taijibaga/heicode
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "fix(agnet): preserve root admin's group during Agnet session sync"

Browse Source 
This reverts commit 992a965. After re-reading the upstream Heicode
design docs (heicode.md, heicode-runtime-auth-newapi-secret-design.md,
plan.md), it is clear that:

  1. users.group = channelId is the correct upstream behaviour. Agnet's
     /me is the source of truth for which NewAPI channel a user belongs
     to. Forking that logic in NewAPI to special-case role>=root breaks
     the documented "Manager owns identity, NewAPI is just the model
     gateway" boundary.

  2. The empty-abilities symptom isn't a NewAPI fork bug. It's that
     chenchen was created by raw SQL INSERT into NewAPI's users table —
     a path that doesn't exist in the design. Real users get their
     channelId from Manager (mcp-server) at login, and ability rows for
     that channelId are provisioned out-of-band by platform operations
     when the channel goes live.

  3. Patching NewAPI to silently keep an admin's hand-edited group hides
     the real provisioning gap and pollutes the upstream sync logic for
     every future user.

Restoring upstream behaviour. Out-of-band fixes (whether to
provision abilities, route mcp-server logins, etc.) belong elsewhere.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
chenchen
2026-05-07 15:15:17 +08:00
co-authored by Claude Opus 4.7
parent 992a965cd9
commit f70d80ca4c
1 changed files with 1 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
heicode/controller/heicode_agnet_session.go
+1 -7
View File
@@ -226,13 +226,7 @@ func syncLocalUserFromAgnet(me agnetMeEnvelope) (*model.User, error) {
user.DisplayName = name
changed = true
}
// Platform administrators keep their human-assigned group (e.g. "default")
// regardless of what Agnet's /me returns. Operators provision channel
// membership for them manually; letting Agnet rewrite it on every web
// login would force them onto whatever stub channel Agnet hands out, and
// abilities lookup against that empty group would erase model visibility.
if ch := strings.TrimSpace(me.Data.ChannelID); ch != "" && user.Group != ch &&
user.Role < common.RoleRootUser {
if ch := strings.TrimSpace(me.Data.ChannelID); ch != "" && user.Group != ch {
user.Group = ch
changed = true
}