tbenandClaude Opus 5.5
69988e08fc
A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
97 lines
2.8 KiB
TypeScript
97 lines
2.8 KiB
TypeScript
import {
|
|
BookOpen,
|
|
Bot,
|
|
CpuAi,
|
|
Database,
|
|
DatabaseBackup,
|
|
KeyRound,
|
|
Layers,
|
|
LockKeyhole,
|
|
Monitor,
|
|
Plug,
|
|
Users,
|
|
SlidersHorizontal,
|
|
UserRound,
|
|
Variable,
|
|
Wrench,
|
|
type LucideIcon,
|
|
} from "lucide-react";
|
|
import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
|
|
import canListUsers from "@/src/utils/rbac/can-list-users";
|
|
import canManageCrew from "@/src/utils/rbac/can-manage-crew";
|
|
|
|
export type SettingsPage = {
|
|
title: string;
|
|
url: string;
|
|
Icon: LucideIcon;
|
|
/**
|
|
* Shown and served to super admins only.
|
|
*/
|
|
super_admin_only?: boolean;
|
|
/**
|
|
* Who sees it, when that's an RBAC rule rather than super admins only.
|
|
*/
|
|
can_view?: (params: { user_types?: BUN_SQLITE_COBBLE_USER_TYPES[] | null }) => boolean;
|
|
};
|
|
|
|
export const SettingsComputersPath = "/admin/settings/computers";
|
|
export const SettingsBackupsPath = "/admin/settings/backups";
|
|
export const SettingsDatabasePath = "/admin/settings/database";
|
|
|
|
/**
|
|
* The `/admin/settings/*` sub pages, listed in the rail on every settings
|
|
* page. The first one is where `/admin/settings` lands.
|
|
*/
|
|
export const SettingsPages: SettingsPage[] = [
|
|
{
|
|
title: "General",
|
|
url: "/admin/settings/general",
|
|
Icon: SlidersHorizontal,
|
|
},
|
|
{ title: "Profile", url: "/admin/settings/profile", Icon: UserRound },
|
|
{
|
|
title: "Change password",
|
|
url: "/admin/settings/change-password",
|
|
Icon: KeyRound,
|
|
},
|
|
{ title: "Secrets", url: "/admin/settings/secrets", Icon: LockKeyhole },
|
|
{ title: "Bots", url: "/admin/settings/bots", Icon: Bot, can_view: canManageCrew },
|
|
{ title: "Workspaces", url: "/admin/settings/workspaces", Icon: Layers, can_view: canManageCrew },
|
|
{ title: "Computers", url: SettingsComputersPath, Icon: Monitor, can_view: canManageCrew },
|
|
{ title: "MCPs", url: "/admin/settings/mcps", Icon: Plug, can_view: canManageCrew },
|
|
{ title: "Tools", url: "/admin/settings/tools", Icon: Wrench, can_view: canManageCrew },
|
|
{ title: "Skills", url: "/admin/settings/skills", Icon: BookOpen, can_view: canManageCrew },
|
|
{
|
|
title: "Users",
|
|
url: "/admin/settings/users",
|
|
Icon: Users,
|
|
can_view: canListUsers,
|
|
},
|
|
{
|
|
title: "Models",
|
|
url: "/admin/settings/models",
|
|
Icon: CpuAi,
|
|
super_admin_only: true,
|
|
},
|
|
{
|
|
title: "Environment",
|
|
url: "/admin/settings/environment",
|
|
Icon: Variable,
|
|
super_admin_only: true,
|
|
},
|
|
{
|
|
title: "Backups",
|
|
url: SettingsBackupsPath,
|
|
Icon: DatabaseBackup,
|
|
super_admin_only: true,
|
|
},
|
|
{
|
|
title: "Database",
|
|
url: SettingsDatabasePath,
|
|
Icon: Database,
|
|
super_admin_only: true,
|
|
},
|
|
];
|
|
|
|
export const SettingsDefaultPath = "/admin/settings/general";
|