mirror of
https://github.com/penpot/penpot.git
synced 2026-11-01 15:40:41 +00:00
8853445951
Operators get a full instance administration panel behind a new
"superuser" access rule. The :app.auth/superusers service resolves
the configured :superusers emails to profile ids once at startup,
so guarded calls are a plain contains? with no query. A token
carrying "superuser" as an operator-granted scope also passes, for
automation without a session; tokens are created with empty perms,
so this opens nothing by itself.
The check is a branch of wrap-authentication, after auth and
before params validation, so outsiders get 403
:superuser-required without leaking expected params. Other token
scopes keep their exact meaning. get-profile and the login
response report the same answer as :is-superuser; the team-scoped
:is-admin is untouched. On devenv any authenticated profile
passes, as the /dbg gate does. The :admins config becomes
:superusers (PENPOT_SUPERUSERS) with no compatibility layer:
operators must rename it or instance-admin access fails closed.
Quote notifications go to the same set.
Admin operations live in app.rpc.admin.* behind
/api/admin/methods, with the same auth wrapping as main but
excluded from the main API docs. Profiles can be listed,
inspected, blocked, unblocked, deleted and restored, teams listed
with members and features, projects and files listed with validate
and repair, error reports listed and shared through JWE links,
and the virtual clock read and set.
Delete and restore run as durable jobs on the unified job table:
the command stamps the object's own row inline so it reads back
instantly, then a delete-object or restore-object job walks the
rest of the tree through app.features.object-cascade. Listing
uses created-at cursors over the new 0157 indexes.
The panel itself is a static SPA served under /admin (public like
any asset; the JS gate reads :is-superuser from get-profile)
with dashboard, users, teams, projects, files and error-report
pages. Devenv points /admin at the backend.
Covered by backend-tests rpc-superuser-test plus
rpc-admin-{users,teams,project,file,delete,restore,misc,
error-reports,error-share} and http-admin tests, with green
regressions on profile, auth and quotes.
Relates to #12015
AI-assisted-by: muse-spark-1.3-contributor
69 lines
2.2 KiB
JavaScript
69 lines
2.2 KiB
JavaScript
// Minimal RPC client against the admin API.
|
|
//
|
|
// The API root is derived from this module's own URL: the panel is
|
|
// served at `<root>/admin/js/api.js` and the API lives at
|
|
// `<root>/api/...`, where `<root>` is empty on a root deployment or
|
|
// the subpath otherwise. No absolute paths, so subpath deployments
|
|
// keep working.
|
|
//
|
|
// Sessions travel in the cookie (`credentials: "same-origin"`), so there
|
|
// is no token handling here. 401/403 responses are propagated as thrown
|
|
// errors with a `status` field so callers can tell "no session" and
|
|
// "no permission" apart.
|
|
|
|
const API_ROOT = new URL("../../api/admin/methods/", import.meta.url);
|
|
const MAIN_API_ROOT = new URL("../../api/main/methods/", import.meta.url);
|
|
|
|
async function call(root, command, params = {}) {
|
|
const response = await fetch(new URL(command, root), {
|
|
method: "POST",
|
|
credentials: "same-origin",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
accept: "application/json",
|
|
},
|
|
body: JSON.stringify(params),
|
|
});
|
|
|
|
if (response.status === 204) {
|
|
return null;
|
|
}
|
|
|
|
if (!response.ok) {
|
|
const error = new Error("rpc failed: " + command);
|
|
error.status = response.status;
|
|
try {
|
|
error.data = await response.json();
|
|
} catch {
|
|
error.data = null;
|
|
}
|
|
throw error;
|
|
}
|
|
|
|
return response.json();
|
|
}
|
|
|
|
export async function rpc(command, params = {}) {
|
|
return call(API_ROOT, command, params);
|
|
}
|
|
|
|
export async function rpcMain(command, params = {}) {
|
|
return call(MAIN_API_ROOT, command, params);
|
|
}
|
|
|
|
// Human-readable detail from a failed RPC call, or null when the
|
|
// server gave nothing usable. Lets the panel repeat the backend
|
|
// reason (e.g. why a delete was refused) instead of a generic
|
|
// message. Every string is painted as text by the caller.
|
|
export function errorHint(err) {
|
|
const hint = err?.data?.["~:hint"];
|
|
return typeof hint === "string" && hint.length > 0 ? hint : null;
|
|
}
|
|
|
|
// Binary transfer calls go through the RPC methods endpoint directly
|
|
// (a download and a multipart upload do not fit the JSON rpc()
|
|
// helper, which always parses the answer as JSON).
|
|
export function methodUrl(name) {
|
|
return new URL("../../api/admin/methods/" + name, import.meta.url);
|
|
}
|