fix(lr-eb1a): add missing permission gates on schedule_move, set_session_visibility, kill_process#219
Merged
Merged
Conversation
…ion_visibility, kill_process Three WS handlers in project-sessions.js skipped access-control checks that all sibling handlers enforce: - schedule_move: add scheduledTasks permission check matching the gate already present for schedule_create in project-user-message.js. Without this fix, the sessions.js handler short-circuits before the gate in project-user-message.js is reached. - set_session_visibility: add canAccessSession guard before calling sm.setSessionVisibility, matching the pattern used by set_session_agent, set_session_bookmark, and reorder_session_bookmarks. - kill_process: add to the admin-only gate block so non-admin users cannot SIGTERM other users' claude subprocesses in multi-user mode. Single-user mode (isMultiUser() === false) behavior is unchanged for all three fixes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ts for all three WS permission gates - kill_process gate was dead (handler return true before line-1540 gate); moved inline at handler entry matching the update_now pattern (line 533). - Removed kill_process from the line-1540 gate block (it never reached there). - test/ws-permission-gates-lr-eb1a.test.js: 7 tests driving real attachSessions; covers 3a (schedule_move denied/allowed by scheduledTasks perm), 3b (set_session_visibility denied/allowed by canAccessSession), 3c (kill_process denied for non-admin, allowed for admin, allowed single-user). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three WS handlers in project-sessions.js skipped access-control checks that all sibling handlers enforce. schedule_move: scheduledTasks permission check added. set_session_visibility: canAccessSession guard added. kill_process: added to admin-only gate. Single-user mode unchanged. Resolves lr-eb1a.