[BUG] 普通用户无法查看自己的请求详细信息

[fangzhengjin]

普通用户点击使用记录中的查看会话信息详情时( /zh-CN/dashboard/sessions/[SESSION_ID]/messages?seq=1 )，会被强制跳转到首页，无法查看请求和详细原始信息，由于用户的 SESSION_ID 在全局应该是唯一的，所以普通用户应该能通过该入口查看自己的请求和响应信息，不需要拦截

[github-actions]

Thank you for reporting this issue.

Analysis:

The issue is confirmed. The page component at src/app/[locale]/dashboard/sessions/[sessionId]/messages/page.tsx has a hardcoded admin-only permission check that redirects non-admin users away, even though the underlying API actions already properly support user-based access control.

Affected code:

• src/app/[locale]/dashboard/sessions/[sessionId]/messages/page.tsx (lines 15-18):

// 权限检查：仅 admin 用户可访问
if (!session || session.user.role !== "admin") {
  return redirect({ href: session ? "/dashboard" : "/login", locale });
}

Backend already supports user-based access:

The following server actions already implement proper ownership-based access control (admin can view all, regular users can only view their own):

• getSessionDetails() at src/actions/active-sessions.ts:531-604 - Verifies session ownership via sessionStats.userId !== currentUserId
• getSessionMessages() at src/actions/active-sessions.ts:388-444 - Same ownership verification
• getSessionRequests() at src/actions/active-sessions.ts:729-809 - Same ownership verification
• terminateActiveSession() at src/actions/active-sessions.ts:819-892 - Same ownership verification
• getSessionResponse() at src/actions/session-response.ts:15-70 - Same ownership verification

UI entry points affected:

Regular users can see the session details links in these components, but are redirected when clicking:

• src/app/[locale]/dashboard/sessions/_components/active-sessions-table.tsx:419
• src/components/customs/session-card.tsx:82
• src/components/customs/active-sessions-cards.tsx:46

Root cause:

The page component's permission check is too restrictive. It only checks for admin role, while the backend API actions already properly verify session ownership. Since session IDs are globally unique and the backend verifies ownership, regular users should be able to access this page to view their own session details.

Suggested fix:

Modify the permission check in page.tsx to allow both:

1. Admin users (can view all sessions)
2. Regular users who own the specific session (verified via the existing backend ownership checks)

Or simply remove the frontend role check entirely, as the backend actions already enforce proper access control.

---

Automated response from Claude AI

[github-actions]

This issue has been automatically marked as stale because it has not had any activity in the last 30 days.

If this issue is still relevant:

• Please comment to keep it open
• Add any new information that might help resolve it

This issue will be automatically closed in 14 days if there is no further activity.