mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-11 15:55:44 +00:00
Juan Fernando Castro
81d700d146
Creating a hosted subdomain gated `root_dir` on `write`, and hosting serves everything under that directory with the ACL deliberately bypassed. So a recipient of a `write` share could point a `*.puter.site` subdomain at the owner's folder and make the subtree world-readable — continuously, covering files the owner added later, with the row under the recipient's account where nothing the owner can list would show it. `update` had the same gate for a changed `root_dir`. `#checkPublishAccess` now decides both: the actor's own tree still takes `write`, anyone else's takes `manage` — "Can edit & share", the level that delegates the decision. Keyed on who owns the entry rather than asking for `manage` outright, which is what the ticket proposed. `manage`'s is-owner implicator declines to answer for app actors, so a flat `manage` would refuse every app publishing a directory its user handed it, with no way for the app to obtain the grant. The write check still runs first — it is what masks a directory the caller cannot see as a 404 — and `manage` satisfies every lower mode, so the order costs a manage-holder nothing. The GUI's Publish As Website item reuses the own-it-or-`manage` answer it already computes for sharing, so it is not offered where this would refuse. Docs state the rule on `hosting.create()` and in `share()`'s level list. Regression tests fail without the driver change: a write-share recipient is refused on create and on repointing an existing subdomain, while `manage` and the actor's own directory are accepted.
Puter.js Docs
Docs · Developer · Puter.com · X
Puter.js Docs
The Puter.js documentation contains everything you need to build powerful applications with Puter.js.
- Get started with Puter.js by reading documentations on usage and best practices
- Browse all available APIs, including AI, networking, authentication, and cloud services
- Find code examples and implementations to speed up your development
Getting Started
💻 Local Development
git clone https://github.com/HeyPuter/docs
cd docs
npm install
npm run dev
→ This should launch Puter.js Docs at http://127.0.0.1:8080 (or the next available port).
Support
Connect with the maintainers and community through these channels:
- Bug report or feature request? Please open an issue.
- X (Twitter): x.com/HeyPuter
- Security issues? security@puter.com
- Email maintainers at hi@puter.com
We are always happy to help you with any questions you may have. Don't hesitate to ask!
License
This repository, including its sub-projects, modules, and components, is licensed under MIT, and its content is licensed under CC BY-SA 4.0 unless explicitly stated otherwise. Third-party libraries included in this repository may be subject to their own licenses.