wmantly
2acc3644c4
- Rename Grant -> Permission end-to-end (model, routes, view, frontend, bootstrap) and add an idempotent redis migration for existing records. - utils/roles.js: glob domain matching (* = one label, ** = any depth) against the full host; authz passes the full hostname. - Local groups: LocalGroup model + admin routes/UI; membership merged into Permission.effectiveFor so app groups behave like SSO groups. - Subject autocomplete via GET /api/permission/subjects (users + derived groups). - User profile page (/profile) and username in the navbar; /api/user/me now returns merged/local/external groups. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
31 lines
1.2 KiB
JavaScript
31 lines
1.2 KiB
JavaScript
'use strict';
|
|
|
|
const router = require('express').Router();
|
|
const conf = require('@simpleworkjs/conf');
|
|
const middleware = require('../middleware/auth');
|
|
const authz = require('../middleware/authz');
|
|
|
|
// API routes for authentication.
|
|
router.use('/auth', require('./auth'));
|
|
|
|
// API routes for working with users. All endpoints need to be have valid user.
|
|
// User management is admin-only; the router allows self-service exceptions
|
|
// (GET /me, PUT /password) before its own admin gate.
|
|
router.use('/user', middleware.auth, require('./user'));
|
|
|
|
// API routes for working with hosts. All endpoints need to be have valid user.
|
|
// Per-domain authorization is enforced inside the host router.
|
|
router.use('/host', middleware.auth, require('./host'));
|
|
|
|
router.use('/dns', middleware.auth, require('./dns'));
|
|
|
|
// API routes for working with hosts. All endpoints need to be have valid user.
|
|
router.use('/cert', middleware.auth, require('./cert'));
|
|
|
|
// Permission management (who can manage which domains) is global-admin-only.
|
|
router.use('/permission', middleware.auth, authz.requireAdmin, require('./permission'));
|
|
|
|
// Local group management is global-admin-only.
|
|
router.use('/group', middleware.auth, authz.requireAdmin, require('./group'));
|
|
|
|
module.exports = router; |