From 9cf1c167e8f412eb17e34404a8771e54f57dbc9b Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Thu, 9 Apr 2026 09:20:24 +0800
Subject: [PATCH] fix(auth): remove sandbox default session fallback

---
 src/app/api/auth/session/route.ts                        | 5 +----
 src/lib/userStore.ts                                     | 4 ++--
 .../builtin/user-center/components/UserOverview.tsx      | 5 +----
 .../extensions/builtin/user-center/routes/agent.tsx      | 9 +++------
 4 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/src/app/api/auth/session/route.ts b/src/app/api/auth/session/route.ts
index b46a3a3..0b61ced 100644
--- a/src/app/api/auth/session/route.ts
+++ b/src/app/api/auth/session/route.ts
@@ -141,10 +141,7 @@ export async function GET(request: NextRequest) {
     Boolean(rawUser.readOnly) ||
     normalizedGroups.some((group) => group.toLowerCase() === "readonly role") ||
     rawRole === "readonly" ||
-    rawRole === "read_only" ||
-    String(rawUser.email ?? "")
-      .trim()
-      .toLowerCase() === "sandbox@svc.plus";
+    rawRole === "read_only";
   const normalizedProxyUuid =
     typeof rawUser.proxyUuid === "string" && rawUser.proxyUuid.trim().length > 0
       ? rawUser.proxyUuid.trim()
diff --git a/src/lib/userStore.ts b/src/lib/userStore.ts
index 962737b..02eaaef 100644
--- a/src/lib/userStore.ts
+++ b/src/lib/userStore.ts
@@ -65,6 +65,8 @@ const KNOWN_ROLE_MAP: Record<string, UserRole> = {
   member: 'user',
 }
 
+const GUEST_SANDBOX_TENANT_ID = 'guest-sandbox'
+const GUEST_SANDBOX_TENANT_NAME = 'Guest Sandbox'
 function normalizeRole(input?: string | null): UserRole {
   if (!input || typeof input !== 'string') {
     return 'guest'
@@ -162,11 +164,9 @@ async function fetchSessionUser(): Promise<User | null> {
         .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)
         .map((value) => value.trim())
       : []
-    const normalizedEmail = typeof email === 'string' ? email.trim().toLowerCase() : ''
     const inferredReadOnly =
       rawRole === 'readonly' ||
       rawRole === 'read_only' ||
-      normalizedEmail === 'sandbox@svc.plus' ||
       normalizedGroups.some((value) => value.toLowerCase() === 'readonly role')
     const normalizedReadOnly = Boolean(sessionUser.readOnly) || inferredReadOnly
     const normalizedProxyUuid =
diff --git a/src/modules/extensions/builtin/user-center/components/UserOverview.tsx b/src/modules/extensions/builtin/user-center/components/UserOverview.tsx
index 55f4134..6a12667 100644
--- a/src/modules/extensions/builtin/user-center/components/UserOverview.tsx
+++ b/src/modules/extensions/builtin/user-center/components/UserOverview.tsx
@@ -57,10 +57,7 @@ export default function UserOverview({ hideMfaMainPrompt = false }: UserOverview
   const username = user?.username ?? '—'
   const email = user?.email ?? '—'
   const docsUrl = mfaCopy.actions.docsUrl
-  const normalizedEmail = user?.email?.toLowerCase() ?? ''
-  const isGuestSandboxReadOnly = Boolean(
-    user?.isReadOnly && (normalizedEmail === 'sandbox@svc.plus'),
-  )
+  const isGuestSandboxReadOnly = Boolean(user?.isGuest && user?.isReadOnly)
   const guestUuidExpiresAtText = useMemo(() => {
     if (!isGuestSandboxReadOnly || !user?.proxyUuidExpiresAt) {
       return null
diff --git a/src/modules/extensions/builtin/user-center/routes/agent.tsx b/src/modules/extensions/builtin/user-center/routes/agent.tsx
index 83a7806..e44abdb 100644
--- a/src/modules/extensions/builtin/user-center/routes/agent.tsx
+++ b/src/modules/extensions/builtin/user-center/routes/agent.tsx
@@ -42,10 +42,7 @@ export default function UserCenterAgentRoute() {
   const user = useUserStore((state) => state.user)
   const { data: nodes, error, isLoading, mutate } = useSWR<VlessNode[]>('user-center-agent-nodes', fetchAgentNodes)
   const [boundNode, setBoundNode] = useState<VlessNode | null>(null)
-  const normalizedEmail = user?.email?.toLowerCase() ?? ''
-  const isGuestSandboxReadOnly = Boolean(
-    user?.isReadOnly && (normalizedEmail === 'sandbox@svc.plus'),
-  )
+  const isGuestSandboxReadOnly = Boolean(user?.isGuest && user?.isReadOnly)
   const visibleNodes = useMemo(() => {
     return (nodes ?? []).filter((node) => {
       if (isGuestSandboxReadOnly) {
@@ -95,7 +92,7 @@ export default function UserCenterAgentRoute() {
 
     // Guest sandbox behavior: if root has bound a preferred node, ensure it is first,
     // but still show all regions/nodes to keep the demo experience useful.
-    if (isGuestSandboxReadOnly && normalizedEmail && boundAddress) {
+    if (isGuestSandboxReadOnly && boundAddress) {
       const matched = nodes?.find((n) => n.address === boundAddress)
       const preferred = matched ?? boundNode ?? null
       if (preferred) {
@@ -110,7 +107,7 @@ export default function UserCenterAgentRoute() {
     }
 
     return base
-  }, [isGuestSandboxReadOnly, nodes, visibleNodes, normalizedEmail, boundAddress, boundNode])
+  }, [isGuestSandboxReadOnly, nodes, visibleNodes, boundAddress, boundNode])
 
   const groupedNodes = useMemo(() => {
     const groups: Record<string, VlessNode[]> = {