projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(rbac): Viewer-Rolle in Settings + Cluster — operative Buttons sperren

Browse Source 
Settings: HAProxy-Reload, Render-Configs, Backup-Now, Service-Restart,
E-Mail-Save, Maintenance-Toggle, Backup-/Audit-Retention, Auto-Update-
und IPv6-Toggle disabled für Viewer (Passwort-Änderung bleibt aktiv).
Cluster: Join-Token-Generation, Peer-Removal, mTLS-Cert-Renew disabled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-24 13:14:51 +02:00
parent 2d027b3044
commit 8b0e8a8ab4
6 changed files with 109 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.1.89 1.1.90

2
cmd/edgeguard-api/main.go
View File

@@ -60,7 +60,7 @@ import (
usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users" usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
) )
var version = "1.1.89" var version = "1.1.90"
func main() { func main() {
addr := os.Getenv("EDGEGUARD_API_ADDR") addr := os.Getenv("EDGEGUARD_API_ADDR")

2
cmd/edgeguard-ctl/main.go
View File

@@ -11,7 +11,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup" "git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
) )
var version = "1.1.89" var version = "1.1.90"
const usage = `edgeguard-ctl — EdgeGuard CLI const usage = `edgeguard-ctl — EdgeGuard CLI

2
cmd/edgeguard-scheduler/main.go
View File

@@ -35,7 +35,7 @@ import (
"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts" "git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
) )
var version = "1.1.89" var version = "1.1.90"
const ( const (
// renewTickInterval — how often we re-evaluate expiring certs. // renewTickInterval — how often we re-evaluate expiring certs.

83
management-ui/src/pages/Cluster/index.tsx
View File

@@ -7,6 +7,7 @@ import { useTranslation } from 'react-i18next'
import apiClient, { isEnvelope } from '../../api/client' import apiClient, { isEnvelope } from '../../api/client'
import PageHeader from '../../components/PageHeader' import PageHeader from '../../components/PageHeader'
import { useAuthStore } from '../../stores/auth'
const { Text } = Typography const { Text } = Typography
@@ -116,6 +117,7 @@ function useTickingNow(intervalMs = 1000): number {
export default function ClusterPage() { export default function ClusterPage() {
const { t } = useTranslation() const { t } = useTranslation()
const now = useTickingNow() const now = useTickingNow()
const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
const { data, isLoading } = useQuery({ const { data, isLoading } = useQuery({
queryKey: ['cluster', 'status'], queryKey: ['cluster', 'status'],
@@ -246,22 +248,30 @@ export default function ClusterPage() {
{ {
title: t('common.actions'), key: 'actions', width: 110, title: t('common.actions'), key: 'actions', width: 110,
render: (_, r) => ( render: (_, r) => (
<Popconfirm isViewer ? (
title={t('cluster.removePeerConfirmTitle')} <Tooltip title={t('auth.viewerBadge')}>
description={t('cluster.removePeerConfirmDesc', { fqdn: r.fqdn })} <Button type="text" size="small" danger icon={<DeleteOutlined />} disabled>
okText={t('common.yes')} {t('cluster.removePeerBtn')}
cancelText={t('common.no')} </Button>
okButtonProps={{ danger: true }} </Tooltip>
onConfirm={() => removePeer.mutate(r.id)} ) : (
> <Popconfirm
<Button title={t('cluster.removePeerConfirmTitle')}
type="text" size="small" danger description={t('cluster.removePeerConfirmDesc', { fqdn: r.fqdn })}
icon={<DeleteOutlined />} okText={t('common.yes')}
loading={removePeer.isPending && removePeer.variables === r.id} cancelText={t('common.no')}
okButtonProps={{ danger: true }}
onConfirm={() => removePeer.mutate(r.id)}
> >
{t('cluster.removePeerBtn')} <Button
</Button> type="text" size="small" danger
</Popconfirm> icon={<DeleteOutlined />}
loading={removePeer.isPending && removePeer.variables === r.id}
>
{t('cluster.removePeerBtn')}
</Button>
</Popconfirm>
)
), ),
}, },
] ]
@@ -274,13 +284,16 @@ export default function ClusterPage() {
subtitle={t('cluster.intro', { count: 1 + data.peers.length })} subtitle={t('cluster.intro', { count: 1 + data.peers.length })}
extra={ extra={
<Space> <Space>
<Button <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
icon={<KeyOutlined />} <Button
loading={generateToken.isPending} icon={<KeyOutlined />}
onClick={() => generateToken.mutate()} loading={generateToken.isPending}
> disabled={isViewer}
{t('cluster.generateJoinToken')} onClick={() => generateToken.mutate()}
</Button> >
{t('cluster.generateJoinToken')}
</Button>
</Tooltip>
<Tag color={data.mode === 'cluster' ? 'blue' : 'default'}> <Tag color={data.mode === 'cluster' ? 'blue' : 'default'}>
{data.mode === 'cluster' ? t('cluster.modeCluster') : t('cluster.modeSingle')} {data.mode === 'cluster' ? t('cluster.modeCluster') : t('cluster.modeSingle')}
</Tag> </Tag>
@@ -363,16 +376,22 @@ export default function ClusterPage() {
{(certStatus.data?.has_ca || certStatus.data?.has_peer) && ( {(certStatus.data?.has_ca || certStatus.data?.has_peer) && (
<Card size="small" title={t('cluster.certCardTitle')} className="mb-16" <Card size="small" title={t('cluster.certCardTitle')} className="mb-16"
extra={certStatus.data?.has_ca && ( extra={certStatus.data?.has_ca && (
<Popconfirm isViewer ? (
title={t('cluster.renewSelfConfirm')} <Tooltip title={t('auth.viewerBadge')}>
okText={t('common.yes')} <Button size="small" disabled>{t('cluster.renewSelfBtn')}</Button>
cancelText={t('common.no')} </Tooltip>
onConfirm={() => renewSelf.mutate()} ) : (
> <Popconfirm
<Button size="small" loading={renewSelf.isPending}> title={t('cluster.renewSelfConfirm')}
{t('cluster.renewSelfBtn')} okText={t('common.yes')}
</Button> cancelText={t('common.no')}
</Popconfirm> onConfirm={() => renewSelf.mutate()}
>
<Button size="small" loading={renewSelf.isPending}>
{t('cluster.renewSelfBtn')}
</Button>
</Popconfirm>
)
)} )}
> >
<Descriptions size="small" column={2} bordered> <Descriptions size="small" column={2} bordered>

89
management-ui/src/pages/Settings/index.tsx
View File

@@ -1,4 +1,4 @@
import { Alert, Button, Card, Descriptions, Form, Input, InputNumber, Select, Space, Spin, Switch, Typography, message } from 'antd' import { Alert, Button, Card, Descriptions, Form, Input, InputNumber, Select, Space, Spin, Switch, Tooltip, Typography, message } from 'antd'
import { CloudDownloadOutlined, CloudSyncOutlined, CodeOutlined, DatabaseOutlined, ExclamationCircleOutlined, FileSearchOutlined, GlobalOutlined, LockOutlined, MailOutlined, ReloadOutlined, SettingOutlined, StopOutlined, ToolOutlined } from '@ant-design/icons' import { CloudDownloadOutlined, CloudSyncOutlined, CodeOutlined, DatabaseOutlined, ExclamationCircleOutlined, FileSearchOutlined, GlobalOutlined, LockOutlined, MailOutlined, ReloadOutlined, SettingOutlined, StopOutlined, ToolOutlined } from '@ant-design/icons'
import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query' import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
import { useEffect, useState } from 'react' import { useEffect, useState } from 'react'
@@ -6,6 +6,7 @@ import { useTranslation } from 'react-i18next'
import apiClient, { isEnvelope } from '../../api/client' import apiClient, { isEnvelope } from '../../api/client'
import PageHeader from '../../components/PageHeader' import PageHeader from '../../components/PageHeader'
import { useAuthStore } from '../../stores/auth'
interface SetupStatus { interface SetupStatus {
completed: boolean completed: boolean
@@ -33,6 +34,7 @@ interface ChangePasswordValues {
export default function SettingsPage() { export default function SettingsPage() {
const { t } = useTranslation() const { t } = useTranslation()
const qc = useQueryClient() const qc = useQueryClient()
const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
const [msg, msgCtx] = message.useMessage() const [msg, msgCtx] = message.useMessage()
const [pwForm] = Form.useForm<ChangePasswordValues>() const [pwForm] = Form.useForm<ChangePasswordValues>()
@@ -343,27 +345,36 @@ export default function SettingsPage() {
size="small" size="small"
> >
<Space wrap> <Space wrap>
<Button <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
icon={<ReloadOutlined />} <Button
loading={haproxyReload.isPending} icon={<ReloadOutlined />}
onClick={() => haproxyReload.mutate()} loading={haproxyReload.isPending}
> disabled={isViewer}
{t('settings.haproxyReloadBtn')} onClick={() => haproxyReload.mutate()}
</Button> >
<Button {t('settings.haproxyReloadBtn')}
icon={<ReloadOutlined />} </Button>
loading={renderConfigs.isPending} </Tooltip>
onClick={() => renderConfigs.mutate()} <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
> <Button
{t('settings.renderConfigsBtn')} icon={<ReloadOutlined />}
</Button> loading={renderConfigs.isPending}
<Button disabled={isViewer}
icon={<DatabaseOutlined />} onClick={() => renderConfigs.mutate()}
loading={triggerBackup.isPending} >
onClick={() => triggerBackup.mutate()} {t('settings.renderConfigsBtn')}
> </Button>
{t('settings.backupNowBtn')} </Tooltip>
</Button> <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
<Button
icon={<DatabaseOutlined />}
loading={triggerBackup.isPending}
disabled={isViewer}
onClick={() => triggerBackup.mutate()}
>
{t('settings.backupNowBtn')}
</Button>
</Tooltip>
</Space> </Space>
<Typography.Paragraph type="secondary" style={{ fontSize: 12, marginTop: 8, marginBottom: 0 }}> <Typography.Paragraph type="secondary" style={{ fontSize: 12, marginTop: 8, marginBottom: 0 }}>
{t('settings.actionsHint')} {t('settings.actionsHint')}
@@ -396,14 +407,17 @@ export default function SettingsPage() {
</Typography.Text> </Typography.Text>
)} )}
</Space> </Space>
<Button <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
size="small" <Button
icon={<ReloadOutlined />} size="small"
loading={restartingService === svc} icon={<ReloadOutlined />}
onClick={() => serviceRestart.mutate(svc)} loading={restartingService === svc}
> disabled={isViewer}
{t('settings.serviceRestartBtn')} onClick={() => serviceRestart.mutate(svc)}
</Button> >
{t('settings.serviceRestartBtn')}
</Button>
</Tooltip>
</Space> </Space>
) )
})} })}
@@ -501,9 +515,11 @@ export default function SettingsPage() {
</Form.Item> </Form.Item>
<Form.Item style={{ marginBottom: 0 }}> <Form.Item style={{ marginBottom: 0 }}>
<Space> <Space>
<Button type="primary" htmlType="submit" loading={updateEmails.isPending}> <Tooltip title={isViewer ? t('auth.viewerBadge') : undefined}>
{t('common.save')} <Button type="primary" htmlType="submit" loading={updateEmails.isPending} disabled={isViewer}>
</Button> {t('common.save')}
</Button>
</Tooltip>
<Button onClick={() => emailForm.resetFields()}> <Button onClick={() => emailForm.resetFields()}>
{t('common.cancel')} {t('common.cancel')}
</Button> </Button>
@@ -532,6 +548,7 @@ export default function SettingsPage() {
<Switch <Switch
checked={maintenance?.enabled ?? false} checked={maintenance?.enabled ?? false}
loading={toggleMaintenance.isPending} loading={toggleMaintenance.isPending}
disabled={isViewer}
onChange={(checked) => toggleMaintenance.mutate({ onChange={(checked) => toggleMaintenance.mutate({
enabled: checked, enabled: checked,
message: maintMessage || maintenance?.message || '', message: maintMessage || maintenance?.message || '',
@@ -574,7 +591,7 @@ export default function SettingsPage() {
step={1} step={1}
value={backupRetention?.keep ?? 0} value={backupRetention?.keep ?? 0}
onChange={(v) => setBackupRetention.mutate((v as number) ?? 0)} onChange={(v) => setBackupRetention.mutate((v as number) ?? 0)}
disabled={setBackupRetention.isPending} disabled={setBackupRetention.isPending || isViewer}
addonAfter={t('settings.backupRetentionUnit')} addonAfter={t('settings.backupRetentionUnit')}
style={{ width: 200 }} style={{ width: 200 }}
/> />
@@ -603,7 +620,7 @@ export default function SettingsPage() {
step={30} step={30}
value={auditRetention?.days ?? 0} value={auditRetention?.days ?? 0}
onChange={(v) => setAuditRetention.mutate((v as number) ?? 0)} onChange={(v) => setAuditRetention.mutate((v as number) ?? 0)}
disabled={setAuditRetention.isPending} disabled={setAuditRetention.isPending || isViewer}
addonAfter={t('settings.auditRetentionUnit')} addonAfter={t('settings.auditRetentionUnit')}
style={{ width: 200 }} style={{ width: 200 }}
/> />
@@ -629,6 +646,7 @@ export default function SettingsPage() {
<Switch <Switch
checked={autoUpdate?.enabled ?? false} checked={autoUpdate?.enabled ?? false}
loading={toggleAutoUpdate.isPending} loading={toggleAutoUpdate.isPending}
disabled={isViewer}
onChange={(checked) => toggleAutoUpdate.mutate(checked)} onChange={(checked) => toggleAutoUpdate.mutate(checked)}
/> />
<Typography.Text> <Typography.Text>
@@ -651,6 +669,7 @@ export default function SettingsPage() {
<Switch <Switch
checked={ipv6?.enabled ?? false} checked={ipv6?.enabled ?? false}
loading={toggleIPv6.isPending} loading={toggleIPv6.isPending}
disabled={isViewer}
onChange={(checked) => toggleIPv6.mutate(checked)} onChange={(checked) => toggleIPv6.mutate(checked)}
/> />
<Typography.Text> <Typography.Text>