Sergei Poljanski
d91a72f603
Add /admin/users to create, edit, disable and delete accounts with the per-area permission grid. New users get a one-time invite link (48 h) by email; the admin also sees it once, so an account without email can still be onboarded. Forgotten passwords get a 1 h reset link with the same answer for unknown accounts. Only token hashes are stored. Guards against escalation and lockout: a user manager can only grant flags they hold and cannot touch flags they lack; only superusers change superuser accounts; nobody can disable or delete themselves; the last active superuser stays. Logins, user changes, and bingo and invoice actions are recorded in an audit log at /admin/audit. Read timestamps as UTC: they are all written with Time.now.utc, and on a UTC+4 host a fresh 1 h token read back as already expired. Assisted-by: Claude:opus-5
23 lines
920 B
Text
23 lines
920 B
Text
<%== erb :'admin/_nav', layout: false %>
|
|
<div class="header">
|
|
<h1>Audit log</h1>
|
|
<p class="tagline"><a href="/admin/users">← users</a> · last <%= @entries.size %> entries</p>
|
|
</div>
|
|
|
|
<section class="section">
|
|
<table class="invoice-list">
|
|
<thead><tr><th>Time (UTC)</th><th>User</th><th>Action</th><th>Target</th><th>Detail</th><th>IP</th></tr></thead>
|
|
<tbody>
|
|
<% @entries.each do |e| %>
|
|
<tr>
|
|
<td class="mono"><%= e[:created_at].strftime('%Y-%m-%d %H:%M') %></td>
|
|
<td><%= e[:username] || '—' %></td>
|
|
<td class="mono"><%= e[:action] %></td>
|
|
<td><%= e[:target] %></td>
|
|
<td class="optional"><%= e[:detail] %></td>
|
|
<td class="mono optional"><%= e[:ip] %></td>
|
|
</tr>
|
|
<% end %>
|
|
</tbody>
|
|
</table>
|
|
</section>
|