From 2532c492f101d906fdfe728eff40fb6ee477ab77 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Tue, 28 Jul 2026 00:59:27 -0400 Subject: [PATCH] Warn before adding a member to app_sso_service_account app_sso_service_account is a marker group: membership hides an account from the Users page's People tab entirely (users.ejs filters it out), which is exactly right for a non-person account but has no guardrail against adding a real person by mistake -- which just happened in production (see #113) and looked exactly like the account had vanished. Adding a member to any other group via this dropdown is unchanged (fires immediately, no confirmation); only app_sso_service_account now asks first, via app.messages.confirm. Verified live against a local stack: confirmation shows the right warning, Cancel leaves the group untouched, Confirm adds the member normally, and every other group's add-member flow is unaffected. Co-Authored-By: Claude Sonnet 5 --- nodejs/views/groups.ejs | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/nodejs/views/groups.ejs b/nodejs/views/groups.ejs index 89a1163..2eb7625 100644 --- a/nodejs/views/groups.ejs +++ b/nodejs/views/groups.ejs @@ -32,6 +32,33 @@ return value; } + // app_sso_service_account is a marker group: membership hides an account + // from the Users page's People tab entirely (see users.ejs), which is + // exactly right for a non-person account but has silently made a real + // person's account look "gone" before (nothing else about it changes). + // Everywhere else in this dropdown just fires the PUT directly; only + // this one group gets a confirmation first. + function addMemberClick(event, groupCN, uid, el){ + event.preventDefault(); + const $el = $(el); + (async function(){ + if (groupCN === 'app_sso_service_account') { + const ok = await app.messages.confirm( + `Mark "${uid}" as a service account? This hides them from the Users page's People tab (Service Accounts tab only) — only do this for a non-person account.`, + $el.closest('.card'), 'warning' + ); + if (!ok) return; + } + try { + const data = await app.api.put(`group/${groupCN}/${uid}`, {}); + await addedUser(data.message, groupCN, uid, $el); + } catch(e) { + app.messages.action(e.message || 'Failed to add member', $el.closest('.card'), 'danger'); + } + })(); + return false; + } + async function addedUser(message, group, user, $form){ let data = await app.group.get(group); $.scope.groupCard.update('cn', group, processGroup(data.results)); @@ -214,7 +241,7 @@
{{ #toAdd }}{{#.}} - + {{uid}} {{/.}}{{ /toAdd }}