Kyle Isom
5a1f4f5837
- Change dashboard route from adminGet to authed middleware
- Show account counts and audit events only for admin users
- Show welcome message for non-admin authenticated users
Security: non-admin users cannot access account lists or audit
events; admin-only data is gated by claims.HasRole("admin") in
the handler, not just at the route level.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package ui
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"git.wntrmute.dev/kyle/mcias/internal/db"
|
|
"git.wntrmute.dev/kyle/mcias/internal/model"
|
|
)
|
|
|
|
// handleDashboard renders the main dashboard page. Admin users see account
|
|
// counts and recent audit events; non-admin users see a welcome page.
|
|
func (u *UIServer) handleDashboard(w http.ResponseWriter, r *http.Request) {
|
|
csrfToken, err := u.setCSRFCookies(w)
|
|
if err != nil {
|
|
u.logger.Error("set CSRF cookies", "error", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
claims := claimsFromContext(r.Context())
|
|
isAdmin := claims != nil && claims.HasRole("admin")
|
|
|
|
data := DashboardData{
|
|
PageData: PageData{CSRFToken: csrfToken, ActorName: u.actorName(r)},
|
|
IsAdmin: isAdmin,
|
|
}
|
|
|
|
if isAdmin {
|
|
accounts, err := u.db.ListAccounts()
|
|
if err != nil {
|
|
u.renderError(w, r, http.StatusInternalServerError, "failed to load accounts")
|
|
return
|
|
}
|
|
|
|
for _, a := range accounts {
|
|
data.TotalAccounts++
|
|
if a.Status == model.AccountStatusActive {
|
|
data.ActiveAccounts++
|
|
}
|
|
}
|
|
|
|
events, _, err := u.db.ListAuditEventsPaged(db.AuditQueryParams{Limit: 10, Offset: 0})
|
|
if err != nil {
|
|
u.logger.Warn("load recent audit events", "error", err)
|
|
events = nil
|
|
}
|
|
data.RecentEvents = events
|
|
}
|
|
|
|
u.render(w, "dashboard", data)
|
|
}
|