wmantly
4a592f9795
Closes the end-user half of the directory and adds nested LDAP groups.
The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:
- GET /api/discovery/me resolved groups from req.user.groups, which does not
exist (req.user carries memberOf), so it returned only isPublic resources
for every human caller -- "My Services" was blank for everyone. The same
read made isDirectoryAdmin() false for real admins.
- The portal's "Discover More Services" called the admin-gated endpoint and
swallowed the 403, so it never rendered for non-admins at all.
- Services reported no address, because /me had reimplemented getMyAccess
without its parent-walking resolution.
Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").
Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.
member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.
Full suite green in both resolution modes: 215 passed, 2 skipped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
407 lines
17 KiB
Plaintext
407 lines
17 KiB
Plaintext
<%- include('top') %>
|
|
|
|
<script type="text/javascript">
|
|
var userlist;
|
|
var allGroups = [];
|
|
|
|
// A member DN under the groups base is a nested group, not a person. Both
|
|
// live in the same `member` attribute, so they have to be told apart here --
|
|
// otherwise a nested group renders as a user whose name happens to be the
|
|
// group's, and its remove button calls the user endpoint and 404s.
|
|
function isGroupDn(dn){
|
|
return /,ou=groups,/i.test(String(dn));
|
|
}
|
|
|
|
function processGroup(value){
|
|
if (!Array.isArray(value.member)) value.member = value.member ? [value.member] : [];
|
|
if (!Array.isArray(value.owner)) value.owner = value.owner ? [value.owner] : [];
|
|
|
|
// Split before anything else consumes `member`.
|
|
value.nested = value.member.filter(isGroupDn).map(function(dn){
|
|
return {
|
|
dn: dn,
|
|
cn: dn.match(/cn=[^,]+/)[0].replace('cn=', ''),
|
|
groupCN: value.cn
|
|
};
|
|
});
|
|
value.member = value.member.filter(function(dn){ return !isGroupDn(dn); });
|
|
value.nestedCount = value.nested.length;
|
|
value.hasNested = value.nestedCount > 0;
|
|
|
|
// Candidates to nest: every other group not already nested here. Self is
|
|
// excluded; deeper loops are refused server-side by Group.wouldCycle,
|
|
// which is the only place that can see the whole graph.
|
|
var nestedDns = value.nested.map(function(g){ return g.dn.toLowerCase(); });
|
|
value.toNest = allGroups.filter(function(g){
|
|
return g.cn !== value.cn && nestedDns.indexOf(String(g.dn).toLowerCase()) === -1;
|
|
}).map(function(g){ return {cn: g.cn, groupCN: value.cn}; });
|
|
|
|
value.toAdd = userlist.filter(function(user){
|
|
return !value.member.includes(user.dn);
|
|
});
|
|
value.toAddOwner = userlist.filter(function(user){
|
|
return !value.owner.includes(user.dn);
|
|
});
|
|
value.member = value.member.map(function(user){
|
|
return {
|
|
dn: user,
|
|
uid: user.match(/cn=[a-zA-Z0-9\_\-\@\.]+/)[0].replace('cn=', '')
|
|
};
|
|
});
|
|
value.owner = value.owner.map(function(user){
|
|
return {
|
|
dn: user,
|
|
uid: user.match(/cn=[a-zA-Z0-9\_\-\@\.]+/)[0].replace('cn=', '')
|
|
};
|
|
});
|
|
value.memberCount = value.member.length;
|
|
value.createTimestamp = moment(value.createTimestamp, "YYYYMMDDHHmmssZ").fromNow();
|
|
value.modifyTimestamp = moment(value.modifyTimestamp, "YYYYMMDDHHmmssZ").fromNow();
|
|
value.groupCN = value.cn;
|
|
return value;
|
|
}
|
|
|
|
// app_sso_service_account is a marker group: membership hides an account
|
|
// from the Users page's People tab entirely (see users.ejs), which is
|
|
// exactly right for a non-person account but has silently made a real
|
|
// person's account look "gone" before (nothing else about it changes).
|
|
// Everywhere else in this dropdown just fires the PUT directly; only
|
|
// this one group gets a confirmation first.
|
|
function addMemberClick(event, groupCN, uid, el){
|
|
event.preventDefault();
|
|
const $el = $(el);
|
|
(async function(){
|
|
if (groupCN === 'app_sso_service_account') {
|
|
const ok = await app.messages.confirm(
|
|
`Mark "${uid}" as a service account? This hides them from the Users page's People tab (Service Accounts tab only) — only do this for a non-person account.`,
|
|
$el.closest('.card'), 'warning'
|
|
);
|
|
if (!ok) return;
|
|
}
|
|
try {
|
|
const data = await app.api.put(`group/${groupCN}/${uid}`, {});
|
|
await addedUser(data.message, groupCN, uid, $el);
|
|
} catch(e) {
|
|
app.messages.action(e.message || 'Failed to add member', $el.closest('.card'), 'danger');
|
|
}
|
|
})();
|
|
return false;
|
|
}
|
|
|
|
async function addedUser(message, group, user, $form){
|
|
let data = await app.group.get(group);
|
|
$.scope.groupCard.update('cn', group, processGroup(data.results));
|
|
app.messages.action(message, $("#group-card-"+group), 'success');
|
|
$('a[href="#'+$form.closest('.tab-pane').attr('id')+'"]').tab('show');
|
|
setTimeout(function(){ app.util.revealItem($("#group-card-" + group)); }, 400);
|
|
}
|
|
|
|
function applySort() {
|
|
const sort = $('#groupSort').val();
|
|
const scope = $.scope.groupCard;
|
|
if (sort === 'name-asc') { scope.__jqOrderBy = 'cn'; scope.__jqOrderReverse = false; }
|
|
if (sort === 'name-desc') { scope.__jqOrderBy = 'cn'; scope.__jqOrderReverse = true; }
|
|
if (sort === 'members-desc') { scope.__jqOrderBy = 'memberCount'; scope.__jqOrderReverse = true; }
|
|
if (sort === 'members-asc') { scope.__jqOrderBy = 'memberCount'; scope.__jqOrderReverse = false; }
|
|
}
|
|
|
|
function matchesSearch(g) {
|
|
const q = $('#groupSearch').val().toLowerCase().trim();
|
|
return !q || g.cn.toLowerCase().includes(q) || (g.description || '').toLowerCase().includes(q);
|
|
}
|
|
|
|
function applyFilters() {
|
|
applySort();
|
|
const groups = allGroups.filter(matchesSearch);
|
|
$.scope.groupCard.empty();
|
|
$.scope.groupCard.push(...groups);
|
|
$('#groupCount').text(groups.length + ' of ' + allGroups.length + ' group' + (allGroups.length !== 1 ? 's' : ''));
|
|
}
|
|
|
|
async function tableAJAX(revealCn) {
|
|
let data = await app.group.list();
|
|
// processGroup builds each card's "nest a group" list from allGroups, so
|
|
// it has to see the full set before the map runs -- assigning only the
|
|
// mapped result would leave every dropdown empty on first load (and one
|
|
// render stale thereafter). The raw entries carry the cn/dn it needs.
|
|
allGroups = data.results;
|
|
allGroups = data.results.map(processGroup);
|
|
applyFilters();
|
|
if (revealCn) setTimeout(function(){ app.util.revealItem($('#group-card-' + revealCn)); }, 100);
|
|
}
|
|
|
|
function addNestedClick(event, groupCN, childCN, el){
|
|
event.preventDefault();
|
|
const $card = $('#group-card-' + groupCN);
|
|
(async function(){
|
|
try {
|
|
const data = await app.api.put(`group/${groupCN}/nested/${childCN}`, {});
|
|
const groupData = await app.group.get(groupCN);
|
|
$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
|
|
app.messages.action(data.message, $card, 'success');
|
|
} catch(e) {
|
|
// 409 here is the cycle guard or an already-nested group -- both
|
|
// carry a specific server message worth showing verbatim.
|
|
app.messages.action((e && e.message) || 'Failed to nest group', $card, 'danger');
|
|
}
|
|
})();
|
|
}
|
|
|
|
async function removeNested(groupCN, childCN, btn) {
|
|
const $item = $(btn).closest('li');
|
|
$item.addClass('list-group-item-warning');
|
|
const confirmed = await app.messages.confirm(
|
|
`Remove "${childCN}" from "${groupCN}"? Its members lose access granted through this group.`,
|
|
$item, 'warning');
|
|
if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
|
|
try {
|
|
const data = await app.api.delete(`group/${groupCN}/nested/${childCN}`);
|
|
const groupData = await app.group.get(groupCN);
|
|
$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
|
|
app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
|
|
} catch(e) {
|
|
$item.removeClass('list-group-item-warning');
|
|
app.messages.action(e.message || 'Failed to un-nest group', $('#group-card-' + groupCN), 'danger');
|
|
}
|
|
}
|
|
|
|
async function removeMember(groupCN, uid, btn) {
|
|
const $item = $(btn).closest('li');
|
|
$item.addClass('list-group-item-warning');
|
|
const confirmed = await app.messages.confirm(`Remove "${uid}" from "${groupCN}"?`, $item, 'warning');
|
|
if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
|
|
try {
|
|
const data = await app.api.delete(`group/${groupCN}/${uid}`);
|
|
const groupData = await app.group.get(groupCN);
|
|
$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
|
|
app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
|
|
} catch(e) {
|
|
$item.removeClass('list-group-item-warning');
|
|
app.messages.action(e.message || 'Failed to remove member', $('#group-card-' + groupCN), 'danger');
|
|
}
|
|
}
|
|
|
|
async function removeOwner(groupCN, uid, btn) {
|
|
const $item = $(btn).closest('li');
|
|
$item.addClass('list-group-item-warning');
|
|
const confirmed = await app.messages.confirm(`Remove "${uid}" as owner of "${groupCN}"?`, $item, 'warning');
|
|
if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
|
|
try {
|
|
const data = await app.api.delete(`group/owner/${groupCN}/${uid}`);
|
|
const groupData = await app.group.get(groupCN);
|
|
$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
|
|
app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
|
|
} catch(e) {
|
|
$item.removeClass('list-group-item-warning');
|
|
app.messages.action(e.message || 'Failed to remove owner', $('#group-card-' + groupCN), 'danger');
|
|
}
|
|
}
|
|
|
|
async function deleteGroup(cn, btn) {
|
|
const $card = $(btn).closest('.card');
|
|
const confirmed = await app.messages.confirm(`Delete group "${cn}"?`, $card, 'danger');
|
|
if (!confirmed) return;
|
|
try {
|
|
await app.api.delete(`group/${cn}`);
|
|
$.scope.groupCard.remove('cn', cn);
|
|
} catch(e) {
|
|
app.messages.action(e.message || 'Failed to delete group', $card, 'danger');
|
|
}
|
|
}
|
|
|
|
app.auth.forceLogin(['app_sso_admin', 'admin']);
|
|
|
|
$(document).ready(async function(){
|
|
userlist = (await app.user.list()).results;
|
|
tableAJAX();
|
|
});
|
|
</script>
|
|
<div class="container mt-4">
|
|
|
|
<div class="d-flex flex-wrap gap-2 align-items-center sticky-top bg-body py-2" style="top: var(--sw-content-offset, 0);">
|
|
<div class="input-group" style="flex: 1 1 200px;">
|
|
<span class="input-group-text"><i class="fa-solid fa-magnifying-glass"></i></span>
|
|
<input type="text" id="groupSearch" class="form-control" placeholder="Search groups…" oninput="applyFilters()">
|
|
</div>
|
|
<select id="groupSort" class="form-select" style="width:auto; min-width:175px" onchange="applyFilters()">
|
|
<option value="name-asc">Name A → Z</option>
|
|
<option value="name-desc">Name Z → A</option>
|
|
<option value="members-desc">Most members</option>
|
|
<option value="members-asc">Fewest members</option>
|
|
</select>
|
|
<span id="groupCount" class="text-muted text-nowrap small"></span>
|
|
</div>
|
|
<div class="row row-cols-1 row-cols-md-3 g-4 mt-0">
|
|
<div class="col">
|
|
<div class="card shadow">
|
|
<div class="card-header">
|
|
<i class="fa-solid fa-object-group"></i>
|
|
Add new group
|
|
<a href="/docs/accounts" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
|
|
</div>
|
|
<div class="card-header actionMessage" style="display:none"></div>
|
|
<div class="card-body">
|
|
<form action="group/" method="post" onsubmit="formAJAX(this)" evalAJAX="tableAJAX(data.results.cn)">
|
|
<div class="mb-3">
|
|
<label class="form-label">Name</label>
|
|
<input type="text" class="form-control shadow" name="name" placeholder="app_gitea_admin" validate=":3" />
|
|
</div>
|
|
|
|
<div class="mb-3">
|
|
<label class="form-label">Description</label>
|
|
<textarea class="form-control shadow" name="description" placeholder="Admin group for gitea app" validate=":3"></textarea>
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-outline-dark">Add</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="col" jq-repeat="groupCard" jq-index-key="cn" jr-order-by="cn" id="group-card-{{cn}}">
|
|
<div class="card shadow col">
|
|
<div class="card-header">
|
|
<h5>
|
|
<i class="fa-solid fa-arrows-down-to-people"></i>
|
|
Group: {{ cn }}
|
|
<a href="/docs/accounts" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
|
|
</h5>
|
|
<ul class="nav nav-tabs card-header-tabs" id="myTab" role="tablist">
|
|
<li class="nav-item">
|
|
<a class="nav-link active" id="group-members-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-memmbers-{{cn}}" href="#group-memmbers-{{cn}}" role="tab" aria-controls="member" aria-selected="true">
|
|
<i class="fa-solid fa-users"></i>
|
|
Members
|
|
</a>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" id="group-nested-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-nested-{{cn}}" href="#group-nested-{{cn}}" role="tab" aria-controls="nested" aria-selected="false">
|
|
<i class="fa-solid fa-layer-group"></i>
|
|
Nested{{#hasNested}} <span class="badge bg-secondary">{{nestedCount}}</span>{{/hasNested}}
|
|
</a>
|
|
</li>
|
|
<li class="nav-item">
|
|
<a class="nav-link" id="group-admins-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-admins-{{cn}}" href="#group-admins-{{cn}}" role="tab" aria-controls="admin" aria-selected="false">
|
|
<i class="fa-solid fa-user-tie"></i>
|
|
Owners
|
|
</a>
|
|
</li>
|
|
<li class="nav-item float-end">
|
|
|
|
</li>
|
|
</ul>
|
|
|
|
</div>
|
|
<div class="card-header actionMessage" style="display:none"></div>
|
|
<div class="card-body">
|
|
<p>
|
|
{{ description }}
|
|
</p>
|
|
<div class="tab-content" id="myTabContent">
|
|
<div class="tab-pane fade show active" id="group-memmbers-{{cn}}" role="tabpanel" aria-labelledby="member-tab">
|
|
<p>
|
|
<ul class="list-group">
|
|
{{ #member }}
|
|
<li id="group-card-{{cn}}-{{uid}}" class="list-group-item shadow">
|
|
<i class="fa-solid fa-user"></i> {{ uid }}
|
|
<button type="button" onclick="removeMember('{{groupCN}}', '{{uid}}', this)" class="btn btn-sm btn-danger float-end">
|
|
<i class="fa-solid fa-user-slash"></i>
|
|
</button>
|
|
</li>
|
|
{{ /member }}
|
|
</ul>
|
|
</p>
|
|
<div class="dropdown">
|
|
<button class="btn btn-secondary dropdown-toggle" type="button" id="group_add_member" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
|
|
<i class="fa-solid fa-user-plus"></i>
|
|
</button>
|
|
<div class="dropdown-menu shadow-lg" aria-labelledby="group_add_member">
|
|
{{ #toAdd }}{{#.}}
|
|
<a class="dropdown-item" href="#" onclick="return addMemberClick(event, '{{groupCN}}', '{{uid}}', this);">
|
|
<i class="fa-solid fa-user"></i> {{uid}}
|
|
</a>
|
|
{{/.}}{{ /toAdd }}
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="tab-pane fade" id="group-nested-{{cn}}" role="tabpanel" aria-labelledby="nested-tab">
|
|
<p class="text-muted small mb-2">
|
|
Everyone in a nested group is a member of this one, at any depth.
|
|
</p>
|
|
<ul class="list-group">
|
|
{{ #nested }}
|
|
<li id="group-card-{{groupCN}}-nested-{{cn}}" class="list-group-item shadow">
|
|
<i class="fa-solid fa-layer-group"></i> {{ cn }}
|
|
<button type="button" onclick="removeNested('{{groupCN}}', '{{cn}}', this)" class="btn btn-sm btn-danger float-end">
|
|
<i class="fa-solid fa-link-slash"></i>
|
|
</button>
|
|
</li>
|
|
{{ /nested }}
|
|
{{ ^hasNested }}
|
|
<li class="list-group-item text-muted fst-italic">No groups nested here.</li>
|
|
{{ /hasNested }}
|
|
</ul>
|
|
<div class="dropdown mt-2">
|
|
<button class="btn btn-secondary dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
|
|
<i class="fa-solid fa-diagram-project"></i> Nest a group
|
|
</button>
|
|
<div class="dropdown-menu" style="max-height: 300px; overflow-y: auto;">
|
|
{{ #toNest }}
|
|
<a class="dropdown-item" href="#" onclick="addNestedClick(event, '{{groupCN}}', '{{cn}}', this)">{{ cn }}</a>
|
|
{{ /toNest }}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="tab-pane fade" id="group-admins-{{cn}}" role="tabpanel" aria-labelledby="admin-tab">
|
|
<p>
|
|
<ul class="list-group">
|
|
{{ #owner }}
|
|
<li class="list-group-item shadow">
|
|
<i class="fa-solid fa-user"></i> {{ uid }}
|
|
<button type="button" onclick="removeOwner('{{groupCN}}', '{{uid}}', this)" class="btn btn-sm btn-danger float-end">
|
|
<i class="fa-solid fa-user-slash"></i>
|
|
</button>
|
|
</li>
|
|
{{ /owner }}
|
|
</ul>
|
|
</p>
|
|
|
|
<div class="dropdown float-start">
|
|
<button class="btn btn-secondary dropdown-toggle" type="button" id="group_add_admin" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
|
|
<i class="fa-solid fa-user-plus"></i>
|
|
</button>
|
|
<div class="dropdown-menu shadow-lg" aria-labelledby="group_add_admin">
|
|
{{ #toAddOwner }}{{#.}}
|
|
<a class="dropdown-item" action="group/owner/{{groupCN}}/{{uid}}" method="put" onclick="formAJAX(this)" evalAJAX="addedUser(data.message, '{{groupCN}}', '{{uid}}', $form)">
|
|
<i class="fa-solid fa-user"></i> {{uid}}
|
|
</a>
|
|
{{/.}}{{ /toAddOwner }}
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="card-footer">
|
|
<div class="float-end">
|
|
<button type="button" onclick="" class="btn btn-warning btn-lg shadow">
|
|
<i class="fa-solid fa-edit"></i>
|
|
</button>
|
|
<button type="button" onclick="deleteGroup('{{cn}}', this)" class="btn btn-danger btn-lg">
|
|
<i class="fa-solid fa-trash"></i>
|
|
</button>
|
|
</div>
|
|
<div>
|
|
Created: {{createTimestamp}}<br />
|
|
Last Modified: {{modifyTimestamp}}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<%- include('bottom') %>
|