mirror of
https://github.com/mudler/LocalAI.git
synced 2026-11-06 20:43:27 -05:00
Ettore Di Giacinto
9e6d6520bd
The capabilities, role grants and pairing that a connector binding
stores now decide what a sender can make the agent do.
Authorize is one pure function: the capability must be in the owner's
ceiling for the binding and the sender must be on the allowlist. A
sensitive capability then needs a paired sender; roles never count for
it. Any other capability needs a pairing or a role that the owner
granted and that the kind lists. The default is no.
Each message gets a grant for its sender. A message that joins a
running turn narrows it to what both senders may do. The tool builder
offers a gated tool only for a held capability, and the tool checks
again when the model calls it, so a call that gets through is refused
with the reason. Today this covers propose_change (memory and profile
kinds), revert_change, the trigger tools, and files sent to the bot. A
chat worker gets the grant with the start request.
The capability gate that the trigger features ask is now answered by
Authorize, and the application sets it. Other features can add a
global switch with AddCapabilitySwitch.
Every use records an allow or deny row (time, binding, sender IDs,
roles, capability, result; no text or codes). GET
/api/chats/connectors/{id}/access returns the effective permissions
per kind of sender and the latest rows, for an add-on settings page.
A binding saved before this change has no capabilities, so its senders
lose these features until the owner enables them.
Assisted-by: Claude:claude-sonnet-5-5 go swag
40 lines
1.7 KiB
Go
40 lines
1.7 KiB
Go
package workerctl
|
|
|
|
// ChatStartRequest is the payload of a chat start: a frontend asks a chat
|
|
// worker to run the next turn of an unattended chat (a trigger run, a job or a
|
|
// connector message). The worker reads the chat, its owner and its model from
|
|
// the shared database, so the request names only the chat and the message.
|
|
type ChatStartRequest struct {
|
|
// Principal is the owner of the chat as the chats service names it.
|
|
Principal string `json:"principal"`
|
|
ChatID string `json:"chat_id"`
|
|
Text string `json:"text"`
|
|
// Grant is set for a connector message: what the sender of the turn may
|
|
// do. The worker keeps it for the turn, so a tool it builds is offered
|
|
// only for the capabilities in it. A start without a grant for a connector
|
|
// chat gets none of the gated tools.
|
|
Grant *ChatGrant `json:"grant,omitempty"`
|
|
}
|
|
|
|
// ChatGrant is the outcome of the permission check for the senders of one
|
|
// connector turn (see studio.Authorize). It holds IDs, never message text.
|
|
type ChatGrant struct {
|
|
Binding string `json:"binding"`
|
|
Kind string `json:"kind,omitempty"`
|
|
Senders []string `json:"senders,omitempty"`
|
|
Roles []string `json:"roles,omitempty"`
|
|
// Caps are the capabilities every sender of the turn holds.
|
|
Caps []string `json:"caps,omitempty"`
|
|
}
|
|
|
|
// ChatStartReply is the worker's answer to a ChatStartRequest. With Error
|
|
// empty, Started says whether the message began a turn on the worker;
|
|
// otherwise a turn was running, and the message waits under PendingID. A
|
|
// non-empty Error is the worker's refusal: the worker is present, and nothing
|
|
// started.
|
|
type ChatStartReply struct {
|
|
Started bool `json:"started,omitempty"`
|
|
PendingID string `json:"pending_id,omitempty"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|