RBAC changes + fix rev console and process view in shellcode

Overlord-Server/src/server/routes/file-download-routes.ts

@@ -8,7 +8,7 @@ import { logger } from "../../logger";
 import { encodeMessage } from "../../protocol";
 import { getConfig } from "../../config";
 import { isAuthorizedAgentRequest } from "../agent-auth";
-import { canUserAccessClient } from "../../users";
+import { canUserAccessClient, canUserAccessFeature } from "../../users";
 
 type RequestIpProvider = {
   requestIP: (req: Request) => { address?: string } | null | undefined;
@@ -160,6 +160,10 @@ async function serveDownloadById(
     return new Response("Forbidden: Admin or operator access required", { status: 403 });
   }
 
+  if (!canUserAccessFeature(user.userId, user.role as any, "file_browser")) {
+    return new Response("Forbidden: feature access denied", { status: 403 });
+  }
+
   logger.debug("[filebrowser] http download request", {
     downloadId,
     userId: user.userId,
@@ -363,6 +367,10 @@ export async function handleFileDownloadRoutes(
       return new Response("Forbidden: client access denied", { status: 403 });
     }
 
+    if (!canUserAccessFeature(user.userId, user.role as any, "file_browser")) {
+      return new Response("Forbidden: feature access denied", { status: 403 });
+    }
+
     logger.debug("[filebrowser] http upload request", {
       userId: user.userId,
       clientId,
@@ -408,6 +416,10 @@ export async function handleFileDownloadRoutes(
       return new Response("Forbidden: Admin or operator access required", { status: 403 });
     }
 
+    if (!canUserAccessFeature(user.userId, user.role as any, "file_browser")) {
+      return new Response("Forbidden: feature access denied", { status: 403 });
+    }
+
     let uploadId = "";
     try {
       uploadId = decodeURIComponent(url.pathname.slice("/api/file/upload/".length));
@@ -651,6 +663,10 @@ export async function handleFileDownloadRoutes(
       return new Response("Forbidden: client access denied", { status: 403 });
     }
 
+    if (!canUserAccessFeature(user.userId, user.role as any, "file_browser")) {
+      return new Response("Forbidden: feature access denied", { status: 403 });
+    }
+
     const target = clientManager.getClient(clientId);
     if (!target) {
       return new Response("Client offline", { status: 404 });