wmantly
4a592f9795
Closes the end-user half of the directory and adds nested LDAP groups.
The directory could describe the lab but could not tell anyone what they had
or how to reach it, and several of the paths meant to do so were silently
returning nothing:
- GET /api/discovery/me resolved groups from req.user.groups, which does not
exist (req.user carries memberOf), so it returned only isPublic resources
for every human caller -- "My Services" was blank for everyone. The same
read made isDirectoryAdmin() false for real admins.
- The portal's "Discover More Services" called the admin-gated endpoint and
swallowed the 403, so it never rendered for non-admins at all.
- Services reported no address, because /me had reimplemented getMyAccess
without its parent-walking resolution.
Adds the catalog at /, self-service access requests, and admin access
visibility (per-resource counts, and the reverse "what can this user reach").
Nested groups come in two halves. groupOfNames.member already accepts a group
DN, so nesting needs no schema -- what it needs is resolution, which no
released OpenLDAP performs. The all-in-one image therefore builds slapd from a
pinned master commit for the nestgroup overlay, and the app computes the
closure itself when pointed at a server without it. Both paths are covered.
member-values is deliberately left out of nestgroup-flags: it expands `member`
when reading a group, which destroys the distinction between "listed here" and
"reachable through a nested group" and is not recoverable afterwards.
Full suite green in both resolution modes: 215 passed, 2 skipped.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
51 lines
2.4 KiB
JavaScript
51 lines
2.4 KiB
JavaScript
'use strict';
|
|
|
|
// Per-app values for the shared UI shell (views/top.ejs + views/bottom.ejs).
|
|
//
|
|
// Those two partials are byte-identical across sso-manager-node, proxy and
|
|
// jump-host — everything that differs between the apps lives here and is
|
|
// exposed to every render as `ui` via app.locals (see app.js). Keep the key set
|
|
// in sync across the three apps; a missing key is a render-time ReferenceError,
|
|
// not a silent fallback.
|
|
|
|
const conf = require('@simpleworkjs/conf');
|
|
|
|
module.exports = {
|
|
// --- footer -------------------------------------------------------------
|
|
repoUrl: 'https://github.com/theta42/sso-manager-node',
|
|
licenseUrl: 'https://github.com/theta42/sso-manager-node/blob/master/LICENSE',
|
|
// In-app docs route (routes/docs.js). Apps without one point at the
|
|
// published docs site and set docsExternal.
|
|
docsUrl: '/docs',
|
|
docsExternal: false,
|
|
// Only sso-manager-node serves a Terms of Service page; null hides the link.
|
|
tosUrl: '/tos',
|
|
|
|
// --- header / nav -------------------------------------------------------
|
|
faviconUrl: conf.logo,
|
|
// Where the current-user chip links. null renders it as a plain span (for
|
|
// apps with no profile page).
|
|
profileUrl: '/profile',
|
|
// Where "Log Out" lands.
|
|
logoutRedirect: '/',
|
|
// Admin-only "a newer release is available" banner, backed by
|
|
// GET /api/update-check. Apps without that endpoint set false.
|
|
updateCheck: true,
|
|
updateLabel: 'SSO Manager',
|
|
|
|
// Nav items, in order. `groups` is an OR-list of group CNs that may see the
|
|
// item; an empty list means "always visible". Gating is done client-side by
|
|
// app-base.js, which reveals .group-required-<cn> for each group the user is
|
|
// in (plus the synthetic `admin` group when user/me reports isAdmin).
|
|
nav: [
|
|
// Ungated on purpose: the catalog is the one page that exists for
|
|
// ordinary users. Before this, every nav item was admin-only and a
|
|
// non-admin had no signposted destination at all.
|
|
{href: '/', icon: 'fa-solid fa-compass', label: 'Catalog', groups: []},
|
|
{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
|
|
{href: '/groups', icon: 'fa-solid fa-users-viewfinder', label: 'Groups', groups: ['app_sso_admin', 'admin']},
|
|
{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
|
|
{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
|
|
],
|
|
};
|