4 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	e798365be2	feat: Removed comments	2026-07-24 09:56:54 +01:00
mrhid6	1a6cf03c03	feat: Removed comments	2026-07-24 09:51:30 +01:00
mrhid6	aa31cd8a10	fix: validate roles, guard last owner, scope bootstrap status ... Security review of e70b2f0. The UI gating was correctly backed by RequireRole everywhere; these are the missing validation gaps behind it. - UpdateUserRole and createOrgUser accepted any role string verbatim, so an admin could self-promote to owner, create an owner outright, or set a junk role that silently stripped a user's access. Roles are now whitelisted, only an owner may grant or remove the owner role, and an actor cannot change their own. - Neither demote nor delete guarded the last owner, so an org could reach zero owners. Both now refuse when no owner would remain, returning 409. Self-delete rejected. - CountUsers counted across all orgs, so a locked-out org could never re-bootstrap once another tenant existed, and the unauthenticated bootstrap-status endpoint reported instance-wide state. It now answers per-org on an org host, falling back to global only on the apex. - HandleMe repeats the middleware's host/org check; it sits outside the middleware so it can still return its own 401. - Post-bootstrap now sends the new owner to their org host's login page. The session cookie is deliberately scoped to the exact host, so the old redirect landed them unauthenticated. - AuthProvider renders an error state instead of mounting the shell with a null user when /auth/me fails for a reason other than 401. - api.ts unwraps {"error": ...} so these messages render as text.	2026-07-22 10:26:21 +01:00
mrhid6	e70b2f0e67	feat(web): login, first-run setup, org settings; org-aware AuthProvider ... - Route group (app) holds AuthProvider + Sidebar, so /login and /setup render without app chrome and never mount the provider. - AuthProvider drops the removed auth_enabled flag and exposes {user, org, isAdmin}. - New login page (password + SSO), first-run setup page, and org settings page with a members table and the OIDC provider form. - Settings page and the Organization nav entry are gated on role, since /api/settings now 403s for members. - GET /api/org/oidc gains client_secret_set so the UI can show whether a secret is stored; the secret itself is still never serialized, and an empty submitted value still means "keep the stored one". - Fix logout: the sidebar linked to /auth/logout with a GET, but the route is POST-only, so logout was 404ing.	2026-07-22 10:17:12 +01:00