tajniak81andClaude Opus 4.8
ae6ed4ac1e
Mirror PilotVault's API Server layout and add the superadmin console,
plugin system, runtime PocketBase settings, and user/organization
management. The car domain (cars, service records, parts, sharing) is
carried over unchanged apart from the auth switch.
Layout: main.go -> cmd/server/main.go; module carcontrol/api ->
drivervault/apiserver. internal/api is split by concern (auth, users,
orgs, settings, plugins, status, health, respond).
Auth: replace the server-minted HS256 JWT and the sessions collection
with a PocketBase token proxy. /api/auth/login relays PocketBase's
{token, record}, and every protected request re-resolves that token
against PocketBase, so a role change or deletion takes effect at once
instead of waiting out a token. AUTH_SECRET is obsolete and internal/auth
is gone. Per-device session listing/revocation goes with it: PocketBase
tokens are stateless. Changing a password rotates the user's token key,
which invalidates every token already issued.
Roles: add superadmin alongside user/admin, plus an organizations
collection and users.organization. Admins are scoped to their own
organization; superadmins span all of them. Guards prevent changing your
own role, deleting your own account, an admin touching a superadmin, and
deleting an organization that still has members.
Plugins: new internal/plugins package with one contract over two kinds --
builtin (compiled in) and external (any HTTP service, registered at
runtime with no rebuild). State persists to plugins.json; secrets are
masked on read and preserved when saved back at the mask.
PocketBase settings: /api/admin/pb-config applies a new connection at
runtime and persists it to .env. It deliberately does not require a
working service account, so a wrong or unreachable connection can still
be fixed from the panel.
Panel: rebuilt as the superadmin console -- login gate, status, users,
organizations, PocketBase, plugins, and the endpoint reference.
Clients: update the Web App and Phone App for the PocketBase token shape,
the move of user management to /api/users ({users}/{user} envelopes, with
password resets folded into PATCH), and the removal of sessions. Both now
mirror the server's real guards rather than the old last-admin rule, and
parse PocketBase's field-level error shape.
Config: modern POCKETBASE_*/API_ADDR names with legacy PB_*/PORT
fallbacks, so existing .env files keep working. Also fixes /api/status
probing the Web App on 8090 instead of DriverVault's 5173.
Run scripts/setup-pocketbase.mjs to add the organizations collection and
grow users.role; every client must log in once more.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
73 lines
2.6 KiB
JavaScript
73 lines
2.6 KiB
JavaScript
// Set a user's access role ("user", "admin" or "superadmin") by email.
|
|
//
|
|
// This is the bootstrap path for the first superadmin: the panel's management
|
|
// screens require one, and only a superadmin can promote another, so the very
|
|
// first one has to be minted here.
|
|
//
|
|
// Usage (PowerShell):
|
|
// $env:POCKETBASE_URL="http://10.2.1.10:8027"
|
|
// $env:POCKETBASE_ADMIN_EMAIL="admin@drivervault.local"
|
|
// $env:POCKETBASE_ADMIN_PASSWORD="..."
|
|
// node scripts/set-role.mjs <email> <user|admin|superadmin>
|
|
|
|
const ROLES = ["user", "admin", "superadmin"];
|
|
|
|
const PB_URL = (process.env.POCKETBASE_URL || process.env.PB_URL || "http://10.2.1.10:8027").replace(
|
|
/\/+$/,
|
|
"",
|
|
);
|
|
const ADMIN_EMAIL = process.env.POCKETBASE_ADMIN_EMAIL || process.env.PB_ADMIN_EMAIL;
|
|
const ADMIN_PASSWORD = process.env.POCKETBASE_ADMIN_PASSWORD || process.env.PB_ADMIN_PASSWORD;
|
|
|
|
const [, , email, role] = process.argv;
|
|
|
|
if (!ADMIN_EMAIL || !ADMIN_PASSWORD) {
|
|
console.error("Set POCKETBASE_ADMIN_EMAIL and POCKETBASE_ADMIN_PASSWORD.");
|
|
process.exit(1);
|
|
}
|
|
if (!email || !role || !ROLES.includes(role)) {
|
|
console.error(`Usage: node scripts/set-role.mjs <email> <${ROLES.join("|")}>`);
|
|
process.exit(1);
|
|
}
|
|
|
|
async function authenticate() {
|
|
for (const ep of [
|
|
"/api/collections/_superusers/auth-with-password",
|
|
"/api/admins/auth-with-password",
|
|
]) {
|
|
const res = await fetch(PB_URL + ep, {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({ identity: ADMIN_EMAIL, password: ADMIN_PASSWORD }),
|
|
});
|
|
if (res.ok) return (await res.json()).token;
|
|
}
|
|
throw new Error("Admin authentication failed.");
|
|
}
|
|
|
|
async function main() {
|
|
console.log(`Connecting to ${PB_URL} ...`);
|
|
const token = await authenticate();
|
|
|
|
const q = new URLSearchParams({ filter: `email='${email.replace(/'/g, "")}'`, perPage: "1" });
|
|
const res = await fetch(`${PB_URL}/api/collections/users/records?${q}`, {
|
|
headers: { Authorization: token },
|
|
});
|
|
if (!res.ok) throw new Error(`lookup failed: ${res.status} ${await res.text()}`);
|
|
const items = (await res.json()).items || [];
|
|
if (items.length === 0) throw new Error(`no user with email ${email}`);
|
|
|
|
const upd = await fetch(`${PB_URL}/api/collections/users/records/${items[0].id}`, {
|
|
method: "PATCH",
|
|
headers: { "Content-Type": "application/json", Authorization: token },
|
|
body: JSON.stringify({ role }),
|
|
});
|
|
if (!upd.ok) throw new Error(`update failed: ${upd.status} ${await upd.text()}`);
|
|
console.log(`✓ ${email} role set to "${role}"`);
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error("\nFailed:", err.message);
|
|
process.exit(1);
|
|
});
|