fix(extension-usage): 收紧用量看板访问权限#899
Conversation
为 chatluna-usage 控制台数据服务增加 authority 限制 在服务端 get() 中校验 console client 的 auth、过期时间与权限等级，避免无 auth 拦截时推送用量数据 将 usage 看板入口和 RPC listener 限制为 console 与 auth 同时可用时注册 在前端根据登录状态隐藏 home slot，并在失权时清理用量状态与废弃未完成请求 在插件服务声明中补充可选 auth 依赖
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
总体概述此PR在客户端实现异步组件加载和基于状态的条件禁用，同时在服务器端为数据服务和控制台事件监听器添加权限验证配置。 变更异步加载与权限验证
代码审查工作量估计🎯 2 (Simple) | ⏱️ ~10 minutes 诗
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces authentication and authority checks for the chatluna-usage extension, restricting access to the dashboard and its backend APIs to logged-in users with sufficient authority. The review feedback highlights that hard-coding the auth service dependency in ctx.inject and frontend state checks will break the dashboard in environments where the auth plugin is not enabled (such as local single-user setups). The reviewer suggests making the auth checks optional on both the backend and frontend so that the dashboard remains functional when the auth service is absent.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/extension-usage/client/state.ts`:
- Around line 41-44: loggedIn computed currently uses non-reactive Date.now(),
so expiration won't re-evaluate when time passes; fix by scheduling a timeout
when loggedIn becomes true to trigger re-evaluation/cleanup at user.expiredAt:
in the same module, track a timer id (clear previous on change), and when
loggedIn flips true compute delay = user.expiredAt - Date.now(), setTimeout to
either update a small reactive ref (e.g., now/tick) that loggedIn depends on or
dispatch the existing cleanup path (the watcher on loggedIn /
store.chatluna_usage clearing logic), and clear the timer when loggedIn becomes
false or user changes; reference: loggedIn computed, authStore.user.expiredAt,
the watch(loggedIn, ...) cleanup logic and store.chatluna_usage/list/loading so
the existing else branch runs when timeout fires.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 5cecc993-2ade-48c4-81a6-d2d66af893ab
⛔ Files ignored due to path filters (1)
packages/extension-usage/package.jsonis excluded by!**/*.json
📒 Files selected for processing (3)
packages/extension-usage/client/index.tspackages/extension-usage/client/state.tspackages/extension-usage/src/index.ts
dingyi222666
left a comment
dingyi222666
left a comment
There was a problem hiding this comment.
我感觉这个 pr 彻底做错了，绝对不需要这么多变更，你多看看 ctx.slot 的方法参数呢？
|
got it |
调整 ChatLuna Usage WebUI 的权限控制实现。 在 DataService 与 console listener 上使用 authority: 1，由 Koishi console 负责权限拦截。 在客户端 home slot 上使用 disabled 根据 chatluna_usage store 控制渲染，避免未授权用户加载用量面板。 移除前端手动 auth 状态判断，并撤回 package.json 中对 auth 可选服务的声明。
2 participants
概览
本 PR 收紧了 chatluna-usage 控制台看板的数据访问权限，避免未授权 console client 获取模型用量数据
改动内容
验证