feat(rbac): RBAC-Audit abschliessen — Viewer-Sperre für alle verbleibenden Seiten (1.1.93)

Domains, Backends (inkl. ServerPanel), Backups/History und Alerts: isViewer-Check + disabled Switches, Tooltip-wrapped Add-Buttons, bedingte Delete/Restore-Render (Viewer → disabled Tooltip statt Popconfirm). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-24 16:39:24 +02:00
parent d3a3b93c1b
commit 0856c2fc10
8 changed files with 132 additions and 90 deletions
--- a/2
+++ b/2
@@ -1 +1 @@
-1.1.92
+1.1.93
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )

-var version = "1.1.92"
+var version = "1.1.93"

 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )

-var version = "1.1.92"
+var version = "1.1.93"

 const usage = `edgeguard-ctl — EdgeGuard CLI

--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -35,7 +35,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )

-var version = "1.1.92"
+var version = "1.1.93"

 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
--- a/management-ui/src/pages/Alerts/index.tsx
+++ b/management-ui/src/pages/Alerts/index.tsx
@@ -13,6 +13,7 @@ import dayjs from 'dayjs'
 import apiClient, { isEnvelope } from '../../api/client'
 import PageHeader from '../../components/PageHeader'
 import EmptyState from '../../components/EmptyState'
+import { useAuthStore } from '../../stores/auth'

 const { Text } = Typography

@@ -66,6 +67,7 @@ function sevTag(s: AlertEvent['severity']) {
 export default function AlertsPage() {
  const { t } = useTranslation()
  const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'

  const channels = useQuery({
    queryKey: ['alerts', 'channels'],
@@ -172,6 +174,7 @@ export default function AlertsPage() {
        <Switch
          size="small"
          checked={v}
+          disabled={isViewer}
          loading={quickToggle.isPending && quickToggle.variables?.id === r.id}
          onChange={(checked) => quickToggle.mutate({ id: r.id, row: r, checked })}
        />
@@ -181,23 +184,29 @@ export default function AlertsPage() {
      title: t('common.actions'), key: 'a', width: 180,
      render: (_, r) => (
        <Space size={4}>
-          <Button size="small" onClick={() => {
-            setEdit(r)
-            const settings = (r.settings ?? {}) as Record<string, unknown>
-            form.setFieldsValue({
-              name: r.name, kind: r.kind, target: r.target, active: r.active,
-              smtp_host: settings.smtp_host as string,
-              smtp_port: settings.smtp_port as number,
-              username:  settings.username as string,
-              password:  settings.password as string,
-              from:      settings.from as string,
-              use_tls:   settings.use_tls as boolean,
-            })
-          }}>{t('common.edit')}</Button>
-          <Popconfirm title={t('alerts.confirmDelete', { name: r.name })}
-            onConfirm={() => del.mutate(r.id)}>
-            <Button size="small" danger>{t('common.delete')}</Button>
-          </Popconfirm>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button size="small" disabled={isViewer} onClick={() => {
+              if (isViewer) return
+              setEdit(r)
+              const settings = (r.settings ?? {}) as Record<string, unknown>
+              form.setFieldsValue({
+                name: r.name, kind: r.kind, target: r.target, active: r.active,
+                smtp_host: settings.smtp_host as string,
+                smtp_port: settings.smtp_port as number,
+                username:  settings.username as string,
+                password:  settings.password as string,
+                from:      settings.from as string,
+                use_tls:   settings.use_tls as boolean,
+              })
+            }}>{t('common.edit')}</Button>
+          </Tooltip>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm title={t('alerts.confirmDelete', { name: r.name })}
+                onConfirm={() => del.mutate(r.id)}>
+                <Button size="small" danger>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
        </Space>
      ),
    },
@@ -284,10 +293,12 @@ export default function AlertsPage() {
          label: t('alerts.tabs.channels'),
          children: (
            <Card size="small" extra={
-              <Button type="primary" size="small" icon={<PlusOutlined />}
-                onClick={openChannelCreate}>
-                {t('alerts.add')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" size="small" icon={<PlusOutlined />}
+                  onClick={openChannelCreate} disabled={isViewer}>
+                  {t('alerts.add')}
+                </Button>
+              </Tooltip>
            }>
              <Table size="small" rowKey="id" loading={channels.isFetching}
                dataSource={channels.data ?? []} columns={chanColumns}
@@ -298,9 +309,11 @@ export default function AlertsPage() {
                    title={t('alerts.emptyChannelsTitle')}
                    description={t('alerts.emptyChannelsDesc')}
                    action={
-                      <Button type="primary" icon={<PlusOutlined />} onClick={openChannelCreate}>
-                        {t('alerts.add')}
-                      </Button>
+                      <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                        <Button type="primary" icon={<PlusOutlined />} onClick={openChannelCreate} disabled={isViewer}>
+                          {t('alerts.add')}
+                        </Button>
+                      </Tooltip>
                    }
                  />
                ) }} />
--- a/management-ui/src/pages/Backends/index.tsx
+++ b/management-ui/src/pages/Backends/index.tsx
@@ -14,6 +14,7 @@ import PageHeader from '../../components/PageHeader'
 import ActionButtons from '../../components/ActionButtons'

 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'

 const { Text } = Typography

@@ -119,6 +120,7 @@ export default function BackendsPage() {
  const { t } = useTranslation()
  const navigate = useNavigate()
  const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'

  const { data, isLoading } = useQuery({ queryKey: ['backends'], queryFn: listBackends })
  const { data: domains } = useQuery({ queryKey: ['domains'], queryFn: listDomains })
@@ -286,6 +288,7 @@ export default function BackendsPage() {
        <Switch
          size="small"
          checked={v}
+          disabled={isViewer}
          loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
          onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
        />
@@ -336,9 +339,11 @@ export default function BackendsPage() {
          rowExpandable: (record) => !!record.id,
        }}
        extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            {t('backends.addBackend')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+              {t('backends.addBackend')}
+            </Button>
+          </Tooltip>
        }
        emptyContent={
          <EmptyState
@@ -346,9 +351,11 @@ export default function BackendsPage() {
            title={t('backends.emptyTitle')}
            description={t('backends.emptyDesc')}
            action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-                {t('backends.addBackend')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+                  {t('backends.addBackend')}
+                </Button>
+              </Tooltip>
            }
          />
        }
@@ -396,6 +403,7 @@ export default function BackendsPage() {
 function ServerPanel({ backendID }: { backendID: number }) {
  const { t } = useTranslation()
  const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
  const [open, setOpen] = useState(false)
  const [editing, setEditing] = useState<BackendServer | null>(null)
  const [form] = Form.useForm<ServerFormValues>()
@@ -462,6 +470,7 @@ function ServerPanel({ backendID }: { backendID: number }) {
        <Switch
          size="small"
          checked={v}
+          disabled={isViewer}
          loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
          onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
        />
@@ -471,17 +480,23 @@ function ServerPanel({ backendID }: { backendID: number }) {
      title: t('common.actions'), key: 'a', width: 160,
      render: (_, r) => (
        <Space size={4}>
-          <Button size="small" onClick={() => {
-            setEditing(r)
-            form.setFieldsValue({
-              name: r.name, address: r.address, port: r.port,
-              weight: r.weight, backup: r.backup, active: r.active,
-            })
-          }}>{t('common.edit')}</Button>
-          <Popconfirm title={t('backends.server.deleteConfirm', { name: r.name })}
-            onConfirm={() => del.mutate(r.id)}>
-            <Button size="small" danger>{t('common.delete')}</Button>
-          </Popconfirm>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button size="small" disabled={isViewer} onClick={() => {
+              if (isViewer) return
+              setEditing(r)
+              form.setFieldsValue({
+                name: r.name, address: r.address, port: r.port,
+                weight: r.weight, backup: r.backup, active: r.active,
+              })
+            }}>{t('common.edit')}</Button>
+          </Tooltip>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm title={t('backends.server.deleteConfirm', { name: r.name })}
+                onConfirm={() => del.mutate(r.id)}>
+                <Button size="small" danger>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
        </Space>
      ),
    },
@@ -491,13 +506,15 @@ function ServerPanel({ backendID }: { backendID: number }) {
    <div>
      <div className="mb-8" style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
        <Text type="secondary">{t('backends.server.intro')}</Text>
-        <Button size="small" type="primary" icon={<PlusOutlined />} onClick={() => {
-          setOpen(true)
-          form.resetFields()
-          form.setFieldsValue({ weight: 100, backup: false, active: true, port: 8080 })
-        }}>
-          {t('backends.server.add')}
-        </Button>
+        <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+          <Button size="small" type="primary" icon={<PlusOutlined />} disabled={isViewer} onClick={() => {
+            setOpen(true)
+            form.resetFields()
+            form.setFieldsValue({ weight: 100, backup: false, active: true, port: 8080 })
+          }}>
+            {t('backends.server.add')}
+          </Button>
+        </Tooltip>
      </div>
      <Table
        size="small"
--- a/management-ui/src/pages/Backups/History.tsx
+++ b/management-ui/src/pages/Backups/History.tsx
@@ -16,6 +16,7 @@ import { useTranslation } from 'react-i18next'
 import dayjs from 'dayjs'

 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'

 const { Text } = Typography

@@ -51,6 +52,7 @@ function fmtDuration(start: string, end: string): string {
 export default function HistoryTab() {
  const { t } = useTranslation()
  const qc = useQueryClient()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
  const [msg, msgCtx] = message.useMessage()

  const list = useQuery({
@@ -223,30 +225,30 @@ export default function HistoryTab() {
              disabled={row.status !== 'success'}
            >{t('backups.download')}</Button>
          </Tooltip>
-          <Popconfirm
-            title={t('backups.confirmRestoreTitle')}
-            description={t('backups.confirmRestoreDesc', { file: row.file })}
-            okText={t('backups.restoreOk')}
-            okButtonProps={{ danger: true }}
-            cancelText={t('common.cancel')}
-            onConfirm={() => startRestore(row)}
-            disabled={row.status !== 'success'}
-          >
-            <Button
-              size="small"
-              icon={<UndoOutlined />}
-              disabled={row.status !== 'success'}
-            >{t('backups.restore')}</Button>
-          </Popconfirm>
-          <Popconfirm
-            title={t('backups.confirmDelete', { file: row.file })}
-            onConfirm={() => del.mutate(row.id)}
-            okButtonProps={{ danger: true }}
-          >
-            <Button size="small" danger icon={<DeleteOutlined />} loading={busyDelete === row.id}>
-              {t('common.delete')}
-            </Button>
-          </Popconfirm>
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" icon={<UndoOutlined />} disabled>{t('backups.restore')}</Button></Tooltip>
+            : <Popconfirm
+                title={t('backups.confirmRestoreTitle')}
+                description={t('backups.confirmRestoreDesc', { file: row.file })}
+                okText={t('backups.restoreOk')}
+                okButtonProps={{ danger: true }}
+                cancelText={t('common.cancel')}
+                onConfirm={() => startRestore(row)}
+                disabled={row.status !== 'success'}
+              >
+                <Button size="small" icon={<UndoOutlined />} disabled={row.status !== 'success'}>{t('backups.restore')}</Button>
+              </Popconfirm>
+          }
+          {isViewer
+            ? <Tooltip title={t('auth.viewerBadge')}><Button size="small" danger icon={<DeleteOutlined />} disabled>{t('common.delete')}</Button></Tooltip>
+            : <Popconfirm
+                title={t('backups.confirmDelete', { file: row.file })}
+                onConfirm={() => del.mutate(row.id)}
+                okButtonProps={{ danger: true }}
+              >
+                <Button size="small" danger icon={<DeleteOutlined />} loading={busyDelete === row.id}>{t('common.delete')}</Button>
+              </Popconfirm>
+          }
        </Space>
      ),
    },
@@ -320,14 +322,17 @@ export default function HistoryTab() {
            {t('common.refresh')}
          </Button>
        </Tooltip>
-        <Button
-          type="primary"
-          icon={<CloudUploadOutlined />}
-          loading={trigger.isPending}
-          onClick={() => trigger.mutate()}
-        >
-          {t('backups.runNow')}
-        </Button>
+        <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+          <Button
+            type="primary"
+            icon={<CloudUploadOutlined />}
+            loading={trigger.isPending}
+            disabled={isViewer}
+            onClick={() => trigger.mutate()}
+          >
+            {t('backups.runNow')}
+          </Button>
+        </Tooltip>
      </Space>

      <Card className="mb-16">
--- a/management-ui/src/pages/Domains/index.tsx
+++ b/management-ui/src/pages/Domains/index.tsx
@@ -12,6 +12,7 @@ import ActionButtons from '../../components/ActionButtons'
 import StatusDot from '../../components/StatusDot'

 import apiClient, { isEnvelope } from '../../api/client'
+import { useAuthStore } from '../../stores/auth'

 interface Domain {
  id: number
@@ -95,6 +96,7 @@ export default function DomainsPage() {
  const { t } = useTranslation()
  const qc = useQueryClient()
  const navigate = useNavigate()
+  const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'

  const { data, isLoading } = useQuery({
    queryKey: ['domains'],
@@ -234,6 +236,7 @@ export default function DomainsPage() {
        <Switch
          size="small"
          checked={v}
+          disabled={isViewer}
          loading={quickToggle.isPending && quickToggle.variables?.id === row.id}
          onChange={(checked) => quickToggle.mutate({ id: row.id, row, checked })}
        />
@@ -322,9 +325,11 @@ export default function DomainsPage() {
        dataSource={data ?? []}
        columns={columns}
        extraActions={
-          <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-            {t('domains.addDomain')}
-          </Button>
+          <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+            <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+              {t('domains.addDomain')}
+            </Button>
+          </Tooltip>
        }
        emptyContent={
          <EmptyState
@@ -332,9 +337,11 @@ export default function DomainsPage() {
            title={t('domains.emptyTitle')}
            description={t('domains.emptyDesc')}
            action={
-              <Button type="primary" icon={<PlusOutlined />} onClick={openCreate}>
-                {t('domains.addDomain')}
-              </Button>
+              <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
+                <Button type="primary" icon={<PlusOutlined />} onClick={openCreate} disabled={isViewer}>
+                  {t('domains.addDomain')}
+                </Button>
+              </Tooltip>
            }
          />
        }
@@ -1 +1 @@
 .1.92
 .1.93