better acl (9f6b421f) · Commits · tuxist / authdb

data/admin.html

+15 −0

Changes for data/admin.html: 15 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -141,6 +141,20 @@ function setContent(html) {

		/* ---- Domain Selector ---- */
		function loadDomainSelector(callback) {
		ajaxGet("/settings/" + currentDomain + "/api/checkpermissions", function(perr, pdata) {
		var isSuperAdmin = (!perr && pdata && pdata.superadmin);

		// Non-SuperAdmins: lock to their session domain, no selector shown
		if (!isSuperAdmin) {
		if (pdata && pdata.sessiondomain) {
		currentDomain = pdata.sessiondomain;
		}
		document.getElementById("domain-select").innerHTML = '';
		if (callback) callback();
		return;
		}

		// SuperAdmins: show full domain selector
		ajaxGet("/settings/" + currentDomain + "/api/listdomains", function(err, data) {
		var sel = '<form id="domainform"><select id="domaindid" onchange="changeDomain(this.value)">';
		sel += '<option value="admin"' + (currentDomain === "admin" ? ' selected' : '') + '>admin.local</option>';
		@@ -154,6 +168,7 @@ function loadDomainSelector(callback) {
		document.getElementById("domain-select").innerHTML = sel;
		if (callback) callback();
		});
		});
		}

		function changeDomain(did) {

src/admin.cpp

+55 −0

Changes for src/admin.cpp: 55 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -418,10 +418,42 @@ namespace authdb {
		return false;
		}

		/* ---- Helper: Check domain access (non-SuperAdmins can only access their own domain) ---- */
		void checkDomainAccess(const SessionData sdat, const char cdid) {
		if (!sdat) throw AuthBackendError("No session!");

		// Determine session domain string
		uuid::uuid sessionDid;
		sdat->getDid(sessionDid);
		std::string sessionDomain;
		if (sessionDid.empty()) {
		sessionDomain = "admin";
		} else {
		sessionDomain = sessionDid.c_str();
		}

		// If requested domain matches session domain, allow
		if (sessionDomain == cdid) return;

		// Otherwise, must be SuperAdmin from admin.local
		if (!isSuperAdmin(sdat))
		throw AuthBackendError("Zugriff verweigert: nur SuperAdmins von admin.local duerfen andere Domains einsehen!");
		}

		/* ---- JSON API: Check Permissions ---- */
		void apiCheckPermissions(libhttppp::HttpRequest &curreq, const SessionData *sdat) {
		json_object *jobj = json_object_new_object();
		json_object_object_add(jobj, "superadmin", json_object_new_boolean(isSuperAdmin(sdat)));

		// Return session domain so frontend knows which domain the user belongs to
		uuid::uuid sessionDid;
		sdat->getDid(sessionDid);
		if (sessionDid.empty()) {
		json_object_object_add(jobj, "sessiondomain", json_object_new_string("admin"));
		} else {
		json_object_object_add(jobj, "sessiondomain", json_object_new_string(sessionDid.c_str()));
		}

		sendJson(curreq, jobj);
		json_object_put(jobj);
		}
		@@ -1380,14 +1412,19 @@ namespace authdb {
		if (sscanf(url.c_str(), "/settings/%[^/]/api/%[^/]/%s", domain, apiurl, param) >= 2) {
		try {
		if (strcmp(apiurl, "listusers") == 0) {
		checkDomainAccess(sdat, domain);
		apiListUsers(curreq, domain);
		} else if (strcmp(apiurl, "getuser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiGetUser(curreq, domain, param);
		} else if (strcmp(apiurl, "createuser") == 0) {
		checkDomainAccess(sdat, domain);
		apiCreateUser(curreq, domain);
		} else if (strcmp(apiurl, "removeuser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiRemoveUser(curreq, domain, param);
		} else if (strcmp(apiurl, "edituser") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiEditUser(curreq, domain, param);
		} else if (strcmp(apiurl, "listdomains") == 0) {
		apiListDomains(curreq);
		@@ -1398,40 +1435,58 @@ namespace authdb {
		} else if (strcmp(apiurl, "removedomain") == 0 && param[0]) {
		apiRemoveDomain(curreq, param, sdat);
		} else if (strcmp(apiurl, "listgroups") == 0) {
		checkDomainAccess(sdat, domain);
		apiListGroups(curreq, domain);
		} else if (strcmp(apiurl, "getgroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiGetGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "creategroup") == 0) {
		checkDomainAccess(sdat, domain);
		apiCreateGroup(curreq, domain);
		} else if (strcmp(apiurl, "removegroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiRemoveGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "editgroup") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiEditGroup(curreq, domain, param);
		} else if (strcmp(apiurl, "listsessions") == 0) {
		checkDomainAccess(sdat, domain);
		apiListSessions(curreq, domain);
		} else if (strcmp(apiurl, "removesession") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiRemoveSession(curreq, param);
		} else if (strcmp(apiurl, "reloadsession") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiReloadSession(curreq, domain, param);
		} else if (strcmp(apiurl, "listgpos") == 0) {
		checkDomainAccess(sdat, domain);
		apiListGpos(curreq, domain);
		} else if (strcmp(apiurl, "getgpo") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiGetGpo(curreq, domain, param);
		} else if (strcmp(apiurl, "creategpo") == 0) {
		checkDomainAccess(sdat, domain);
		apiCreateGpo(curreq, domain);
		} else if (strcmp(apiurl, "removegpo") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiRemoveGpo(curreq, domain, param);
		} else if (strcmp(apiurl, "editgpo") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiEditGpo(curreq, domain, param);
		} else if (strcmp(apiurl, "listclients") == 0) {
		checkDomainAccess(sdat, domain);
		apiListClients(curreq, domain);
		} else if (strcmp(apiurl, "getclient") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiGetClient(curreq, domain, param);
		} else if (strcmp(apiurl, "createclient") == 0) {
		checkDomainAccess(sdat, domain);
		apiCreateClient(curreq, domain);
		} else if (strcmp(apiurl, "removeclient") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiRemoveClient(curreq, domain, param);
		} else if (strcmp(apiurl, "editclient") == 0 && param[0]) {
		checkDomainAccess(sdat, domain);
		apiEditClient(curreq, domain, param);
		} else {
		sendJsonError(curreq, "Unknown API endpoint", 404);