theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add cross-app super admin group; rename Executive page to Overview

Browse Source 
- app_super_admin is a new cross-app LDAP group (also recognized by proxy
  and jump-host) that grants full admin here regardless of app_sso_admin
  membership: bypassed centrally in utils/permission.js's byGroup, folded
  into GET /api/user/me's isAdmin flag, and added to nav/forceLogin gates
  alongside app_sso_admin.
- Renamed the Executive page to Overview (route, view, API path
  /api/metrics/overview, nav label, docs), keeping /executive as a 301
  redirect alongside the existing /admin, /notifications, /dashboard
  legacy redirects.
This commit is contained in:
William Mantly
2026-07-30 11:56:58 -04:00
parent 6c71c91ff6
commit e9b808d1c2
11 changed files with 33 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/utils/permission.js
+10 -1
View File
@@ -2,7 +2,16 @@
const {Group} = require('../models/group_ldap');
const SUPER_ADMIN_GROUP = 'app_super_admin';
let byGroup = async function(user, groups, ownerOf){
try{
let superAdmin = await Group.get(SUPER_ADMIN_GROUP);
if(superAdmin.member.includes(user.dn)) return true
}catch(error){
// group not found, continue checking
}
for(let group of groups){
try{
group = await Group.get(group);
@@ -28,4 +37,4 @@ let byGroup = async function(user, groups, ownerOf){
throw error;
}
module.exports = {byGroup};
module.exports = {byGroup, SUPER_ADMIN_GROUP};
nodejs/utils/ui.js
+4 -4
View File
@@ -38,9 +38,9 @@ module.exports = {
// app-base.js, which reveals .group-required-<cn> for each group the user is
// in (plus the synthetic `admin` group when user/me reports isAdmin).
nav: [
{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin']},
{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin']},
{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin']},
{href: '/executive', icon: 'fa-solid fa-gauge-high', label: 'Executive', groups: ['app_sso_admin']},
{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin', 'admin']},
{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
],
};