Kyle Isom
d7d7ba21d9
- Add IsAdmin bool to PageData (embedded in all page view structs)
- Remove redundant IsAdmin from DashboardData
- Add isAdmin() helper to derive admin status from request claims
- Set IsAdmin in all page-level handlers that populate PageData
- Wrap admin-only nav links in base.html with {{if .IsAdmin}}
- Add tests: non-admin dashboard/profile hide admin links,
admin dashboard shows them
Security: navigation links to /accounts, /audit, /policies,
and /pgcreds are now only rendered for admin users. Server-side
authorization (requireAdminRole middleware) was already in place;
this change removes the information leak of showing links that
return 403 to non-admin users.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
50 lines
1.2 KiB
Go
50 lines
1.2 KiB
Go
package ui
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"git.wntrmute.dev/kyle/mcias/internal/db"
|
|
"git.wntrmute.dev/kyle/mcias/internal/model"
|
|
)
|
|
|
|
// handleDashboard renders the main dashboard page. Admin users see account
|
|
// counts and recent audit events; non-admin users see a welcome page.
|
|
func (u *UIServer) handleDashboard(w http.ResponseWriter, r *http.Request) {
|
|
csrfToken, err := u.setCSRFCookies(w)
|
|
if err != nil {
|
|
u.logger.Error("set CSRF cookies", "error", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
admin := isAdmin(r)
|
|
|
|
data := DashboardData{
|
|
PageData: PageData{CSRFToken: csrfToken, ActorName: u.actorName(r), IsAdmin: admin},
|
|
}
|
|
|
|
if admin {
|
|
accounts, err := u.db.ListAccounts()
|
|
if err != nil {
|
|
u.renderError(w, r, http.StatusInternalServerError, "failed to load accounts")
|
|
return
|
|
}
|
|
|
|
for _, a := range accounts {
|
|
data.TotalAccounts++
|
|
if a.Status == model.AccountStatusActive {
|
|
data.ActiveAccounts++
|
|
}
|
|
}
|
|
|
|
events, _, err := u.db.ListAuditEventsPaged(db.AuditQueryParams{Limit: 10, Offset: 0})
|
|
if err != nil {
|
|
u.logger.Warn("load recent audit events", "error", err)
|
|
events = nil
|
|
}
|
|
data.RecentEvents = events
|
|
}
|
|
|
|
u.render(w, "dashboard", data)
|
|
}
|