fix(cli): expose asynchronous dependency refresh operations

back/api/open.ts

@@ -27,7 +27,7 @@ export default (app: Router) => {
     celebrate({
       body: Joi.object({
         name: Joi.string().optional().allow('').disallow('system'),
-        scopes: Joi.array().items(Joi.string().required().invalid('apps')),
+        scopes: Joi.array().items(Joi.string().required()),
       }),
     }),
     async (req: Request, res: Response, next: NextFunction) => {
@@ -47,7 +47,7 @@ export default (app: Router) => {
     celebrate({
       body: Joi.object({
         name: Joi.string().optional().allow(''),
-        scopes: Joi.array().items(Joi.string().invalid('apps')),
+        scopes: Joi.array().items(Joi.string()),
         id: Joi.number().required(),
       }),
     }),

back/data/open.ts

@@ -24,25 +24,7 @@ export interface AppToken {
   expiration: number;
 }
 
-export type AppScope =
-  | 'crons'
-  | 'crons:read'
-  | 'subscriptions'
-  | 'subscriptions:read'
-  | 'envs'
-  | 'envs:read'
-  | 'configs'
-  | 'configs:read'
-  | 'scripts'
-  | 'scripts:read'
-  | 'logs'
-  | 'logs:read'
-  | 'dependencies'
-  | 'dependencies:read'
-  | 'dashboard'
-  | 'dashboard:read'
-  | 'system'
-  | 'apps';
+export type AppScope = 'envs' | 'crons' | 'configs' | 'scripts' | 'logs' | 'system' | 'dashboard';
 
 export interface AppInstance extends Model<App, App>, App {}
 export const AppModel = sequelize.define<AppInstance>('App', {

back/loaders/express.ts

@@ -112,43 +112,7 @@ export default ({ app }: { app: Application }) => {
         const keyMatch = pathLower.match(/\/open\/([a-z]+)\/*/);
         const key = keyMatch && keyMatch[1];
 
-        const isReadRequest =
-          (['GET', 'HEAD'].includes(req.method) &&
-            !(
-              key === 'crons' && /^\/open\/crons\/import\/?$/.test(pathLower)
-            )) ||
-          (['scripts', 'logs'].includes(key || '') &&
-            req.method === 'POST' &&
-            /^\/open\/(?:scripts|logs)\/download\/?$/.test(pathLower));
-        const hasNamespaceScope =
-          doc.scopes.includes(key as AppScope) ||
-          ([
-            'crons',
-            'subscriptions',
-            'envs',
-            'configs',
-            'scripts',
-            'logs',
-            'dependencies',
-            'dashboard',
-          ].includes(key || '') &&
-            doc.scopes.includes(`${key}:read` as AppScope) &&
-            isReadRequest);
-        if (!hasNamespaceScope) {
-          const err = new UnauthorizedError('credentials_bad_scheme', {
-            message: t('暂无权限'),
-          });
-          return next(err);
-        }
-
-        // The built-in system app still needs its local CLI maintenance API.
-        const appRouteAllowed =
-          key !== 'system' ||
-          doc.name === 'system' ||
-          ((req.method === 'GET' || req.method === 'HEAD') &&
-            (pathLower === '/open/system' || pathLower === '/open/system/')) ||
-          (req.method === 'PUT' && pathLower === '/open/system/notify');
-        if (!appRouteAllowed) {
+        if (!doc.scopes.includes(key as AppScope)) {
           const err = new UnauthorizedError('credentials_bad_scheme', {
             message: t('暂无权限'),
           });

back/loaders/initData.ts

@@ -222,9 +222,6 @@ export default async () => {
     }
   } catch { }
 
-  // Replace legacy task environment files before recovered tasks can run.
-  await envService.set_envs();
-
   // 初始化保存一次ck和定时任务数据
   cronClient.readiness.configure(async () => {
     await cronService.autosave_crontab(true);
@@ -232,6 +229,8 @@ export default async () => {
   });
   await cronClient.readiness.recover();
 
+  await envService.set_envs();
+
   const authInfo = await userService.getAuthInfo();
   await shareStore.updateAuthInfo(authInfo);
   await openService.refreshApps();

back/services/env.ts

@@ -14,17 +14,12 @@ import {
 } from '../data/env';
 import { writeFileWithLock } from '../shared/utils';
 import { sequelize } from '../data';
-import {
-  assertAllowedTaskEnvName,
-  isAllowedTaskEnvName,
-} from '../shared/taskEnvName';
 
 @Service()
 export default class EnvService {
   constructor(@Inject('logger') private logger: winston.Logger) { }
 
   public async create(payloads: Env[]): Promise<Env[]> {
-    payloads.forEach((payload) => assertAllowedTaskEnvName(payload.name));
     const envs = await this.envs();
     let position = initPosition;
     if (
@@ -57,7 +52,6 @@ export default class EnvService {
   public async update(payload: Env): Promise<Env> {
     const doc = await this.getDb({ id: payload.id });
     const tab = new Env({ ...doc, ...payload });
-    assertAllowedTaskEnvName(tab.name);
     const newDoc = await this.updateDb(tab);
     await this.set_envs();
     return newDoc;
@@ -157,10 +151,7 @@ export default class EnvService {
         ['position', 'DESC'],
         ['createdAt', 'ASC'],
       ]);
-      return result.map((env) => ({
-        ...env,
-        securityBlocked: !isAllowedTaskEnvName(env.name),
-      }));
+      return result;
     } catch (error) {
       throw error;
     }
@@ -191,14 +182,11 @@ export default class EnvService {
   }
 
   public async enabled(ids: number[]) {
-    const docs = await EnvModel.findAll({ where: { id: ids } });
-    docs.forEach((doc) => assertAllowedTaskEnvName(doc.name));
     await EnvModel.update({ status: EnvStatus.normal }, { where: { id: ids } });
     await this.set_envs();
   }
 
   public async updateNames({ ids, name }: { ids: number[]; name: string }) {
-    assertAllowedTaskEnvName(name);
     await EnvModel.update({ name }, { where: { id: ids } });
     await this.set_envs();
   }
@@ -254,13 +242,6 @@ export default class EnvService {
       name: { [Op.not]: null },
       status: EnvStatus.normal,
     });
-    const invalid = envs.filter((env) => !isAllowedTaskEnvName(env.name));
-    if (invalid.length > 0) {
-      this.logger.warn(
-        'Skipped reserved environment variables in task files: %s',
-        JSON.stringify(invalid.map((env) => ({ id: env.id, name: env.name }))),
-      );
-    }
     const groups = groupBy(envs, 'name');
     let env_string = '';
     let js_env_string = '';
@@ -269,8 +250,8 @@ export default class EnvService {
       if (Object.prototype.hasOwnProperty.call(groups, key)) {
         const group = groups[key];
 
-        // Ignore invalid and reserved names, including legacy database rows.
-        if (isAllowedTaskEnvName(key)) {
+        // 忽略不符合bash要求的环境变量名称
+        if (/^[a-zA-Z_][0-9a-zA-Z_]*$/.test(key)) {
           let value = group
             .map((x) => x.value)
             .join('&')

back/services/log.ts

@@ -8,6 +8,6 @@ export default class LogService {
   constructor(@Inject('logger') private logger: winston.Logger) {}
 
   public checkFilePath(filePath: string, fileName: string) {
-    return resolveFileAccess(config.logPath, [filePath || '', fileName], ['.tmp']);
+    return resolveFileAccess(config.logPath, [filePath || '', fileName]);
   }
 }

back/services/open.ts

@@ -92,10 +92,6 @@ export default class OpenService {
 
   private async updateDb(payload: Partial<App>): Promise<App> {
     return this.withAppsLock(async () => {
-      const target = await AppModel.findOne({ where: { id: payload.id } });
-      if (target?.name === 'system' || payload.name === 'system') {
-        throw Object.assign(new Error(t('暂无权限')), { status: 403 });
-      }
       await AppModel.update(payload, { where: { id: payload.id } });
       const apps = await this.find({});
       await shareStore.updateApps(apps);
@@ -113,12 +109,6 @@ export default class OpenService {
 
   public async remove(ids: number[]) {
     return this.withAppsLock(async () => {
-      const systemApp = await AppModel.findOne({
-        where: { id: ids, name: 'system' },
-      });
-      if (systemApp) {
-        throw Object.assign(new Error(t('暂无权限')), { status: 403 });
-      }
       await AppModel.destroy({ where: { id: ids } });
       const apps = await this.find({});
       await shareStore.updateApps(apps);

back/shared/fileAccess.ts

@@ -24,11 +24,8 @@ export function resolveFileAccess(
   const resolvedRoot = path.resolve(root);
   const target = path.resolve(resolvedRoot, ...parts);
   if (target === resolvedRoot || !isWithin(resolvedRoot, target)) return '';
-  // File systems such as default APFS can resolve a differently cased spelling
-  // of the same entry. Check every protected name without case sensitivity.
-  const blockedNames = new Set(blacklist.map((part) => part.toLowerCase()));
   const isBlocked = (relative: string) =>
-    relative.split(path.sep).some((part) => blockedNames.has(part.toLowerCase()));
+    relative.split(path.sep).some((part) => blacklist.includes(part));
   if (isBlocked(path.relative(resolvedRoot, target))) return '';
   try {
     const realRoot = fs.realpathSync(resolvedRoot);

back/shared/i18n.ts

@@ -23,7 +23,6 @@ const messages: Record<string, Record<string, string>> = {
     '代理层数不能超过 20': 'Proxy hop count cannot exceed 20',
     '环境变量 QL_TRUST_PROXY 已生效，系统设置不可覆盖':
       'QL_TRUST_PROXY is active and cannot be overridden by system settings',
-    环境变量名称不可使用: 'Environment variable name is reserved or invalid',
     系统配置不存在: 'System configuration does not exist',
     '历史版本仅支持不超过 1 MiB 的 UTF-8 文本脚本':
       'Version history only supports UTF-8 text scripts up to 1 MiB',

back/shared/taskEnvName.ts

@@ -1,79 +0,0 @@
-import { t } from './i18n';
-
-// These names control the task runner or the interpreters it starts. Values
-// managed through the environment API must remain task data, not executable
-// configuration.
-const reservedNames = new Set([
-  'TASK_BEFORE',
-  'TASK_AFTER',
-  'WORK_DIR',
-  'TASK_SHELL_PARAMS',
-  'SCRIPT_PARAMS',
-  'WHICH_PROGRAM',
-  'ISJSORPYTHONFILE',
-  'EXPORTED_VARIABLES',
-  'FOUND_DOUBLE_DASH',
-  'LOG_DIR',
-  'LOG_PATH',
-  'ID',
-  'BEGIN_TIMESTAMP',
-  'TIME_FORMAT',
-  'MTIME_FORMAT',
-  'IS_MACOS',
-  'RANDOMDELAY',
-  'RANDOMDELAYFILEEXTENSIONS',
-  'RANDOMDELAYIGNOREDMINUTES',
-  'COMMAND_TIMEOUT_TIME',
-  'SET_U_ON',
-  '_TASK_EXIT_CODE',
-  'PATH',
-  'HOME',
-  'SHELL',
-  'ENV',
-  'BASH_ENV',
-  'BASHOPTS',
-  'SHELLOPTS',
-  'IFS',
-  'CDPATH',
-  'GLOBIGNORE',
-  'PROMPT_COMMAND',
-  'PS4',
-  'NODE_OPTIONS',
-  'NODE_PATH',
-  'PREV_NODE_OPTIONS',
-  'PREV_NODE_PATH',
-  'PREV_PYTHONPATH',
-  'GIT_SSH',
-  'GIT_SSH_COMMAND',
-  'GIT_ASKPASS',
-  'GIT_EXEC_PATH',
-  'GIT_TEMPLATE_DIR',
-  'SSH_ASKPASS',
-]);
-
-export function isAllowedTaskEnvName(name: unknown): name is string {
-  if (typeof name !== 'string' || !/^[a-zA-Z_][0-9a-zA-Z_]*$/.test(name)) {
-    return false;
-  }
-
-  const upper = name.toUpperCase();
-  return (
-    !reservedNames.has(upper) &&
-    !upper.startsWith('BASH_') &&
-    !upper.startsWith('QL') &&
-    !upper.startsWith('FILE_') &&
-    !upper.startsWith('DIR_') &&
-    !upper.startsWith('LD_') &&
-    !upper.startsWith('DYLD_') &&
-    !upper.startsWith('PYTHON') &&
-    !upper.startsWith('GIT_CONFIG_')
-  );
-}
-
-export function assertAllowedTaskEnvName(name: unknown): asserts name is string {
-  if (!isAllowedTaskEnvName(name)) {
-    throw Object.assign(new Error(t('环境变量名称不可使用')), {
-      status: 400,
-    });
-  }
-}

cli/README.en.md

@@ -48,7 +48,7 @@ The CLI also supports task/subscription CRUD, application and secret management,
 ```sh
 ql task create --name demo --command 'task demo.js' --schedule '0 0 * * *' --json
 ql subscription create --type public-repo --url https://example.com/repo.git --alias demo --schedule-type crontab --schedule '0 0 * * *' --json
-ql app create --name agent --scopes crons,subscriptions,envs --show-secrets --json
+ql app create --name agent --scopes crons,subscriptions --show-secrets --json
 ql env create --data @envs.json --json
 ql api request PUT /open/crons/run --data '[12,13]' --json
 ```
@@ -68,7 +68,7 @@ Protected requests use `Authorization: Bearer <token>`. Two credential sources a
 
 ### Application login
 
-Create a dedicated panel application with the required scopes. Existing scopes retain their original permissions. For read-only access, use `crons:read`, `subscriptions:read`, `envs:read`, `configs:read`, `scripts:read`, `dependencies:read`, `logs:read`, or `dashboard:read`. Script and log downloads use POST but are available to their read-only scopes. `GET /crons/import` writes tasks and is excluded from `crons:read`. `login` and `auth login` are equivalent. Interactive login hides the Client Secret; secret command-line arguments are not supported.
+Create a dedicated panel application with the required scopes, such as crons, subscriptions or envs. `login` and `auth login` are equivalent. Interactive login hides the Client Secret; secret command-line arguments are not supported.
 
 ```sh
 ql login --url https://ql.example.com

cli/README.md

@@ -48,7 +48,7 @@ ql auth logout --json
 ```sh
 ql task create --name demo --command 'task demo.js' --schedule '0 0 * * *' --json
 ql subscription create --type public-repo --url https://example.com/repo.git --alias demo --schedule-type crontab --schedule '0 0 * * *' --json
-ql app create --name agent --scopes crons,subscriptions,envs --show-secrets --json
+ql app create --name agent --scopes crons,subscriptions --show-secrets --json
 ql env create --data @envs.json --json
 ql api request PUT /open/crons/run --data '[12,13]' --json
 ```
@@ -68,7 +68,7 @@ ql api request PUT /open/crons/run --data '[12,13]' --json
 
 ### 应用凭据登录
 
-在面板创建专用应用，按需授予 crons、subscriptions 等权限。旧 scope 保留原有权限；仅读取时可选用 `crons:read`、`subscriptions:read`、`envs:read`、`configs:read`、`scripts:read`、`dependencies:read`、`logs:read`、`dashboard:read`。脚本和日志下载虽使用 POST，也允许对应只读权限；`GET /crons/import` 会写入任务，不属于只读操作。`login` 与 `auth login` 等价；交互输入 Client ID 和不回显的 Client Secret，密钥不支持命令行参数。
+在面板创建专用应用，按需授予 crons、subscriptions、envs 等权限。`login` 与 `auth login` 等价；交互输入 Client ID 和不回显的 Client Secret，密钥不支持命令行参数。
 
 ```sh
 ql login --url https://ql.example.com

cli/skills/qinglong-cli/references/openapi.md

@@ -6,13 +6,11 @@ The catalogue covers 151 active routes in the current backend. `ql api routes --
 
 ## 认证与权限 / Authentication and permissions
 
-常规使用 `ql login` 的应用凭据。scope 通常对应 /open 后首个路径段：crons、subscriptions、envs、configs、scripts、logs、dependencies、system、dashboard 等。旧 scope 保留原有权限；上述资源除 system 外可选用对应的 `:read` scope。`crons:read` 不包含会写入任务的 `GET /crons/import`；`scripts:read`、`logs:read` 包含使用 POST 的下载，不包含写入、删除或执行。`dashboard:read` 不允许 POST 统计上报。外部应用的 `system` scope 仅允许读取系统状态和发送通知。应用管理需要 apps；`GET /apps` 会返回 Client Secret，因此不提供 `apps:read`。user、health、update 等路由同样接受服务端权限校验。路由存在不代表现有应用已获授权。
+常规使用 `ql login` 的应用凭据。scope 是 /open 后首个路径段：crons、subscriptions、envs、configs、scripts、logs、dependencies、system、dashboard 等。应用管理需要 apps；user、health、update 等路由同样接受服务端权限校验。面板 UI 当前没有列出全部这些 scope，不能把路由存在理解成现有应用已获授权。
 
-认证步骤、环境变量优先级、应用登录、面板会话与双因素验证、退出行为，统一见 [认证参考](panel.md#authentication)。应用管理可用已有 apps 权限的应用或授权面板会话；后端创建和更新应用时拒绝授予 apps 权限。QL_URL/QL_ACCESS_TOKEN 不保存、不刷新，不自动退回应用配置。
+认证步骤、环境变量优先级、应用登录、面板会话与双因素验证、退出行为，统一见 [认证参考](panel.md#authentication)。应用管理可用 apps 权限的应用或授权面板会话；QL_URL/QL_ACCESS_TOKEN 不保存、不刷新，不自动退回应用配置。
 
-See the [authentication reference](panel.md#authentication) for application login, direct-token precedence, owner sessions/2FA and logout. App management accepts existing apps-scoped credentials or an authorized owner session; the backend rejects granting apps scope when creating or updating an application. Direct tokens are not saved/refreshed and never fall back to application configuration.
-
-Existing scopes retain their original access. Use the resource's `:read` scope for read-only access to crons, subscriptions, envs, configs, scripts, dependencies, logs, or dashboard. `crons:read` excludes the mutating `GET /crons/import`; `scripts:read` and `logs:read` include downloads (POST), but exclude writes, deletion, and execution. `dashboard:read` excludes statistics reporting (POST). External `system` applications may only read system status and send notifications. `GET /apps` returns Client Secrets, so there is no `apps:read` scope.
+See the [authentication reference](panel.md#authentication) for application login, direct-token precedence, owner sessions/2FA and logout. App management accepts apps-scoped credentials or an authorized owner session. Direct tokens are not saved/refreshed and never fall back to application configuration.
 
 `auth status --scope <scope>` tests a representative read; update has no read endpoint and is not offered by status. This does not prove permission for every write. `app list/create/update/reset-secret` 默认隐藏 client_secret/tokens；只有明确需要凭据时才加 --show-secrets，并避免把输出记录到共享日志。其他资源/通用请求可能含环境值、配置、脚本、订阅凭据和会话，按敏感数据处理。
 
@@ -51,7 +49,6 @@ ql script get --query '{"file":"demo.js","path":""}' --json
 ql script history-list --query '{"filename":"demo.js","path":""}' --json
 ql script history-detail --query '{"filename":"demo.js","path":"","id":"VERSION_UUID"}' --json
 ql script history-restore --data '{"filename":"demo.js","path":"","id":"VERSION_UUID","expectedHash":"CURRENT_SHA256"}' --json
-# Requires the full configs scope or a panel session token.
 ql config save --data '{"name":"example.sh","content":"# example"}' --json
 ql config get --query '{"path":"example.sh"}' --json
 ql log download --data '{"filename":"example.log","path":"example"}' --output ./example.log --json

cli/src/remote/commands/auth.ts

@@ -107,14 +107,6 @@ export async function auth(
       {
         crons: 'crons?page=1&size=1',
         configs: 'configs/files',
-        'envs:read': 'envs',
-        'configs:read': 'configs/files',
-        'scripts:read': 'scripts',
-        'crons:read': 'crons?page=1&size=1',
-        'subscriptions:read': 'subscriptions',
-        'dependencies:read': 'dependencies',
-        'logs:read': 'logs',
-        'dashboard:read': 'dashboard/overview',
         dashboard: 'dashboard/overview',
       } as Record<string, string>
     )[scope] ?? scope,

cli/src/remote/commands/registry.ts

@@ -26,14 +26,6 @@ export const commands: readonly CommandSpec[] = [
         default: 'crons',
         choices: [
           ...new Set(openOperations.map((op) => op.path.split('/')[0]!)),
-          'envs:read',
-          'configs:read',
-          'scripts:read',
-          'crons:read',
-          'subscriptions:read',
-          'dependencies:read',
-          'logs:read',
-          'dashboard:read',
         ].filter((scope) => !['auth', 'update'].includes(scope)),
       },
     },

cli/test/linux/openapi.cjs

@@ -28,12 +28,12 @@ const fs = require('node:fs/promises');
     assert.equal(result.status, 0, args.slice(0, 2).join(' ') + ': ' + result.stderr);
     return JSON.parse(result.stdout).data;
   };
-  const app = cli(['app', 'create', '--name', 'cli-fixture', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard', '--show-secrets'], true);
+  const app = cli(['app', 'create', '--name', 'cli-fixture', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard,apps', '--show-secrets'], true);
   assert.ok(app.client_id && app.client_secret);
   cli(['login', '--url', url], false, { QL_CLIENT_ID: app.client_id, QL_CLIENT_SECRET: app.client_secret });
-  cli(['auth', 'status', '--scope', 'crons']);
-  cli(['app', 'update', String(app.id), '--name', 'cli-updated', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard'], true);
-  assert.ok(cli(['app', 'list'], true).every(item => !('client_secret' in item) && !('tokens' in item)));
+  cli(['auth', 'status', '--scope', 'apps']);
+  cli(['app', 'update', String(app.id), '--name', 'cli-updated', '--scopes', 'crons,subscriptions,envs,configs,scripts,logs,dependencies,system,dashboard,apps']);
+  assert.ok(cli(['app', 'list']).every(item => !('client_secret' in item) && !('tokens' in item)));
   const task = cli(['task', 'create', '--name', 'cli-task', '--command', 'echo OPENAPI_FIXTURE', '--schedule', '0 0 * * *']);
   cli(['task', 'update', String(task.id), '--name', 'cli-task-updated', '--command', 'echo OPENAPI_UPDATED', '--schedule', '0 1 * * *']);
   cli(['task', 'disable', String(task.id)]); cli(['task', 'enable', String(task.id)]);

cli/test/remote/cli.test.cjs

@@ -81,13 +81,6 @@ async function fixture(t) {
           code: 200,
           data: { data: [{ id: 12, name: 'example' }], total: 1 },
         });
-      else if (
-        ['/panel/open/envs', '/panel/open/configs/files', '/panel/open/scripts',
-          '/panel/open/subscriptions', '/panel/open/dependencies',
-          '/panel/open/logs', '/panel/open/dashboard/overview']
-          .includes(url.pathname)
-      )
-        json({ code: 200, data: [] });
       else if (
         ['/panel/open/crons/run', '/panel/open/crons/stop'].includes(
           url.pathname,
@@ -162,21 +155,6 @@ test('compiled entry: login aliases, private storage, status, refresh and local
   assert.equal(JSON.parse(status.out).data.scopeChecked, 'crons');
   assert.doesNotMatch(status.out, /test-secret|test-token/);
   assert.equal(f.requests.at(-1).url.pathname, '/panel/open/crons');
-  for (const [scope, pathname] of [
-    ['envs:read', '/panel/open/envs'],
-    ['configs:read', '/panel/open/configs/files'],
-    ['scripts:read', '/panel/open/scripts'],
-    ['crons:read', '/panel/open/crons'],
-    ['subscriptions:read', '/panel/open/subscriptions'],
-    ['dependencies:read', '/panel/open/dependencies'],
-    ['logs:read', '/panel/open/logs'],
-    ['dashboard:read', '/panel/open/dashboard/overview'],
-  ]) {
-    const checked = await f.invoke(['auth', 'status', '--scope', scope, '--json']);
-    assert.equal(checked.code, 0, checked.err);
-    assert.equal(JSON.parse(checked.out).data.scopeChecked, scope);
-    assert.equal(f.requests.at(-1).url.pathname, pathname);
-  }
   const config = JSON.parse(fs.readFileSync(f.file));
   config.expiration = 1;
   fs.writeFileSync(f.file, JSON.stringify(config));

src/locales/en-US.json

@@ -116,7 +116,6 @@
   "代理端口": "Proxy Port",
   "以后再说": "Later",
   "仪表盘": "Dashboard",
-  "仪表盘（只读）": "Dashboard (read only)",
   "任务": "Task",
   "任务数": "Tasks",
   "任务未运行": "Task not running",
@@ -127,7 +126,6 @@
   "使用手机应用扫描二维码，或者输入秘钥": "Scan the QR code with the mobile app or enter the key",
   "依赖文件": "Dependency Files",
   "依赖管理": "Dependency Management",
-  "依赖管理（只读）": "Dependencies (read only)",
   "依赖类型": "Dependency Type",
   "依赖缓存": "Dependency cache",
   "依赖设置": "Dependence Settings",
@@ -194,8 +192,6 @@
   "可用，你使用的版本为": "available, the version you are using is",
   "同时删除关联任务和脚本": "Delete associated tasks and scripts as well",
   "名称": "Name",
-  "名称受限": "Restricted name",
-  "名称受限，未注入任务": "Restricted name; not injected into tasks",
   "名称不能为保留关键字": "The name cannot be a reserved keyword",
   "吗": "?",
   "否": "No",
@@ -236,7 +232,6 @@
   "完成设置": "Finish Setup",
   "定时": "Schedule",
   "定时任务": "Scheduled Tasks",
-  "定时任务（只读）": "Scheduled Tasks (read only)",
   "定时任务并发数": "Concurrent Scheduled Tasks",
   "定时类型": "Schedule Type",
   "定时规则": "Schedule Rule",
@@ -340,7 +335,6 @@
   "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符": "Log name can only contain Chinese characters, letters, numbers, underscores, hyphens, dots, and path separators",
   "日志文件": "Log files",
   "日志管理": "Log Management",
-  "日志管理（只读）": "Logs (read only)",
   "时": "hour(s)",
   "时区": "Timezone",
   "是": "Yes",
@@ -421,7 +415,6 @@
   "版本": "Version",
   "状态": "Status",
   "环境变量": "Environment variable",
-  "环境变量（只读）": "Environment variables (read only)",
   "生成数据中...": "Generating data...",
   "用于访问所有私有仓库的全局SSH私钥": "Global SSH private key for accessing all private repositories",
   "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/": "Token, which can be obtained after scanning and logging in, is available under 'My Account' -> 'Settings' -> 'Tokens'. Please refer to the instructions for detailed steps: https://www.weplusbot.com/",
@@ -505,7 +498,6 @@
   "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径": "Working directory for script execution. Leave blank for auto-detection. Relative paths are based on the scripts directory. Absolute paths are also supported.",
   "脚本文件": "Script files",
   "脚本管理": "Script Management",
-  "脚本（只读）": "Scripts (read only)",
   "自动删除任务": "Automatically Delete Tasks",
   "自动拆分": "Auto Split",
   "自动添加任务": "Automatically Add Tasks",
@@ -520,13 +512,11 @@
   "视图管理": "View Management",
   "订阅": "Subscription",
   "订阅管理": "Subscription Management",
-  "订阅管理（只读）": "Subscriptions (read only)",
   "设置": "Settings",
   "访问密钥": "Access Key",
   "语言": "Language",
   "请": "Please",
   "请先按如下方式修复：": "Please fix it as follows:",
-  "请先修改环境变量名称": "Rename the environment variable first",
   "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置": "Request body format: key1: value1 (separate multiple keys with line breaks). URL or body must contain $title, $content is optional and corresponds to the API content position.",
   "请求头Content-Type": "Request Header Content-Type",
   "请求头格式Custom-Header1: Header1，多个换行分割": "Request header format: Custom-Header1: Header1 (separate multiple headers with line breaks)",
@@ -620,7 +610,6 @@
   "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "Email service name, e.g., 126, 163, Gmail, QQ, etc. Supported list: https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
   "邮箱认证地址": "Email address for SMTP authentication",
   "配置文件": "Configuration Files",
-  "配置文件（只读）": "Configuration files (read only)",
   "重启": "Restart",
   "重命名": "Rename",
   "重新下载": "Redownload",

src/locales/zh-CN.json

@@ -115,7 +115,6 @@
   "代理端口": "代理端口",
   "以后再说": "以后再说",
   "仪表盘": "仪表盘",
-  "仪表盘（只读）": "仪表盘（只读）",
   "任务": "任务",
   "任务数": "任务数",
   "任务未运行": "任务未运行",
@@ -126,7 +125,6 @@
   "使用手机应用扫描二维码，或者输入秘钥": "使用手机应用扫描二维码，或者输入秘钥",
   "依赖文件": "依赖文件",
   "依赖管理": "依赖管理",
-  "依赖管理（只读）": "依赖管理（只读）",
   "依赖类型": "依赖类型",
   "依赖缓存": "依赖缓存",
   "依赖设置": "依赖设置",
@@ -193,8 +191,6 @@
   "可用，你使用的版本为": "可用，你使用的版本为",
   "同时删除关联任务和脚本": "同时删除关联任务和脚本",
   "名称": "名称",
-  "名称受限": "名称受限",
-  "名称受限，未注入任务": "名称受限，未注入任务",
   "名称不能为保留关键字": "名称不能为保留关键字",
   "吗": "吗",
   "否": "否",
@@ -235,7 +231,6 @@
   "完成设置": "完成设置",
   "定时": "定时",
   "定时任务": "定时任务",
-  "定时任务（只读）": "定时任务（只读）",
   "定时任务并发数": "定时任务并发数",
   "定时类型": "定时类型",
   "定时规则": "定时规则",
@@ -339,7 +334,6 @@
   "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符": "日志名称只能包含中文、字母、数字、下划线、连字符、点和路径分隔符",
   "日志文件": "日志文件",
   "日志管理": "日志管理",
-  "日志管理（只读）": "日志管理（只读）",
   "时": "时",
   "时区": "时区",
   "是": "是",
@@ -421,7 +415,6 @@
   "版本": "版本",
   "状态": "状态",
   "环境变量": "环境变量",
-  "环境变量（只读）": "环境变量（只读）",
   "生成数据中...": "生成数据中...",
   "用于访问所有私有仓库的全局SSH私钥": "用于访问所有私有仓库的全局SSH私钥",
   "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/": "用户令牌，扫描登录后 我的—>设置->令牌 中获取，参考 https://www.weplusbot.com/",
@@ -505,7 +498,6 @@
   "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径": "脚本执行时的工作目录，留空则自动检测。相对路径基于 scripts 目录，也支持绝对路径",
   "脚本文件": "脚本文件",
   "脚本管理": "脚本管理",
-  "脚本（只读）": "脚本（只读）",
   "自动删除任务": "自动删除任务",
   "自动拆分": "自动拆分",
   "自动添加任务": "自动添加任务",
@@ -520,13 +512,11 @@
   "视图管理": "视图管理",
   "订阅": "订阅",
   "订阅管理": "订阅管理",
-  "订阅管理（只读）": "订阅管理（只读）",
   "设置": "设置",
   "访问密钥": "访问密钥",
   "语言": "语言",
   "请": "请",
   "请先按如下方式修复：": "请先按如下方式修复：",
-  "请先修改环境变量名称": "请先修改环境变量名称",
   "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置": "请求体格式key1: value1，多个换行分割。url或者body中必须包含$title，$content可选，对应api内容的位置",
   "请求头Content-Type": "请求头Content-Type",
   "请求头格式Custom-Header1: Header1，多个换行分割": "请求头格式Custom-Header1: Header1，多个换行分割",
@@ -620,7 +610,6 @@
   "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json": "邮箱服务名称，比如126、163、Gmail、QQ等，支持列表https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json",
   "邮箱认证地址": "邮箱认证地址",
   "配置文件": "配置文件",
-  "配置文件（只读）": "配置文件（只读）",
   "重启": "重启",
   "重命名": "重命名",
   "重新下载": "重新下载",

src/pages/env/index.tsx

@@ -174,7 +174,7 @@ const Env = () => {
       title: intl.get('状态'),
       key: 'status',
       dataIndex: 'status',
-      width: 170,
+      width: 100,
       filters: [
         {
           text: intl.get('已启用'),
@@ -192,13 +192,6 @@ const Env = () => {
             <Tag color={StatusColor[record.status]} style={{ marginRight: 0 }}>
               {intl.get(Status[record.status])}
             </Tag>
-            {record.securityBlocked && (
-              <Tooltip title={intl.get('名称受限，未注入任务')}>
-                <Tag color="warning" style={{ marginRight: 0 }}>
-                  {intl.get('名称受限')}
-                </Tag>
-              </Tooltip>
-            )}
           </Space>
         );
       },
@@ -209,8 +202,6 @@ const Env = () => {
       width: 160,
       render: (text: string, record: any, index: number) => {
         const isPc = !isPhone;
-        const isBlockedEnable =
-          record.status === Status.已禁用 && record.securityBlocked;
         return (
           <Space size="middle">
             <Tooltip title={isPc ? intl.get('编辑') : ''}>
@@ -221,9 +212,7 @@ const Env = () => {
             <Tooltip
               title={
                 isPc
-                  ? isBlockedEnable
-                    ? intl.get('请先修改环境变量名称')
-                    : record.status === Status.已禁用
+                  ? record.status === Status.已禁用
                     ? intl.get('启用')
                     : intl.get('禁用')
                   : ''
@@ -289,10 +278,6 @@ const Env = () => {
   };
 
   const enabledOrDisabledEnv = (record: any, index: number) => {
-    if (record.status === Status.已禁用 && record.securityBlocked) {
-      message.error(intl.get('请先修改环境变量名称'));
-      return;
-    }
     Modal.confirm({
       title: intl.get('确认操作', {
         operation:
@@ -553,13 +538,6 @@ const Env = () => {
   };
 
   const operateEnvs = (operationStatus: number) => {
-    if (
-      operationStatus === 0 &&
-      value.some((env) => selectedRowIds.includes(env.id) && env.securityBlocked)
-    ) {
-      message.error(intl.get('请先修改环境变量名称'));
-      return;
-    }
     Modal.confirm({
       title: intl.get('确认操作', {
         operation: intl.get(OperationName[operationStatus]),

src/utils/config.ts

@@ -20,58 +20,30 @@ export default {
       name: intl.get('定时任务'),
       value: 'crons',
     },
-    {
-      name: intl.get('定时任务（只读）'),
-      value: 'crons:read',
-    },
     {
       name: intl.get('环境变量'),
       value: 'envs',
     },
-    {
-      name: intl.get('环境变量（只读）'),
-      value: 'envs:read',
-    },
     {
       name: intl.get('订阅管理'),
       value: 'subscriptions',
     },
-    {
-      name: intl.get('订阅管理（只读）'),
-      value: 'subscriptions:read',
-    },
     {
       name: intl.get('配置文件'),
       value: 'configs',
     },
-    {
-      name: intl.get('配置文件（只读）'),
-      value: 'configs:read',
-    },
     {
       name: intl.get('脚本管理'),
       value: 'scripts',
     },
-    {
-      name: intl.get('脚本（只读）'),
-      value: 'scripts:read',
-    },
     {
       name: intl.get('日志管理'),
       value: 'logs',
     },
-    {
-      name: intl.get('日志管理（只读）'),
-      value: 'logs:read',
-    },
     {
       name: intl.get('依赖管理'),
       value: 'dependencies',
     },
-    {
-      name: intl.get('依赖管理（只读）'),
-      value: 'dependencies:read',
-    },
     {
       name: intl.get('系统信息'),
       value: 'system',
@@ -80,29 +52,17 @@ export default {
       name: intl.get('仪表盘'),
       value: 'dashboard',
     },
-    {
-      name: intl.get('仪表盘（只读）'),
-      value: 'dashboard:read',
-    },
   ],
   scopesMap: {
     crons: intl.get('定时任务'),
-    'crons:read': intl.get('定时任务（只读）'),
     envs: intl.get('环境变量'),
-    'envs:read': intl.get('环境变量（只读）'),
     subscriptions: intl.get('订阅管理'),
-    'subscriptions:read': intl.get('订阅管理（只读）'),
     configs: intl.get('配置文件'),
-    'configs:read': intl.get('配置文件（只读）'),
     scripts: intl.get('脚本管理'),
-    'scripts:read': intl.get('脚本（只读）'),
     logs: intl.get('日志管理'),
-    'logs:read': intl.get('日志管理（只读）'),
     dependencies: intl.get('依赖管理'),
-    'dependencies:read': intl.get('依赖管理（只读）'),
     system: intl.get('系统信息'),
     dashboard: intl.get('仪表盘'),
-    'dashboard:read': intl.get('仪表盘（只读）'),
   },
   notificationModes: [
     { value: 'gotify', label: 'Gotify' },

test/back/advisory-input-security.test.cjs

@@ -43,104 +43,6 @@ test('environment values remain literal when the generated JavaScript loads', as
   );
 });
 
-test('environment API rejects execution controls and legacy rows stay out of task files', async () => {
-  const output = {};
-  let writes = 0;
-  const warnings = [];
-  const legacy = [
-    { id: 1, name: 'task_before', value: 'touch /tmp/untrusted' },
-    { id: 2, name: 'NODE_OPTIONS', value: '--require /tmp/untrusted.js' },
-    { id: 3, name: 'PREV_NODE_OPTIONS', value: '--import=data:text/javascript,bad' },
-    { id: 4, name: 'GIT_SSH_COMMAND', value: 'sh -c bad' },
-    { id: 5, name: 'PATH', value: '/tmp/untrusted' },
-    { id: 6, name: 'file_task_before', value: '/tmp/untrusted.sh' },
-    { id: 7, name: 'SAFE_VALUE', value: 'kept' },
-    { id: 8, name: 'bad\nname', value: 'untrusted' },
-    { id: 9, name: 'work_dir', value: '/tmp/untrusted' },
-    { id: 10, name: 'task_shell_params', value: 'other.sh' },
-    { id: 11, name: 'which_program', value: 'bash' },
-    { id: 12, name: 'script_params', value: 'other.sh' },
-    { id: 13, name: 'LOG_DIR', value: '../../config' },
-    { id: 14, name: 'EXPORTED_VARIABLES', value: 'PATH' },
-    { id: 15, name: 'begin_timestamp', value: 'a[$(printf BAD)]' },
-    { id: 16, name: 'is_macos', value: 'a[$(printf BAD)]' },
-    { id: 17, name: 'RandomDelayIgnoredMinutes', value: 'a[$(printf BAD)]' },
-    { id: 18, name: 'ID', value: '999' },
-    { id: 19, name: 'BASH_XTRACEFD', value: '2' },
-  ];
-  const Env = load(path.resolve('back/services/env.ts'), {
-    typedi: decorators,
-    '../config': { envFile: 'sh', jsEnvFile: 'js', pyEnvFile: 'py' },
-    '../data/env': {
-      Env: class { constructor(value) { Object.assign(this, value); } },
-      EnvModel: {
-        update: async (value, query) => {
-          writes++;
-        },
-        findAll: async () => [legacy[0]],
-      },
-      EnvStatus: { normal: 0, disabled: 1 },
-    },
-    '../data': { sequelize: { literal: (value) => value } },
-    '../shared/utils': {
-      writeFileWithLock: async (file, value) => { output[file] = value; },
-    },
-  }).default;
-  const service = new Env({
-    ...logger,
-    warn: (...args) => warnings.push(args),
-  });
-  service.envs = async () => legacy;
-  service.insert = async () => { writes++; return []; };
-  service.getDb = async () => ({ id: 1, name: 'SAFE_VALUE', value: 'kept' });
-  service.updateDb = async () => { writes++; return {}; };
-
-  for (const name of [
-    'task_before', 'PREV_NODE_OPTIONS', 'GIT_SSH_COMMAND', 'work_dir',
-    'task_shell_params', 'which_program', 'script_params', 'LOG_DIR',
-    'EXPORTED_VARIABLES',
-    'begin_timestamp', 'is_macos', 'RandomDelayIgnoredMinutes', 'ID',
-    'BASH_XTRACEFD',
-  ]) {
-    await assert.rejects(
-      service.create([
-        { name: 'SAFE_VALUE', value: 'ok' },
-        { name, value: 'untrusted' },
-      ]),
-      /环境变量名称不可使用/,
-    );
-  }
-  await assert.rejects(
-    service.update({ id: 1, name: 'BASH_ENV', value: '/tmp/untrusted.sh' }),
-    /环境变量名称不可使用/,
-  );
-  await assert.rejects(
-    service.updateNames({ ids: [1], name: 'PYTHONPATH' }),
-    /环境变量名称不可使用/,
-  );
-  assert.equal(writes, 0);
-
-  await service.set_envs();
-  assert.equal(writes, 0);
-  assert.equal(warnings.length, 1);
-  assert.match(warnings[0][1], /GIT_SSH_COMMAND/);
-  assert.equal(warnings[0][1].includes('\n'), false);
-  await assert.rejects(service.enabled([1]), /环境变量名称不可使用/);
-  assert.equal(writes, 0);
-  delete service.envs;
-  service.find = async () => legacy;
-  const listed = await service.envs();
-  assert.equal(listed[0].securityBlocked, true);
-  assert.equal(listed[6].securityBlocked, false);
-  for (const contents of Object.values(output)) {
-    assert.doesNotMatch(
-      contents,
-      /task_before|NODE_OPTIONS|GIT_SSH_COMMAND|PATH|work_dir|task_shell_params|which_program|script_params|LOG_DIR|EXPORTED_VARIABLES|begin_timestamp|is_macos|RandomDelayIgnoredMinutes|ID|BASH_XTRACEFD/,
-    );
-    assert.match(contents, /SAFE_VALUE/);
-  }
-});
-
 test('subscription shell parameters round trip without expansion or command substitution', () => {
   const { formatCommand } = load(path.resolve('back/config/subscription.ts'));
   const payload =

test/back/app-scope-security.test.cjs

@@ -1,69 +0,0 @@
-const assert = require('node:assert/strict');
-const test = require('node:test');
-const express = require('express');
-const { errors } = require('celebrate');
-const path = require('node:path');
-const load = require('../helpers/load-security-module.cjs');
-
-test('application API rejects granting apps scope on create and update', async (t) => {
-  const calls = [];
-  class OpenService {}
-  const service = {
-    create: async (body) => {
-      calls.push(['create', body]);
-      return body;
-    },
-    update: async (body) => {
-      calls.push(['update', body]);
-      return body;
-    },
-  };
-  const route = load(path.join(__dirname, '../../back/api/open.ts'), {
-    '../services/open': OpenService,
-    typedi: { Container: { get: () => service } },
-  }).default;
-  const app = express();
-  app.use(express.json());
-  for (const prefix of ['/api', '/open']) {
-    const router = express.Router();
-    route(router);
-    app.use(prefix, router);
-  }
-  app.use(errors());
-  const server = app.listen(0, '127.0.0.1');
-  t.after(() => new Promise((resolve) => server.close(resolve)));
-  await new Promise((resolve, reject) => {
-    server.once('listening', resolve);
-    server.once('error', reject);
-  });
-  const request = async (prefix, method, body) => {
-    const response = await fetch(
-      `http://127.0.0.1:${server.address().port}${prefix}/apps`,
-      {
-        method,
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(body),
-      },
-    );
-    return response.status;
-  };
-  for (const prefix of ['/api', '/open']) {
-    assert.equal(
-      await request(prefix, 'POST', { name: 'new', scopes: ['crons', 'apps'] }),
-      400,
-    );
-    assert.equal(
-      await request(prefix, 'PUT', { id: 1, scopes: ['apps'] }),
-      400,
-    );
-    assert.equal(
-      await request(prefix, 'POST', { name: 'new', scopes: ['crons:read'] }),
-      200,
-    );
-    assert.equal(
-      await request(prefix, 'PUT', { id: 1, scopes: ['crons'] }),
-      200,
-    );
-  }
-  assert.equal(calls.length, 4);
-});

test/back/file-access-scope.test.cjs

@@ -115,9 +115,7 @@ for (const customData of [false, true]) {
       );
     for (const name of [
       'token.json',
-      'TOKEN.JSON',
       'grpc/client.key',
-      'Grpc/client.key',
       'secret-link',
       'data/scripts/secret-link',
       'data/scripts/../config/token.json',
@@ -178,23 +176,5 @@ test('log APIs allow configuration-like names while retaining directory boundari
     ])
       assert.equal((await invoke(method, route, values)).code, 403, filename);
   }
-  const hidden = path.join(config.logPath, '.tmp', 'own_user.list');
-  fs.mkdirSync(path.dirname(hidden), { recursive: true });
-  fs.writeFileSync(hidden, 'hidden task command');
-  for (const values of [
-    { path: '.tmp', file: 'own_user.list', filename: 'own_user.list' },
-    { path: '.TMP', file: 'own_user.list', filename: 'own_user.list' },
-    { path: '', file: '.tmp/own_user.list', filename: '.tmp/own_user.list' },
-    { path: '', file: '.Tmp/own_user.list', filename: '.Tmp/own_user.list' },
-  ]) {
-    for (const [method, route] of [
-      ['get', '/detail'],
-      ['post', '/download'],
-      ['delete', '/'],
-    ]) {
-      assert.equal((await invoke(method, route, values)).code, 403);
-    }
-  }
-  assert.equal(fs.readFileSync(hidden, 'utf8'), 'hidden task command');
   assert.equal(fs.readFileSync(secret, 'utf8'), 'PANEL-SECRET');
 });

test/back/file-access-security.test.cjs

@@ -24,14 +24,11 @@ test('file access enforces directory boundaries, blacklist descendants and symli
     '../config-other/secret',
     '/etc/passwd',
     'grpc/client.key',
-    'GRPC/client.key',
     'alias/client.key',
     'outside/new.txt',
     'dangling',
     'auth.json',
-    'AUTH.JSON',
     'nested/auth.json',
-    'nested/Auth.Json',
     '',
   ]) {
     assert.equal(

test/back/http-security.test.cjs

@@ -13,7 +13,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
     fs.mkdirSync(path.join(tmp, dir), { recursive: true });
   fs.writeFileSync(path.join(tmp, 'config/grpc/client.key'), 'SENTINEL');
   fs.writeFileSync(path.join(tmp, 'config/normal.txt'), 'normal');
-  fs.writeFileSync(path.join(tmp, 'config/config.sh'), 'original');
   const secret = 'http-security-test';
   const valid = jwt.sign({}, secret, { algorithm: 'HS384', expiresIn: '1h' });
   const expired = jwt.sign({}, secret, { algorithm: 'HS384', expiresIn: -1 });
@@ -52,10 +51,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       scopes: ['configs'],
       tokens: [{ value: 'config-app', expiration: Date.now() / 1000 + 3600 }],
     },
-    {
-      scopes: ['configs:read'],
-      tokens: [{ value: 'config-read-app', expiration: Date.now() / 1000 + 3600 }],
-    },
     {
       scopes: ['configs', 'scripts'],
       tokens: [
@@ -66,55 +61,13 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       scopes: ['scripts'],
       tokens: [{ value: 'script-app', expiration: Date.now() / 1000 + 3600 }],
     },
-    {
-      scopes: ['scripts:read'],
-      tokens: [{ value: 'script-read-app', expiration: Date.now() / 1000 + 3600 }],
-    },
     {
       scopes: ['envs'],
       tokens: [{ value: 'env-app', expiration: Date.now() / 1000 + 3600 }],
     },
-    {
-      scopes: ['envs:read'],
-      tokens: [{ value: 'env-read-app', expiration: Date.now() / 1000 + 3600 }],
-    },
-    {
-      name: 'external-system',
-      scopes: ['system'],
-      tokens: [{ value: 'system-app', expiration: Date.now() / 1000 + 3600 }],
-    },
-    {
-      name: 'system',
-      scopes: ['system'],
-      tokens: [{ value: 'internal-system', expiration: Date.now() / 1000 + 3600 }],
-    },
   ];
-  for (const scope of ['crons', 'subscriptions', 'dependencies', 'logs', 'dashboard']) {
-    for (const suffix of ['', ':read']) {
-      apps.push({
-        scopes: [`${scope}${suffix}`],
-        tokens: [{
-          value: `${scope}${suffix}-app`,
-          expiration: Date.now() / 1000 + 3600,
-        }],
-      });
-    }
-  }
-  let resetCalls = 0;
-  let commandCalls = 0;
-  let envWriteCalls = 0;
-  let scopedMutationCalls = 0;
   let initialized = 0;
   const User = class {};
-  const Script = class {
-    getFile(folder, filename) {
-      return fs.promises.readFile(path.join(config.scriptPath, folder, filename), 'utf8');
-    }
-    checkFilePath(folder, filename) {
-      return path.join(config.scriptPath, folder || '', filename);
-    }
-  };
-  const script = new Script();
   const user = {
     initializeUser: async () => {
       initialized++;
@@ -137,7 +90,7 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
     },
     '../config/serverEnv': { serveEnv: (_req, res) => res.end() },
     '../services/user': User,
-    '../services/script': Script,
+    '../services/script': class {},
     '../data/open': {},
     '../data/system': {},
     typedi: { Service: () => (x) => x },
@@ -158,8 +111,7 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
   mocks.typedi = {
     ...mocks.typedi,
     Container: {
-      get: (x) =>
-        x === User ? user : x === History ? history : x === Script ? script : configService,
+      get: (x) => (x === User ? user : x === History ? history : configService),
     },
   };
   mocks['../api'] = () => {
@@ -174,41 +126,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       historyCache,
     ).default(router);
     router.get('/envs', (_req, res) => res.json({ code: 200 }));
-    router.post('/envs', (_req, res) => {
-      envWriteCalls++;
-      res.json({ code: 200 });
-    });
-    for (const route of [
-      '/crons', '/subscriptions', '/dependencies', '/logs', '/dashboard/overview',
-    ]) {
-      router.get(route, (_req, res) => res.json({ code: 200 }));
-    }
-    for (const [method, route] of [
-      ['put', '/crons/run'],
-      ['put', '/subscriptions/run'],
-      ['post', '/dependencies'],
-      ['delete', '/logs'],
-      ['post', '/dashboard/record'],
-      ['get', '/crons/import'],
-    ]) {
-      router[method](route, (_req, res) => {
-        scopedMutationCalls++;
-        res.json({ code: 200 });
-      });
-    }
-    router.post('/logs/download', (_req, res) =>
-      res.json({ code: 200, data: 'downloaded' }),
-    );
-    router.get('/system', (_req, res) => res.json({ code: 200 }));
-    router.put('/system/notify', (_req, res) => res.json({ code: 200 }));
-    router.put('/system/auth/reset', (_req, res) => {
-      resetCalls++;
-      res.json({ code: 200 });
-    });
-    router.put('/system/command-run', (_req, res) => {
-      commandCalls++;
-      res.json({ code: 200 });
-    });
     return router;
   };
   const app = express();
@@ -286,68 +203,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
     assert.equal((await request(`${prefix}/envs`)).status, 401, prefix);
   }
   assert.equal((await request('/open/envs', 'env-app')).body.code, 200);
-  assert.equal((await request('/open/envs', 'env-read-app')).body.code, 200);
-  for (const prefix of ['/open', '/panel/open']) {
-    assert.equal(
-      (await request(`${prefix}/envs`, 'env-read-app', 'POST', [
-        { name: 'SAFE_VALUE', value: 'kept' },
-      ])).status,
-      401,
-    );
-  }
-  assert.equal(envWriteCalls, 0);
-  assert.equal(
-    (await request('/open/envs', 'env-app', 'POST', [
-      { name: 'SAFE_VALUE', value: 'kept' },
-    ])).body.code,
-    200,
-  );
-  assert.equal(envWriteCalls, 1);
-  for (const [scope, readPath, method, writePath] of [
-    ['crons', '/crons', 'PUT', '/crons/run'],
-    ['subscriptions', '/subscriptions', 'PUT', '/subscriptions/run'],
-    ['dependencies', '/dependencies', 'POST', '/dependencies'],
-    ['logs', '/logs', 'DELETE', '/logs'],
-    ['dashboard', '/dashboard/overview', 'POST', '/dashboard/record'],
-  ]) {
-    for (const prefix of ['/open', '/panel/open']) {
-      assert.equal(
-        (await request(`${prefix}${readPath}`, `${scope}:read-app`)).body.code,
-        200,
-      );
-      assert.equal(
-        (await request(`${prefix}${writePath}`, `${scope}:read-app`, method))
-          .status,
-        401,
-      );
-    }
-    assert.equal(
-      (await request(`/open${writePath}`, `${scope}-app`, method)).body.code,
-      200,
-    );
-  }
-  assert.equal(scopedMutationCalls, 5);
-  for (const prefix of ['/open', '/panel/open']) {
-    assert.equal(
-      (await request(`${prefix}/crons/import`, 'crons:read-app')).status,
-      401,
-    );
-    assert.equal(
-      (await request(`${prefix}/logs/download`, 'logs:read-app', 'POST'))
-        .body.data,
-      'downloaded',
-    );
-  }
-  const importedWithHead = await fetch(
-    `http://127.0.0.1:${server.address().port}/open/crons/import`,
-    { method: 'HEAD', headers: { Authorization: 'Bearer crons:read-app' } },
-  );
-  assert.equal(importedWithHead.status, 401);
-  assert.equal(
-    (await request('/open/crons/import', 'crons-app')).body.code,
-    200,
-  );
-  assert.equal(scopedMutationCalls, 6);
   assert.equal(
     (await request('/open/configs/detail?path=normal.txt', 'env-app')).status,
     401,
@@ -357,58 +212,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       .data,
     'normal',
   );
-  assert.equal(
-    (await request('/open/configs/detail?path=normal.txt', 'config-read-app'))
-      .body.data,
-    'normal',
-  );
-  for (const prefix of ['/open', '/panel/open']) {
-    for (const name of ['normal.txt', 'config.sh', 'task_before.sh']) {
-      assert.equal(
-        (await request(`${prefix}/configs/save`, 'config-read-app', 'POST', {
-          name,
-          content: 'untrusted',
-        })).status,
-        401,
-      );
-    }
-  }
-  assert.equal(fs.readFileSync(path.join(tmp, 'config/config.sh'), 'utf8'), 'original');
-  assert.equal((await request('/open/system', 'system-app')).body.code, 200);
-  assert.equal(
-    (await request('/open/system/notify', 'system-app', 'PUT', {
-      title: 'title',
-      content: 'content',
-    })).body.code,
-    200,
-  );
-  for (const prefix of ['/open', '/panel/open']) {
-    assert.equal(
-      (await request(`${prefix}/system/auth/reset`, 'system-app', 'PUT', {
-        password: 'changed',
-      })).status,
-      401,
-    );
-    assert.equal(
-      (await request(`${prefix}/system/command-run`, 'system-app', 'PUT', {
-        command: 'id',
-      })).status,
-      401,
-    );
-  }
-  assert.equal(resetCalls, 0);
-  assert.equal(commandCalls, 0);
-  assert.equal(
-    (await request('/open/system/auth/reset', 'internal-system', 'PUT', {
-      retries: 0,
-    })).body.code,
-    200,
-  );
-  assert.equal(
-    (await request('/api/system/auth/reset', valid, 'PUT', { retries: 0 })).body.code,
-    200,
-  );
-  assert.equal(resetCalls, 2);
   assert.equal(
     (await request('/open/configs/detail?path=grpc/client.key', 'config-app'))
       .body.code,
@@ -474,14 +277,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
     ).body.code,
     200,
   );
-  assert.equal(
-    (await request('/api/configs/save', valid, 'POST', {
-      name: 'config.sh',
-      content: 'owner config',
-    })).body.code,
-    200,
-  );
-  assert.equal(fs.readFileSync(path.join(tmp, 'config/config.sh'), 'utf8'), 'owner config');
   assert.equal(
     (
       await request('/api/configs/save', valid, 'POST', {
@@ -501,15 +296,6 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       ).status,
       401,
     );
-    assert.equal(
-      (
-        await request(`${prefix}/scripts`, 'script-read-app', 'POST', {
-          filename: 'test.js',
-          content: 'unauthorized',
-        })
-      ).status,
-      401,
-    );
     assert.equal(
       (
         await request(`${prefix}/scripts`, 'script-app', 'POST', {
@@ -524,38 +310,4 @@ test('HTTP authentication protects init, scopes, expired sessions and config sec
       'authorized script',
     );
   }
-  assert.equal(
-    (await request('/open/scripts/detail?file=test.js', 'script-read-app')).body
-      .data,
-    'authorized script',
-  );
-  const downloaded = await fetch(
-    `http://127.0.0.1:${server.address().port}/open/scripts/download`,
-    {
-      method: 'POST',
-      headers: {
-        Authorization: 'Bearer script-read-app',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ filename: 'test.js' }),
-    },
-  );
-  assert.equal(downloaded.status, 200);
-  assert.equal(await downloaded.text(), 'authorized script');
-  for (const method of ['PUT', 'DELETE']) {
-    assert.equal(
-      (await request('/open/scripts', 'script-read-app', method, {
-        filename: 'test.js', content: 'unauthorized',
-      })).status,
-      401,
-    );
-  }
-  for (const path of ['run', 'stop', 'rename', 'history/restore']) {
-    assert.equal(
-      (await request(`/open/scripts/${path}`, 'script-read-app', 'PUT', {
-        filename: 'test.js', content: 'unauthorized',
-      })).status,
-      401,
-    );
-  }
 });

test/back/restart-instance-recovery.test.cjs

@@ -24,9 +24,8 @@ test('startup closes interrupted instances without inventing exit codes or rewri
     { id: 4, status: 3, started_at: 100, finished_at: 130, exit_code: 7 },
   ]);
   const systemConfig = { info: { lang: 'en-US' } };
-  const startupEvents = [];
   const service = {
-    set_envs: async () => { startupEvents.push('environment'); },
+    set_envs: async () => {},
     getAuthInfo: async () => ({}),
     initializeSystemApp: async () => {},
     refreshApps: async () => {},
@@ -71,10 +70,7 @@ test('startup closes interrupted instances without inventing exit codes or rewri
     '../shared/i18n': { setLang() {} },
     './logger': {},
     '../schedule/client': {
-      readiness: {
-        configure() {},
-        recover: async () => { startupEvents.push('scheduler'); },
-      },
+      readiness: { configure() {}, recover: async () => {} },
     },
   }).default;
   // Dependency installation is unrelated to startup reconciliation.
@@ -86,7 +82,6 @@ test('startup closes interrupted instances without inventing exit codes or rewri
   } finally {
     global.setTimeout = originalTimeout;
   }
-  assert.deepEqual(startupEvents, ['environment', 'scheduler']);
   const rows = await instances.findAll({ order: [['id', 'ASC']], raw: true });
   assert.equal(rows[0].status, 2);
   assert.ok(
@@ -114,9 +109,6 @@ test('startup closes interrupted instances without inventing exit codes or rewri
   } finally {
     global.setTimeout = originalTimeout;
   }
-  assert.deepEqual(startupEvents, [
-    'environment', 'scheduler', 'environment', 'scheduler',
-  ]);
   assert.deepEqual(
     await instances.findAll({ order: [['id', 'ASC']], raw: true }),
     rows,

test/back/systemTokenRenewal.test.cjs

@@ -397,22 +397,6 @@ for (const mutation of ['resetSecret', 'remove', 'update', 'create']) {
   });
 }
 
-test('application mutations cannot change or expose the built-in system app', async (t) => {
-  const state = appsFixture(t);
-  for (const change of [
-    () => state.service.resetSecret(1),
-    () => state.service.update({ id: 1, name: 'system', scopes: ['crons'] }),
-    () => state.service.update({ id: 2, name: 'system', scopes: ['crons'] }),
-    () => state.service.remove([1, 2]),
-  ]) {
-    await assert.rejects(change(), (error) => error.status === 403);
-  }
-  assert.equal(state.apps().length, 2);
-  assert.equal(state.apps()[0].client_secret, 'system-secret');
-  assert.equal(state.apps()[0].tokens[0].value, 'system-token');
-  assert.deepEqual(state.cached(), state.apps());
-});
-
 test('system initialization preserves active tokens while migrating dashboard scope', async (t) => {
   const state = appsFixture(t);
   await AppModel.update({ scopes: ['crons', 'system'] }, { where: { id: 1 } });