CPM can now act as its own forward auth provider for proxied sites. Users authenticate at a login portal (credentials or OAuth) and Caddy gates access via a verify subrequest, eliminating the need for external IdPs like Authentik. Key components: - Forward auth flow: verify endpoint, exchange code callback, login portal - User groups with membership management - Per-proxy-host access control (users and/or groups) - Caddy config generation for forward_auth handler + callback route - OAuth and credential login on the portal page - Admin UI: groups page, inline user/group assignment in proxy host form - REST API: /api/v1/groups, /api/v1/forward-auth-sessions, per-host access - Integration tests for groups and forward auth schema Also fixes mTLS E2E test selectors broken by the RBAC refactor. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
64 lines
1.6 KiB
TypeScript
64 lines
1.6 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { requireAdmin } from "@/src/lib/auth";
|
|
import {
|
|
createGroup,
|
|
updateGroup,
|
|
deleteGroup,
|
|
addGroupMember,
|
|
removeGroupMember
|
|
} from "@/src/lib/models/groups";
|
|
|
|
export async function createGroupAction(formData: FormData) {
|
|
const session = await requireAdmin();
|
|
const userId = Number(session.user.id);
|
|
|
|
await createGroup(
|
|
{
|
|
name: String(formData.get("name") ?? ""),
|
|
description: formData.get("description") ? String(formData.get("description")) : null,
|
|
},
|
|
userId
|
|
);
|
|
|
|
revalidatePath("/groups");
|
|
}
|
|
|
|
export async function updateGroupAction(id: number, formData: FormData) {
|
|
const session = await requireAdmin();
|
|
const userId = Number(session.user.id);
|
|
|
|
await updateGroup(
|
|
id,
|
|
{
|
|
name: String(formData.get("name") ?? ""),
|
|
description: formData.get("description") ? String(formData.get("description")) : null,
|
|
},
|
|
userId
|
|
);
|
|
|
|
revalidatePath("/groups");
|
|
}
|
|
|
|
export async function deleteGroupAction(id: number) {
|
|
const session = await requireAdmin();
|
|
const userId = Number(session.user.id);
|
|
await deleteGroup(id, userId);
|
|
revalidatePath("/groups");
|
|
}
|
|
|
|
export async function addGroupMemberAction(groupId: number, memberId: number) {
|
|
const session = await requireAdmin();
|
|
const userId = Number(session.user.id);
|
|
await addGroupMember(groupId, memberId, userId);
|
|
revalidatePath("/groups");
|
|
}
|
|
|
|
export async function removeGroupMemberAction(groupId: number, memberId: number) {
|
|
const session = await requireAdmin();
|
|
const userId = Number(session.user.id);
|
|
await removeGroupMember(groupId, memberId, userId);
|
|
revalidatePath("/groups");
|
|
}
|