kyleandClaude Opus 5.5
d4e821799c
Admins (Microsoft 365 sign-in names in BACKUP_DASH_ADMINS) get an Admin link to /admin.html, where they can create, list and revoke the API keys collectors use, instead of running manage.py on the server. Backend - /api/v1/admin/keys (list, create, revoke), admins only (403 otherwise); the user comes from the headers nginx sets after sign-in - Changes need an X-Requested-By header, which another site's page can't add, so a signed-in admin's browser can't be used to forge them - A new key is returned once; only its hash is stored. Names are unique for good, so revoked keys' history stays unambiguous - Keys record who created/revoked them and the company they last reported for (schema v2; databases migrate automatically on start) - /api/v1/me reports is_admin; manage.py shares the key code and records itself as creator/revoker Frontend - admin.html / admin.js: name validation shown after interaction (:user-invalid, aria-invalid kept in sync), the one-time key with a copy button (falls back to selecting it if clipboard access is refused), a key table flagging keys quiet for over 24 hours, and revoking confirmed in a <dialog>; results announced in a status region - Shared el() and signed-in helpers moved to dom.js / signed-in.js - Mock mode (?mock=1) includes sample keys Tested: 15 new backend tests (access, forged requests, names, duplicates, revoking, last-used company, v1 -> v2 upgrade); in the browser, every admin flow in mock mode and at phone width; end to end through the nginx config with the real API (a key created on the API works for ingest; revoking it makes ingest 401; non-admins see an explanation and no Admin link). Co-Authored-By: Claude Opus 5.5 <[email protected]>
19 lines
695 B
JavaScript
19 lines
695 B
JavaScript
import { CONFIG } from './config.js';
|
|
|
|
/**
|
|
* Fills in the top bar's "signed in as … / Sign out" from /api/v1/me, and shows the Admin link
|
|
* to admins. Pass the elements that exist on the page; missing ones are skipped.
|
|
*/
|
|
export function showSignedInUser(me, { signedIn, signedInEmail, signOut, adminLink } = {}) {
|
|
const who = me?.email || me?.name;
|
|
if (who && signedIn) { // nothing to show without Microsoft 365 sign-in (dev, mock)
|
|
signedInEmail.textContent = who;
|
|
signOut.href = CONFIG.signOutUrl;
|
|
signedIn.hidden = false;
|
|
}
|
|
if (me?.is_admin && adminLink) {
|
|
adminLink.href = `/admin.html${location.search}`; // keeps ?mock=1
|
|
adminLink.hidden = false;
|
|
}
|
|
}
|