mirror of
https://github.com/profullstack/agentbbs.git
synced 2026-08-13 14:27:27 +00:00
Anthony Ettinger
232b8151a2
A privileged operator console reached as `ssh admin@host`, gated by route
plus the $AGENTBBS_ADMINS allowlist (admin status is operator-granted only,
never self-assigned in-band). It is a self-contained Bubble Tea model, not a
hub plugin, so it never appears in the public menu.
Sections (PRD §6):
- Users & members: list accounts; b = suspend/ban (operators protected).
Banned accounts are blocked at the hub and pod@ routes.
- Sessions & pods: live in-memory session registry; k = disconnect.
- Moderation & audit: admin action log + agent@ transcripts (tab to switch).
- Config & plugins: runtime snapshot; space = enable/disable a plugin
(persisted; filtered from the hub on next sign-in).
Every privileged action is written to a new admin_actions audit table.
store: + banned column, admin_actions and plugin_state tables, and the
backing methods (ListUsers/SetBanned/RecentSessions/LogAdminAction/
RecentAdminActions/RecentChatsAll/DisabledPlugins/SetPluginDisabled), with
unit tests. auth: admin allowlist helpers + tests. Docs in docs/admin.md;
README M2 flipped to done.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1,000 B
Go
42 lines
1,000 B
Go
package auth
|
|
|
|
import "testing"
|
|
|
|
func TestIsAdminName(t *testing.T) {
|
|
for _, name := range []string{"admin", "ADMIN", "sysop"} {
|
|
if !IsAdminName(name) {
|
|
t.Errorf("IsAdminName(%q) = false, want true", name)
|
|
}
|
|
}
|
|
for _, name := range []string{"bbs", "pod", "anthony", ""} {
|
|
if IsAdminName(name) {
|
|
t.Errorf("IsAdminName(%q) = true, want false", name)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAdminsAllowlist(t *testing.T) {
|
|
t.Setenv("AGENTBBS_ADMINS", "anthony, Root ops")
|
|
admins := Admins()
|
|
for _, want := range []string{"anthony", "root", "ops"} {
|
|
if !admins[want] {
|
|
t.Errorf("expected %q in allowlist, got %v", want, admins)
|
|
}
|
|
}
|
|
if !IsAdmin("ANTHONY") {
|
|
t.Error("IsAdmin should be case-insensitive")
|
|
}
|
|
if IsAdmin("eve") {
|
|
t.Error("eve must not be an admin")
|
|
}
|
|
}
|
|
|
|
func TestAdminsEmpty(t *testing.T) {
|
|
t.Setenv("AGENTBBS_ADMINS", "")
|
|
if len(Admins()) != 0 {
|
|
t.Error("empty env should yield no admins")
|
|
}
|
|
if IsAdmin("anyone") {
|
|
t.Error("nobody is admin when allowlist is empty")
|
|
}
|
|
}
|