4 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
ReactorcoremeltdownandClaude Opus 5	81094c0228	Add the administration pages to the web interface ... Running the server meant running the API by hand: invites, accounts, groups and grants existed only as endpoints and CLI commands, so the browser could create a vault and nothing else. /web/groups walks the group tree and opens onto one group's members, roles and vault access, including the grants it inherits from above and where they come from. /web/users lists the accounts you may see, and lets a server administrator disable, enable, clear a lost second factor, promote, demote or delete one. /web/invites shows the outstanding links with their use counts, issues new ones and revokes them. Every administrative change is now a function of the state and the caller in admin.go, which both the JSON handlers and the forms call. The alternative was a second copy of the permission rules behind the pages, which would have drifted on the first change. The same move gave the API the two verbs it was missing: DELETE /api/v1/invites/{token} and PATCH /api/v1/users/{id}. Account changes are server-administrator only. A group administrator decides who reaches which vault; disabling an account or clearing somebody's second factor reaches past the group they share. Disable and delete revoke that account's sessions, and the three changes that would lock the caller out are refused on their own account. Pages go through webPage and forms through webForm, so the session and CSRF checks cannot be forgotten on a new form. No page carries any JavaScript. Server 0.6.0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-10-30 12:32:08 +01:00
Reactorcoremeltdown	0848c0186c	Pass server version to container build	2026-10-30 10:08:34 +01:00
Reactorcoremeltdown	9729edfc9d	Fixed a typo	2026-10-30 10:03:26 +01:00
Reactorcoremeltdown	da503eac2a	Initial deploy	2026-10-30 10:01:11 +01:00