uncle6me-web
f6728974ea
leo 實證的洞＝「知道網址即可讀走全部知識」；一修 fail-open（沒設 secret 就不擋）、 二修仍放行讀取＝洞沒補。三修（總管手改）：無 token→全部 401（health 豁免）， 老實例升級路徑＝重跑安裝器（同時注入金鑰與新 workflow），不以繼續外洩換相容。 ＋結構閘測試：斷言 src/index.ts 的無 token 分支不得有 return next()—— 擋「測試複本與真實作漂移」那類假綠（本輪正是它抓到二修的複本沒同步）。 kbdb vitest 60/60 全綠（總管親跑）。
66 lines
1.8 KiB
TypeScript
66 lines
1.8 KiB
TypeScript
// KBDB Base types. Base depends on D1 only.
|
|
// Optional modules add their own bindings (embed: VECTORIZE+AI). Base never references them.
|
|
|
|
export type Bindings = {
|
|
DB: D1Database;
|
|
ENVIRONMENT: string;
|
|
// Auth guard (t115 二修, fail-closed): provisioned by the installer automatically.
|
|
// NOT set → writes (POST/PATCH/DELETE/PUT) rejected 401; reads pass with a warning
|
|
// (upgrade-window grace so read-only workflows don't break before both workers are
|
|
// updated together).
|
|
// SET → all non-health routes require `Authorization: Bearer <token>`.
|
|
// cypher-executor sends this via kbdbBase(); portal/webhooks/recipes send it inline.
|
|
KBDB_INTERNAL_TOKEN?: string;
|
|
// Optional embed module (issue #7 / SDD T2.4). Present ONLY when the self-host opened
|
|
// semantic search (kbdb_embed:true → deploy injects [[vectorize]] + [ai]). Base never
|
|
// requires them; code checks `if (env.VECTORIZE && env.AI)` before touching embed.
|
|
VECTORIZE?: VectorizeIndex;
|
|
AI?: Ai;
|
|
};
|
|
|
|
export type EntryType =
|
|
| 'block'
|
|
| 'value'
|
|
| 'template'
|
|
| 'slot'
|
|
| 'project'
|
|
| 'workflow'
|
|
| 'recipe_stat';
|
|
|
|
export interface Entry {
|
|
id: string;
|
|
content: string | null;
|
|
entry_type: EntryType | string;
|
|
owner_id: string | null;
|
|
parent_id: string | null;
|
|
page_name: string | null;
|
|
refs_json: string;
|
|
tags_json: string;
|
|
task_status: string | null;
|
|
content_hash: string | null;
|
|
is_embedded: number;
|
|
confidence: number | null;
|
|
metadata_json: string | null;
|
|
created_at: number;
|
|
updated_at: number;
|
|
}
|
|
|
|
export interface Template {
|
|
id: string;
|
|
name: string;
|
|
description: string | null;
|
|
slots_json: string;
|
|
created_by: string | null;
|
|
created_at: number;
|
|
updated_at: number;
|
|
}
|
|
|
|
export interface EntryValue {
|
|
id: string;
|
|
record_id: string;
|
|
template_id: string;
|
|
slot_name: string;
|
|
entry_id: string;
|
|
created_at: number;
|
|
}
|