OIDC app creation with encrypted secrets and application roles
This commit is contained in:
Dan Milne
@@ -51,6 +51,52 @@
|
||||
<%= form.text_area :redirect_uris, rows: 4, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono", placeholder: "https://example.com/callback\nhttps://app.example.com/auth/callback" %>
|
||||
<p class="mt-1 text-sm text-gray-500">One URI per line. These are the allowed callback URLs for your application.</p>
|
||||
</div>
|
||||
|
||||
<!-- Role Mapping Configuration -->
|
||||
<div class="border-t border-gray-200 pt-6">
|
||||
<h4 class="text-base font-semibold text-gray-900 mb-4">Role Mapping Configuration</h4>
|
||||
|
||||
<div>
|
||||
<%= form.label :role_mapping_mode, "Role Mapping Mode", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.select :role_mapping_mode,
|
||||
options_for_select([
|
||||
["Disabled", "disabled"],
|
||||
["OIDC Managed", "oidc_managed"],
|
||||
["Hybrid (Groups + Roles)", "hybrid"]
|
||||
], application.role_mapping_mode || "disabled"),
|
||||
{},
|
||||
{ class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" } %>
|
||||
<p class="mt-1 text-sm text-gray-500">Controls how external roles are mapped and synchronized.</p>
|
||||
</div>
|
||||
|
||||
<div id="role-mapping-advanced" class="mt-4 space-y-4 border-t border-gray-200 pt-4" style="<%= 'display: none;' unless application.role_mapping_enabled? %>">
|
||||
<div>
|
||||
<%= form.label :role_claim_name, "Role Claim Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :role_claim_name, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "roles" %>
|
||||
<p class="mt-1 text-sm text-gray-500">Name of the claim that contains role information (default: 'roles').</p>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<%= form.label :role_prefix, "Role Prefix (Optional)", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :role_prefix, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "app-" %>
|
||||
<p class="mt-1 text-sm text-gray-500">Only roles starting with this prefix will be mapped. Useful for multi-tenant scenarios.</p>
|
||||
</div>
|
||||
|
||||
<div class="space-y-3">
|
||||
<label class="block text-sm font-medium text-gray-700">Managed Permissions</label>
|
||||
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :managed_permissions, { multiple: true, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" }, "include_permissions", "" %>
|
||||
<%= form.label :managed_permissions_include_permissions, "Include role permissions in tokens", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :managed_permissions, { multiple: true, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" }, "include_metadata", "" %>
|
||||
<%= form.label :managed_permissions_include_metadata, "Include role metadata in tokens", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
@@ -86,14 +132,30 @@
|
||||
// Show/hide OIDC fields based on app type selection
|
||||
const appTypeSelect = document.querySelector('#application_app_type');
|
||||
const oidcFields = document.querySelector('#oidc-fields');
|
||||
const roleMappingMode = document.querySelector('#application_role_mapping_mode');
|
||||
const roleMappingAdvanced = document.querySelector('#role-mapping-advanced');
|
||||
|
||||
function updateFieldVisibility() {
|
||||
const isOidc = appTypeSelect.value === 'oidc';
|
||||
const roleMappingEnabled = roleMappingMode && ['oidc_managed', 'hybrid'].includes(roleMappingMode.value);
|
||||
|
||||
if (oidcFields) {
|
||||
oidcFields.style.display = isOidc ? 'block' : 'none';
|
||||
}
|
||||
|
||||
if (roleMappingAdvanced) {
|
||||
roleMappingAdvanced.style.display = isOidc && roleMappingEnabled ? 'block' : 'none';
|
||||
}
|
||||
}
|
||||
|
||||
if (appTypeSelect && oidcFields) {
|
||||
appTypeSelect.addEventListener('change', function() {
|
||||
if (this.value === 'oidc') {
|
||||
oidcFields.style.display = 'block';
|
||||
} else {
|
||||
oidcFields.style.display = 'none';
|
||||
}
|
||||
});
|
||||
appTypeSelect.addEventListener('change', updateFieldVisibility);
|
||||
}
|
||||
|
||||
if (roleMappingMode) {
|
||||
roleMappingMode.addEventListener('change', updateFieldVisibility);
|
||||
}
|
||||
|
||||
// Initialize visibility on page load
|
||||
updateFieldVisibility();
|
||||
</script>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<div class="sm:flex sm:items-center">
|
||||
<div class="sm:flex-auto">
|
||||
<h1 class="text-2xl font-semibold text-gray-900">Applications</h1>
|
||||
<p class="mt-2 text-sm text-gray-700">Manage OIDC applications.</p>
|
||||
<p class="mt-2 text-sm text-gray-700">Manage OIDC Clients.</p>
|
||||
</div>
|
||||
<div class="mt-4 sm:mt-0 sm:ml-16 sm:flex-none">
|
||||
<%= link_to "New Application", new_admin_application_path, class: "block rounded-md bg-blue-600 px-3 py-2 text-center text-sm font-semibold text-white shadow-sm hover:bg-blue-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-blue-600" %>
|
||||
|
||||
125
app/views/admin/applications/roles.html.erb
Normal file
125
app/views/admin/applications/roles.html.erb
Normal file
@@ -0,0 +1,125 @@
|
||||
<% content_for :title, "Role Management - #{@application.name}" %>
|
||||
|
||||
<div class="bg-white shadow sm:rounded-lg">
|
||||
<div class="px-4 py-5 sm:p-6">
|
||||
<div class="flex items-center justify-between mb-6">
|
||||
<h3 class="text-lg font-medium leading-6 text-gray-900">
|
||||
Role Management for <%= @application.name %>
|
||||
</h3>
|
||||
<%= link_to "← Back to Application", admin_application_path(@application), class: "text-sm text-blue-600 hover:text-blue-500" %>
|
||||
</div>
|
||||
|
||||
<% if @application.role_mapping_enabled? %>
|
||||
<div class="bg-blue-50 border border-blue-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-blue-800">Role Mapping Configuration</h3>
|
||||
<div class="mt-2 text-sm text-blue-700">
|
||||
<p>Mode: <strong><%= @application.role_mapping_mode.humanize %></strong></p>
|
||||
<% if @application.role_claim_name.present? %>
|
||||
<p>Role Claim: <strong><%= @application.role_claim_name %></strong></p>
|
||||
<% end %>
|
||||
<% if @application.role_prefix.present? %>
|
||||
<p>Role Prefix: <strong><%= @application.role_prefix %></strong></p>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-yellow-800">Role Mapping Disabled</h3>
|
||||
<div class="mt-2 text-sm text-yellow-700">
|
||||
<p>Role mapping is currently disabled for this application. Enable it in the application settings to manage roles.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<!-- Create New Role -->
|
||||
<div class="border-b border-gray-200 pb-6 mb-6">
|
||||
<h4 class="text-md font-medium text-gray-900 mb-4">Create New Role</h4>
|
||||
<%= form_with(model: [:admin, @application, ApplicationRole.new], url: create_role_admin_application_path(@application), local: true, class: "space-y-4") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :name, "Role Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "admin" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Administrator" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Description of this role's permissions" %>
|
||||
</div>
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.submit "Create Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-blue-600" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<!-- Existing Roles -->
|
||||
<div class="space-y-6">
|
||||
<h4 class="text-md font-medium text-gray-900">Existing Roles</h4>
|
||||
|
||||
<% if @application_roles.any? %>
|
||||
<div class="space-y-4">
|
||||
<% @application_roles.each do |role| %>
|
||||
<div class="border border-gray-200 rounded-lg p-4">
|
||||
<div class="flex items-start justify-between">
|
||||
<div class="flex-1">
|
||||
<div class="flex items-center space-x-3">
|
||||
<h5 class="text-sm font-medium text-gray-900"><%= role.name %></h5>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">
|
||||
<%= role.display_name %>
|
||||
</span>
|
||||
<% unless role.active %>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-800">
|
||||
Inactive
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
<% if role.description.present? %>
|
||||
<p class="mt-1 text-sm text-gray-500"><%= role.description %></p>
|
||||
<% end %>
|
||||
|
||||
<!-- Assigned Users -->
|
||||
<div class="mt-3">
|
||||
<p class="text-xs text-gray-500 mb-2">Assigned Users:</p>
|
||||
<div class="flex flex-wrap gap-2">
|
||||
<% role.users.each do |user| %>
|
||||
<span class="inline-flex items-center px-2 py-1 rounded-md text-xs font-medium bg-blue-100 text-blue-800">
|
||||
<%= user.email_address %>
|
||||
<span class="ml-1 text-blue-600">(<%= role.user_role_assignments.find_by(user: user)&.source %>)</span>
|
||||
<%= link_to "×", remove_role_admin_application_path(@application, user_id: user.id, role_id: role.id),
|
||||
method: :post,
|
||||
data: { confirm: "Remove role from #{user.email_address}?" },
|
||||
class: "ml-1 text-blue-600 hover:text-blue-800" %>
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="text-center py-12">
|
||||
<div class="text-gray-500 text-sm">
|
||||
No roles configured yet. Create your first role above to get started with role-based access control.
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
173
app/views/admin/applications/roles_backup.html.erb
Normal file
173
app/views/admin/applications/roles_backup.html.erb
Normal file
@@ -0,0 +1,173 @@
|
||||
<% content_for :title, "Role Management - #{@application.name}" %>
|
||||
|
||||
<div class="bg-white shadow sm:rounded-lg">
|
||||
<div class="px-4 py-5 sm:p-6">
|
||||
<div class="flex items-center justify-between mb-6">
|
||||
<h3 class="text-lg font-medium leading-6 text-gray-900">
|
||||
Role Management for <%= @application.name %>
|
||||
</h3>
|
||||
<%= link_to "← Back to Application", admin_application_path(@application), class: "text-sm text-blue-600 hover:text-blue-500" %>
|
||||
</div>
|
||||
|
||||
<% if @application.role_mapping_enabled? %>
|
||||
<div class="bg-blue-50 border border-blue-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-blue-800">Role Mapping Configuration</h3>
|
||||
<div class="mt-2 text-sm text-blue-700">
|
||||
<p>Mode: <strong><%= @application.role_mapping_mode.humanize %></strong></p>
|
||||
<% if @application.role_claim_name.present? %>
|
||||
<p>Role Claim: <strong><%= @application.role_claim_name %></strong></p>
|
||||
<% end %>
|
||||
<% if @application.role_prefix.present? %>
|
||||
<p>Role Prefix: <strong><%= @application.role_prefix %></strong></p>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-yellow-800">Role Mapping Disabled</h3>
|
||||
<div class="mt-2 text-sm text-yellow-700">
|
||||
<p>Role mapping is currently disabled for this application. Enable it in the application settings to manage roles.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<!-- Create New Role -->
|
||||
<div class="border-b border-gray-200 pb-6 mb-6">
|
||||
<h4 class="text-md font-medium text-gray-900 mb-4">Create New Role</h4>
|
||||
<%= form_with(model: [:admin, @application, ApplicationRole.new], url: create_role_admin_application_path(@application), local: true, class: "space-y-4") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :name, "Role Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "admin" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Administrator" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Description of this role's permissions" %>
|
||||
</div>
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.submit "Create Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-blue-600" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<!-- Existing Roles -->
|
||||
<div class="space-y-6">
|
||||
<h4 class="text-md font-medium text-gray-900">Existing Roles</h4>
|
||||
|
||||
<% if @application_roles.any? %>
|
||||
<div class="space-y-4">
|
||||
<% @application_roles.each do |role| %>
|
||||
<div class="border border-gray-200 rounded-lg p-4">
|
||||
<div class="flex items-start justify-between">
|
||||
<div class="flex-1">
|
||||
<div class="flex items-center space-x-3">
|
||||
<h5 class="text-sm font-medium text-gray-900"><%= role.name %></h5>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">
|
||||
<%= role.display_name %>
|
||||
</span>
|
||||
<% unless role.active %>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-800">
|
||||
Inactive
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
<% if role.description.present? %>
|
||||
<p class="mt-1 text-sm text-gray-500"><%= role.description %></p>
|
||||
<% end %>
|
||||
|
||||
<!-- Assigned Users -->
|
||||
<div class="mt-3">
|
||||
<p class="text-xs text-gray-500 mb-2">Assigned Users:</p>
|
||||
<div class="flex flex-wrap gap-2">
|
||||
<% role.users.each do |user| %>
|
||||
<span class="inline-flex items-center px-2 py-1 rounded-md text-xs font-medium bg-blue-100 text-blue-800">
|
||||
<%= user.email_address %>
|
||||
<span class="ml-1 text-blue-600">(<%= role.user_role_assignments.find_by(user: user)&.source %>)</span>
|
||||
<%= link_to "×", remove_role_admin_application_path(@application, user_id: user.id, role_id: role.id),
|
||||
method: :post,
|
||||
data: { confirm: "Remove role from #{user.email_address}?" },
|
||||
class: "ml-1 text-blue-600 hover:text-blue-800" %>
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Actions -->
|
||||
<div class="ml-4 flex-shrink-0">
|
||||
<div class="space-y-2">
|
||||
<!-- Assign Role to User -->
|
||||
<div class="flex items-center space-x-2">
|
||||
<select id="assign-user-<%= role.id %>" class="text-xs rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500">
|
||||
<option value="">Assign to user...</option>
|
||||
<% @available_users.each do |user| %>
|
||||
<% unless role.user_has_role?(user) %>
|
||||
<option value="<%= user.id %>"><%= user.email_address %></option>
|
||||
<% end %>
|
||||
<% end %>
|
||||
</select>
|
||||
<%= link_to "Assign", assign_role_admin_application_path(@application, role_id: role.id, user_id: "REPLACE_USER_ID"),
|
||||
method: :post,
|
||||
class: "text-xs bg-blue-600 px-2 py-1 rounded text-white hover:bg-blue-500",
|
||||
onclick: "this.href = this.href.replace('REPLACE_USER_ID', document.getElementById('assign-user-<%= role.id %>').value); if (this.href.includes('undefined')) { alert('Please select a user'); return false; }" %>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role -->
|
||||
<%= link_to "Edit", "#", class: "text-xs text-gray-600 hover:text-gray-800", onclick: "document.getElementById('edit-role-<%= role.id %>').classList.toggle('hidden'); return false;" %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role Form (Hidden by default) -->
|
||||
<div id="edit-role-<%= role.id %>" class="hidden mt-4 border-t pt-4">
|
||||
<%= form_with(model: [:admin, @application, role], url: update_role_admin_application_path(@application, role_id: role.id), local: true, method: :patch, class: "space-y-3") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex items-center pt-6">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex space-x-2">
|
||||
<%= form.submit "Update Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500" %>
|
||||
<%= link_to "Cancel", "#", class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50", onclick: "document.getElementById('edit-role-<%= role.id %>').classList.add('hidden'); return false;" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="text-center py-12">
|
||||
<div class="text-gray-500 text-sm">
|
||||
No roles configured yet. Create your first role above to get started with role-based access control.
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
179
app/views/admin/applications/roles_broken.html.erb
Normal file
179
app/views/admin/applications/roles_broken.html.erb
Normal file
@@ -0,0 +1,179 @@
|
||||
<% content_for :title, "Role Management - #{@application.name}" %>
|
||||
|
||||
<div class="bg-white shadow sm:rounded-lg">
|
||||
<div class="px-4 py-5 sm:p-6">
|
||||
<div class="flex items-center justify-between mb-6">
|
||||
<h3 class="text-lg font-medium leading-6 text-gray-900">
|
||||
Role Management for <%= @application.name %>
|
||||
</h3>
|
||||
<%= link_to "← Back to Application", admin_application_path(@application), class: "text-sm text-blue-600 hover:text-blue-500" %>
|
||||
</div>
|
||||
|
||||
<% if @application.role_mapping_enabled? %>
|
||||
<div class="bg-blue-50 border border-blue-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-blue-800">Role Mapping Configuration</h3>
|
||||
<div class="mt-2 text-sm text-blue-700">
|
||||
<p>Mode: <strong><%= @application.role_mapping_mode.humanize %></strong></p>
|
||||
<% if @application.role_claim_name.present? %>
|
||||
<p>Role Claim: <strong><%= @application.role_claim_name %></strong></p>
|
||||
<% end %>
|
||||
<% if @application.role_prefix.present? %>
|
||||
<p>Role Prefix: <strong><%= @application.role_prefix %></strong></p>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-yellow-800">Role Mapping Disabled</h3>
|
||||
<div class="mt-2 text-sm text-yellow-700">
|
||||
<p>Role mapping is currently disabled for this application. Enable it in the application settings to manage roles.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<!-- Create New Role -->
|
||||
<div class="border-b border-gray-200 pb-6 mb-6">
|
||||
<h4 class="text-md font-medium text-gray-900 mb-4">Create New Role</h4>
|
||||
<%= form_with(model: [:admin, @application, ApplicationRole.new], url: create_role_admin_application_path(@application), local: true, class: "space-y-4") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :name, "Role Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "admin" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Administrator" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Description of this role's permissions" %>
|
||||
</div>
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.submit "Create Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-blue-600" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<!-- Existing Roles -->
|
||||
<div class="space-y-6" data-controller="role-management">
|
||||
<h4 class="text-md font-medium text-gray-900">Existing Roles</h4>
|
||||
|
||||
<% if @application_roles.any? %>
|
||||
<div class="space-y-4">
|
||||
<% @application_roles.each do |role| %>
|
||||
<div class="border border-gray-200 rounded-lg p-4">
|
||||
<div class="flex items-start justify-between">
|
||||
<div class="flex-1">
|
||||
<div class="flex items-center space-x-3">
|
||||
<h5 class="text-sm font-medium text-gray-900"><%= role.name %></h5>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">
|
||||
<%= role.display_name %>
|
||||
</span>
|
||||
<% unless role.active %>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-800">
|
||||
Inactive
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
<% if role.description.present? %>
|
||||
<p class="mt-1 text-sm text-gray-500"><%= role.description %></p>
|
||||
<% end %>
|
||||
|
||||
<!-- Assigned Users -->
|
||||
<div class="mt-3">
|
||||
<p class="text-xs text-gray-500 mb-2">Assigned Users:</p>
|
||||
<div class="flex flex-wrap gap-2">
|
||||
<% role.users.each do |user| %>
|
||||
<span class="inline-flex items-center px-2 py-1 rounded-md text-xs font-medium bg-blue-100 text-blue-800">
|
||||
<%= user.email_address %>
|
||||
<span class="ml-1 text-blue-600">(<%= role.user_role_assignments.find_by(user: user)&.source %>)</span>
|
||||
<%= link_to "×", remove_role_admin_application_path(@application, user_id: user.id, role_id: role.id),
|
||||
method: :post,
|
||||
data: { confirm: "Remove role from #{user.email_address}?" },
|
||||
class: "ml-1 text-blue-600 hover:text-blue-800" %>
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Actions -->
|
||||
<div class="ml-4 flex-shrink-0">
|
||||
<div class="space-y-2">
|
||||
<!-- Assign Role to User -->
|
||||
<div class="flex items-center space-x-2">
|
||||
<select id="assign-user-<%= role.id %>" data-role-target="userSelect" data-role-id="<%= role.id %>" class="text-xs rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500">
|
||||
<option value="">Assign to user...</option>
|
||||
<% @available_users.each do |user| %>
|
||||
<% unless role.user_has_role?(user) %>
|
||||
<option value="<%= user.id %>"><%= user.email_address %></option>
|
||||
<% end %>
|
||||
<% end %>
|
||||
</select>
|
||||
<%= link_to "Assign", assign_role_admin_application_path(@application, role_id: role.id, user_id: "PLACEHOLDER"),
|
||||
method: :post,
|
||||
class: "text-xs bg-blue-600 px-2 py-1 rounded text-white hover:bg-blue-500",
|
||||
data: { role_target: "assignLink", action: "click->role-management#assignRole" } %>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role -->
|
||||
<%= link_to "Edit", "#",
|
||||
class: "text-xs text-gray-600 hover:text-gray-800",
|
||||
data: { action: "click->role-management#toggleEdit" },
|
||||
data: { role_id: role.id } %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role Form (Hidden by default) -->
|
||||
<div id="edit-role-<%= role.id %>" class="hidden mt-4 border-t pt-4" data-role-target="editForm" data-role-id="<%= role.id %>">
|
||||
<%= form_with(model: [:admin, @application, role], url: update_role_admin_application_path(@application, role_id: role.id), local: true, method: :patch, class: "space-y-3") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex items-center pt-6">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex space-x-2">
|
||||
<%= form.submit "Update Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500" %>
|
||||
<%= link_to "Cancel", "#",
|
||||
class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50",
|
||||
data: { action: "click->role-management#hideEdit" },
|
||||
data: { role_id: role.id } %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="text-center py-12">
|
||||
<div class="text-gray-500 text-sm">
|
||||
No roles configured yet. Create your first role above to get started with role-based access control.
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
173
app/views/admin/applications/roles_complex.html.erb
Normal file
173
app/views/admin/applications/roles_complex.html.erb
Normal file
@@ -0,0 +1,173 @@
|
||||
<% content_for :title, "Role Management - #{@application.name}" %>
|
||||
|
||||
<div class="bg-white shadow sm:rounded-lg">
|
||||
<div class="px-4 py-5 sm:p-6">
|
||||
<div class="flex items-center justify-between mb-6">
|
||||
<h3 class="text-lg font-medium leading-6 text-gray-900">
|
||||
Role Management for <%= @application.name %>
|
||||
</h3>
|
||||
<%= link_to "← Back to Application", admin_application_path(@application), class: "text-sm text-blue-600 hover:text-blue-500" %>
|
||||
</div>
|
||||
|
||||
<% if @application.role_mapping_enabled? %>
|
||||
<div class="bg-blue-50 border border-blue-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-blue-800">Role Mapping Configuration</h3>
|
||||
<div class="mt-2 text-sm text-blue-700">
|
||||
<p>Mode: <strong><%= @application.role_mapping_mode.humanize %></strong></p>
|
||||
<% if @application.role_claim_name.present? %>
|
||||
<p>Role Claim: <strong><%= @application.role_claim_name %></strong></p>
|
||||
<% end %>
|
||||
<% if @application.role_prefix.present? %>
|
||||
<p>Role Prefix: <strong><%= @application.role_prefix %></strong></p>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
|
||||
<div class="flex">
|
||||
<div class="ml-3">
|
||||
<h3 class="text-sm font-medium text-yellow-800">Role Mapping Disabled</h3>
|
||||
<div class="mt-2 text-sm text-yellow-700">
|
||||
<p>Role mapping is currently disabled for this application. Enable it in the application settings to manage roles.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<!-- Create New Role -->
|
||||
<div class="border-b border-gray-200 pb-6 mb-6">
|
||||
<h4 class="text-md font-medium text-gray-900 mb-4">Create New Role</h4>
|
||||
<%= form_with(model: [:admin, @application, ApplicationRole.new], url: create_role_admin_application_path(@application), local: true, class: "space-y-4") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :name, "Role Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "admin" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Administrator" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Description of this role's permissions" %>
|
||||
</div>
|
||||
<div class="flex items-center">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.submit "Create Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-blue-600" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<!-- Existing Roles -->
|
||||
<div class="space-y-6">
|
||||
<h4 class="text-md font-medium text-gray-900">Existing Roles</h4>
|
||||
|
||||
<% if @application_roles.any? %>
|
||||
<div class="space-y-4">
|
||||
<% @application_roles.each do |role| %>
|
||||
<div class="border border-gray-200 rounded-lg p-4">
|
||||
<div class="flex items-start justify-between">
|
||||
<div class="flex-1">
|
||||
<div class="flex items-center space-x-3">
|
||||
<h5 class="text-sm font-medium text-gray-900"><%= role.name %></h5>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-800">
|
||||
<%= role.display_name %>
|
||||
</span>
|
||||
<% unless role.active %>
|
||||
<span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-100 text-gray-800">
|
||||
Inactive
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
<% if role.description.present? %>
|
||||
<p class="mt-1 text-sm text-gray-500"><%= role.description %></p>
|
||||
<% end %>
|
||||
|
||||
<!-- Assigned Users -->
|
||||
<div class="mt-3">
|
||||
<p class="text-xs text-gray-500 mb-2">Assigned Users:</p>
|
||||
<div class="flex flex-wrap gap-2">
|
||||
<% role.users.each do |user| %>
|
||||
<span class="inline-flex items-center px-2 py-1 rounded-md text-xs font-medium bg-blue-100 text-blue-800">
|
||||
<%= user.email_address %>
|
||||
<span class="ml-1 text-blue-600">(<%= role.user_role_assignments.find_by(user: user)&.source %>)</span>
|
||||
<%= link_to "×", remove_role_admin_application_path(@application, user_id: user.id, role_id: role.id),
|
||||
method: :post,
|
||||
data: { confirm: "Remove role from #{user.email_address}?" },
|
||||
class: "ml-1 text-blue-600 hover:text-blue-800" %>
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Actions -->
|
||||
<div class="ml-4 flex-shrink-0">
|
||||
<div class="space-y-2">
|
||||
<!-- Assign Role to User -->
|
||||
<div class="flex items-center space-x-2">
|
||||
<select id="assign-user-<%= role.id %>" class="text-xs rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500">
|
||||
<option value="">Assign to user...</option>
|
||||
<% @available_users.each do |user| %>
|
||||
<% unless role.user_has_role?(user) %>
|
||||
<option value="<%= user.id %>"><%= user.email_address %></option>
|
||||
<% end %>
|
||||
<% end %>
|
||||
</select>
|
||||
<%= link_to "Assign", assign_role_admin_application_path(@application, role_id: role.id, user_id: "PLACEHOLDER"),
|
||||
method: :post,
|
||||
class: "text-xs bg-blue-600 px-2 py-1 rounded text-white hover:bg-blue-500",
|
||||
onclick: "var select = document.getElementById('assign-user-<%= role.id %>'); var userId = select.value; if (!userId) { alert('Please select a user'); return false; } this.href = this.href.replace('PLACEHOLDER', userId);" %>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role -->
|
||||
<%= link_to "Edit", "#", class: "text-xs text-gray-600 hover:text-gray-800", onclick: "document.getElementById('edit-role-<%= role.id %>').classList.toggle('hidden'); return false;" %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Edit Role Form (Hidden by default) -->
|
||||
<div id="edit-role-<%= role.id %>" class="hidden mt-4 border-t pt-4">
|
||||
<%= form_with(model: [:admin, @application, role], url: update_role_admin_application_path(@application, role_id: role.id), local: true, method: :patch, class: "space-y-3") do |form| %>
|
||||
<div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
|
||||
<div>
|
||||
<%= form.label :display_name, "Display Name", class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_field :display_name, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex items-center pt-6">
|
||||
<%= form.check_box :active, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
|
||||
<%= form.label :active, "Active", class: "ml-2 block text-sm text-gray-900" %>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<%= form.label :description, class: "block text-sm font-medium text-gray-700" %>
|
||||
<%= form.text_area :description, rows: 2, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
|
||||
</div>
|
||||
<div class="flex space-x-2">
|
||||
<%= form.submit "Update Role", class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500" %>
|
||||
<%= link_to "Cancel", "#", class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50", onclick: "document.getElementById('edit-role-<%= role.id %>').classList.add('hidden'); return false;" %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="text-center py-12">
|
||||
<div class="text-gray-500 text-sm">
|
||||
No roles configured yet. Create your first role above to get started with role-based access control.
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@@ -1,4 +1,21 @@
|
||||
<div class="mb-6">
|
||||
<% if flash[:client_id] && flash[:client_secret] %>
|
||||
<div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
|
||||
<h4 class="text-sm font-medium text-yellow-800 mb-2">🔐 OIDC Client Credentials</h4>
|
||||
<p class="text-xs text-yellow-700 mb-3">Copy these credentials now. The client secret will not be shown again.</p>
|
||||
<div class="space-y-2">
|
||||
<div>
|
||||
<span class="text-xs font-medium text-yellow-700">Client ID:</span>
|
||||
</div>
|
||||
<code class="block bg-yellow-100 px-3 py-2 rounded font-mono text-xs break-all"><%= flash[:client_id] %></code>
|
||||
<div class="mt-3">
|
||||
<span class="text-xs font-medium text-yellow-700">Client Secret:</span>
|
||||
</div>
|
||||
<code class="block bg-yellow-100 px-3 py-2 rounded font-mono text-xs break-all"><%= flash[:client_secret] %></code>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<div class="sm:flex sm:items-center sm:justify-between">
|
||||
<div>
|
||||
<h1 class="text-2xl font-semibold text-gray-900"><%= @application.name %></h1>
|
||||
@@ -6,6 +23,9 @@
|
||||
</div>
|
||||
<div class="mt-4 sm:mt-0 flex gap-3">
|
||||
<%= link_to "Edit", edit_admin_application_path(@application), class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50" %>
|
||||
<% if @application.oidc? %>
|
||||
<%= link_to "Manage Roles", roles_admin_application_path(@application), class: "rounded-md bg-indigo-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-indigo-500" %>
|
||||
<% end %>
|
||||
<%= button_to "Delete", admin_application_path(@application), method: :delete, data: { turbo_confirm: "Are you sure?" }, class: "rounded-md bg-red-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-red-500" %>
|
||||
</div>
|
||||
</div>
|
||||
@@ -64,7 +84,12 @@
|
||||
<div>
|
||||
<dt class="text-sm font-medium text-gray-500">Client Secret</dt>
|
||||
<dd class="mt-1 text-sm text-gray-900">
|
||||
<code class="block bg-gray-100 px-3 py-2 rounded font-mono text-xs break-all"><%= @application.client_secret %></code>
|
||||
<div class="bg-gray-100 px-3 py-2 rounded text-xs text-gray-500 italic">
|
||||
🔒 Client secret is stored securely and cannot be displayed
|
||||
</div>
|
||||
<p class="mt-2 text-xs text-gray-500">
|
||||
To get a new client secret, use the "Regenerate Credentials" button above.
|
||||
</p>
|
||||
</dd>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
Reference in New Issue
Block a user