thomasandClaude
e0733666ae
- sessions.impersonator_id: Admin-Session behält Token, schaltet user_id aufs Ziel, Admin bleibt in impersonator_id gespeichert (Stack, keine Verschachtelung). uid()/Config/Dateien laufen als Ziel-Nutzer. - Admin sieht in /admin pro Nutzer "Anmelden als"; Bestätigungsdialog. - Dauerhaftes amber Banner im Header mit "Zurück zum Admin" (POST, kein JS nötig) erscheint auf jeder Seite während Impersonation. - requireAdmin verweigert während Impersonation -> keine Admin-Aktionen als fremder Nutzer; Stop-Route prüft impersonator_id (kein Escalation-Pfad für Normalnutzer). Selbst-Imitation blockiert. - audit_log-Tabelle protokolliert Start/Stop persistent; Admin-Seite zeigt Audit-Liste (/admin/audit/impersonations). - Migration: idempotentes ALTER ADD COLUMN impersonator_id fuer Bestand. Co-Authored-By: Claude <noreply@anthropic.com>
172 lines
12 KiB
Plaintext
172 lines
12 KiB
Plaintext
<!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<%- include('partials/head') %>
|
|
</head>
|
|
<body class="min-h-screen flex flex-col transition-colors duration-300 bg-gray-50 dark:bg-gray-900 text-gray-900 dark:text-gray-100" id="body">
|
|
<%- include('partials/header') %>
|
|
|
|
<main class="flex-1 container mx-auto px-4 py-8 max-w-4xl">
|
|
<a href="/" class="inline-flex items-center gap-2 text-sm text-blue-600 dark:text-blue-400 hover:underline mb-6">
|
|
<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
|
|
<path stroke-linecap="round" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 19l-7-7m0 0l7-7m-7 7h18"></path>
|
|
</svg>
|
|
Zurück zur Übersicht
|
|
</a>
|
|
|
|
<h2 class="text-2xl font-bold mb-1">Benutzerverwaltung</h2>
|
|
<p class="text-sm text-gray-500 dark:text-gray-400 mb-6">Benutzer anlegen, Passwörter zurücksetzen und Benutzer inkl. aller ihrer Daten löschen.</p>
|
|
|
|
<!-- Neuen Benutzer anlegen -->
|
|
<div class="bg-white dark:bg-gray-800 rounded-lg shadow-md p-6 mb-8">
|
|
<h3 class="text-lg font-semibold mb-4">Neuen Benutzer anlegen</h3>
|
|
<form method="POST" action="/admin/users" class="grid sm:grid-cols-3 gap-4 items-end">
|
|
<div>
|
|
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1" for="newUsername">Benutzername</label>
|
|
<input id="newUsername" name="username" type="text" required maxlength="64"
|
|
class="w-full rounded-lg border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 px-3 py-2 text-gray-800 dark:text-white focus:ring-2 focus:ring-blue-500 focus:border-transparent outline-none" />
|
|
</div>
|
|
<div>
|
|
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1" for="newPassword">Passwort</label>
|
|
<input id="newPassword" name="password" type="password" required
|
|
class="w-full rounded-lg border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 px-3 py-2 text-gray-800 dark:text-white focus:ring-2 focus:ring-blue-500 focus:border-transparent outline-none" />
|
|
</div>
|
|
<div class="flex items-end gap-4">
|
|
<label class="inline-flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300">
|
|
<input type="checkbox" name="is_admin" value="1" class="rounded border-gray-300 dark:border-gray-600" />
|
|
Admin
|
|
</label>
|
|
<button type="submit" class="rounded-lg bg-blue-600 hover:bg-blue-700 transition-colors text-white font-medium px-4 py-2">
|
|
Anlegen
|
|
</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
|
|
<!-- Bestehende Benutzer -->
|
|
<div class="bg-white dark:bg-gray-800 rounded-lg shadow-md p-6">
|
|
<h3 class="text-lg font-semibold mb-4">Bestehende Benutzer</h3>
|
|
<div class="overflow-x-auto">
|
|
<table class="w-full text-sm">
|
|
<thead>
|
|
<tr class="text-left text-gray-500 dark:text-gray-400 border-b border-gray-200 dark:border-gray-700">
|
|
<th class="py-2 pr-4 font-medium">Benutzername</th>
|
|
<th class="py-2 pr-4 font-medium">Rolle</th>
|
|
<th class="py-2 pr-4 font-medium">Bewerbungen</th>
|
|
<th class="py-2 pr-4 font-medium">Erstellt</th>
|
|
<th class="py-2 pr-4 font-medium text-right">Aktionen</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody class="divide-y divide-gray-100 dark:divide-gray-700">
|
|
<% users.forEach(function(u) { %>
|
|
<tr>
|
|
<td class="py-3 pr-4 font-medium text-gray-800 dark:text-gray-100">
|
|
<%= u.username %>
|
|
<% if (u.id === currentUserId) { %><span class="text-xs text-gray-400">(du)</span><% } %>
|
|
</td>
|
|
<td class="py-3 pr-4">
|
|
<% if (u.is_admin) { %>
|
|
<span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300">Admin</span>
|
|
<% } else { %>
|
|
<span class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300">Benutzer</span>
|
|
<% } %>
|
|
</td>
|
|
<td class="py-3 pr-4 text-gray-600 dark:text-gray-300"><%= u.anzahl_bewerbungen %></td>
|
|
<td class="py-3 pr-4 text-gray-500 dark:text-gray-400"><%= u.created_at %></td>
|
|
<td class="py-3 pr-4 text-right whitespace-nowrap">
|
|
<a href="/jobsuche?user=<%= u.id %>"
|
|
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3"
|
|
title="Suchprofil und Zeitplan dieses Benutzers verwalten">Jobsuche</a>
|
|
<% if (u.id !== currentUserId) { %>
|
|
<form method="POST" action="/admin/users/<%= u.id %>/impersonate" class="inline"
|
|
onsubmit="return confirm('Als „<%= u.username %>“ anmelden? Du siehst dann dessen Konto. Admin-Rechte sind dabei pausiert; über das Banner oben kannst du zurückwechseln.');">
|
|
<button type="submit" class="text-sm text-emerald-600 dark:text-emerald-400 hover:underline mr-3"
|
|
title="Dieses Konto übernehmen (Impersonation)">Anmelden als</button>
|
|
</form>
|
|
<% } %>
|
|
<button type="button"
|
|
onclick="document.getElementById('resetForm<%= u.id %>').classList.toggle('hidden')"
|
|
class="text-sm text-blue-600 dark:text-blue-400 hover:underline mr-3">
|
|
Passwort
|
|
</button>
|
|
<% if (u.id !== currentUserId) { %>
|
|
<form method="POST" action="/admin/users/<%= u.id %>/delete" class="inline"
|
|
onsubmit="return confirm('Benutzer „<%= u.username %>“ inkl. aller Daten wirklich löschen? Das lässt sich nicht rückgängig machen.');">
|
|
<button type="submit" class="text-sm text-red-600 dark:text-red-400 hover:underline">Löschen</button>
|
|
</form>
|
|
<% } %>
|
|
</td>
|
|
</tr>
|
|
<tr id="resetForm<%= u.id %>" class="hidden">
|
|
<td colspan="5" class="py-3 pr-4">
|
|
<form method="POST" action="/admin/users/<%= u.id %>/reset-password" class="flex items-end gap-3 flex-wrap">
|
|
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300">
|
|
Neues Passwort
|
|
<input name="password" type="password" required
|
|
class="mt-1 block w-full sm:w-64 rounded-lg border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 px-3 py-2 text-gray-800 dark:text-white focus:ring-2 focus:ring-blue-500 focus:border-transparent outline-none" />
|
|
</label>
|
|
<button type="submit" class="rounded-lg bg-blue-600 hover:bg-blue-700 transition-colors text-white font-medium px-4 py-2">
|
|
Speichern (alle Sessions ungültigen)
|
|
</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
<% }); %>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Impersonations-Audit: wer hat als wen gehandelt, wann -->
|
|
<div class="bg-white dark:bg-gray-800 rounded-lg shadow-md p-6 mt-8">
|
|
<h3 class="text-lg font-semibold mb-1">Impersonationen (Audit)</h3>
|
|
<p class="text-sm text-gray-500 dark:text-gray-400 mb-4">Nachvollziehbar protokolliert: jeder Wechsel auf ein anderes Konto und jeder Rückwechsel.</p>
|
|
<div class="overflow-x-auto">
|
|
<table class="w-full text-sm">
|
|
<thead>
|
|
<tr class="text-left text-gray-500 dark:text-gray-400 border-b border-gray-200 dark:border-gray-700">
|
|
<th class="py-2 pr-4 font-medium">Admin</th>
|
|
<th class="py-2 pr-4 font-medium">Aktion</th>
|
|
<th class="py-2 pr-4 font-medium">Zeit</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody id="auditBody" class="divide-y divide-gray-100 dark:divide-gray-700">
|
|
<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">… wird geladen</td></tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
</main>
|
|
|
|
<script>
|
|
(function () {
|
|
function esc(s) { var d = document.createElement('div'); d.textContent = s == null ? '' : String(s); return d.innerHTML; }
|
|
fetch('/admin/audit/impersonations', { cache: 'no-store' })
|
|
.then(function (r) { return r.json(); })
|
|
.then(function (d) {
|
|
var body = document.getElementById('auditBody');
|
|
var items = (d && d.items) || [];
|
|
if (!items.length) {
|
|
body.innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Keine Impersonationen protokolliert.</td></tr>';
|
|
return;
|
|
}
|
|
body.innerHTML = items.map(function (it) {
|
|
var isStop = /stop/.test(it.action);
|
|
var badge = isStop
|
|
? '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300">Rückwechsel</span>'
|
|
: '<span class="inline-flex px-2 py-0.5 rounded-full text-xs font-medium bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-300">Anmeldung als</span>';
|
|
var ziel = isStop ? '' : ' <span class="text-gray-700 dark:text-gray-300">' + esc(it.action.replace(/^impersonate_start\s*→\s*/, '')) + '</span>';
|
|
return '<tr>'
|
|
+ '<td class="py-2 pr-4 font-medium text-gray-800 dark:text-gray-100">' + esc(it.actor || '?') + '</td>'
|
|
+ '<td class="py-2 pr-4">' + badge + ziel + '</td>'
|
|
+ '<td class="py-2 pr-4 text-gray-500 dark:text-gray-400">' + esc(it.created_at) + '</td>'
|
|
+ '</tr>';
|
|
}).join('');
|
|
})
|
|
.catch(function () {
|
|
document.getElementById('auditBody').innerHTML = '<tr><td colspan="3" class="py-4 text-gray-400 dark:text-gray-500">Audit konnte nicht geladen werden.</td></tr>';
|
|
});
|
|
})();
|
|
</script>
|
|
</body>
|
|
</html> |