bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: require private knowledge ACL support

Browse source
This commit is contained in:
冰朔 2026-08-02 22:30:04 +08:00
commit 0d105d03ec
2 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server-tools/lake-lamp-authz/install-architecture-provisioner.sh
View file

@ -193,10 +193,12 @@ fi
echo "registered HoloLake knowledge repository is missing" >&2 echo "registered HoloLake knowledge repository is missing" >&2
exit 1 exit 1
} }
if command -v setfacl >/dev/null 2>&1; then command -v setfacl >/dev/null 2>&1 || {
echo "setfacl is required for private knowledge repository access" >&2
exit 1
}
setfacl -R -m u:guanghu-authz:rX "$knowledge_repo" setfacl -R -m u:guanghu-authz:rX "$knowledge_repo"
setfacl -R -d -m u:guanghu-authz:rX "$knowledge_repo" setfacl -R -d -m u:guanghu-authz:rX "$knowledge_repo"
fi
runuser -u guanghu-authz -- git --git-dir="$knowledge_repo" rev-parse --verify refs/heads/main >/dev/null runuser -u guanghu-authz -- git --git-dir="$knowledge_repo" rev-parse --verify refs/heads/main >/dev/null
systemctl daemon-reload systemctl daemon-reload

2
server-tools/lake-lamp-authz/install-architecture-provisioner.test.js
View file

@ -24,6 +24,8 @@ test("bootstrap installer preserves secrets and deploys the complete HoloLake ca
assert.match(source, /openssl rand -hex 32/); assert.match(source, /openssl rand -hex 32/);
assert.match(source, /manual-backups\/lake-lamp-authz-/); assert.match(source, /manual-backups\/lake-lamp-authz-/);
assert.match(source, /rollback\(\)/); assert.match(source, /rollback\(\)/);
assert.match(source, /command -v setfacl/);
assert.match(source, /setfacl is required for private knowledge repository access/);
assert.match(source, /setfacl -R -m u:guanghu-authz:rX/); assert.match(source, /setfacl -R -m u:guanghu-authz:rX/);
assert.doesNotMatch(source, /cat ["']?\$authorization_env/); assert.doesNotMatch(source, /cat ["']?\$authorization_env/);
assert.doesNotMatch(source, /set -x/); assert.doesNotMatch(source, /set -x/);