root/geo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(desktop): implement workspace foundation + desktop-client skeleton

Browse Source 
Plan 0 (workspaces): add workspaces + workspace_memberships schema, extend
JWT/Actor/claims with primary_workspace_id, seed default workspace per tenant,
thread workspace_id through tenant monitoring quota.

Plan A (desktop skeleton): new Electron app (apps/desktop-client) with main/
preload/renderer, shared Vue component package (packages/ui-shared), and server
surface — desktop client registration + token rotation + heartbeat, SSE task
event stream, desktop accounts/tasks/content handlers, publish job endpoint,
and supporting repositories, services, sqlc queries, and migrations.

Hard cutover per plan: remove browser-extension monitoring callback endpoints,
stub legacy media API in admin-web, and delete monitoring_callback_handler.go.
This commit is contained in:
liangxu
2026-04-19 14:18:20 +08:00
parent 98f9e95875
commit b16e9f0bd1
141 changed files with 21533 additions and 357 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/internal/shared/auth/claims.go
+4 -3
View File
@@ -5,8 +5,9 @@ import (
)
type Claims struct {
UserID int64 `json:"user_id"`
TenantID int64 `json:"tenant_id"`
Role string `json:"role"`
UserID int64 `json:"user_id"`
TenantID int64 `json:"tenant_id"`
PrimaryWorkspaceID int64 `json:"primary_workspace_id"`
Role string `json:"role"`
jwt.RegisteredClaims
}
server/internal/shared/auth/context.go
+4 -3
View File
@@ -3,9 +3,10 @@ package auth
import "context"
type Actor struct {
UserID int64
TenantID int64
Role string
UserID int64
TenantID int64
PrimaryWorkspaceID int64
Role string
}
type actorKey struct{}
server/internal/shared/auth/context_test.go
+15 -2
View File
@@ -8,7 +8,7 @@ import (
)
func TestWithActorAndFromCtx(t *testing.T) {
actor := Actor{UserID: 1, TenantID: 10, Role: "editor"}
actor := Actor{UserID: 1, TenantID: 10, PrimaryWorkspaceID: 100, Role: "editor"}
ctx := WithActor(context.Background(), actor)
got, ok := ActorFromCtx(ctx)
@@ -28,9 +28,22 @@ func TestMustActorPanics(t *testing.T) {
}
func TestMustActorReturns(t *testing.T) {
actor := Actor{UserID: 5, TenantID: 20, Role: "tenant_admin"}
actor := Actor{UserID: 5, TenantID: 20, PrimaryWorkspaceID: 200, Role: "tenant_admin"}
ctx := WithActor(context.Background(), actor)
got := MustActor(ctx)
assert.Equal(t, actor, got)
}
func TestActorCarriesPrimaryWorkspaceID(t *testing.T) {
ctx := WithActor(context.Background(), Actor{
UserID: 10,
TenantID: 20,
PrimaryWorkspaceID: 30,
Role: "member",
})
actor, ok := ActorFromCtx(ctx)
assert.True(t, ok)
assert.Equal(t, int64(30), actor.PrimaryWorkspaceID)
}
server/internal/shared/auth/jwt.go
+9 -7
View File
@@ -31,15 +31,16 @@ type TokenPair struct {
ExpiresAt int64 `json:"expires_at"`
}
func (m *Manager) Issue(userID, tenantID int64, role string) (*TokenPair, error) {
func (m *Manager) Issue(userID, tenantID, primaryWorkspaceID int64, role string) (*TokenPair, error) {
now := time.Now()
accessJTI := uuid.New().String()
refreshJTI := uuid.New().String()
accessClaims := Claims{
UserID: userID,
TenantID: tenantID,
Role: role,
UserID: userID,
TenantID: tenantID,
PrimaryWorkspaceID: primaryWorkspaceID,
Role: role,
RegisteredClaims: jwt.RegisteredClaims{
ID: accessJTI,
Subject: "access",
@@ -53,9 +54,10 @@ func (m *Manager) Issue(userID, tenantID int64, role string) (*TokenPair, error)
}
refreshClaims := Claims{
UserID: userID,
TenantID: tenantID,
Role: role,
UserID: userID,
TenantID: tenantID,
PrimaryWorkspaceID: primaryWorkspaceID,
Role: role,
RegisteredClaims: jwt.RegisteredClaims{
ID: refreshJTI,
Subject: "refresh",
server/internal/shared/auth/jwt_test.go
+5 -4
View File
@@ -11,7 +11,7 @@ import (
func TestIssueAndParse(t *testing.T) {
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
pair, err := mgr.Issue(42, 10, "tenant_admin")
pair, err := mgr.Issue(42, 10, 100, "tenant_admin")
require.NoError(t, err)
assert.NotEmpty(t, pair.AccessToken)
assert.NotEmpty(t, pair.RefreshToken)
@@ -23,6 +23,7 @@ func TestIssueAndParse(t *testing.T) {
require.NoError(t, err)
assert.Equal(t, int64(42), claims.UserID)
assert.Equal(t, int64(10), claims.TenantID)
assert.Equal(t, int64(100), claims.PrimaryWorkspaceID)
assert.Equal(t, "tenant_admin", claims.Role)
assert.Equal(t, "access", claims.Subject)
assert.Equal(t, pair.AccessJTI, claims.ID)
@@ -31,7 +32,7 @@ func TestIssueAndParse(t *testing.T) {
func TestParseRefreshToken(t *testing.T) {
mgr := NewManager("test-secret-key", 15*time.Minute, 7*24*time.Hour)
pair, err := mgr.Issue(1, 1, "viewer")
pair, err := mgr.Issue(1, 1, 10, "viewer")
require.NoError(t, err)
claims, err := mgr.Parse(pair.RefreshToken)
@@ -43,7 +44,7 @@ func TestParseRefreshToken(t *testing.T) {
func TestParseExpired(t *testing.T) {
mgr := NewManager("test-secret-key", -1*time.Second, -1*time.Second)
pair, err := mgr.Issue(1, 1, "viewer")
pair, err := mgr.Issue(1, 1, 10, "viewer")
require.NoError(t, err)
_, err = mgr.Parse(pair.AccessToken)
@@ -54,7 +55,7 @@ func TestParseWrongSecret(t *testing.T) {
mgr1 := NewManager("secret-one", 15*time.Minute, 7*24*time.Hour)
mgr2 := NewManager("secret-two", 15*time.Minute, 7*24*time.Hour)
pair, err := mgr1.Issue(1, 1, "viewer")
pair, err := mgr1.Issue(1, 1, 10, "viewer")
require.NoError(t, err)
_, err = mgr2.Parse(pair.AccessToken)
server/internal/shared/auth/middleware.go
+4 -3
View File
@@ -87,9 +87,10 @@ func Middleware(jwtMgr *Manager, sessions *SessionStore) gin.HandlerFunc {
}
actor := Actor{
UserID: claims.UserID,
TenantID: claims.TenantID,
Role: claims.Role,
UserID: claims.UserID,
TenantID: claims.TenantID,
PrimaryWorkspaceID: claims.PrimaryWorkspaceID,
Role: claims.Role,
}
c.Request = c.Request.WithContext(WithActor(c.Request.Context(), actor))
c.Next()
server/internal/shared/auth/middleware_test.go
+4 -3
View File
@@ -30,7 +30,7 @@ func setupTestMiddleware(t *testing.T) (*Manager, *SessionStore, *miniredis.Mini
func TestAuthMiddleware_ValidToken(t *testing.T) {
mgr, sessions, _ := setupTestMiddleware(t)
pair, err := mgr.Issue(1, 10, "editor")
pair, err := mgr.Issue(1, 10, 100, "editor")
require.NoError(t, err)
r := gin.New()
@@ -52,6 +52,7 @@ func TestAuthMiddleware_ValidToken(t *testing.T) {
assert.Equal(t, http.StatusOK, w.Code)
assert.Equal(t, int64(1), gotActor.UserID)
assert.Equal(t, int64(10), gotActor.TenantID)
assert.Equal(t, int64(100), gotActor.PrimaryWorkspaceID)
assert.Equal(t, "editor", gotActor.Role)
}
@@ -87,7 +88,7 @@ func TestAuthMiddleware_InvalidToken(t *testing.T) {
func TestAuthMiddleware_RefreshTokenRejected(t *testing.T) {
mgr, sessions, _ := setupTestMiddleware(t)
pair, err := mgr.Issue(1, 10, "editor")
pair, err := mgr.Issue(1, 10, 100, "editor")
require.NoError(t, err)
r := gin.New()
@@ -105,7 +106,7 @@ func TestAuthMiddleware_RefreshTokenRejected(t *testing.T) {
func TestAuthMiddleware_BlacklistedToken(t *testing.T) {
mgr, sessions, mr := setupTestMiddleware(t)
pair, err := mgr.Issue(1, 10, "editor")
pair, err := mgr.Issue(1, 10, 100, "editor")
require.NoError(t, err)
// Blacklist the access token's JTI