wmantly
c7ec65e0d9
- All pages now wrap their content in <div class="container mt-4">, matching sso-manager-node's width instead of rendering full-bleed inside the fluid shell. - Users and Permissions pages converted from bare <table>s to the same card-grid convention already used on the Groups page. - Users backed by SSO/OIDC login (backing === 'oidc', set by the redis user model's JIT-provisioning path) are now marked "External (SSO)" and their password-change control is hidden; PUT /password/:username also rejects with 403 server-side for such users. Deletion stays allowed. Redis-backend only -- LDAP/PAM deployments have no per-record marker for this today. - app-base.js (byte-identical across the 3 apps): added app.util.revealItem(), wired into the Users/Permissions create flows. - Bumped @simpleworkjs/frontend to ^0.2.7.
105 lines
3.2 KiB
JavaScript
Executable File
105 lines
3.2 KiB
JavaScript
Executable File
'use strict';
|
|
|
|
const router = require('express').Router();
|
|
const {User} = require('../models').models;
|
|
const authz = require('../middleware/authz');
|
|
const {passwordError} = require('../utils/password_policy');
|
|
|
|
// Reject a weak password before it reaches the model. Throws 422 with a
|
|
// per-field key the frontend surfaces inline.
|
|
function validatePassword(password){
|
|
let message = passwordError(password);
|
|
if(message) throw new User.errors.ObjectValidateError([{key: 'password', message}]);
|
|
}
|
|
|
|
// User management is global-admin-only, except the self-service routes below
|
|
// (GET /me, PUT /password) which any authenticated user may call for their own
|
|
// account.
|
|
|
|
router.get('/', authz.requireAdmin, async function(req, res, next){
|
|
try{
|
|
return res.json({
|
|
results: await User[req.query.detail ? "listDetail" : "list"]()
|
|
});
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
router.post('/', authz.requireAdmin, async function(req, res, next){
|
|
try{
|
|
req.body.created_by = authz.reqUsername(req)
|
|
validatePassword(req.body.password);
|
|
|
|
// User.create (not the nonexistent User.add) — the drift here meant every
|
|
// API-created account threw, so the new credentials never existed to log
|
|
// in with (issue #48).
|
|
return res.json(await User.create(req.body));
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
router.delete('/:username', authz.requireAdmin, async function(req, res, next){
|
|
try{
|
|
let user = await User.get(req.params.username);
|
|
|
|
return res.json({username: req.params.username, results: await user.remove()})
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
// Self-service: the caller's own identity and effective rights. Drives the
|
|
// frontend's nav/button gating.
|
|
router.get('/me', async function(req, res, next){
|
|
try{
|
|
let effective = await authz.getEffective(req);
|
|
return res.json({
|
|
username: authz.reqUsername(req),
|
|
// Merged groups (external + local); localGroups is the app-managed
|
|
// subset, externalGroups the ones from SSO/LDAP.
|
|
groups: effective.groups || req.groups || [],
|
|
localGroups: effective.localGroups || [],
|
|
externalGroups: req.groups || [],
|
|
isAdmin: effective.isAdmin,
|
|
global: effective.global,
|
|
domains: effective.domains,
|
|
});
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
// Self-service: change your own password.
|
|
router.put('/password', async function(req, res, next){
|
|
try{
|
|
validatePassword(req.body.password);
|
|
return res.json({results: await req.user.setPassword(req.body)})
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
// Admin: reset another user's password. Blocked for SSO/OIDC-provisioned
|
|
// accounts (backing === 'oidc') -- they authenticate through the IdP, not a
|
|
// local password, so resetting one here would be a no-op at best and a
|
|
// false sense of control at worst. Only applies to the redis user backend;
|
|
// LDAP/PAM-backed deployments have no per-record marker for this.
|
|
router.put('/password/:username', authz.requireAdmin, async function(req, res, next){
|
|
try{
|
|
validatePassword(req.body.password);
|
|
let user = await User.get(req.params.username);
|
|
if(user.backing === 'oidc'){
|
|
let e = new Error('Cannot set a password for an SSO-authenticated user.');
|
|
e.status = 403;
|
|
throw e;
|
|
}
|
|
return res.json({results: await user.setPassword(req.body)});
|
|
}catch(error){
|
|
next(error);
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|