From 48e999149c21ce4ccac266d187b944dbc87c8053 Mon Sep 17 00:00:00 2001
From: hjjjj <1311711287@qq.com>
Date: Wed, 1 Apr 2026 12:01:56 +0800
Subject: [PATCH] feat(server): enhance user permissions and access control

- Introduced root admin checks in various functions to streamline permission handling for users.
- Updated skill and agent management routes to simplify access control by removing redundant role checks.
- Added favicon links to HTML files for improved branding in the admin and updates sections.
---
 admin-web/index.html   |  3 +++
 routes/auth.js         |  1 +
 server.js              | 39 ++++++++++++++++-----------------------
 updates/index.html     |  3 +++
 updates/latest-mac.yml | 11 -----------
 updates/latest.yml     |  8 --------
 6 files changed, 23 insertions(+), 42 deletions(-)
 delete mode 100644 updates/latest-mac.yml
 delete mode 100644 updates/latest.yml

diff --git a/admin-web/index.html b/admin-web/index.html
index 5b4ef34..3168d2c 100644
--- a/admin-web/index.html
+++ b/admin-web/index.html
@@ -4,6 +4,9 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>权限管理平台</title>
+    <link rel="icon" type="image/png" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png" />
+    <link rel="shortcut icon" type="image/png" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png" />
+    <link rel="apple-touch-icon" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png" />
     <style>
       :root {
         --bg: #f8fafc;
diff --git a/routes/auth.js b/routes/auth.js
index c488b69..5209c30 100644
--- a/routes/auth.js
+++ b/routes/auth.js
@@ -98,6 +98,7 @@ function sanitizeUserForClient(userDoc) {
 }
 
 function canAccessFeature(user, permissionKey) {
+  if (user?.is_root_admin) return true
   const perms = sanitizePermissions(user.permissions)
   return !!perms[permissionKey]
 }
diff --git a/server.js b/server.js
index 9ececd7..a38847f 100644
--- a/server.js
+++ b/server.js
@@ -157,7 +157,12 @@ function normalizeTagList(tags) {
   return out
 }
 
+const ROOT_MODE_TAGS = ['clarify', 'cowork', 'create', 'video', 'code']
+
 function getAllowedModeTagsFromUser(user) {
+  if (user?.is_root_admin) {
+    return normalizeTagList(ROOT_MODE_TAGS)
+  }
   const modes = Array.isArray(user?.permissions?.allowedModes) ? user.permissions.allowedModes : []
   return normalizeTagList(modes)
 }
@@ -167,24 +172,12 @@ function buildModeIntersectionFilter(user, requestedTags = []) {
   const requested = normalizeTagList(requestedTags)
   const isRootAdmin = !!user?.is_root_admin
   const isManagementList = requested.length === 0
+  if (isRootAdmin && isManagementList) return {}
   const effective =
     requested.length > 0
       ? requested.filter((tag) => allowedTags.includes(tag))
       : allowedTags
 
-  if (isRootAdmin && isManagementList) {
-    if (effective.length === 0) {
-      return { $or: [{ tags: { $exists: false } }, { tags: { $size: 0 } }] }
-    }
-    return {
-      $or: [
-        { tags: { $in: effective } },
-        { tags: { $exists: false } },
-        { tags: { $size: 0 } }
-      ]
-    }
-  }
-
   if (effective.length === 0) {
     return { _id: { $exists: false } }
   }
@@ -192,10 +185,10 @@ function buildModeIntersectionFilter(user, requestedTags = []) {
 }
 
 function canUserAccessTaggedResource(user, resourceTags) {
+  if (user?.is_root_admin) return true
   const allowedTags = getAllowedModeTagsFromUser(user)
   const tags = normalizeTagList(resourceTags)
-  const isRootAdmin = !!user?.is_root_admin
-  if (tags.length === 0) return isRootAdmin
+  if (tags.length === 0) return false
   if (allowedTags.length === 0) return false
   return tags.some((tag) => allowedTags.includes(tag))
 }
@@ -495,7 +488,7 @@ app.get('/api/skills/:name/files/*', async (req, res) => {
 app.post('/api/skills/:name/lock', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
         return res.status(403).json({ success: false, error: '无权编辑技能' })
       }
       const skill = await skillsCollection.findOne({ name: req.params.name })
@@ -520,7 +513,7 @@ app.post('/api/skills/:name/lock', async (req, res) => {
 app.delete('/api/skills/:name/lock', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
         return res.status(403).json({ success: false, error: '无权编辑技能' })
       }
       const skill = await skillsCollection.findOne({ name: req.params.name })
@@ -590,7 +583,7 @@ app.get('/api/skills/mine', async (req, res, next) => {
 app.patch('/api/skills/:name/tags', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
         return res.status(403).json({ success: false, error: '无权修改技能标签' })
       }
       const allowedModeTags = getAllowedModeTagsFromUser(req.user)
@@ -636,7 +629,7 @@ app.patch('/api/skills/:name/tags', async (req, res) => {
 app.post('/api/skills/:name/publish', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewSkillsPage')) {
         return res.status(403).json({ success: false, error: '无权发布或修改技能' })
       }
 
@@ -965,7 +958,7 @@ app.get('/api/agents/:name', async (req, res) => {
 app.post('/api/agents/:name/publish', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
         return res.status(403).json({ success: false, error: '无权发布或修改智能体' })
       }
       const { content, description, tags, localModifiedAt } = req.body
@@ -1045,7 +1038,7 @@ app.post('/api/agents/:name/publish', async (req, res) => {
 app.patch('/api/agents/:name/tags', async (req, res) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
         return res.status(403).json({ success: false, error: '无权修改智能体标签' })
       }
       const allowedModeTags = getAllowedModeTagsFromUser(req.user)
@@ -1087,7 +1080,7 @@ app.delete('/api/agents/:name', requireAdmin(async (req, res) => {
 app.post('/api/agents/:name/lock', async (req, res, next) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
         return res.status(403).json({ success: false, error: '无权编辑智能体' })
       }
       const agent = await agentsCollection.findOne({ name: req.params.name })
@@ -1107,7 +1100,7 @@ app.post('/api/agents/:name/lock', async (req, res, next) => {
 app.delete('/api/agents/:name/lock', async (req, res, next) => {
   authRoutes.verifyToken(req, res, async () => {
     try {
-      if (req.user.role !== 'admin' && !authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
+      if (!authRoutes.hasPermission(req.user, 'canViewAgentsPage')) {
         return res.status(403).json({ success: false, error: '无权编辑智能体' })
       }
       const agent = await agentsCollection.findOne({ name: req.params.name })
diff --git a/updates/index.html b/updates/index.html
index d33e901..4566ae8 100644
--- a/updates/index.html
+++ b/updates/index.html
@@ -4,6 +4,9 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>LikeCowork 安装指南</title>
+  <link rel="icon" type="image/png" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png">
+  <link rel="shortcut icon" type="image/png" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png">
+  <link rel="apple-touch-icon" href="https://oss.xintiao85.com/images/20260312_110209_2a7c6d79c7469d640f64cb663d6983b1.png">
   <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }
     body {
diff --git a/updates/latest-mac.yml b/updates/latest-mac.yml
deleted file mode 100644
index 3717c93..0000000
--- a/updates/latest-mac.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-version: 1.2.1
-files:
-  - url: likecowork-1.2.1-x64-mac.zip
-    sha512: QIOFv41c9MYOPPKaxz4QunYHZJoobVSXhQYXQFgFJUm89Hf3AEC8PtHx3N8e7A99Nun7UuYwO16EaS9YmMJu7w==
-    size: 978479730
-  - url: likecowork-1.2.1-arm64-mac.zip
-    sha512: L6CFKjmxD0Aep4gXkX2ojPuhPnwphHwoEVZXcI45WXmMzQRZfSG3bXY4o+PdZ+nfE7CFYkYbGl9g9yTbc/fPKQ==
-    size: 973708487
-path: likecowork-1.2.1-x64-mac.zip
-sha512: QIOFv41c9MYOPPKaxz4QunYHZJoobVSXhQYXQFgFJUm89Hf3AEC8PtHx3N8e7A99Nun7UuYwO16EaS9YmMJu7w==
-releaseDate: '2026-03-27T08:06:20.025Z'
diff --git a/updates/latest.yml b/updates/latest.yml
deleted file mode 100644
index 85ad871..0000000
--- a/updates/latest.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-version: 1.2.1
-files:
-  - url: likecowork-1.2.1-setup.exe
-    sha512: c3DLm7mfzV5e94GRDSkB0RWkqvSOJO04TVbMBR3FIoVsiRCTtGn/raRXYfs+xTS9mZ5JlpkYTdM+gtS3aQ3UhQ==
-    size: 938877301
-path: likecowork-1.2.1-setup.exe
-sha512: c3DLm7mfzV5e94GRDSkB0RWkqvSOJO04TVbMBR3FIoVsiRCTtGn/raRXYfs+xTS9mZ5JlpkYTdM+gtS3aQ3UhQ==
-releaseDate: '2026-03-27T07:51:13.507Z'