arcodange-org/erp
1
0
Fork 0
Code Issues 18 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

Browse Source 
The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
arcodange
2026-07-11 17:38:30 +02:00
co-authored by Claude Fable 5
parent 3045d50626
commit 0240c519b1
6 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/README.md
+5 -2
View File
@@ -95,12 +95,15 @@ Vault at `kvv2/erp-sandbox/ai_agent`.
### Write rights granted
The `ai_agent_sandbox` user is created non-admin and granted read + create on:
The `ai_agent_sandbox` user is created non-admin and granted (the authoritative
list is `WRITE_IDS` in `provisionSandbox.ts`):
| Module | rights ids |
| ---------------- | ---------------------------------- |
| facture | lire=11, creer=12 |
| societe | lire=121, creer=122 |
| societe | lire=121, creer=122, client voir=262 |
| societe contact | lire=281, creer=282 |
| fournisseur | lire=1181, facture lire=1231, facture creer=1232 |
| produit | lire=31, creer=32 |
| banque | lire=111 |
| user | lire=251 — requis par le probe armé `GET /users/info` (checkpoint `status`/`relink-env`) |
test/provisionSandbox.ts
+4
View File
@@ -39,6 +39,7 @@ import userSetup from "./scripts/admin/userSetup.ts";
fournisseur: lire=1181, facture lire=1231, facture creer=1232
produit: lire=31, creer=32
banque: lire=111
user: lire=251
*/
const WRITE_IDS = [
11, // facture lire
@@ -56,6 +57,9 @@ const WRITE_IDS = [
31, // produit lire
32, // produit creer
111, // banque lire — list bank accounts (GET /bankaccounts) to pick account_id
251, // user lire — requis par le probe armé GET /users/info (checkpoint status/relink)
// Sans lui l'endpoint répond 403 alors que la clé authentifie, et le
// checkpoint affiche NOT armed sur un agent pourtant fonctionnel.
];
const KEY_FILE = ".ai_agent_sandbox.key";