fix: un dossier perso n'est plus visible par les autres comptes #194

L'admin (vaults: ["*"]) voyait le home de chaque utilisateur dans sa
barre latérale : "*" ouvrait tous les vaults, home-* compris.

- backend/auth/middleware.py : check_vault_access exige un octroi
  explicite pour tout vault home-* (nouveau is_home_vault()).
- Filtres « * » en dur remplacés par check_vault_access : dashboard,
  conflits, liens retour, favoris, abonnements push.
- /api/search : search_vaults(is_allowed=…) filtre les bruts avant
  pagination (total et page restent justes).
- backend/user_home.py : _grant n'écarte plus les comptes « * » —
  l'admin reçoit son propre home-admin (auto-réparé au démarrage).
- Tests : test_user_home.py +2, assertion API inversée dans
  test_auth_api.py (admin ne voit plus home-alice).

backend/auth/middleware.py

@@ -142,6 +142,11 @@ def require_admin(current_user=Depends(require_auth)):
     return current_user
 
 
+def is_home_vault(vault_name: str) -> bool:
+    """Un dossier personnel (#194) : vault « home-<user> »."""
+    return vault_name.startswith("home-")
+
+
 def check_vault_access(vault_name: str, user: dict) -> bool:
     """Check if a user has access to a specific vault.
 
@@ -149,8 +154,13 @@ def check_vault_access(vault_name: str, user: dict) -> bool:
     - vaults == ["*"] → full access (admin default)
     - vault_name in vaults → access granted
     - otherwise → denied
+
+    #194 : un dossier personnel n'est **jamais** couvert par ``*`` — sinon
+    un admin (``vaults: ["*"]``) verrait le dossier de chaque utilisateur.
     """
     vaults = user.get("_token_vaults") or user.get("vaults", [])
+    if is_home_vault(vault_name):
+        return vault_name in vaults
     if "*" in vaults:
         return True
     return vault_name in vaults

backend/push.py

@@ -13,7 +13,7 @@ from typing import Any
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, Field
 
-from backend.auth.middleware import require_auth
+from backend.auth.middleware import check_vault_access, require_auth
 
 logger = logging.getLogger("obsigate.push")
 
@@ -167,9 +167,9 @@ async def subscribe_push(
     """Subscribe to push notifications for a vault."""
     username = current_user.get("username", "unknown")
     
-    # Check if user has access to this vault
-    user_vaults = current_user.get("_token_vaults") or current_user.get("vaults", [])
-    if "*" not in user_vaults and request.vault not in user_vaults:
+    # Check if user has access to this vault (#194 : "*" n'inclut pas les
+    # dossiers persos, check_vault_access est la source unique).
+    if not check_vault_access(request.vault, current_user):
         raise HTTPException(status_code=403, detail="No access to this vault")
     
     # Check if subscription already exists

backend/routers/config.py

@@ -24,7 +24,7 @@ from pathlib import Path
 from fastapi import APIRouter, Body, Depends, HTTPException, Query
 
 from backend.ai import PROVIDERS, _read_ai_keys, get_ai_key
-from backend.auth.middleware import require_admin, require_auth
+from backend.auth.middleware import check_vault_access, require_admin, require_auth
 from backend.indexer import index
 from backend.media_types import IMAGE_EXTENSIONS
 from backend.schemas import (
@@ -495,14 +495,13 @@ async def api_diagnostics(current_user=Depends(require_admin)):
 @router.get("/api/dashboard", response_model=DashboardResponse)
 async def api_dashboard(current_user=Depends(require_auth)):
     """Aggregated dashboard statistics across all accessible vaults."""
-    user_vaults = current_user.get("_token_vaults") or current_user.get("vaults", [])
     vault_stats = []
     total_files = 0
     total_tags = set()
     total_size = 0
     total_images = 0
     for vname, vdata in index.items():
-        if "*" not in user_vaults and vname not in user_vaults:
+        if not check_vault_access(vname, current_user):
             continue
         files = vdata.get("files", [])
         fc = len(files)

backend/routers/conflicts.py

@@ -31,10 +31,9 @@ router = APIRouter(tags=["conflicts"])
 @router.get("/api/conflicts", response_model=ConflictsResponse)
 async def api_conflicts(current_user=Depends(require_auth)):
     """List sync-conflict files across accessible vaults."""
-    user_vaults = current_user.get("_token_vaults") or current_user.get("vaults", [])
     all_conflicts = get_conflicts()
-    if "*" not in user_vaults:
-        all_conflicts = [c for c in all_conflicts if c["vault"] in user_vaults]
+    # #194 : filtrage via check_vault_access ("*" n'inclut pas les homes).
+    all_conflicts = [c for c in all_conflicts if check_vault_access(c["vault"], current_user)]
     return {"conflicts": all_conflicts, "total": len(all_conflicts)}
 
 

backend/routers/files_read.py

@@ -166,12 +166,11 @@ async def api_file_backlinks(
     if not vault_data:
         raise HTTPException(status_code=404, detail=f"Vault '{vault_name}' not found")
 
-    user_vaults = current_user.get("_token_vaults") or current_user.get("vaults", [])
     backlinks = get_backlinks(vault_name, path)
 
-    # Filter by user-accessible vaults
-    if "*" not in user_vaults:
-        backlinks = [b for b in backlinks if b["vault"] in user_vaults]
+    # Filter by user-accessible vaults (#194 : check_vault_access, "*" sans
+    # les dossiers persos).
+    backlinks = [b for b in backlinks if check_vault_access(b["vault"], current_user)]
 
     return {
         "vault": vault_name,

backend/routers/history.py

@@ -59,7 +59,6 @@ async def api_recent(limit: int | None = Query(None), vault: str | None = Query(
 @router.get("/api/bookmarks", response_model=BookmarksResponse)
 async def api_bookmarks(vault: str | None = Query(None), current_user=Depends(require_auth)):
     username = current_user.get("username")
-    user_vaults = current_user.get("_token_vaults") or current_user.get("vaults", [])
 
     if not username:
         return {"files": []}
@@ -68,7 +67,8 @@ async def api_bookmarks(vault: str | None = Query(None), current_user=Depends(re
     files_resp = []
     for item in history:
         v_name = item["vault"]
-        if "*" not in user_vaults and v_name not in user_vaults:
+        # #194 : check_vault_access — "*" n'inclut pas les dossiers persos.
+        if not check_vault_access(v_name, current_user):
             continue
 
         # Find in index to get metadata

backend/routers/search.py

@@ -82,7 +82,12 @@ async def api_search(
     # paginate in the shared service so routes and tools share the same logic.
     return await loop.run_in_executor(
         get_search_executor(),
-        partial(search_vaults, q, vault, tag, limit, offset),
+        # #194 : filtre par vault accessible AVANT pagination ("*" sans les
+        # dossiers persos) — sinon un user voyait les notes des autres.
+        partial(
+            search_vaults, q, vault, tag, limit, offset,
+            is_allowed=lambda v: check_vault_access(v, current_user),
+        ),
     )
 
 

backend/services/recent.py

@@ -12,6 +12,7 @@ import time
 from datetime import datetime
 from typing import Any
 
+from backend.auth.middleware import is_home_vault
 from backend.history import get_recent_opened, is_bookmarked
 from backend.indexer import find_file_in_index, index
 
@@ -31,6 +32,10 @@ def humanize_mtime(mtime: float) -> str:
 
 
 def _can_access(vault: str, user_vaults: list[str]) -> bool:
+    # #194 : un dossier perso ne bénéficie jamais de "*" (même règle que
+    # backend.auth.middleware.check_vault_access).
+    if is_home_vault(vault):
+        return vault in user_vaults
     return "*" in user_vaults or vault in user_vaults
 
 

backend/services/search.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from typing import Any
 
 
@@ -11,15 +12,19 @@ def search_vaults(
     tag: str | None = None,
     limit: int = 50,
     offset: int = 0,
+    is_allowed: Callable[[str], bool] | None = None,
 ) -> dict[str, Any]:
     """Full-text search with pagination, returned as the API response payload.
 
-    No permission filtering is applied here: callers that need it (the tool
-    layer) filter the ``results`` list themselves.
+    ``is_allowed`` (#194) filters the raw hits **before** pagination, so a
+    restricted vault set neither distorts ``total`` nor the returned page.
+    The tool layer filters on its own and leaves it as ``None``.
     """
     from backend.search import search
 
     all_results = search(q, vault_filter=vault, tag_filter=tag)
+    if is_allowed is not None:
+        all_results = [r for r in all_results if is_allowed(r.get("vault", ""))]
     total = len(all_results)
     page = all_results[offset: offset + limit]
     return {

backend/user_home.py

@@ -112,14 +112,18 @@ async def release_user_home(username: str) -> None:
 
 
 def _grant(username: str, vault_name: str) -> None:
-    """Ajoute le vault à ``user.vaults`` si l'utilisateur n'a pas déjà ``*``."""
+    """Ajoute le vault à ``user.vaults`` s'il n'y est pas déjà (#194).
+
+    L'octroi est explicite même pour un admin (``vaults: ["*"]``) : ``*`` ne
+    couvre jamais un dossier perso (voir ``check_vault_access``).
+    """
     from backend.auth.user_store import get_user, update_user
 
     user = get_user(username)
     if not user:
         return  # créé hors API (bootstrap avant users.json) → réparé au boot suivant
     vaults = user.get("vaults") or []
-    if "*" in vaults or vault_name in vaults:
+    if vault_name in vaults:
         return
     update_user(username, {"vaults": [*vaults, vault_name]})