective.
- Routes: GET/POST .../target-pins and .../target-pins/{pid}/revoke under
/api/tasks/{id} and /api/conversations/{id}; decision_source=target filter.
- ValidateExemptionHost: an exemption written as an IP literal may be private
unicast, never loopback, link-local or metadata, unspecified or multicast.
69 lines
2.1 KiB
Go
69 lines
2.1 KiB
Go
package server
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"unicode/utf8"
|
|
|
|
"github.com/Autumn-27/artex/db"
|
|
)
|
|
|
|
const (
|
|
maxTaskNameRunes = 200
|
|
maxTaskMetadataRequestSize = 16 << 10
|
|
)
|
|
|
|
// updateTaskMetadata changes list-only task metadata. It intentionally does not
|
|
// touch lifecycle state, scheduling, or the task's immutable description/goal.
|
|
func (s *Server) updateTaskMetadata(w http.ResponseWriter, r *http.Request) {
|
|
taskID := r.PathValue("id")
|
|
if _, ok := s.m.Task(taskID); !ok {
|
|
writeErr(w, http.StatusNotFound, "task not found")
|
|
return
|
|
}
|
|
r.Body = http.MaxBytesReader(w, r.Body, maxTaskMetadataRequestSize)
|
|
var request struct {
|
|
Name *string `json:"name"`
|
|
Pinned *bool `json:"pinned"`
|
|
PlanQuietMode *bool `json:"plan_quiet_mode"`
|
|
TargetGate *bool `json:"target_gate"`
|
|
}
|
|
if err := decode(r, &request); err != nil {
|
|
var tooLarge *http.MaxBytesError
|
|
if errors.As(err, &tooLarge) {
|
|
writeErr(w, http.StatusRequestEntityTooLarge, "request body too large")
|
|
} else {
|
|
writeErr(w, http.StatusBadRequest, err.Error())
|
|
}
|
|
return
|
|
}
|
|
if request.Name == nil && request.Pinned == nil && request.PlanQuietMode == nil && request.TargetGate == nil {
|
|
writeErr(w, http.StatusBadRequest, "at least one of name, pinned, plan_quiet_mode or target_gate must be provided")
|
|
return
|
|
}
|
|
if request.Name != nil {
|
|
name := strings.TrimSpace(*request.Name)
|
|
if name == "" {
|
|
writeErr(w, http.StatusBadRequest, "task name cannot be empty")
|
|
return
|
|
}
|
|
if utf8.RuneCountInString(name) > maxTaskNameRunes {
|
|
writeErr(w, http.StatusBadRequest, fmt.Sprintf("task name must be at most %d characters", maxTaskNameRunes))
|
|
return
|
|
}
|
|
request.Name = &name
|
|
}
|
|
task, err := s.m.UpdateTaskMetadata(taskID, db.TaskPatch{Name: request.Name, Pinned: request.Pinned, PlanQuietMode: request.PlanQuietMode, TargetGate: request.TargetGate})
|
|
if err != nil {
|
|
writeErr(w, http.StatusInternalServerError, err.Error())
|
|
return
|
|
}
|
|
if task == nil {
|
|
writeErr(w, http.StatusNotFound, "task not found")
|
|
return
|
|
}
|
|
writeJSON(w, http.StatusOK, taskDTO(task, s.resolvedTaskStatus(task)))
|
|
}
|