asxpi/asxpio
asxpi/asxpio
1
0
Fork 0
Code Issues Pull requests Packages 1 Activity Actions

admin: user management, invites, password reset, audit log

Browse source 
Add /admin/users to create, edit, disable and delete accounts with the
per-area permission grid. New users get a one-time invite link (48 h)
by email; the admin also sees it once, so an account without email can
still be onboarded. Forgotten passwords get a 1 h reset link with the
same answer for unknown accounts. Only token hashes are stored.

Guards against escalation and lockout: a user manager can only grant
flags they hold and cannot touch flags they lack; only superusers change
superuser accounts; nobody can disable or delete themselves; the last
active superuser stays.

Logins, user changes, and bingo and invoice actions are recorded in an
audit log at /admin/audit.

Read timestamps as UTC: they are all written with Time.now.utc, and on a
UTC+4 host a fresh 1 h token read back as already expired.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-10 08:31:42 +04:00
commit d91a72f603
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
17 changed files with 686 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

37
views/admin/users/index.erb Normal file
View file

@ -0,0 +1,37 @@
<%== erb :'admin/_nav', layout: false %>
<div class="header">
<h1>Users</h1>
<p class="tagline">
<% if can?('users', 'write') %><a href="/admin/users/new">+ New user</a> · <% end %><a href="/admin/audit">audit log</a>
</p>
</div>
<% if @flash %><div class="form-error-base"><div><%= @flash %></div></div><% end %>
<% if @link %>
<section class="section">
<p><%= @link['kind'] == 'invite' ? 'Invite' : 'Password reset' %> link<%= @link['sent'] ? " emailed to #{@link['to']}" : (@link['to'] ? " — email to #{@link['to']} FAILED, send it yourself" : ' (no email on file — send it yourself)') %>.
Shown once; it works once and expires in <%= @link['kind'] == 'invite' ? '48 hours' : '1 hour' %>:</p>
<p class="mono" style="word-break: break-all"><%= @link['url'] %></p>
</section>
<% end %>
<section class="section">
<table class="invoice-list">
<thead><tr><th>User</th><th>Access</th><th>Status</th><th>Last login</th><th></th></tr></thead>
<tbody>
<% @users.each do |u| %>
<tr>
<td><b><%= u.username %></b><% if u.name.to_s != '' %><br /><span class="optional"><%= u.name %></span><% end %><% if u.email %><br /><span class="optional"><%= u.email %></span><% end %></td>
<td><%= perm_summary(u) %></td>
<td>
<% if !u.active %><span class="badge badge-pending">disabled</span>
<% elsif !u.password_digest %><span class="badge badge-pending">invited</span>
<% else %><span class="badge badge-paid">active</span><% end %>
</td>
<td class="mono"><%= u.last_login_at&.strftime('%Y-%m-%d %H:%M') || '—' %></td>
<td class="actions"><a href="/admin/users/<%= u.id %>"><%= can?('users', 'write') ? 'edit' : 'view' %></a></td>
</tr>
<% end %>
</tbody>
</table>
</section>