fix(acl): a missing allow_ip_literals means allowed (#261) #426

Merged
jared merged 1 commits from fix/acl-ip-literals-default into lotus 2026-10-19 14:21:18 -04:00
Owner

Fixes #261.

  • Default: allow_ip_literals absent → allowed, the spec default. The editor used ?? false, so the first save in a room with no ACL (or one omitting the field) silently banned IP-literal servers.
  • normalizeServerAcl() (in utils/serverAcl.ts) fills the spec defaults once. It feeds the initial state, the unsaved-changes check and the save.
  • Related: for an existing ACL with no allow list, the editor used to show * (allow all). The spec reads it as allowing no servers, so one save could silently open a deny-all room. The editor now shows it as it is, matching the /acl command, which already refuses to widen it.
  • Checkbox: still driven by onClick (folds' Checkbox has no onChange), now readOnly, so React's "checked without onChange" warning is gone.

Verified

  • Unit tests: 4 new, 9/9 in the file.
  • Browser, on a fresh room with no ACL: the box starts ticked. Clicking the box, its label and the Space key all toggle it, with no React warning. Adding a deny entry and saving without touching the box stored {"allow":["*"],"allow_ip_literals":true,"deny":["badserver.example"]}.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

Fixes #261. - **Default:** `allow_ip_literals` absent → **allowed**, the spec default. The editor used `?? false`, so the first save in a room with no ACL (or one omitting the field) silently banned IP-literal servers. - `normalizeServerAcl()` (in `utils/serverAcl.ts`) fills the spec defaults once. It feeds the initial state, the unsaved-changes check and the save. - **Related:** for an existing ACL with no `allow` list, the editor used to *show* `*` (allow all). The spec reads it as allowing no servers, so one save could silently open a deny-all room. The editor now shows it as it is, matching the `/acl` command, which already refuses to widen it. - **Checkbox:** still driven by `onClick` (folds' Checkbox has no `onChange`), now `readOnly`, so React's "checked without onChange" warning is gone. **Verified** - Unit tests: 4 new, 9/9 in the file. - Browser, on a fresh room with no ACL: the box starts **ticked**. Clicking the box, its label and the Space key all toggle it, with no React warning. Adding a deny entry and saving without touching the box stored `{"allow":["*"],"allow_ip_literals":true,"deny":["badserver.example"]}`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared added 1 commit 2026-10-19 14:07:08 -04:00
fix(acl): a missing allow_ip_literals means allowed (#261)
CI / Build & Quality Checks (pull_request) Successful in 1m54s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 10s
CI / Playwright smoke (e2e) (pull_request) Successful in 11m45s
adf94d7bc1
The Server ACL editor treated an absent allow_ip_literals as false, so the
first save in a room with no ACL (or one omitting the field) silently banned
IP-literal servers. The spec default is true. normalizeServerAcl() fills the
spec defaults once and feeds the initial state, the dirty check and the save.
It also stops showing an existing ACL with no allow list as allow-all: per
spec that allows no servers, and the /acl command already keeps it as-is.

The checkbox is driven by onClick (folds has no onChange), now readOnly so
React stops warning about a checked input without onChange.

Fixes #261

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
jared merged commit a5471a0576 into lotus 2026-10-19 14:21:18 -04:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#426