fix(docs): Wiki.js session gate fail-open + read_only rule intersection #191
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/docs-session-source-permissions"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Two confirmed defects behind the Docs 403s and the Home->login->Home
bounce:
The session gate treated broker HTTP errors as a dead-session
verdict. brokerPost returned null on any non-2xx and the gate
destroyed the managed session on
data === null— so a 429 from thebroker's throttle:300,1 or a 5xx during a Portal restart
mass-logged-out Docs: navigations lost wikiSession, hit the
anonymous SSO bounce, and in-flight /_api calls evaluated as
anonymous (403, _error/unauthorized). Non-2xx answers are now
transport failures (undefined -> fail open), matching the
Forgejo/OpenProject gates and the gate's own documented policy:
only an explicit {active:false} 200 verdict or an absent
dwb_session cookie drops a session.
read_only orgs were not actually read-only on Docs. This Wiki.js 3
beta resolves page access from the pooled group RULES alone — the
group
permissionslist is a disjoint admin/route vocabulary thatnever intersects page rules — so collapsing permissions to the
guest set left every role's write grants in its ALLOW+SUBTREE rule
intact. ensureWikiJsOrgGroups now intersects the rule roles with
NativeAuthorizer::WIKIJS_READ_ONLY_PERMISSIONS (new shared const,
also used by wikijsPermissions and
DocsAccessService::effectivePermissions), so the provisioned and
projected rights match again: read:pages/read:assets/
read:comments/read:history/read:source and nothing else.
Also corrects the "(group globals) ∩ (page rules)" comments that
described a composition model this beta does not implement.
Two confirmed defects behind the Docs 403s and the Home->login->Home bounce: 1. The session gate treated broker HTTP errors as a dead-session verdict. brokerPost returned null on any non-2xx and the gate destroyed the managed session on `data === null` — so a 429 from the broker's throttle:300,1 or a 5xx during a Portal restart mass-logged-out Docs: navigations lost wikiSession, hit the anonymous SSO bounce, and in-flight /_api calls evaluated as anonymous (403, _error/unauthorized). Non-2xx answers are now transport failures (undefined -> fail open), matching the Forgejo/OpenProject gates and the gate's own documented policy: only an explicit {active:false} 200 verdict or an absent dwb_session cookie drops a session. 2. read_only orgs were not actually read-only on Docs. This Wiki.js 3 beta resolves page access from the pooled group RULES alone — the group `permissions` list is a disjoint admin/route vocabulary that never intersects page rules — so collapsing permissions to the guest set left every role's write grants in its ALLOW+SUBTREE rule intact. ensureWikiJsOrgGroups now intersects the rule roles with NativeAuthorizer::WIKIJS_READ_ONLY_PERMISSIONS (new shared const, also used by wikijsPermissions and DocsAccessService::effectivePermissions), so the provisioned and projected rights match again: read:pages/read:assets/ read:comments/read:history/read:source and nothing else. Also corrects the "(group globals) ∩ (page rules)" comments that described a composition model this beta does not implement.