From 69036cc6a462a82bfafb8b86f5ccef29ca066f0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa?=
<dani-garcia@users.noreply.github.com>
Date: Sat, 26 Jan 2019 19:28:54 +0100
Subject: [PATCH] Add disabled user badge (no password) and deauthorize button
to admin page.
---
src/api/admin.rs | 21 ++++++++++++++++++++-
src/db/models/user.rs | 1 +
src/static/templates/admin/page.hbs | 14 +++++++++++---
3 files changed, 32 insertions(+), 4 deletions(-)
diff --git a/src/api/admin.rs b/src/api/admin.rs
index 63629bf3..b49d3ca0 100644
--- a/src/api/admin.rs
+++ b/src/api/admin.rs
@@ -17,7 +17,14 @@ pub fn routes() -> Vec<Route> {
return Vec::new();
}
- routes![admin_login, post_admin_login, admin_page, invite_user, delete_user]
+ routes![
+ admin_login,
+ post_admin_login,
+ admin_page,
+ invite_user,
+ delete_user,
+ deauth_user,
+ ]
}
const COOKIE_NAME: &'static str = "BWRS_ADMIN";
@@ -150,6 +157,18 @@ fn delete_user(uuid: String, _token: AdminToken, conn: DbConn) -> EmptyResult {
user.delete(&conn)
}
+#[post("/users/<uuid>/deauth")]
+fn deauth_user(uuid: String, _token: AdminToken, conn: DbConn) -> EmptyResult {
+ let mut user = match User::find_by_uuid(&uuid, &conn) {
+ Some(user) => user,
+ None => err!("User doesn't exist"),
+ };
+
+ user.reset_security_stamp();
+
+ user.save(&conn)
+}
+
pub struct AdminToken {}
impl<'a, 'r> FromRequest<'a, 'r> for AdminToken {
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 608f87b5..429fc4ea 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -120,6 +120,7 @@ impl User {
let twofactor_enabled = !TwoFactor::find_by_user(&self.uuid, conn).is_empty();
json!({
+ "_Enabled": !self.password_hash.is_empty(),
"Id": self.uuid,
"Name": self.name,
"Email": self.email,
diff --git a/src/static/templates/admin/page.hbs b/src/static/templates/admin/page.hbs
index 5d1d9c71..7caa8b16 100644
--- a/src/static/templates/admin/page.hbs
+++ b/src/static/templates/admin/page.hbs
@@ -13,6 +13,9 @@
{{#if TwoFactorEnabled}}
<span class="badge badge-success ml-2">2FA</span>
{{/if}}
+ {{#unless _Enabled}}
+ <span class="badge badge-warning ml-2">Disabled</span>
+ {{/unless}}
<span class="d-block">{{Email}}</span>
</div>
<div class="col">
@@ -23,7 +26,8 @@
{{/each}}
</span>
</div>
- <div style="flex: 0 0 100px;">
+ <div style="flex: 0 0 240px;">
+ <a class="mr-3" href="#" onclick='deauthUser("{{Id}}")'>Deauthorize sessions</a>
<a class="mr-3" href="#" onclick='deleteUser("{{Id}}", "{{Email}}")'>Delete User</a>
</div>
</div>
@@ -79,6 +83,12 @@
}
return false;
}
+ function deauthUser(id) {
+ _post("/admin/users/" + id + "/deauth",
+ "Sessions deauthorized correctly",
+ "Error deauthorizing sessions");
+ return false;
+ }
function inviteUser() {
inv = $("#email-invite");
data = JSON.stringify({ "Email": inv.val() });
@@ -87,14 +97,12 @@
"Error inviting user", data);
return false;
}
-
let OrgTypes = {
"0": { "name": "Owner", "color": "orange" },
"1": { "name": "Admin", "color": "blueviolet" },
"2": { "name": "User", "color": "blue" },
"3": { "name": "Manager", "color": "green" },
};
-
$(window).on('load', function () {
$("#invite-form").submit(inviteUser);
$("img.identicon").each(function (i, e) {
--
GitLab