tmp

2026-09-02 22:39:04 +08:00
parent c95a9c4c95
commit f81f6906f0
24 changed files with 389 additions and 1024 deletions
@@ -97,6 +97,11 @@ export default class WebSocketServerManager {
            return;
          }
          if (msg.agent === 'escort-admin') {
+            // 管理端 agent 含写库/环境变量等高危工具，必须校验管理员角色，防止普通用户越权
+            if (!userInfo.app || !("wxapp-escort-admin" in userInfo.app)) {
+              ws.send(JSON.stringify({ type: 'error', content: '无管理员权限' }));
+              return;
+            }
            await adminAgent.streamChat(userInfo, [msg], (source, type, content, id) => {
              send(source, type, content, id);
            });