feat: delegated admin sections for second-admin roles (#123)
Adds per-section admin permission bits (users, groups, files, shares, storage, queue, settings, payment, events, reports). A group carrying any of these bits — without the full is_admin bit — becomes a delegated administrator that can open the admin panel but only access its granted sections. Backend enforcement, not just tab hiding: - IsAdminOrDelegated gates the /admin route tree; AdminSection middleware gates each admin subgroup (user/group/file/entity/share/policy/node/ queue/settings/oauthClient/tool). - Escalation guards: delegated admins cannot grant or modify admin-capable permission bits on groups, cannot create admin-capable groups, cannot assign users to admin groups, and cannot edit, demote, or delete members of admin-capable groups (single + batch paths). - Existing full admins keep unrestricted access; group 1 stays admin. Frontend: - Admin nav filters items by granted section bits; the dashboard entry appears for delegated admins too. - Group editor shows per-section switches when "Admin group" is off. Middleware tests cover full/delegated/non-admin and matching vs non-matching section access. Closes #123 (fork). Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>pull/3582/head
Tomas Dvorak
2 weeks ago
parent
c6bf098b87
commit
bb53ee5c4c
@ -0,0 +1,102 @@
|
|||||||
|
package middleware
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http/httptest"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/ent"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/inventory"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/inventory/types"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/boolset"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/util"
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
)
|
||||||
|
|
||||||
|
func perms(bits ...types.GroupPermission) *boolset.BooleanSet {
|
||||||
|
b := &boolset.BooleanSet{}
|
||||||
|
for _, p := range bits {
|
||||||
|
boolset.Set(int(p), true, b)
|
||||||
|
}
|
||||||
|
return b
|
||||||
|
}
|
||||||
|
|
||||||
|
func newAdminRequest(t *testing.T, permissions *boolset.BooleanSet) *gin.Context {
|
||||||
|
t.Helper()
|
||||||
|
w := httptest.NewRecorder()
|
||||||
|
c := gin.CreateTestContextOnly(w, testEngine)
|
||||||
|
c.Request = httptest.NewRequest("GET", "/api/v4/admin/summary", nil)
|
||||||
|
u := &ent.User{
|
||||||
|
ID: 2,
|
||||||
|
Edges: ent.UserEdges{
|
||||||
|
Group: &ent.Group{Permissions: permissions},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
util.WithValue(c, inventory.UserCtx{}, u)
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestIsAdminOrDelegated(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
handler := IsAdminOrDelegated()
|
||||||
|
|
||||||
|
t.Run("full admin passes", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionIsAdmin))
|
||||||
|
handler(c)
|
||||||
|
if c.IsAborted() {
|
||||||
|
t.Fatal("full admin was rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("delegated admin passes", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionAdminUsers))
|
||||||
|
handler(c)
|
||||||
|
if c.IsAborted() {
|
||||||
|
t.Fatal("delegated admin was rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("regular user rejected", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionShare))
|
||||||
|
handler(c)
|
||||||
|
if !c.IsAborted() {
|
||||||
|
t.Fatal("regular user was not rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAdminSection(t *testing.T) {
|
||||||
|
gin.SetMode(gin.TestMode)
|
||||||
|
handler := AdminSection(types.GroupPermissionAdminUsers, types.GroupPermissionAdminGroups)
|
||||||
|
|
||||||
|
t.Run("full admin passes any section", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionIsAdmin))
|
||||||
|
handler(c)
|
||||||
|
if c.IsAborted() {
|
||||||
|
t.Fatal("full admin was rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("matching delegated section passes", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionAdminUsers))
|
||||||
|
handler(c)
|
||||||
|
if c.IsAborted() {
|
||||||
|
t.Fatal("delegated admin with matching section was rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("non-matching delegated section rejected", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms(types.GroupPermissionAdminFiles))
|
||||||
|
handler(c)
|
||||||
|
if !c.IsAborted() {
|
||||||
|
t.Fatal("delegated admin without matching section was not rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("regular user rejected", func(t *testing.T) {
|
||||||
|
c := newAdminRequest(t, perms())
|
||||||
|
handler(c)
|
||||||
|
if !c.IsAborted() {
|
||||||
|
t.Fatal("regular user was not rejected")
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
Loading…
Reference in new issue