Per-user local_project_disabled flag (block create + index)#63
Merged
Conversation
…dex) Add an admin-controlled, per-user switch that forbids a user from creating local projects and from indexing/reindexing, while keeping search of their already-indexed projects and workspace creation available. Admins are always exempt. - DB: users.local_project_disabled INTEGER NOT NULL DEFAULT 0 + idempotent migration #14. Default 0 backfills existing and new users to "allowed" (backward compatible). - Carry the column through every users.User builder, including the two hand-rolled auth-path JOINs that populate ac.User: apikeys.Authenticate (CLI/API-key path) and sessions.Get (dashboard path) — missing either is a silent enforcement bypass. - Enforcement: requireLocalProjectActions guard (access.go) gates CreateProject and index begin/files/finish with 403; admins and CIX_AUTH_DISABLED exempt. index/cancel (cleanup) and index/status + search (read) stay open. - Admin API: local_project_disabled on userPayload (/auth/me + /admin/users) and as a PATCH /admin/users/{id} field; SetLocalProjectDisabled setter. - OpenAPI: User + UpdateUserRequest schema fields, 403 docs; regen dashboard types; admin Users table gains a per-user toggle ("Always" for admins). - Tests: migration backfill + setter round-trip; httpapi gating (403 on create/index for a restricted user, read/workspace stay allowed, admin exempt, re-enable restores). docs/AUTH_REVIEW.md updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The cix-workspace skill and its investigator sub-agent assumed a single cix backend. The cix CLI supports several named servers (--server <alias>, CIX_SERVER), and a workspace + all its repos live on exactly one server — so a cross-project workflow that mixes servers silently returns empty or wrong-repo results. - cix-workspace SKILL: new "which server hosts the workspace?" section; thread --server through Step 0/1/2, the sub-agent fan-out prompt, the quick reference, and the TL;DR. Replace the raw curl per-project search (which hardcodes one server's URL/key) with `cix search -n <project> --server <alias>`, which resolves the right backend from config. - cix-workspace-investigator: every cix call must carry --server <alias> when the workspace is on a non-default server (tools list, hard rule 1, the "where your project lives" preamble). - skills/README.md: align the plugin install snippet with the dashboard onboarding card — `claude plugin …` console commands, drop the obsolete /reload-plugins. - Sync canonical skills into the plugin bundle (sync-skills.sh); plugin bats suite green (15/15). The cix skill already documented multi-server; no change needed there. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… edges Address review feedback on the per-user restriction: - Add an index/files 403 case to the gating test (the guard is identical to begin/finish, but explicit coverage closes the gap). - Document the role-independent persistence edge: the flag is not cleared on promote-to-admin (admins just ignore it) and re-activates on demotion — intentional. Noted at SetLocalProjectDisabled and the dashboard "Always" cell. - Document the mid-indexing edge: flipping the flag during an in-flight index session strands it; index/cancel stays open and the session TTLs out. Noted at requireLocalProjectActions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Adds an admin-controlled, per-user switch that forbids a user from creating local projects and from indexing/reindexing, while keeping search of their already-indexed projects and workspace creation available. Admins are always exempt.
Requested behavior:
Design
users.local_project_disabled(boolean,true= forbidden). Inverted polarity →DEFAULT 0makes existing and new users allowed by default; an admin flips it to restrict someone.role=adminandCIX_AUTH_DISABLEDshort-circuit the guard), matching the existing ownership/index model.API error (403): your account is not permitted to create or index local projects— the CLI already surfaces the serverdetail.Changes
columnExistsshort-circuit,ALTER … DEFAULT 0).users.Userconstructor, crucially the two hand-rolled auth-path JOINs that populateac.User—apikeys.Authenticate(CLI/API-key) andsessions.Get(dashboard). Missing either would be a silent enforcement bypass.requireLocalProjectActionsinaccess.go; gatesCreateProjectand indexbegin/files/finish.index/cancel(cleanup) andindex/status+ search (read) stay open.userPayload(/auth/me+/admin/users) and aPATCH /admin/users/{id}field;SetLocalProjectDisabledsetter.Tests
users: migration backfill leaves existing rows allowed; newCreatedefaults to allowed;SetLocalProjectDisabledround-trips throughGetByID/Authenticate.db: legacy-schema migration backfills to0and is idempotent.httpapi: restricted user → 403 on create + index begin/finish;/auth/mereflects the flag; read (index/status) and workspace creation stay allowed; admin exempt even when flagged; re-enabling restores access.docs/AUTH_REVIEW.mdaccess matrix updated.make testgreen; dashboardtypecheck+buildgreen. No build artifacts committed (dist/*andgenerated.tsare gitignored;dist/.gitkeeppreserved).🤖 Generated with Claude Code