fix: drop legacy app_super_admin -- SUPER_ADMIN_GROUP is now god_admin (v1.26.1)

god_admin now exists at boot (seeded by docker-entrypoint), so the canonical
cross-resource super group nested into every resource's _admin group is god_admin,
not the legacy app_super_admin. docker-entrypoint no longer seeds or nests
app_super_admin (god_admin nests into the app_sso_* groups directly). isSuperAdmin
still recognizes a pre-existing app_super_admin as a migration alias until rebuild.

nodejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.26.0",
+  "version": "1.26.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.26.0",
+      "version": "1.26.1",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.26.0",
+  "version": "1.26.1",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {

nodejs/routes/api_directory_admin.js

@@ -12,7 +12,7 @@ const groups = require('../utils/groups');
 
 // Make `childCn` a member of `parentCn`, i.e. everyone in the child is
 // transitively in the parent. Idempotent and non-fatal: "already a member" is
-// the goal state, and a missing group (e.g. app_super_admin absent on a
+// the goal state, and a missing group (e.g. god_admin absent on a
 // directory seeded by an older entrypoint) is a reason to skip, not to fail the
 // caller's real work.
 async function nestGroup(childCn, parentCn) {
@@ -121,7 +121,7 @@ async function ensureSiteGroups(siteSlug, ownerDn, siteName, siteResourceId) {
 //   {site}_{slug}_admin  -> {site}_{slug}_access
 //   {site}_{slug}_admin  -> {site}_{kind}s_admin    (aggregate)
 //   {site}_{slug}_access -> {site}_{kind}s_access   (aggregate)
-//   app_super_admin      -> {site}_{slug}_admin     (legacy cross-app)
+//   god_admin            -> {site}_{slug}_admin     (global super admin)
 async function provisionResourceGroups(resource, kind, siteSlug, ownerDn) {
   const accessCn = groups.resourceGroupCns(siteSlug, resource.slug, 'access');
   const adminCn = groups.resourceGroupCns(siteSlug, resource.slug, 'admin');
@@ -487,7 +487,7 @@ router.get('/access-summary', async (req, res, next) => {
       //
       // Counts come from the transitive closure, not from `member`. Reading the
       // attribute would report only who is listed on the group, missing anyone
-      // who reaches it through a nested group -- and since app_super_admin is
+      // who reaches it through a nested group -- and since god_admin is
       // nested into every resource's _admin group, that is not an edge case.
       let members = [];
       if (group) {

nodejs/utils/permission.js

@@ -4,13 +4,14 @@ const {Group} = require('../models/group_ldap');
 const groups = require('./groups');
 
 // The group nested into every resource's _admin group by api_directory_admin
-// (cross-resource super-admin administration). KEEP the legacy `app_super_admin`
-// here: it is the group that actually exists and gets nested. The new schema's
-// global `god_admin` is recognized in isSuperAdmin() below, and api_directory_admin
-// nests SUPER_ADMIN_GROUP -- so until `god_admin` is created during bootstrap, this
-// must stay `app_super_admin` or resource auto-provisioning's nesting silently
-// no-ops (leaving only the creator as the group's sole member).
-const SUPER_ADMIN_GROUP = 'app_super_admin';
+// (cross-resource super-admin administration). This is `god_admin` -- the global
+// super group of the new model (docs/GROUPS.md), seeded by docker-entrypoint.sh.
+// It used to be the legacy `app_super_admin`, which existed while god_admin
+// didn't; now that god_admin is created at boot, the provisioning nests it.
+// LEGACY_SUPER_ADMIN_ALIASES still recognizes a `app_super_admin` that predates
+// the migration, so an existing deployment isn't stripped of rights until it's
+// rebuilt.
+const SUPER_ADMIN_GROUP = 'god_admin';
 const LEGACY_SUPER_ADMIN_ALIASES = ['app_super_admin'];
 
 // True if the user (by resolved member cns) is a global god/super admin.