goclaw

mirror of https://github.com/tiennm99/goclaw.git synced 2026-08-01 10:20:32 +00:00

Files

T

viettranx 7aa47d1baf refactor(security): remove cross-tenant bypass, enforce strict tenant isolation

- Add RoleOwner ("owner") to permissions hierarchy (above admin)
- Replace all IsCrossTenant/client.IsCrossTenant() permission guards with
  IsOwnerRole/client.IsOwner() role-based checks (20+ locations)
- Remove cross-tenant bypass from tenantClauseN SQL helper — always adds
  AND tenant_id = $N (fail-closed)
- Add explicit unscoped store methods for startup: ListAllProviders,
  ListAllInstances, ListAllEnabled, GetByIDUnscoped, GetTeamUnscoped
- Remove CrossTenant from auth layer: owner users get role "owner" with
  concrete tenant ID (MasterTenantID fallback), no bypass flag
- Remove crossTenant field from WS Client; connect response sends
  is_owner instead of cross_tenant
- Simplify event filter from 3-mode to 2-mode (tenant-scoped + owner sees system events)
- Fix channel instance loader to use inst.TenantID for agent lookup
- Fix agent embedding goroutine to capture tenant from caller context
- Fix provider cache invalidation to use event.TenantID
- Separate skills store: ListAllSystemSkills (system only) vs
  ListAllSkills (system + tenant-scoped), StoreMissingDeps restricted
  to system skills only
- Frontend: isCrossTenant → isOwner, add "owner" to UserRole type,
  RequireAdmin uses hasMinRole for owner > admin hierarchy

2026-03-24 20:40:59 +07:00

templates

fix(agent): improve team lead delegation messaging + group chat reply hint

2026-03-19 13:35:57 +07:00

files.go

feat: agent heartbeat system — periodic proactive check-ins (#245 )

2026-03-18 13:11:44 +07:00

load_store.go

Initial commit: GoClaw AI agent gateway

2026-02-22 14:58:07 +07:00

seed_store_test.go

refactor(security): remove cross-tenant bypass, enforce strict tenant isolation