Orgs: let any user create an organization and become its admin
Organization writes were superadmin-only, so standing up a tenant needed an out-of-band superadmin. Creating one is now self-service, and an admin manages the org they belong to. - POST /api/orgs is open to any authenticated user. A creator who isn't a superadmin must have no organization yet (a single-valued membership relation means a second one would abandon the first), and is promoted to the new org's admin and first member in the same request. If that promotion fails the org is rolled back, so it is never left stranded with nobody able to administer it. Superadmins still create tenants without joining them. - PATCH/DELETE are manager-gated and scope an admin to their own org. An admin deletes theirs only as its sole member: they are detached and demoted to a plain user before the record goes, so the org is empty when it is removed. Other members still block deletion with a 409. - /api/me now carries organization + organizationName, which the clients need to tell "no org yet" from "org you administer". The panel, Web App (new OrgManager.vue in Settings) and Phone App (new _OrganizationSection) all mirror the server's gates rather than re-deciding them. The Phone App cached its role at login and gates the Users tab on it, so AuthService.adoptRole refreshes that from the profile instead of making a freshly promoted admin sign in again. Covered by orgs_test.go, which drives the real handler + middleware chain against a stand-in PocketBase: promotion, the already-a-member refusal, superadmin staying unattached, the rollback, own-org scoping, the detach-and-demote, and the blocking-member 409. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tajniak81
co-authored by
Claude Opus 5
Claude Opus 5
parent
358ee68f94
commit
cd16d4383f
+17
-1
@@ -76,6 +76,22 @@ their own account. An organization cannot be deleted while it still has members.
|
||||
membership. A superadmin spans all organizations; an admin is scoped by the
|
||||
server to their own. Users may have no organization at all.
|
||||
|
||||
Creating one is self-service: any user who does not already belong to an
|
||||
organization may `POST /api/orgs`, and becomes that organization's **admin** and
|
||||
first member in the same request (if the promotion fails the new organization is
|
||||
rolled back, so it is never left with nobody able to administer it). A user who
|
||||
already belongs to one is refused — membership is a single relation, so creating
|
||||
a second would mean silently abandoning the first.
|
||||
|
||||
A superadmin is the exception: they create organizations without joining them,
|
||||
since they already span every tenant.
|
||||
|
||||
From there an admin manages **their own** organization — rename it, or delete it
|
||||
once they are its only member. Deleting it detaches and demotes them back to a
|
||||
plain `user` before the record is removed, so the organization is empty when it
|
||||
goes. A superadmin may rename or delete any organization, but still only once it
|
||||
has no members at all.
|
||||
|
||||
### Per-user car ownership + sharing
|
||||
|
||||
Cars are not a global list. `cars.owner` marks ownership and `car_shares` grants
|
||||
@@ -139,7 +155,7 @@ POST /api/me/verify/request
|
||||
GET /api/me/export POST /api/me/import
|
||||
POST /api/me/delete POST /api/me/delete/cancel
|
||||
|
||||
# users + organizations (admin or superadmin; org writes are superadmin-only)
|
||||
# users + organizations (admin or superadmin; POST /api/orgs is open to any user)
|
||||
GET /api/users POST /api/users
|
||||
PATCH /api/users/{id} DELETE /api/users/{id}
|
||||
GET /api/orgs POST /api/orgs
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+1
-1
@@ -6,7 +6,7 @@
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta name="theme-color" content="#2563eb" />
|
||||
<title>DriverVault · API Server</title>
|
||||
<script type="module" crossorigin src="/assets/index-D-rTgBao.js"></script>
|
||||
<script type="module" crossorigin src="/assets/index-OHZkxAdj.js"></script>
|
||||
<link rel="stylesheet" crossorigin href="/assets/index-D3MeNcl7.css">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
@@ -33,6 +33,7 @@ type userRecord struct {
|
||||
FontSize string `json:"font_size"`
|
||||
DeletionRequestedAt string `json:"deletion_requested_at"`
|
||||
Role string `json:"role"`
|
||||
Organization string `json:"organization"`
|
||||
Created string `json:"created"`
|
||||
}
|
||||
|
||||
@@ -51,6 +52,8 @@ func (rec userRecord) toModel() models.User {
|
||||
FontSize: orDefault(rec.FontSize, "medium"),
|
||||
Role: orDefault(rec.Role, "user"),
|
||||
Created: rec.Created,
|
||||
|
||||
Organization: rec.Organization,
|
||||
}
|
||||
if t := parsePBDate(rec.DeletionRequestedAt); !t.IsZero() {
|
||||
u.DeletionRequestedAt = &t
|
||||
@@ -65,6 +68,17 @@ func orDefault(v, fallback string) string {
|
||||
return v
|
||||
}
|
||||
|
||||
// profileOf builds the profile payload for a user record, resolving their
|
||||
// organization's name so the clients can label the membership without a second
|
||||
// round trip. The lookup is best effort — an unresolvable name leaves the id.
|
||||
func (s *Server) profileOf(r *http.Request, rec *userRecord) models.User {
|
||||
u := rec.toModel()
|
||||
if u.Organization != "" {
|
||||
u.OrganizationName = s.orgName(r.Context(), u.Organization)
|
||||
}
|
||||
return u
|
||||
}
|
||||
|
||||
func (s *Server) fetchUser(r *http.Request, id string) (*userRecord, error) {
|
||||
var rec userRecord
|
||||
if err := s.pb.GetOne(r.Context(), s.usersCollection(), id, &rec); err != nil {
|
||||
@@ -84,7 +98,7 @@ func (s *Server) handleGetMe(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, rec))
|
||||
}
|
||||
|
||||
type updateMeRequest struct {
|
||||
@@ -181,7 +195,7 @@ func (s *Server) handleUpdateMe(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, &rec))
|
||||
}
|
||||
|
||||
type changePasswordRequest struct {
|
||||
@@ -256,7 +270,7 @@ func (s *Server) handleUploadAvatar(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, rec))
|
||||
}
|
||||
|
||||
func (s *Server) handleDeleteAvatar(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
@@ -81,8 +81,24 @@ func (s *Server) handleListOrgs(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusOK, map[string]any{"organizations": list.Items})
|
||||
}
|
||||
|
||||
// POST /api/orgs — create an organization (superadmin only). Body: {name}.
|
||||
// POST /api/orgs — create an organization. Body: {name}. A superadmin may create
|
||||
// any number of organizations and is not attached to them (they manage every
|
||||
// tenant centrally). Any other user may create one only if they don't already
|
||||
// belong to an organization, and they become its admin and first member — the
|
||||
// self-service path for standing up a new tenant.
|
||||
//
|
||||
// This handler carries no requireRole gate (any authenticated caller may reach
|
||||
// it), so it checks the service account itself.
|
||||
func (s *Server) handleCreateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.pb.Configured() {
|
||||
writeError(w, http.StatusServiceUnavailable, "organizations are not configured on the server")
|
||||
return
|
||||
}
|
||||
who := caller(r)
|
||||
if !who.isSuperadmin() && who.OrgID != "" {
|
||||
writeError(w, http.StatusForbidden, "you already belong to an organization")
|
||||
return
|
||||
}
|
||||
name, ok := decodeOrgName(w, r)
|
||||
if !ok {
|
||||
return
|
||||
@@ -100,16 +116,42 @@ func (s *Server) handleCreateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
var org orgView
|
||||
_ = json.Unmarshal(data, &org)
|
||||
|
||||
// A non-superadmin creator becomes the admin of, and first member of, the org
|
||||
// they just made. If that promotion fails, roll the org back so we never leave
|
||||
// a stranded organization that nobody can administer.
|
||||
if !who.isSuperadmin() {
|
||||
data, status, err = s.pb.Raw(r.Context(), http.MethodPatch,
|
||||
"/api/collections/"+s.usersCollection()+"/records/"+url.PathEscape(who.ID),
|
||||
map[string]any{"organization": org.ID, "role": roleAdmin})
|
||||
if err != nil || status != http.StatusOK {
|
||||
_, _, _ = s.pb.Raw(r.Context(), http.MethodDelete,
|
||||
"/api/collections/"+colOrgs+"/records/"+url.PathEscape(org.ID), nil)
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
return
|
||||
}
|
||||
relay(w, status, data)
|
||||
return
|
||||
}
|
||||
}
|
||||
writeJSON(w, http.StatusCreated, map[string]any{"organization": org})
|
||||
}
|
||||
|
||||
// PATCH /api/orgs/{id} — rename an organization (superadmin only). Body: {name}.
|
||||
// PATCH /api/orgs/{id} — rename an organization (manager only). A superadmin may
|
||||
// rename any organization; an admin may rename only their own. Body: {name}.
|
||||
func (s *Server) handleUpdateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
who := caller(r)
|
||||
id := r.PathValue("id")
|
||||
if id == "" {
|
||||
writeError(w, http.StatusBadRequest, "missing organization id")
|
||||
return
|
||||
}
|
||||
// An admin is scoped to their own organization; a superadmin spans all.
|
||||
if !who.isSuperadmin() && (who.OrgID == "" || id != who.OrgID) {
|
||||
writeError(w, http.StatusForbidden, "you can only rename your own organization")
|
||||
return
|
||||
}
|
||||
name, ok := decodeOrgName(w, r)
|
||||
if !ok {
|
||||
return
|
||||
@@ -129,18 +171,35 @@ func (s *Server) handleUpdateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusOK, map[string]any{"organization": org})
|
||||
}
|
||||
|
||||
// DELETE /api/orgs/{id} — delete an organization (superadmin only). Refused
|
||||
// while the org still has members, to avoid silently orphaning users.
|
||||
// DELETE /api/orgs/{id} — delete an organization (manager only). A superadmin may
|
||||
// delete any organization, but only once it has no members. An admin may delete
|
||||
// only their own organization, and only when they are its sole member: the admin
|
||||
// is detached and demoted back to a plain user, then the org is removed. Either
|
||||
// path refuses to silently orphan other members.
|
||||
func (s *Server) handleDeleteOrg(w http.ResponseWriter, r *http.Request) {
|
||||
who := caller(r)
|
||||
id := r.PathValue("id")
|
||||
if id == "" {
|
||||
writeError(w, http.StatusBadRequest, "missing organization id")
|
||||
return
|
||||
}
|
||||
|
||||
// Guard: block deletion if any user still belongs to this org.
|
||||
// Count the members that block deletion. A superadmin is blocked by anyone at
|
||||
// all; an admin deleting their own org is blocked only by *other* members,
|
||||
// since they detach themselves below.
|
||||
filter := "organization = \"" + id + "\""
|
||||
blocked := "organization still has members; reassign or remove them first"
|
||||
if !who.isSuperadmin() {
|
||||
// An admin is scoped to their own organization.
|
||||
if who.OrgID == "" || id != who.OrgID {
|
||||
writeError(w, http.StatusForbidden, "you can only delete your own organization")
|
||||
return
|
||||
}
|
||||
filter += " && id != \"" + who.ID + "\""
|
||||
blocked = "organization still has other members; reassign or remove them first"
|
||||
}
|
||||
countPath := "/api/collections/" + s.usersCollection() + "/records?perPage=1&fields=id&filter=" +
|
||||
url.QueryEscape("organization = \""+id+"\"")
|
||||
url.QueryEscape(filter)
|
||||
data, status, err := s.pb.Raw(r.Context(), http.MethodGet, countPath, nil)
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
@@ -152,7 +211,25 @@ func (s *Server) handleDeleteOrg(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
_ = json.Unmarshal(data, &page)
|
||||
if page.TotalItems > 0 {
|
||||
writeError(w, http.StatusConflict, "organization still has members; reassign or remove them first")
|
||||
writeError(w, http.StatusConflict, blocked)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Detach and demote the admin so the org is empty before it is removed. Done
|
||||
// before the delete because users.organization does not cascade: a failed
|
||||
// delete leaves an empty org a superadmin can clean up, which beats leaving a
|
||||
// member pointing at an organization that no longer exists.
|
||||
if !who.isSuperadmin() {
|
||||
data, status, err = s.pb.Raw(r.Context(), http.MethodPatch,
|
||||
"/api/collections/"+s.usersCollection()+"/records/"+url.PathEscape(who.ID),
|
||||
map[string]any{"organization": "", "role": roleUser})
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
return
|
||||
}
|
||||
if status != http.StatusOK {
|
||||
relay(w, status, data)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,333 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"drivervault/apiserver/internal/config"
|
||||
"drivervault/apiserver/internal/pb"
|
||||
)
|
||||
|
||||
// These tests cover the self-service organization flows through the real
|
||||
// Handler + middleware chain: an org-less user creating an org and being
|
||||
// promoted to its admin (including the rollback when that promotion fails), and
|
||||
// an admin renaming or deleting only their own organization. A stand-in
|
||||
// PocketBase (orgFakePB) serves exactly the endpoints those paths hit.
|
||||
|
||||
const (
|
||||
orgTestUserID = "u1"
|
||||
orgTestBearer = "user-bearer-token"
|
||||
orgTestNewID = "neworg1"
|
||||
)
|
||||
|
||||
// orgFakePB answers the identity, organization and user-record calls the org
|
||||
// handlers make, and records the writes so tests can assert on them.
|
||||
type orgFakePB struct {
|
||||
mu sync.Mutex
|
||||
|
||||
// Identity returned by auth-refresh.
|
||||
callerRole string
|
||||
callerOrg string
|
||||
|
||||
// Behaviour switches.
|
||||
userPatchStatus int // status for a caller promotion/demotion (200 when 0)
|
||||
memberCount int // totalItems for the blocking-member query
|
||||
|
||||
// Recorded effects.
|
||||
createdOrgs []string
|
||||
orgPatches []map[string]any
|
||||
orgDeletes []string
|
||||
userPatches []map[string]any
|
||||
}
|
||||
|
||||
func (f *orgFakePB) handler(t *testing.T) http.Handler {
|
||||
t.Helper()
|
||||
mux := http.NewServeMux()
|
||||
|
||||
// Service-account auth (pb.Client.Authenticate).
|
||||
mux.HandleFunc("POST /api/collections/_superusers/auth-with-password", func(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, 200, map[string]any{"token": "svc-token"})
|
||||
})
|
||||
|
||||
// Identify the bearer (withAuth → identify → AuthRefresh).
|
||||
mux.HandleFunc("POST /api/collections/users/auth-refresh", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Header.Get("Authorization") == "" {
|
||||
writeJSON(w, 401, map[string]any{})
|
||||
return
|
||||
}
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"record": map[string]any{
|
||||
"id": orgTestUserID, "email": "owner@test.local", "name": "Owner",
|
||||
"role": f.callerRole, "organization": f.callerOrg,
|
||||
}})
|
||||
})
|
||||
|
||||
// Organization create / rename / delete.
|
||||
mux.HandleFunc("POST /api/collections/organizations/records", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.createdOrgs = append(f.createdOrgs, orgTestNewID)
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"id": orgTestNewID, "name": body["name"], "created": "2026-08-17 10:00:00Z"})
|
||||
})
|
||||
mux.HandleFunc("PATCH /api/collections/organizations/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.orgPatches = append(f.orgPatches, body)
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"id": r.PathValue("id"), "name": body["name"]})
|
||||
})
|
||||
mux.HandleFunc("DELETE /api/collections/organizations/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
f.mu.Lock()
|
||||
f.orgDeletes = append(f.orgDeletes, r.PathValue("id"))
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 204, nil)
|
||||
})
|
||||
|
||||
// Blocking-member count for a delete.
|
||||
mux.HandleFunc("GET /api/collections/users/records", func(w http.ResponseWriter, r *http.Request) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"totalItems": f.memberCount, "items": []any{}})
|
||||
})
|
||||
|
||||
// Caller promotion / demotion.
|
||||
mux.HandleFunc("PATCH /api/collections/users/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.userPatches = append(f.userPatches, body)
|
||||
status := f.userPatchStatus
|
||||
f.mu.Unlock()
|
||||
if status != 0 && status != 200 {
|
||||
writeJSON(w, status, map[string]any{"message": "cannot update user"})
|
||||
return
|
||||
}
|
||||
writeJSON(w, 200, map[string]any{"id": r.PathValue("id")})
|
||||
})
|
||||
|
||||
return mux
|
||||
}
|
||||
|
||||
// newOrgTestServer wires the fake PocketBase to a real Handler and returns the
|
||||
// app's base URL.
|
||||
func newOrgTestServer(t *testing.T, f *orgFakePB) string {
|
||||
t.Helper()
|
||||
pbSrv := httptest.NewServer(f.handler(t))
|
||||
t.Cleanup(pbSrv.Close)
|
||||
|
||||
s := New(config.Config{UsersCollection: "users"}, pb.New(pbSrv.URL, "admin@test.local", "pw"))
|
||||
appSrv := httptest.NewServer(s.Handler())
|
||||
t.Cleanup(appSrv.Close)
|
||||
return appSrv.URL
|
||||
}
|
||||
|
||||
// orgReq issues an authenticated request and returns the status and decoded body.
|
||||
func orgReq(t *testing.T, base, method, path string, body any) (int, map[string]any) {
|
||||
t.Helper()
|
||||
var buf bytes.Buffer
|
||||
if body != nil {
|
||||
if err := json.NewEncoder(&buf).Encode(body); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
req, err := http.NewRequest(method, base+path, &buf)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
req.Header.Set("Authorization", "Bearer "+orgTestBearer)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
out := map[string]any{}
|
||||
_ = json.NewDecoder(resp.Body).Decode(&out)
|
||||
return resp.StatusCode, out
|
||||
}
|
||||
|
||||
func TestCreateOrgPromotesCreatorToAdmin(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Acme Inc."})
|
||||
if status != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201 (body %v)", status, body)
|
||||
}
|
||||
org, _ := body["organization"].(map[string]any)
|
||||
if org["id"] != orgTestNewID || org["name"] != "Acme Inc." {
|
||||
t.Fatalf("organization = %v, want id %q name %q", org, orgTestNewID, "Acme Inc.")
|
||||
}
|
||||
|
||||
if len(f.userPatches) != 1 {
|
||||
t.Fatalf("user patches = %d, want 1 (%v)", len(f.userPatches), f.userPatches)
|
||||
}
|
||||
patch := f.userPatches[0]
|
||||
if patch["organization"] != orgTestNewID {
|
||||
t.Errorf("patched organization = %v, want %q", patch["organization"], orgTestNewID)
|
||||
}
|
||||
if patch["role"] != roleAdmin {
|
||||
t.Errorf("patched role = %v, want %q", patch["role"], roleAdmin)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org was rolled back unexpectedly: %v", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateOrgRejectedWhenCallerAlreadyHasOne(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "existing1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Second Org"})
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403 (body %v)", status, body)
|
||||
}
|
||||
if len(f.createdOrgs) != 0 {
|
||||
t.Errorf("created orgs = %v, want none", f.createdOrgs)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
// A superadmin manages every tenant centrally, so creating one must not move
|
||||
// them into it or change their role.
|
||||
func TestCreateOrgLeavesSuperadminUnattached(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleSuperadmin, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Tenant A"})
|
||||
if status != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201 (body %v)", status, body)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none for a superadmin", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
// If the creator cannot be promoted, the new org must not survive — otherwise it
|
||||
// is stranded with nobody able to administer it.
|
||||
func TestCreateOrgRollsBackWhenPromotionFails(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "", userPatchStatus: http.StatusBadRequest}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Doomed"})
|
||||
if status == http.StatusCreated {
|
||||
t.Fatalf("status = %d, want a failure", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 1 || f.orgDeletes[0] != orgTestNewID {
|
||||
t.Errorf("org deletes = %v, want rollback of %q", f.orgDeletes, orgTestNewID)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateOrgRejectsBadName(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": " "})
|
||||
if status != http.StatusBadRequest {
|
||||
t.Fatalf("status = %d, want 400", status)
|
||||
}
|
||||
if len(f.createdOrgs) != 0 {
|
||||
t.Errorf("created orgs = %v, want none", f.createdOrgs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateOrgAdminScopedToOwnOrg(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
// Someone else's organization is off limits.
|
||||
status, _ := orgReq(t, base, http.MethodPatch, "/api/orgs/o2", map[string]any{"name": "Hijack"})
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("foreign org status = %d, want 403", status)
|
||||
}
|
||||
if len(f.orgPatches) != 0 {
|
||||
t.Fatalf("org patches = %v, want none", f.orgPatches)
|
||||
}
|
||||
|
||||
// Their own is fine.
|
||||
status, body := orgReq(t, base, http.MethodPatch, "/api/orgs/o1", map[string]any{"name": "Renamed"})
|
||||
if status != http.StatusOK {
|
||||
t.Fatalf("own org status = %d, want 200 (body %v)", status, body)
|
||||
}
|
||||
if len(f.orgPatches) != 1 || f.orgPatches[0]["name"] != "Renamed" {
|
||||
t.Errorf("org patches = %v, want one rename to %q", f.orgPatches, "Renamed")
|
||||
}
|
||||
}
|
||||
|
||||
// An admin deleting their own org is detached and demoted first, so the org is
|
||||
// empty by the time it is removed.
|
||||
func TestDeleteOrgAdminSoleMemberIsDetachedAndDemoted(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1", memberCount: 0}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil)
|
||||
if status != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200 (body %v)", status, body)
|
||||
}
|
||||
if len(f.userPatches) != 1 {
|
||||
t.Fatalf("user patches = %d, want 1 (%v)", len(f.userPatches), f.userPatches)
|
||||
}
|
||||
patch := f.userPatches[0]
|
||||
if patch["organization"] != "" {
|
||||
t.Errorf("patched organization = %v, want cleared", patch["organization"])
|
||||
}
|
||||
if patch["role"] != roleUser {
|
||||
t.Errorf("patched role = %v, want %q", patch["role"], roleUser)
|
||||
}
|
||||
if len(f.orgDeletes) != 1 || f.orgDeletes[0] != "o1" {
|
||||
t.Errorf("org deletes = %v, want [o1]", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteOrgBlockedByOtherMembers(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1", memberCount: 2}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil)
|
||||
if status != http.StatusConflict {
|
||||
t.Fatalf("status = %d, want 409", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org deletes = %v, want none", f.orgDeletes)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none — the admin must stay put", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteOrgAdminCannotDeleteForeignOrg(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o2", nil)
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org deletes = %v, want none", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
// A plain user is not a manager, so rename/delete stay closed to them even for
|
||||
// the org they belong to.
|
||||
func TestPlainUserCannotManageOrgs(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
if status, _ := orgReq(t, base, http.MethodPatch, "/api/orgs/o1", map[string]any{"name": "Nope"}); status != http.StatusForbidden {
|
||||
t.Errorf("rename status = %d, want 403", status)
|
||||
}
|
||||
if status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil); status != http.StatusForbidden {
|
||||
t.Errorf("delete status = %d, want 403", status)
|
||||
}
|
||||
}
|
||||
@@ -28,7 +28,7 @@
|
||||
// GET /api/me/export POST /api/me/import
|
||||
// POST /api/me/delete POST /api/me/delete/cancel
|
||||
//
|
||||
// # users + organizations (manager; writes to orgs are superadmin-only)
|
||||
// # users + organizations (manager; POST /api/orgs is open to any user)
|
||||
// GET /api/users POST /api/users
|
||||
// PATCH /api/users/{id} DELETE /api/users/{id}
|
||||
// GET /api/orgs POST /api/orgs
|
||||
@@ -285,12 +285,15 @@ func (s *Server) Handler() http.Handler {
|
||||
mux.HandleFunc("PATCH /api/users/{id}", s.requireManager(s.handleUpdateUser))
|
||||
mux.HandleFunc("DELETE /api/users/{id}", s.requireManager(s.handleDeleteUser))
|
||||
|
||||
// Organizations — listing is manager-scoped; create/edit/delete are
|
||||
// superadmin-only (a superadmin spans all organizations).
|
||||
// Organizations — the tenants users belong to. Listing is manager-scoped (an
|
||||
// admin sees only their own org). Any org-less user may create an org and
|
||||
// becomes its admin; an admin may rename or delete their own org; a superadmin
|
||||
// spans every organization. Create carries no role gate, so it checks the
|
||||
// service account itself.
|
||||
mux.HandleFunc("GET /api/orgs", s.requireManager(s.handleListOrgs))
|
||||
mux.HandleFunc("POST /api/orgs", s.requireSuperadmin(s.handleCreateOrg))
|
||||
mux.HandleFunc("PATCH /api/orgs/{id}", s.requireSuperadmin(s.handleUpdateOrg))
|
||||
mux.HandleFunc("DELETE /api/orgs/{id}", s.requireSuperadmin(s.handleDeleteOrg))
|
||||
mux.HandleFunc("POST /api/orgs", s.handleCreateOrg)
|
||||
mux.HandleFunc("PATCH /api/orgs/{id}", s.requireManager(s.handleUpdateOrg))
|
||||
mux.HandleFunc("DELETE /api/orgs/{id}", s.requireManager(s.handleDeleteOrg))
|
||||
|
||||
// PocketBase connection settings — superadmin only. These do NOT require the
|
||||
// service account to already be configured (they exist to configure it).
|
||||
|
||||
@@ -335,6 +335,11 @@ type User struct {
|
||||
FontSize string `json:"fontSize"` // small | medium | large
|
||||
Role string `json:"role"` // user | admin
|
||||
|
||||
// Organization membership. Empty when the user belongs to no organization —
|
||||
// the clients use that to offer creating one (which makes them its admin).
|
||||
Organization string `json:"organization"`
|
||||
OrganizationName string `json:"organizationName,omitempty"`
|
||||
|
||||
// Non-empty while an account-deletion request is pending its cooldown.
|
||||
DeletionRequestedAt *time.Time `json:"deletionRequestedAt,omitempty"`
|
||||
|
||||
|
||||
@@ -26,7 +26,14 @@ onMounted(async () => {
|
||||
const sections = computed(() => {
|
||||
const out = [{ id: "overview", label: t("sections.overview") }];
|
||||
if (isManager.value) {
|
||||
out.push({ id: "users", label: t("sections.users") }, { id: "orgs", label: t("sections.orgs") });
|
||||
out.push({ id: "users", label: t("sections.users") });
|
||||
}
|
||||
// Organizations is open to everyone: a manager sees the org(s) they manage,
|
||||
// and an org-less user gets the form that stands one up (making them its
|
||||
// admin). Only a caller with neither an org nor a manager role sees nothing
|
||||
// to do there, and they still get the create form.
|
||||
if (isManager.value || me.value) {
|
||||
out.push({ id: "orgs", label: t("sections.orgs") });
|
||||
}
|
||||
if (isSuperadmin.value) {
|
||||
out.push(
|
||||
@@ -129,9 +136,9 @@ const managementApi = [
|
||||
{ method: "PATCH", path: "/api/users/{id}", desc: "Update email / name / role / org / password" },
|
||||
{ method: "DELETE", path: "/api/users/{id}", desc: "Delete a user" },
|
||||
{ method: "GET", path: "/api/orgs", desc: "List organizations" },
|
||||
{ method: "POST", path: "/api/orgs", desc: "Create an organization (superadmin)" },
|
||||
{ method: "PATCH", path: "/api/orgs/{id}", desc: "Rename an organization (superadmin)" },
|
||||
{ method: "DELETE", path: "/api/orgs/{id}", desc: "Delete an organization (superadmin)" },
|
||||
{ method: "POST", path: "/api/orgs", desc: "Create an organization (any user without one; creator becomes admin)" },
|
||||
{ method: "PATCH", path: "/api/orgs/{id}", desc: "Rename an organization (own org; any as superadmin)" },
|
||||
{ method: "DELETE", path: "/api/orgs/{id}", desc: "Delete an organization (own org; any as superadmin)" },
|
||||
];
|
||||
|
||||
const superadminApi = [
|
||||
|
||||
@@ -1,17 +1,31 @@
|
||||
<script setup>
|
||||
import { ref, onMounted } from "vue";
|
||||
import { isSuperadmin, request } from "../api";
|
||||
import { computed, ref, onMounted } from "vue";
|
||||
import { isManager, isSuperadmin, loadMe, me, request } from "../api";
|
||||
import { t } from "../i18n";
|
||||
|
||||
// Listing is manager-scoped (an admin sees only their own org); creating,
|
||||
// renaming and deleting are superadmin-only, matching the server's gates.
|
||||
// Mirrors the server's gates: listing is manager-scoped (an admin sees only
|
||||
// their own org); a caller with no organization may create one and becomes its
|
||||
// admin; an admin may rename or delete their own org; a superadmin spans all.
|
||||
const orgs = ref([]);
|
||||
const error = ref("");
|
||||
const busy = ref(false);
|
||||
const editing = ref(null); // org id, or "new"
|
||||
const draftName = ref("");
|
||||
|
||||
const myOrg = computed(() => me.value?.organization || "");
|
||||
// A superadmin creates tenants freely; anyone else only their first one.
|
||||
const canCreate = computed(() => isSuperadmin.value || !myOrg.value);
|
||||
// An admin manages only their own org; a superadmin manages every org.
|
||||
function canManage(o) {
|
||||
return isSuperadmin.value || o.id === myOrg.value;
|
||||
}
|
||||
|
||||
async function load() {
|
||||
// Listing is manager-only; an org-less user just gets the create form.
|
||||
if (!isManager.value) {
|
||||
orgs.value = [];
|
||||
return;
|
||||
}
|
||||
try {
|
||||
const out = await request("/api/orgs");
|
||||
orgs.value = out.organizations || [];
|
||||
@@ -43,6 +57,9 @@ async function save() {
|
||||
try {
|
||||
if (editing.value === "new") {
|
||||
await request("/api/orgs", { method: "POST", body: { name: draftName.value } });
|
||||
// Creating an org as a non-superadmin makes the caller its admin, so the
|
||||
// local identity (role + organization) is now stale.
|
||||
if (!isSuperadmin.value) await loadMe();
|
||||
} else {
|
||||
await request(`/api/orgs/${editing.value}`, {
|
||||
method: "PATCH",
|
||||
@@ -59,14 +76,18 @@ async function save() {
|
||||
}
|
||||
|
||||
async function remove(o) {
|
||||
if (!confirm(t("orgs.confirmDelete", { name: o.name }))) return;
|
||||
// Deleting your own org detaches you from it and drops you back to a plain user.
|
||||
const mine = !isSuperadmin.value && o.id === myOrg.value;
|
||||
const key = mine ? "orgs.confirmDeleteOwn" : "orgs.confirmDelete";
|
||||
if (!confirm(t(key, { name: o.name }))) return;
|
||||
busy.value = true;
|
||||
error.value = "";
|
||||
try {
|
||||
await request(`/api/orgs/${o.id}`, { method: "DELETE" });
|
||||
if (mine) await loadMe(); // now org-less and demoted to user
|
||||
await load();
|
||||
} catch (e) {
|
||||
// The server refuses (409) while the org still has members.
|
||||
// The server refuses (409) while the org still has other members.
|
||||
error.value = e.message;
|
||||
} finally {
|
||||
busy.value = false;
|
||||
@@ -78,10 +99,14 @@ async function remove(o) {
|
||||
<div class="dh-card overflow-hidden">
|
||||
<div class="flex items-center justify-between border-b border-subtle px-5 py-4">
|
||||
<div>
|
||||
<div class="text-base font-bold tracking-[-0.02em] text-strong">{{ t("orgs.title") }}</div>
|
||||
<p class="mt-0.5 text-xs text-muted">{{ t("orgs.subtitle") }}</p>
|
||||
<div class="text-base font-bold tracking-[-0.02em] text-strong">
|
||||
{{ isSuperadmin ? t("orgs.title") : t("common.organization") }}
|
||||
</div>
|
||||
<p class="mt-0.5 text-xs text-muted">
|
||||
{{ isSuperadmin ? t("orgs.subtitle") : myOrg ? t("orgs.subtitleOwn") : t("orgs.subtitleNone") }}
|
||||
</p>
|
||||
</div>
|
||||
<button v-if="isSuperadmin" class="dh-btn" @click="startNew">{{ t("orgs.newOrg") }}</button>
|
||||
<button v-if="canCreate" class="dh-btn" @click="startNew">{{ t("orgs.newOrg") }}</button>
|
||||
</div>
|
||||
|
||||
<p v-if="error" class="border-b border-subtle px-5 py-3 text-xs text-danger">{{ error }}</p>
|
||||
@@ -98,7 +123,7 @@ async function remove(o) {
|
||||
</div>
|
||||
|
||||
<p v-if="!orgs.length" class="px-5 py-6 text-center text-sm text-muted">
|
||||
{{ t("orgs.empty") }}
|
||||
{{ canCreate && !isSuperadmin ? t("orgs.createHint") : t("orgs.empty") }}
|
||||
</p>
|
||||
|
||||
<table v-else class="w-full text-left text-sm">
|
||||
@@ -114,7 +139,7 @@ async function remove(o) {
|
||||
<td class="px-5 py-2.5 font-medium text-strong">{{ o.name }}</td>
|
||||
<td class="data px-5 py-2.5 text-xs text-muted">{{ o.id }}</td>
|
||||
<td class="px-5 py-2.5 text-right whitespace-nowrap">
|
||||
<template v-if="isSuperadmin">
|
||||
<template v-if="canManage(o)">
|
||||
<button class="dh-btn-ghost" @click="startEdit(o)">{{ t("common.rename") }}</button>
|
||||
<button class="dh-btn-danger ml-1.5" :disabled="busy" @click="remove(o)">
|
||||
{{ t("common.delete") }}
|
||||
|
||||
@@ -73,11 +73,15 @@
|
||||
"orgs": {
|
||||
"title": "Organisationer",
|
||||
"subtitle": "Enheder, som brugere tilhører",
|
||||
"subtitleOwn": "Din organisation",
|
||||
"subtitleNone": "Opret en for at administrere dit eget team",
|
||||
"newOrg": "Ny organisation",
|
||||
"namePlaceholder": "Acme Fleet",
|
||||
"empty": "Ingen organisationer endnu.",
|
||||
"createHint": "Du har endnu ingen organisation. Opret en for at blive dens administrator.",
|
||||
"colId": "ID",
|
||||
"confirmDelete": "Slet organisationen \"{name}\"?"
|
||||
"confirmDelete": "Slet organisationen \"{name}\"?",
|
||||
"confirmDeleteOwn": "Slet din organisation „{name}“? Du fjernes fra den og bliver en almindelig bruger."
|
||||
},
|
||||
|
||||
"pocketbase": {
|
||||
|
||||
@@ -73,11 +73,15 @@
|
||||
"orgs": {
|
||||
"title": "Organizations",
|
||||
"subtitle": "Tenants users belong to",
|
||||
"subtitleOwn": "Your organization",
|
||||
"subtitleNone": "Create one to manage your own team",
|
||||
"newOrg": "New organization",
|
||||
"namePlaceholder": "Acme Fleet",
|
||||
"empty": "No organizations yet.",
|
||||
"createHint": "You have no organization yet. Create one to become its admin.",
|
||||
"colId": "ID",
|
||||
"confirmDelete": "Delete the organization \"{name}\"?"
|
||||
"confirmDelete": "Delete the organization \"{name}\"?",
|
||||
"confirmDeleteOwn": "Delete your organization \"{name}\"? You will be removed from it and become a regular user."
|
||||
},
|
||||
|
||||
"pocketbase": {
|
||||
|
||||
@@ -73,11 +73,15 @@
|
||||
"orgs": {
|
||||
"title": "Organizacje",
|
||||
"subtitle": "Podmioty, do których należą użytkownicy",
|
||||
"subtitleOwn": "Twoja organizacja",
|
||||
"subtitleNone": "Utwórz ją, aby zarządzać własnym zespołem",
|
||||
"newOrg": "Nowa organizacja",
|
||||
"namePlaceholder": "Acme Fleet",
|
||||
"empty": "Brak organizacji.",
|
||||
"createHint": "Nie masz jeszcze organizacji. Utwórz ją, aby zostać jej administratorem.",
|
||||
"colId": "ID",
|
||||
"confirmDelete": "Usunąć organizację „{name}”?"
|
||||
"confirmDelete": "Usunąć organizację „{name}”?",
|
||||
"confirmDeleteOwn": "Usunąć Twoją organizację „{name}”? Zostaniesz z niej usunięty i staniesz się zwykłym użytkownikiem."
|
||||
},
|
||||
|
||||
"pocketbase": {
|
||||
|
||||
Reference in New Issue
Block a user