Sergei Poljanski
d91a72f603
Add /admin/users to create, edit, disable and delete accounts with the per-area permission grid. New users get a one-time invite link (48 h) by email; the admin also sees it once, so an account without email can still be onboarded. Forgotten passwords get a 1 h reset link with the same answer for unknown accounts. Only token hashes are stored. Guards against escalation and lockout: a user manager can only grant flags they hold and cannot touch flags they lack; only superusers change superuser accounts; nobody can disable or delete themselves; the last active superuser stays. Logins, user changes, and bingo and invoice actions are recorded in an audit log at /admin/audit. Read timestamps as UTC: they are all written with Time.now.utc, and on a UTC+4 host a fresh 1 h token read back as already expired. Assisted-by: Claude:opus-5
16 lines
1,005 B
Text
16 lines
1,005 B
Text
<div class="header">
|
|
<h1>Admin</h1>
|
|
<p class="tagline">asxp.io</p>
|
|
</div>
|
|
|
|
<section class="section">
|
|
<% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
|
|
<form class="invoice-form auth-form" method="post" action="/admin/login">
|
|
<input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
|
|
<input type="hidden" name="next" value="<%= @next %>" />
|
|
<div class="field"><label for="username">Username</label><input type="text" id="username" name="username" value="<%= params[:username] %>" autocomplete="username" autocapitalize="none" required autofocus /></div>
|
|
<div class="field"><label for="password">Password</label><input type="password" id="password" name="password" autocomplete="current-password" required /></div>
|
|
<button type="submit" class="download-button">Log in</button>
|
|
</form>
|
|
<p class="optional" style="text-align: center"><a href="/admin/reset">Forgot password?</a></p>
|
|
</section>
|