arcodange-org/erp
1
0
Fork 0
Code Issues 18 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

Browse Source 
The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
arcodange
2026-07-11 17:38:30 +02:00
co-authored by Claude Fable 5
parent 3045d50626
commit 0240c519b1
6 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/README.md
+5 -2
View File
@@ -95,12 +95,15 @@ Vault at `kvv2/erp-sandbox/ai_agent`.
### Write rights granted
The `ai_agent_sandbox` user is created non-admin and granted read + create on:
The `ai_agent_sandbox` user is created non-admin and granted (the authoritative
list is `WRITE_IDS` in `provisionSandbox.ts`):
| Module | rights ids |
| ---------------- | ---------------------------------- |
| facture | lire=11, creer=12 |
| societe | lire=121, creer=122 |
| societe | lire=121, creer=122, client voir=262 |
| societe contact | lire=281, creer=282 |
| fournisseur | lire=1181, facture lire=1231, facture creer=1232 |
| produit | lire=31, creer=32 |
| banque | lire=111 |
| user | lire=251 — requis par le probe armé `GET /users/info` (checkpoint `status`/`relink-env`) |