Until now every account could do the same, and managing accounts meant running make-user.php on the server. Accounts now carry a role, and admins get a tab in the editor to create, rename, re-role, reset and delete accounts. Both issues share the same server files, so they land in one commit. #180 Roles: - Every account is admin or user. A missing or unknown role counts as user, on the server and in the client. - auth/session and auth/login return {user, role}. - Auth::requireAdmin() answers everyone else with 403. - make-user.php takes the role as a third argument. Without it an existing account keeps its role, so a password reset from the CLI never demotes an admin. - Admins see and save other users' projects like their own. Saving keeps the original owner. #179 User management: - The account menu gets "User management" (admins only) and "Plugins" (everyone). Both open the same closable tab, accounts on top and plugins below. The fixed Plugins tab is gone. - Per account: Rename, Role, Password (no old password needed) and Delete with a confirmation. "New user..." creates one. - Each account lists its projects with an Open button. - Delete is refused while the account still owns projects. - Renaming moves the projects along and ends every session of the account. transfer takes the same lock as save. - On their own row an admin can only set the password. The last admin cannot be demoted or deleted. The server enforces both. - The account rules live in AccountRules.php and accountRules.ts as pure functions, so they are testable without a server. Findings: - At 1280 px the Delete button reached past the column edge and was not clickable. The name column is flexible now, and module 49 checks the layout. - The server lets an admin delete other users' projects, but the editor has no button for it yet. Left open in the issue. Tests: - ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204). - New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it as its own step in the gate job, the host has no PHP. - New e2e module 49 with 18 checks. CI creates the e2e-admin account in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab. - e2e 1-16,37,38,45,46,49: all passed, 581 checks. - Counter-checks: owner on save, admin view, default role and self delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin, a wider column and the caller as owner each fail exactly their e2e check. - Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adminandClaude Opus 5.5 committed
1 parent
30fb3a2316
commit
ceaa44e5b8
38 files changed
+1803
-138
No files matched your search
+139
-12
@@ -7,15 +7,25 @@ declare(strict_types=1);
|
||||
* Routing uses the `r` query parameter (e.g. `index.php?r=projects/abc123`) because the
|
||||
* site's nginx configuration does not pass PATH_INFO to PHP.
|
||||
*
|
||||
* GET ?r=auth/session → {user} (null while nobody is signed in)
|
||||
* POST ?r=auth/login {username,password} → {user} | 401
|
||||
* GET ?r=auth/session → {user, role} (both null while nobody is signed in)
|
||||
* POST ?r=auth/login {username,password} → {user, role} | 401
|
||||
* POST ?r=auth/logout → 204
|
||||
* POST ?r=auth/password {currentPassword,newPassword} → 204 | 401 | 422
|
||||
* (the only auth route that needs a session; ends the account's
|
||||
* other logins, keeps the one asking)
|
||||
*
|
||||
* Everything below needs a signed-in user (401 otherwise), and projects belong to one: a project
|
||||
* of somebody else answers like one that is not there.
|
||||
* of somebody else answers like one that is not there – unless the one asking is an administrator
|
||||
* (#179), who reads, saves and deletes it like their own; a save keeps its owner.
|
||||
*
|
||||
* Administrators only (403 for everybody else, #180):
|
||||
*
|
||||
* GET ?r=users → [{username,role,createdAt,projects:[{id,name,revision,updatedAt}]}]
|
||||
* POST ?r=users {username,password,role} → 201 {username,role,createdAt} | 409 | 422
|
||||
* PATCH ?r=users/{name} {username?,role?,password?} → {username,role,createdAt} | 404 | 409 | 422
|
||||
* DELETE ?r=users/{name} → 204 | 404 | 409 (still owns projects) | 422
|
||||
* (renaming or deleting signs the account out everywhere; a new
|
||||
* password ends its other sessions)
|
||||
*
|
||||
* GET ?r=projects → [{id,name,revision,updatedAt}]
|
||||
* POST ?r=projects {name} → {id,name,revision,updatedAt,project}
|
||||
@@ -47,6 +57,7 @@ declare(strict_types=1);
|
||||
* `data/sounds/` and `data/pixels/` as static files; the API only writes them.
|
||||
*/
|
||||
|
||||
require __DIR__ . '/lib/AccountRules.php';
|
||||
require __DIR__ . '/lib/Auth.php';
|
||||
require __DIR__ . '/lib/FontStore.php';
|
||||
require __DIR__ . '/lib/OriginalName.php';
|
||||
@@ -86,7 +97,8 @@ function routeAuth(array $parts, string $method, Auth $auth): never
|
||||
}
|
||||
// Always 200, never 401: "nobody is signed in" is an answer, not a failure, and the
|
||||
// login screen asks this before it can know either way.
|
||||
Response::json(['user' => $auth->user()]);
|
||||
$user = $auth->user();
|
||||
Response::json(['user' => $user, 'role' => $user === null ? null : $auth->role($user)]);
|
||||
}
|
||||
|
||||
if ($what === 'login') {
|
||||
@@ -99,7 +111,7 @@ function routeAuth(array $parts, string $method, Auth $auth): never
|
||||
// One message for both halves: which of the two was wrong is the attacker's question.
|
||||
Response::error('Wrong user name or password', 401);
|
||||
}
|
||||
Response::json(['user' => $user]);
|
||||
Response::json(['user' => $user, 'role' => $auth->role($user)]);
|
||||
}
|
||||
|
||||
if ($what === 'password') {
|
||||
@@ -132,9 +144,9 @@ function routeAuth(array $parts, string $method, Auth $auth): never
|
||||
}
|
||||
|
||||
/** @param list<string> $parts */
|
||||
function routeProjects(array $parts, string $method, string $owner): never
|
||||
function routeProjects(array $parts, string $method, string $owner, bool $seesAll): never
|
||||
{
|
||||
$store = new Store(dirname(__DIR__) . '/data/projects', $owner);
|
||||
$store = new Store(dirname(__DIR__) . '/data/projects', $owner, $seesAll);
|
||||
|
||||
if (count($parts) === 1) {
|
||||
if ($method === 'GET') {
|
||||
@@ -190,6 +202,120 @@ function routeProjects(array $parts, string $method, string $owner): never
|
||||
Response::error('Method not allowed', 405);
|
||||
}
|
||||
|
||||
/** @param list<string> $parts */
|
||||
function routeUsers(array $parts, string $method, Auth $auth, UserStore $users): never
|
||||
{
|
||||
$actor = $auth->requireAdmin();
|
||||
$projects = new Store(dirname(__DIR__) . '/data/projects', $actor, true);
|
||||
$shown = static function (string $name) use ($users): array {
|
||||
foreach ($users->accounts() as $account) {
|
||||
if (strcasecmp($account['username'], $name) === 0) {
|
||||
return $account;
|
||||
}
|
||||
}
|
||||
throw new RuntimeException("Account {$name} vanished");
|
||||
};
|
||||
|
||||
if (count($parts) === 1) {
|
||||
if ($method === 'GET') {
|
||||
Response::json(array_map(
|
||||
static fn(array $a): array => $a + ['projects' => $projects->listOf($a['username'])],
|
||||
$users->accounts(),
|
||||
));
|
||||
}
|
||||
if ($method === 'POST') {
|
||||
$body = Response::body();
|
||||
$name = (string) ($body['username'] ?? '');
|
||||
$password = (string) ($body['password'] ?? '');
|
||||
$role = (string) ($body['role'] ?? 'user');
|
||||
if (!UserStore::isValidName($name)) {
|
||||
Response::error('A user name is 2–32 letters, digits, dots, dashes or underscores', 422);
|
||||
}
|
||||
if (!UserStore::isValidPassword($password)) {
|
||||
Response::error('The password needs at least ' . UserStore::MIN_PASSWORD_LENGTH . ' characters', 422);
|
||||
}
|
||||
if (!UserStore::isValidRole($role)) {
|
||||
Response::error('Unknown role', 422);
|
||||
}
|
||||
if ($users->exists($name)) {
|
||||
Response::error("The name {$name} is taken", 409);
|
||||
}
|
||||
$users->put($name, $password, $role);
|
||||
Response::json($shown($name), 201);
|
||||
}
|
||||
Response::error('Method not allowed', 405);
|
||||
}
|
||||
|
||||
$target = $parts[1];
|
||||
if (!$users->exists($target)) {
|
||||
Response::error('User not found', 404);
|
||||
}
|
||||
$role = $users->role($target);
|
||||
|
||||
if ($method === 'PATCH') {
|
||||
$body = Response::body();
|
||||
$newName = array_key_exists('username', $body) ? (string) $body['username'] : null;
|
||||
$newRole = array_key_exists('role', $body) ? (string) $body['role'] : null;
|
||||
$password = array_key_exists('password', $body) ? (string) $body['password'] : null;
|
||||
// Everything is checked before anything is written: half an edit is worse than none.
|
||||
if ($newName !== null && $newName !== $target) {
|
||||
$refusal = AccountRules::renameRefusal($actor, $target);
|
||||
if ($refusal !== null) {
|
||||
Response::error($refusal, 422);
|
||||
}
|
||||
if (!UserStore::isValidName($newName)) {
|
||||
Response::error('A user name is 2–32 letters, digits, dots, dashes or underscores', 422);
|
||||
}
|
||||
if (strcasecmp($newName, $target) !== 0 && $users->exists($newName)) {
|
||||
Response::error("The name {$newName} is taken", 409);
|
||||
}
|
||||
}
|
||||
if ($newRole !== null) {
|
||||
if (!UserStore::isValidRole($newRole)) {
|
||||
Response::error('Unknown role', 422);
|
||||
}
|
||||
$refusal = AccountRules::roleRefusal($actor, $target, $role, $newRole, $users->adminCount());
|
||||
if ($refusal !== null) {
|
||||
Response::error($refusal, 422);
|
||||
}
|
||||
}
|
||||
if ($password !== null && !UserStore::isValidPassword($password)) {
|
||||
Response::error('The password needs at least ' . UserStore::MIN_PASSWORD_LENGTH . ' characters', 422);
|
||||
}
|
||||
|
||||
if ($password !== null) {
|
||||
$auth->resetPassword($target, $password);
|
||||
}
|
||||
if ($newRole !== null && $newRole !== $role) {
|
||||
$users->setRole($target, $newRole);
|
||||
}
|
||||
$name = $shown($target)['username'];
|
||||
if ($newName !== null && $newName !== $name) {
|
||||
$users->rename($name, $newName);
|
||||
$projects->transfer($name, $newName);
|
||||
$auth->endSessionsOf($name);
|
||||
$name = $newName;
|
||||
}
|
||||
Response::json($shown($name));
|
||||
}
|
||||
|
||||
if ($method === 'DELETE') {
|
||||
$refusal = AccountRules::deleteRefusal($actor, $target, $role, $users->adminCount());
|
||||
if ($refusal !== null) {
|
||||
Response::error($refusal, 422);
|
||||
}
|
||||
$refusal = AccountRules::ownerRefusal($target, count($projects->listOf($shown($target)['username'])));
|
||||
if ($refusal !== null) {
|
||||
Response::error($refusal, 409);
|
||||
}
|
||||
$users->remove($target);
|
||||
$auth->endSessionsOf($target);
|
||||
Response::noContent();
|
||||
}
|
||||
|
||||
Response::error('Method not allowed', 405);
|
||||
}
|
||||
|
||||
/** @param list<string> $parts */
|
||||
function routeTextures(array $parts, string $method): never
|
||||
{
|
||||
@@ -350,19 +476,20 @@ try {
|
||||
Response::error('Not found', 404);
|
||||
}
|
||||
|
||||
$auth = new Auth(
|
||||
new UserStore(dirname(__DIR__) . '/data/users.json'),
|
||||
new SessionStore(dirname(__DIR__) . '/data/sessions'),
|
||||
);
|
||||
$users = new UserStore(dirname(__DIR__) . '/data/users.json');
|
||||
$auth = new Auth($users, new SessionStore(dirname(__DIR__) . '/data/sessions'));
|
||||
if ($parts[0] === 'auth') {
|
||||
routeAuth($parts, $method, $auth);
|
||||
}
|
||||
if ($parts[0] === 'users') {
|
||||
routeUsers($parts, $method, $auth, $users);
|
||||
}
|
||||
// Images, fonts, sounds, cels and plugins are shared between accounts; being signed in is still the
|
||||
// price of admission, so an uploaded file cannot be dropped in by a stranger.
|
||||
$user = $auth->require();
|
||||
|
||||
match ($parts[0]) {
|
||||
'projects' => routeProjects($parts, $method, $user),
|
||||
'projects' => routeProjects($parts, $method, $user, $auth->role($user) === 'admin'),
|
||||
'textures' => routeTextures($parts, $method),
|
||||
'fonts' => routeFonts($parts, $method),
|
||||
'sounds' => routeSounds($parts, $method),
|
||||
|
||||
Reference in new issue
Block a user