vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add instance user administration

395554f453ca31d3bd325920a7011c91230e961c · Keenan Nemetz · 15d ago · parent 8e93a8f0

Add instance user administration

Instance admins get an Admin -> Users surface: create an account from a one-time enrollment link, grant or revoke instance admin, retire an account, refresh its invite, inspect keys and sessions, remove a key, and revoke every session. Account creation uses CreateWithInvite, so the browser never asks an operator to paste somebody else's SSH key. Enrollment links are rendered once with no-store and warn when browser login is disabled. Retiring and admin changes keep the store's last-admin guard and audit trail.

server/web/admin_users.go +218

@@ -0,0 +1,218 @@
	1	package web
	2
	3	// Instance admin users: the operations that used to need `vole admin user`.
	4	// Account creation goes through CreateWithInvite, so the browser never asks an
	5	// operator to paste somebody else's SSH key; the one-time enrollment link is the
	6	// credential and is shown once.
	7
	8	import (
	9	"net/http"
	10	"strings"
	11	"time"
	12
	13	"github.com/rodent-software/vole/forge/identity"
	14	"github.com/rodent-software/vole/forge/session"
	15	)
	16
	17	type adminUserRow struct {
	18	Account *identity.Account
	19	Sessions int
	20	}
	21
	22	type adminUsersView struct {
	23	Page
	24	Users []adminUserRow
	25	Error string
	26	}
	27
	28	type adminUserView struct {
	29	Page
	30	Account *identity.Account
	31	Sessions []session.Session
	32	Error string
	33	}
	34
	35	type adminInviteView struct {
	36	Page
	37	Account *identity.Account
	38	Link string
	39	Expires time.Time
	40	BrowserLogin bool
	41	}
	42
	43	func (w Web) adminUsersView(r http.Request, msg string) adminUsersView {
	44	accounts := w.Ident.All()
	45	rows := make([]adminUserRow, 0, len(accounts))
	46	for _, acct := range accounts {
	47	row := adminUserRow{Account: acct}
	48	if w.Sessions != nil {
	49	if list, err := w.Sessions.List(acct.ID); err == nil {
	50	row.Sessions = len(list)
	51	}
	52	}
	53	rows = append(rows, row)
	54	}
	55	return adminUsersView{Page: w.page(r, "Users"), Users: rows, Error: msg}
	56	}
	57
	58	func (w Web) adminUserView(r http.Request, acct *identity.Account, msg string) adminUserView {
	59	v := adminUserView{Page: w.page(r, acct.Label()), Account: acct, Error: msg}
	60	if w.Sessions != nil {
	61	v.Sessions, _ = w.Sessions.List(acct.ID)
	62	}
	63	return v
	64	}
	65
	66	func (w Web) adminInviteView(r http.Request, acct identity.Account, inv identity.Invite) adminInviteView {
	67	link := "/invite/" + inv.Token
	68	if base := w.Cfg.BaseURL(); base != "" {
	69	link = base + link
	70	}
	71	return adminInviteView{
	72	Page: w.page(r, "Invite "+acct.Label()), Account: acct,
	73	Link: link, Expires: inv.Expires, BrowserLogin: w.enabled(),
	74	}
	75	}
	76
	77	// adminUserPost is the shared gate for the action endpoints: instance admin,
	78	// existing account, CSRF, and a parsed form.
	79	func (w Web) adminUserPost(rw http.ResponseWriter, r http.Request) (identity.Account, principal, bool) {
	80	pr, ok := w.requireInstanceAdmin(rw, r)
	81	if !ok {
	82	return nil, nil, false
	83	}
	84	acct, err := w.Ident.Find(r.PathValue("id"))
	85	if err != nil {
	86	w.notFound(rw, r)
	87	return nil, nil, false
	88	}
	89	r.Body = http.MaxBytesReader(rw, r.Body, 1<<20)
	90	if !w.checkCSRF(r) {
	91	http.Error(rw, "bad request", http.StatusForbidden)
	92	return nil, nil, false
	93	}
	94	if err := r.ParseForm(); err != nil {
	95	http.Error(rw, "cannot read the form", http.StatusBadRequest)
	96	return nil, nil, false
	97	}
	98	return acct, pr, true
	99	}
	100
	101	func (w Web) AdminUsersPage(rw http.ResponseWriter, r http.Request) {
	102	if _, ok := w.requireInstanceAdmin(rw, r); !ok {
	103	return
	104	}
	105	w.render(rw, "admin_users", w.adminUsersView(r, ""), 0)
	106	}
	107
	108	func (w Web) CreateAdminUser(rw http.ResponseWriter, r http.Request) {
	109	if _, ok := w.requireInstanceAdmin(rw, r); !ok {
	110	return
	111	}
	112	r.Body = http.MaxBytesReader(rw, r.Body, 1<<20)
	113	if !w.checkCSRF(r) {
	114	http.Error(rw, "bad request", http.StatusForbidden)
	115	return
	116	}
	117	if err := r.ParseForm(); err != nil {
	118	http.Error(rw, "cannot read the form", http.StatusBadRequest)
	119	return
	120	}
	121	name := strings.TrimSpace(r.PostFormValue("name"))
	122	display := strings.TrimSpace(r.PostFormValue("display"))
	123	acct, inv, err := w.Ident.CreateWithInvite(name, display, w.accountID(r), 0)
	124	if err != nil {
	125	w.render(rw, "admin_users", w.adminUsersView(r, err.Error()), http.StatusBadRequest)
	126	return
	127	}
	128	rw.Header().Set("Cache-Control", "no-store")
	129	w.render(rw, "admin_invite", w.adminInviteView(r, acct, inv), 0)
	130	}
	131
	132	func (w Web) AdminUserPage(rw http.ResponseWriter, r http.Request) {
	133	if _, ok := w.requireInstanceAdmin(rw, r); !ok {
	134	return
	135	}
	136	acct, err := w.Ident.Find(r.PathValue("id"))
	137	if err != nil {
	138	w.notFound(rw, r)
	139	return
	140	}
	141	w.render(rw, "admin_user", w.adminUserView(r, acct, ""), 0)
	142	}
	143
	144	func (w Web) SetAdminUser(rw http.ResponseWriter, r http.Request) {
	145	acct, pr, ok := w.adminUserPost(rw, r)
	146	if !ok {
	147	return
	148	}
	149	admin := r.PostFormValue("admin") == "true"
	150	if _, err := w.Ident.SetAdmin(acct.ID, admin, pr.account.ID); err != nil {
	151	w.render(rw, "admin_user", w.adminUserView(r, acct, err.Error()), http.StatusBadRequest)
	152	return
	153	}
	154	http.Redirect(rw, r, "/admin/users/"+acct.ID, http.StatusSeeOther)
	155	}
	156
	157	func (w Web) RetireAdminUser(rw http.ResponseWriter, r http.Request) {
	158	acct, pr, ok := w.adminUserPost(rw, r)
	159	if !ok {
	160	return
	161	}
	162	if got := strings.TrimSpace(r.PostFormValue("confirm")); got != acct.Name {
	163	w.render(rw, "admin_user", w.adminUserView(r, acct, "Type the account name exactly to confirm retirement."), http.StatusBadRequest)
	164	return
	165	}
	166	if _, err := w.Ident.Retire(acct.ID, pr.account.ID); err != nil {
	167	w.render(rw, "admin_user", w.adminUserView(r, acct, err.Error()), http.StatusBadRequest)
	168	return
	169	}
	170	http.Redirect(rw, r, "/admin/users", http.StatusSeeOther)
	171	}
	172
	173	func (w Web) InviteAdminUser(rw http.ResponseWriter, r http.Request) {
	174	acct, pr, ok := w.adminUserPost(rw, r)
	175	if !ok {
	176	return
	177	}
	178	inv, err := w.Ident.Invite(acct.ID, pr.account.ID, 0)
	179	if err != nil {
	180	w.render(rw, "admin_user", w.adminUserView(r, acct, err.Error()), http.StatusBadRequest)
	181	return
	182	}
	183	rw.Header().Set("Cache-Control", "no-store")
	184	w.render(rw, "admin_invite", w.adminInviteView(r, acct, inv), 0)
	185	}
	186
	187	func (w Web) RevokeAdminUserSessions(rw http.ResponseWriter, r http.Request) {
	188	acct, _, ok := w.adminUserPost(rw, r)
	189	if !ok {
	190	return
	191	}
	192	if w.Sessions == nil {
	193	w.serverError(rw, r, "sessions are unavailable")
	194	return
	195	}
	196	if _, err := w.Sessions.RevokeAccount(acct.ID); err != nil {
	197	w.serverError(rw, r, "cannot revoke sessions: "+err.Error())
	198	return
	199	}
	200	http.Redirect(rw, r, "/admin/users/"+acct.ID, http.StatusSeeOther)
	201	}
	202
	203	func (w Web) RemoveAdminUserKey(rw http.ResponseWriter, r http.Request) {
	204	acct, pr, ok := w.adminUserPost(rw, r)
	205	if !ok {
	206	return
	207	}
	208	fingerprint := strings.TrimSpace(r.PostFormValue("fingerprint"))
	209	if fingerprint == "" {
	210	w.render(rw, "admin_user", w.adminUserView(r, acct, "Choose a key to remove."), http.StatusBadRequest)
	211	return
	212	}
	213	if err := w.Ident.RemoveKey(acct.ID, fingerprint, pr.account.ID); err != nil {
	214	w.render(rw, "admin_user", w.adminUserView(r, acct, err.Error()), http.StatusBadRequest)
	215	return
	216	}
	217	http.Redirect(rw, r, "/admin/users/"+acct.ID, http.StatusSeeOther)
	218	}