From f70d80ca4cc4a98bc1914863740f5d4323a3093d Mon Sep 17 00:00:00 2001 From: chenchen Date: Thu, 7 May 2026 15:15:17 +0800 Subject: [PATCH] Revert "fix(agnet): preserve root admin's group during Agnet session sync" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 992a965. After re-reading the upstream Heicode design docs (heicode.md, heicode-runtime-auth-newapi-secret-design.md, plan.md), it is clear that: 1. users.group = channelId is the correct upstream behaviour. Agnet's /me is the source of truth for which NewAPI channel a user belongs to. Forking that logic in NewAPI to special-case role>=root breaks the documented "Manager owns identity, NewAPI is just the model gateway" boundary. 2. The empty-abilities symptom isn't a NewAPI fork bug. It's that chenchen was created by raw SQL INSERT into NewAPI's users table — a path that doesn't exist in the design. Real users get their channelId from Manager (mcp-server) at login, and ability rows for that channelId are provisioned out-of-band by platform operations when the channel goes live. 3. Patching NewAPI to silently keep an admin's hand-edited group hides the real provisioning gap and pollutes the upstream sync logic for every future user. Restoring upstream behaviour. Out-of-band fixes (whether to provision abilities, route mcp-server logins, etc.) belong elsewhere. Co-Authored-By: Claude Opus 4.7 (1M context) --- heicode/controller/heicode_agnet_session.go | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/heicode/controller/heicode_agnet_session.go b/heicode/controller/heicode_agnet_session.go index fdf1582..534cd37 100644 --- a/heicode/controller/heicode_agnet_session.go +++ b/heicode/controller/heicode_agnet_session.go @@ -226,13 +226,7 @@ func syncLocalUserFromAgnet(me agnetMeEnvelope) (*model.User, error) { user.DisplayName = name changed = true } - // Platform administrators keep their human-assigned group (e.g. "default") - // regardless of what Agnet's /me returns. Operators provision channel - // membership for them manually; letting Agnet rewrite it on every web - // login would force them onto whatever stub channel Agnet hands out, and - // abilities lookup against that empty group would erase model visibility. - if ch := strings.TrimSpace(me.Data.ChannelID); ch != "" && user.Group != ch && - user.Role < common.RoleRootUser { + if ch := strings.TrimSpace(me.Data.ChannelID); ch != "" && user.Group != ch { user.Group = ch changed = true }