431 lines
22 KiB
PHP
431 lines
22 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
|
|
|
|
use App\AccountGate;
|
|
use App\ConfigLoader;
|
|
use App\RegistrationService;
|
|
use ModulesCore\ModuleHttp;
|
|
|
|
if (session_status() !== PHP_SESSION_ACTIVE) {
|
|
session_start();
|
|
}
|
|
|
|
$projectRoot = dirname(__DIR__, 3);
|
|
ModuleHttp::requireDesktopAccess($projectRoot);
|
|
|
|
$accountGate = new AccountGate(ConfigLoader::load($projectRoot, 'registration'));
|
|
$registration = new RegistrationService($projectRoot, ConfigLoader::load($projectRoot, 'registration'));
|
|
|
|
$currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
|
|
$currentGroups = array_map(
|
|
static fn (string $group): string => strtolower(trim($group, '/')),
|
|
array_values(array_map('strval', (array) ($currentUser['groups'] ?? [])))
|
|
);
|
|
$isPartial = !empty($_GET['partial']);
|
|
|
|
if (!in_array('administrators', $currentGroups, true)) {
|
|
http_response_code(403);
|
|
$forbidden = '<div class="window-app-shell um-shell"><div class="window-app-frame um-frame"><main class="window-app-main um-main"><div class="window-app-panel um-panel"><section class="window-app-card um-card"><p class="um-message is-error">Kein Zugriff auf User Management.</p></section></div></main></div></div>';
|
|
if ($isPartial) {
|
|
echo $forbidden;
|
|
return;
|
|
}
|
|
|
|
?><!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>User Management</title>
|
|
<link rel="stylesheet" href="/assets/desktop/desktop.css">
|
|
<link rel="stylesheet" href="/assets/apps/user-management/app.css">
|
|
</head>
|
|
<body><?= $forbidden ?></body>
|
|
</html><?php
|
|
return;
|
|
}
|
|
|
|
$csrfToken = (string) ($_SESSION['user_management_token'] ?? '');
|
|
if ($csrfToken === '') {
|
|
$csrfToken = bin2hex(random_bytes(16));
|
|
$_SESSION['user_management_token'] = $csrfToken;
|
|
}
|
|
|
|
$section = trim((string) ($_GET['section'] ?? $_POST['active_section'] ?? 'pending'));
|
|
$allowedSections = ['pending', 'users', 'reset'];
|
|
if (!in_array($section, $allowedSections, true)) {
|
|
$section = 'pending';
|
|
}
|
|
|
|
$messages = [];
|
|
$errors = [];
|
|
$selectedId = trim((string) ($_GET['id'] ?? $_POST['selected_id'] ?? ''));
|
|
$manualUsername = trim((string) ($_POST['manual_username'] ?? ''));
|
|
$manualResetUsername = trim((string) ($_POST['reset_username'] ?? ''));
|
|
$manualResetPassword = (string) ($_POST['reset_password'] ?? '');
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$postedToken = (string) ($_POST['csrf_token'] ?? '');
|
|
|
|
if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) {
|
|
$errors[] = 'Die Formularpruefung ist fehlgeschlagen.';
|
|
} else {
|
|
$action = (string) ($_POST['action'] ?? '');
|
|
|
|
if ($action === 'approve-registration') {
|
|
$groupDns = array_values(array_filter(array_map('strval', (array) ($_POST['group_dns'] ?? []))));
|
|
$memberOfList = implode(PHP_EOL, $groupDns);
|
|
$result = $registration->approve($selectedId, [
|
|
'member_of_list' => $memberOfList,
|
|
'admin_note' => (string) ($_POST['admin_note'] ?? ''),
|
|
], (string) ($currentUser['username'] ?? 'administrator'));
|
|
|
|
if (($result['success'] ?? false) !== true) {
|
|
$errors = array_merge($errors, array_values(array_map('strval', (array) ($result['errors'] ?? []))));
|
|
} else {
|
|
$messages[] = 'Registrierung wurde freigeschaltet.';
|
|
}
|
|
$section = 'pending';
|
|
} elseif ($action === 'deactivate-user') {
|
|
$result = $registration->deactivateUser($manualUsername);
|
|
if (($result['success'] ?? false) === true) {
|
|
$messages[] = (string) ($result['message'] ?? '');
|
|
} else {
|
|
$errors[] = (string) ($result['message'] ?? '');
|
|
}
|
|
$section = 'users';
|
|
} elseif ($action === 'activate-user') {
|
|
$groupDns = array_values(array_filter(array_map('strval', (array) ($_POST['manual_group_dns'] ?? []))));
|
|
$result = $registration->activateExistingUser($manualUsername, $groupDns);
|
|
if (($result['success'] ?? false) === true) {
|
|
$messages[] = (string) ($result['message'] ?? '');
|
|
} else {
|
|
$errors[] = (string) ($result['message'] ?? '');
|
|
}
|
|
$section = 'users';
|
|
} elseif ($action === 'send-reset-mail') {
|
|
$origin = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http') . '://' . ($_SERVER['HTTP_HOST'] ?? 'localhost');
|
|
$result = $registration->sendPasswordReset($manualResetUsername, $origin);
|
|
if (($result['success'] ?? false) === true) {
|
|
$messages[] = (string) ($result['message'] ?? '');
|
|
} else {
|
|
$errors[] = (string) ($result['message'] ?? '');
|
|
}
|
|
$section = 'reset';
|
|
} elseif ($action === 'set-password') {
|
|
if (strlen($manualResetPassword) < 12) {
|
|
$errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.';
|
|
} else {
|
|
$result = $registration->setUserPassword($manualResetUsername, $manualResetPassword);
|
|
if (($result['success'] ?? false) === true) {
|
|
$messages[] = (string) ($result['message'] ?? '');
|
|
} else {
|
|
$errors[] = (string) ($result['message'] ?? '');
|
|
}
|
|
}
|
|
$section = 'reset';
|
|
}
|
|
}
|
|
}
|
|
|
|
$pendingRequests = $registration->pendingApprovals();
|
|
$availableGroups = $registration->availableGroups();
|
|
$existingUsers = $registration->searchExistingUsers('', 250);
|
|
$selected = $selectedId !== ''
|
|
? $registration->find($selectedId)
|
|
: ($pendingRequests[0] ?? null);
|
|
|
|
if ($selectedId === '' && is_array($selected) && isset($selected['id'])) {
|
|
$selectedId = (string) $selected['id'];
|
|
}
|
|
|
|
$h = static fn (?string $value): string => htmlspecialchars($value ?? '', ENT_QUOTES);
|
|
$sectionUrl = static function (string $targetSection, string $requestId = ''): string {
|
|
$query = ['section' => $targetSection];
|
|
if ($requestId !== '') {
|
|
$query['id'] = $requestId;
|
|
}
|
|
|
|
return '/admin/users/?' . http_build_query($query, '', '&', PHP_QUERY_RFC3986);
|
|
};
|
|
|
|
$sectionMeta = [
|
|
'pending' => [
|
|
'label' => 'Freischaltungen',
|
|
'title' => 'Offene Registrierungen',
|
|
'description' => 'Neue Registrierungen pruefen, Gruppen zuweisen und Freischaltungen sauber dokumentieren.',
|
|
'nav' => 'Anfragen sichten und direkt freigeben.',
|
|
],
|
|
'users' => [
|
|
'label' => 'Benutzerstatus',
|
|
'title' => 'Bestehende Benutzer',
|
|
'description' => 'LDAP-Benutzer aktivieren, deaktivieren und Gruppen fuer die Desktop-Nutzung zuweisen.',
|
|
'nav' => 'Aktivierung und Sperrung vorhandener Konten.',
|
|
],
|
|
'reset' => [
|
|
'label' => 'Passwort-Reset',
|
|
'title' => 'Passwortverwaltung',
|
|
'description' => 'Reset-Mails ausloesen oder ein Passwort direkt als Administrator setzen.',
|
|
'nav' => 'Ruecksetzen oder direkt neu vergeben.',
|
|
],
|
|
];
|
|
|
|
ob_start();
|
|
?>
|
|
<div id="user-management-app" class="window-app-shell um-shell">
|
|
<div class="window-app-frame um-frame">
|
|
<aside class="window-app-sidebar um-sidebar">
|
|
<div class="window-app-brand um-brand">
|
|
<p class="window-app-kicker um-kicker">Administration</p>
|
|
<h1>User Management</h1>
|
|
<p class="window-app-copy um-copy">Freischaltungen, Benutzerstatus und Passwort-Reset im gemeinsamen Desktop-Standard.</p>
|
|
</div>
|
|
|
|
<div class="window-app-nav-list um-nav-list">
|
|
<?php foreach ($sectionMeta as $sectionId => $meta): ?>
|
|
<a class="window-app-nav-button um-nav-button<?= $section === $sectionId ? ' is-active' : '' ?>" href="<?= $h($sectionUrl($sectionId, $sectionId === 'pending' ? $selectedId : '')) ?>">
|
|
<strong><?= $h($meta['label']) ?></strong>
|
|
<span class="window-app-meta um-meta"><?= $h($meta['nav']) ?></span>
|
|
</a>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
|
|
<section class="window-app-card um-side-card">
|
|
<strong class="um-side-title">Schnellstatus</strong>
|
|
<div class="um-side-metric">
|
|
<span>Offene Anfragen</span>
|
|
<strong><?= count($pendingRequests) ?></strong>
|
|
</div>
|
|
<div class="um-side-metric">
|
|
<span>Admin</span>
|
|
<strong><?= $h((string) ($currentUser['username'] ?? 'administrator')) ?></strong>
|
|
</div>
|
|
</section>
|
|
</aside>
|
|
|
|
<main class="window-app-main um-main">
|
|
<div class="window-app-panel um-panel">
|
|
<section class="window-app-hero um-hero">
|
|
<div>
|
|
<p class="window-app-kicker um-kicker">User Management</p>
|
|
<h2 class="window-app-title"><?= $h($sectionMeta[$section]['title']) ?></h2>
|
|
<p class="window-app-copy um-copy"><?= $h($sectionMeta[$section]['description']) ?></p>
|
|
</div>
|
|
<div class="window-app-pill-row um-pill-row">
|
|
<span class="window-app-pill">Administrators only</span>
|
|
<span class="window-app-pill">Desktop Auth</span>
|
|
<span class="window-app-pill">Section: <?= $h($sectionMeta[$section]['label']) ?></span>
|
|
</div>
|
|
</section>
|
|
|
|
<?php if ($messages !== []): ?>
|
|
<section class="window-app-card um-card">
|
|
<div class="um-message is-success">
|
|
<strong>Ergebnis</strong>
|
|
<ul class="um-list">
|
|
<?php foreach ($messages as $message): ?>
|
|
<li><?= $h($message) ?></li>
|
|
<?php endforeach; ?>
|
|
</ul>
|
|
</div>
|
|
</section>
|
|
<?php endif; ?>
|
|
|
|
<?php if ($errors !== []): ?>
|
|
<section class="window-app-card um-card">
|
|
<div class="um-message is-error">
|
|
<strong>Bitte pruefen</strong>
|
|
<ul class="um-list">
|
|
<?php foreach ($errors as $error): ?>
|
|
<li><?= $h($error) ?></li>
|
|
<?php endforeach; ?>
|
|
</ul>
|
|
</div>
|
|
</section>
|
|
<?php endif; ?>
|
|
|
|
<script id="um-existing-users-data" type="application/json"><?= json_encode($existingUsers, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) ?></script>
|
|
|
|
<?php if ($section === 'pending'): ?>
|
|
<div class="window-app-grid um-grid um-grid--split">
|
|
<section class="window-app-card um-card">
|
|
<div class="um-section-head">
|
|
<div>
|
|
<p class="window-app-kicker um-kicker">Queue</p>
|
|
<h3 class="um-section-title">Wartende Registrierungen</h3>
|
|
</div>
|
|
<span class="window-app-meta um-meta"><?= count($pendingRequests) ?> offen</span>
|
|
</div>
|
|
|
|
<div class="um-request-list">
|
|
<?php if ($pendingRequests === []): ?>
|
|
<div class="um-empty">Aktuell gibt es keine offenen Registrierungen.</div>
|
|
<?php else: ?>
|
|
<?php foreach ($pendingRequests as $request): ?>
|
|
<a class="um-request-card<?= (($selected['id'] ?? '') === ($request['id'] ?? '')) ? ' is-active' : '' ?>" href="<?= $h($sectionUrl('pending', (string) ($request['id'] ?? ''))) ?>">
|
|
<strong><?= $h((string) ($request['username'] ?? '')) ?></strong>
|
|
<span><?= $h((string) ($request['email'] ?? '')) ?></span>
|
|
<span class="um-request-status"><?= $h((string) ($request['status'] ?? 'pending')) ?></span>
|
|
</a>
|
|
<?php endforeach; ?>
|
|
<?php endif; ?>
|
|
</div>
|
|
</section>
|
|
|
|
<section class="window-app-card um-card">
|
|
<div class="um-section-head">
|
|
<div>
|
|
<p class="window-app-kicker um-kicker">Approval</p>
|
|
<h3 class="um-section-title">Freischaltung</h3>
|
|
</div>
|
|
</div>
|
|
|
|
<?php if (is_array($selected)): ?>
|
|
<div class="um-summary-grid">
|
|
<div class="um-summary-item"><span>Benutzer</span><strong><?= $h((string) ($selected['username'] ?? '')) ?></strong></div>
|
|
<div class="um-summary-item"><span>E-Mail</span><strong><?= $h((string) ($selected['email'] ?? '')) ?></strong></div>
|
|
<div class="um-summary-item"><span>Status</span><strong><?= $h((string) ($selected['status'] ?? '')) ?></strong></div>
|
|
</div>
|
|
|
|
<form class="um-form" method="post" action="/admin/users/">
|
|
<input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
|
|
<input type="hidden" name="selected_id" value="<?= $h((string) ($selected['id'] ?? '')) ?>">
|
|
<input type="hidden" name="action" value="approve-registration">
|
|
<input type="hidden" name="active_section" value="pending">
|
|
|
|
<fieldset class="um-fieldset">
|
|
<legend>Gruppen fuer Freischaltung</legend>
|
|
<div class="um-checkbox-grid">
|
|
<?php foreach ($availableGroups as $group): ?>
|
|
<label class="window-app-item um-checkbox-item">
|
|
<input type="checkbox" name="group_dns[]" value="<?= $h((string) ($group['dn'] ?? '')) ?>">
|
|
<span class="window-app-item-main">
|
|
<strong><?= $h((string) ($group['label'] ?? '')) ?></strong>
|
|
<p><?= $h((string) ($group['dn'] ?? '')) ?></p>
|
|
</span>
|
|
</label>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
</fieldset>
|
|
|
|
<label class="um-field">
|
|
<span>Admin-Notiz</span>
|
|
<textarea name="admin_note" rows="4"></textarea>
|
|
</label>
|
|
|
|
<div class="um-actions">
|
|
<button class="window-app-nav-button um-primary" type="submit">Freischaltung bestaetigen</button>
|
|
</div>
|
|
</form>
|
|
<?php else: ?>
|
|
<div class="um-empty">Keine Anfrage ausgewaehlt.</div>
|
|
<?php endif; ?>
|
|
</section>
|
|
</div>
|
|
<?php elseif ($section === 'users'): ?>
|
|
<section class="window-app-card um-card">
|
|
<div class="um-section-head">
|
|
<div>
|
|
<p class="window-app-kicker um-kicker">Existing User</p>
|
|
<h3 class="um-section-title">Bestehenden Benutzer verwalten</h3>
|
|
</div>
|
|
</div>
|
|
|
|
<form class="um-form" method="post" action="/admin/users/">
|
|
<input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
|
|
<input type="hidden" name="active_section" value="users">
|
|
|
|
<label class="um-field">
|
|
<span>Benutzername</span>
|
|
<div class="um-user-picker" data-user-picker>
|
|
<input type="text" name="manual_username" value="<?= $h($manualUsername) ?>" required autocomplete="off" data-user-picker-input>
|
|
<div class="um-user-picker-list" data-user-picker-list hidden></div>
|
|
</div>
|
|
</label>
|
|
|
|
<fieldset class="um-fieldset">
|
|
<legend>Gruppen fuer Aktivierung</legend>
|
|
<div class="um-checkbox-grid">
|
|
<?php foreach ($availableGroups as $group): ?>
|
|
<label class="window-app-item um-checkbox-item">
|
|
<input type="checkbox" name="manual_group_dns[]" value="<?= $h((string) ($group['dn'] ?? '')) ?>">
|
|
<span class="window-app-item-main">
|
|
<strong><?= $h((string) ($group['label'] ?? '')) ?></strong>
|
|
<p><?= $h((string) ($group['dn'] ?? '')) ?></p>
|
|
</span>
|
|
</label>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
</fieldset>
|
|
|
|
<div class="um-actions">
|
|
<button class="window-app-nav-button um-primary" type="submit" name="action" value="activate-user">Benutzer aktivieren</button>
|
|
<button class="window-app-nav-button um-danger" type="submit" name="action" value="deactivate-user">Benutzer deaktivieren</button>
|
|
</div>
|
|
</form>
|
|
</section>
|
|
<?php else: ?>
|
|
<section class="window-app-card um-card">
|
|
<div class="um-section-head">
|
|
<div>
|
|
<p class="window-app-kicker um-kicker">Reset</p>
|
|
<h3 class="um-section-title">Passwort zuruecksetzen</h3>
|
|
</div>
|
|
</div>
|
|
|
|
<form class="um-form" method="post" action="/admin/users/">
|
|
<input type="hidden" name="csrf_token" value="<?= $h($csrfToken) ?>">
|
|
<input type="hidden" name="active_section" value="reset">
|
|
|
|
<label class="um-field">
|
|
<span>Benutzername</span>
|
|
<div class="um-user-picker" data-user-picker>
|
|
<input type="text" name="reset_username" value="<?= $h($manualResetUsername) ?>" required autocomplete="off" data-user-picker-input>
|
|
<div class="um-user-picker-list" data-user-picker-list hidden></div>
|
|
</div>
|
|
</label>
|
|
|
|
<label class="um-field">
|
|
<span>Neues Passwort fuer direkten Reset</span>
|
|
<input type="password" name="reset_password" value="" placeholder="Optional fuer direkten Admin-Reset">
|
|
</label>
|
|
|
|
<div class="um-actions">
|
|
<button class="window-app-nav-button um-secondary" type="submit" name="action" value="send-reset-mail">Reset-Mail senden</button>
|
|
<button class="window-app-nav-button um-primary" type="submit" name="action" value="set-password">Passwort direkt setzen</button>
|
|
</div>
|
|
</form>
|
|
</section>
|
|
<?php endif; ?>
|
|
</div>
|
|
</main>
|
|
</div>
|
|
</div>
|
|
<?php
|
|
$pageContent = (string) ob_get_clean();
|
|
|
|
if ($isPartial) {
|
|
echo $pageContent;
|
|
return;
|
|
}
|
|
?><!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>User Management</title>
|
|
<link rel="stylesheet" href="/assets/desktop/desktop.css">
|
|
<link rel="stylesheet" href="/assets/apps/user-management/app.css">
|
|
</head>
|
|
<body>
|
|
<?= $pageContent ?>
|
|
<script src="/assets/apps/user-management/app.js"></script>
|
|
<script>
|
|
window.initUserManagementApp?.(document.getElementById('user-management-app'), { standalone: true });
|
|
</script>
|
|
</body>
|
|
</html>
|