asxpi/asxpio
asxpi/asxpio
1
0
Fork 0
Code Issues Pull requests Packages 1 Activity Actions

admin: user management, invites, password reset, audit log

Browse source 
Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-10 08:31:42 +04:00
commit d91a72f603
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
17 changed files with 686 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
views/admin/set_password.erb Normal file
View file

@ -0,0 +1,15 @@
<div class="header">
<h1><%= @purpose == 'invite' ? 'Welcome' : 'Reset password' %></h1>
<p class="tagline">Set a password for <b><%= @token.user.username %></b></p>
</div>
<section class="section">
<% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
<form class="invoice-form auth-form" method="post" action="/admin/<%= @purpose %>/<%= params[:token] %>">
<input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
<input type="text" name="username" value="<%= @token.user.username %>" autocomplete="username" hidden />
<div class="field"><label for="password">Password <span class="optional">(at least <%= User::MIN_PASS %> characters)</span></label><input type="password" id="password" name="password" autocomplete="new-password" minlength="<%= User::MIN_PASS %>" required autofocus /></div>
<div class="field"><label for="confirm">Repeat password</label><input type="password" id="confirm" name="confirm" autocomplete="new-password" required /></div>
<button type="submit" class="download-button">Set password and log in</button>
</form>
</section>