mirror of
https://github.com/we-promise/sure.git
synced 2026-04-19 20:14:08 +00:00
Merge pull request #538 from luckyPipewrench/sso-upgrades
Multi-provider SSO with admin UI and SAML support
This commit is contained in:
soky srm
276
app/views/admin/sso_providers/_form.html.erb
Normal file
276
app/views/admin/sso_providers/_form.html.erb
Normal file
@@ -0,0 +1,276 @@
|
||||
<%# locals: (sso_provider:) %>
|
||||
|
||||
<% if sso_provider.errors.any? %>
|
||||
<div class="bg-destructive/10 border border-destructive rounded-lg p-4 mb-4">
|
||||
<div class="flex">
|
||||
<%= icon "alert-circle", class: "w-5 h-5 text-destructive mr-2 shrink-0" %>
|
||||
<div>
|
||||
<p class="text-sm font-medium text-destructive">
|
||||
<%= pluralize(sso_provider.errors.count, "error") %> prohibited this provider from being saved:
|
||||
</p>
|
||||
<ul class="mt-2 text-sm text-destructive list-disc list-inside">
|
||||
<% sso_provider.errors.full_messages.each do |message| %>
|
||||
<li><%= message %></li>
|
||||
<% end %>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<%= styled_form_with model: [:admin, sso_provider], class: "space-y-6", data: { controller: "admin-sso-form" } do |form| %>
|
||||
<div class="space-y-4">
|
||||
<h3 class="font-medium text-primary">Basic Information</h3>
|
||||
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<%= form.select :strategy,
|
||||
options_for_select([
|
||||
["OpenID Connect", "openid_connect"],
|
||||
["SAML 2.0", "saml"],
|
||||
["Google OAuth2", "google_oauth2"],
|
||||
["GitHub", "github"]
|
||||
], sso_provider.strategy),
|
||||
{ label: "Strategy" },
|
||||
{ data: { action: "change->admin-sso-form#toggleFields" } } %>
|
||||
|
||||
<%= form.text_field :name,
|
||||
label: "Name",
|
||||
placeholder: "e.g., keycloak, authentik",
|
||||
required: true,
|
||||
data: { action: "input->admin-sso-form#updateCallbackUrl" } %>
|
||||
</div>
|
||||
<p class="text-xs text-secondary -mt-2">Unique identifier (lowercase, numbers, underscores only)</p>
|
||||
|
||||
<div class="grid grid-cols-1 gap-4 sm:grid-cols-2">
|
||||
<%= form.text_field :label,
|
||||
label: "Button Label",
|
||||
placeholder: "e.g., Sign in with Keycloak",
|
||||
required: true %>
|
||||
|
||||
<div>
|
||||
<%= form.text_field :icon,
|
||||
label: "Icon (optional)",
|
||||
placeholder: "e.g., key, shield" %>
|
||||
<p class="text-xs text-secondary mt-1">Lucide icon name for the login button</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<%= form.check_box :enabled,
|
||||
label: "Enable this provider",
|
||||
checked: sso_provider.enabled? %>
|
||||
</div>
|
||||
|
||||
<div class="border-t border-primary pt-4 space-y-4">
|
||||
<h3 class="font-medium text-primary">OAuth/OIDC Configuration</h3>
|
||||
|
||||
<div data-oidc-field class="<%= "hidden" unless sso_provider.strategy == "openid_connect" %>">
|
||||
<%= form.text_field :issuer,
|
||||
label: "Issuer URL",
|
||||
placeholder: "https://your-idp.example.com/realms/your-realm",
|
||||
data: { action: "blur->admin-sso-form#validateIssuer" } %>
|
||||
<p class="text-xs text-secondary mt-1">OIDC issuer URL (validates .well-known/openid-configuration)</p>
|
||||
</div>
|
||||
|
||||
<%= form.text_field :client_id,
|
||||
label: "Client ID",
|
||||
placeholder: "your-client-id",
|
||||
required: true %>
|
||||
|
||||
<%= form.password_field :client_secret,
|
||||
label: "Client Secret",
|
||||
placeholder: sso_provider.persisted? ? "••••••••" : "your-client-secret",
|
||||
required: !sso_provider.persisted? %>
|
||||
<% if sso_provider.persisted? %>
|
||||
<p class="text-xs text-secondary -mt-2">Leave blank to keep existing secret</p>
|
||||
<% end %>
|
||||
|
||||
<div data-oidc-field class="<%= "hidden" unless sso_provider.strategy == "openid_connect" %>">
|
||||
<label class="block text-sm font-medium text-primary mb-1">Callback URL</label>
|
||||
<div class="flex items-center gap-2">
|
||||
<code class="flex-1 bg-surface px-3 py-2 rounded text-sm text-secondary overflow-x-auto"
|
||||
data-admin-sso-form-target="callbackUrl"><%= "#{request.base_url}/auth/#{sso_provider.name.presence || 'PROVIDER_NAME'}/callback" %></code>
|
||||
<button type="button"
|
||||
data-action="click->admin-sso-form#copyCallback"
|
||||
class="p-2 text-secondary hover:text-primary shrink-0"
|
||||
title="Copy to clipboard">
|
||||
<%= icon "copy", class: "w-4 h-4" %>
|
||||
</button>
|
||||
</div>
|
||||
<p class="text-xs text-secondary mt-1">Configure this URL in your identity provider</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div data-saml-field class="border-t border-primary pt-4 space-y-4 <%= "hidden" unless sso_provider.strategy == "saml" %>">
|
||||
<h3 class="font-medium text-primary"><%= t("admin.sso_providers.form.saml_configuration") %></h3>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.idp_metadata_url") %></label>
|
||||
<input type="text" name="sso_provider[settings][idp_metadata_url]"
|
||||
value="<%= sso_provider.settings&.dig("idp_metadata_url") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="https://idp.example.com/metadata"
|
||||
autocomplete="off">
|
||||
<p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.idp_metadata_url_help") %></p>
|
||||
</div>
|
||||
|
||||
<details class="mt-4">
|
||||
<summary class="cursor-pointer text-sm font-medium text-secondary hover:text-primary"><%= t("admin.sso_providers.form.manual_saml_config") %></summary>
|
||||
<div class="mt-3 space-y-3 pl-4 border-l-2 border-secondary/30">
|
||||
<p class="text-xs text-secondary"><%= t("admin.sso_providers.form.manual_saml_help") %></p>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.idp_sso_url") %></label>
|
||||
<input type="text" name="sso_provider[settings][idp_sso_url]"
|
||||
value="<%= sso_provider.settings&.dig("idp_sso_url") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="https://idp.example.com/sso"
|
||||
autocomplete="off">
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.idp_slo_url") %></label>
|
||||
<input type="text" name="sso_provider[settings][idp_slo_url]"
|
||||
value="<%= sso_provider.settings&.dig("idp_slo_url") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="https://idp.example.com/slo (optional)"
|
||||
autocomplete="off">
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.idp_certificate") %></label>
|
||||
<textarea name="sso_provider[settings][idp_certificate]"
|
||||
rows="4"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm font-mono"
|
||||
placeholder="-----BEGIN CERTIFICATE-----"><%= sso_provider.settings&.dig("idp_certificate") %></textarea>
|
||||
<p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.idp_certificate_help") %></p>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.idp_cert_fingerprint") %></label>
|
||||
<input type="text" name="sso_provider[settings][idp_cert_fingerprint]"
|
||||
value="<%= sso_provider.settings&.dig("idp_cert_fingerprint") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm font-mono"
|
||||
placeholder="AB:CD:EF:..."
|
||||
autocomplete="off">
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.name_id_format") %></label>
|
||||
<select name="sso_provider[settings][name_id_format]"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm">
|
||||
<option value="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" <%= "selected" if sso_provider.settings&.dig("name_id_format").blank? || sso_provider.settings&.dig("name_id_format") == "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" %>><%= t("admin.sso_providers.form.name_id_email") %></option>
|
||||
<option value="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" <%= "selected" if sso_provider.settings&.dig("name_id_format") == "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" %>><%= t("admin.sso_providers.form.name_id_persistent") %></option>
|
||||
<option value="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" <%= "selected" if sso_provider.settings&.dig("name_id_format") == "urn:oasis:names:tc:SAML:2.0:nameid-format:transient" %>><%= t("admin.sso_providers.form.name_id_transient") %></option>
|
||||
<option value="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" <%= "selected" if sso_provider.settings&.dig("name_id_format") == "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" %>><%= t("admin.sso_providers.form.name_id_unspecified") %></option>
|
||||
</select>
|
||||
</div>
|
||||
</div>
|
||||
</details>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1">SP Callback URL (ACS URL)</label>
|
||||
<div class="flex items-center gap-2">
|
||||
<code class="flex-1 bg-surface px-3 py-2 rounded text-sm text-secondary overflow-x-auto"
|
||||
data-admin-sso-form-target="samlCallbackUrl"><%= "#{request.base_url}/auth/#{sso_provider.name.presence || 'PROVIDER_NAME'}/callback" %></code>
|
||||
<button type="button"
|
||||
data-action="click->admin-sso-form#copySamlCallback"
|
||||
class="p-2 text-secondary hover:text-primary shrink-0"
|
||||
title="Copy to clipboard">
|
||||
<%= icon "copy", class: "w-4 h-4" %>
|
||||
</button>
|
||||
</div>
|
||||
<p class="text-xs text-secondary mt-1">Configure this URL as the Assertion Consumer Service URL in your IdP</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="border-t border-primary pt-4 space-y-4">
|
||||
<h3 class="font-medium text-primary"><%= t("admin.sso_providers.form.provisioning_title") %></h3>
|
||||
|
||||
<%= form.select "settings[default_role]",
|
||||
options_for_select([
|
||||
[t("admin.sso_providers.form.role_member"), "member"],
|
||||
[t("admin.sso_providers.form.role_admin"), "admin"],
|
||||
[t("admin.sso_providers.form.role_super_admin"), "super_admin"]
|
||||
], sso_provider.settings&.dig("default_role") || "member"),
|
||||
{ label: t("admin.sso_providers.form.default_role_label"), include_blank: false } %>
|
||||
<p class="text-xs text-secondary -mt-2"><%= t("admin.sso_providers.form.default_role_help") %></p>
|
||||
|
||||
<details class="mt-4">
|
||||
<summary class="cursor-pointer text-sm font-medium text-secondary hover:text-primary"><%= t("admin.sso_providers.form.role_mapping_title") %></summary>
|
||||
<div class="mt-3 space-y-3 pl-4 border-l-2 border-secondary/30">
|
||||
<p class="text-xs text-secondary"><%= t("admin.sso_providers.form.role_mapping_help") %></p>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.super_admin_groups") %></label>
|
||||
<input type="text" name="sso_provider[settings][role_mapping][super_admin]"
|
||||
value="<%= Array(sso_provider.settings&.dig("role_mapping", "super_admin")).join(", ") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="Platform-Admins, IdP-Superusers"
|
||||
autocomplete="off">
|
||||
<p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.groups_help") %></p>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.admin_groups") %></label>
|
||||
<input type="text" name="sso_provider[settings][role_mapping][admin]"
|
||||
value="<%= Array(sso_provider.settings&.dig("role_mapping", "admin")).join(", ") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="Team-Leads, Managers"
|
||||
autocomplete="off">
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label class="block text-sm font-medium text-primary mb-1"><%= t("admin.sso_providers.form.member_groups") %></label>
|
||||
<input type="text" name="sso_provider[settings][role_mapping][member]"
|
||||
value="<%= Array(sso_provider.settings&.dig("role_mapping", "member")).join(", ") %>"
|
||||
class="w-full px-3 py-2 border border-primary rounded-lg text-sm"
|
||||
placeholder="* (all groups)"
|
||||
autocomplete="off">
|
||||
</div>
|
||||
</div>
|
||||
</details>
|
||||
</div>
|
||||
|
||||
<div data-oidc-field class="border-t border-primary pt-4 space-y-4 <%= "hidden" unless sso_provider.strategy == "openid_connect" %>">
|
||||
<h3 class="font-medium text-primary"><%= t("admin.sso_providers.form.advanced_title") %></h3>
|
||||
|
||||
<div>
|
||||
<%= form.text_field "settings[scopes]",
|
||||
label: t("admin.sso_providers.form.scopes_label"),
|
||||
value: sso_provider.settings&.dig("scopes"),
|
||||
placeholder: "openid email profile groups" %>
|
||||
<p class="text-xs text-secondary mt-1"><%= t("admin.sso_providers.form.scopes_help") %></p>
|
||||
</div>
|
||||
|
||||
<%= form.select "settings[prompt]",
|
||||
options_for_select([
|
||||
[t("admin.sso_providers.form.prompt_default"), ""],
|
||||
[t("admin.sso_providers.form.prompt_login"), "login"],
|
||||
[t("admin.sso_providers.form.prompt_consent"), "consent"],
|
||||
[t("admin.sso_providers.form.prompt_select_account"), "select_account"],
|
||||
[t("admin.sso_providers.form.prompt_none"), "none"]
|
||||
], sso_provider.settings&.dig("prompt")),
|
||||
{ label: t("admin.sso_providers.form.prompt_label"), include_blank: false } %>
|
||||
<p class="text-xs text-secondary -mt-2"><%= t("admin.sso_providers.form.prompt_help") %></p>
|
||||
</div>
|
||||
|
||||
<div class="flex justify-between items-center gap-3 pt-4 border-t border-primary">
|
||||
<div>
|
||||
<% if sso_provider.persisted? %>
|
||||
<button type="button"
|
||||
data-action="click->admin-sso-form#testConnection"
|
||||
data-admin-sso-form-test-url-value="<%= test_connection_admin_sso_provider_path(sso_provider) %>"
|
||||
class="px-4 py-2 text-sm font-medium text-secondary hover:text-primary border border-secondary rounded-lg">
|
||||
<%= t("admin.sso_providers.form.test_connection") %>
|
||||
</button>
|
||||
<span data-admin-sso-form-target="testResult" class="ml-2 text-sm"></span>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<div class="flex gap-3">
|
||||
<%= link_to "Cancel", admin_sso_providers_path, class: "px-4 py-2 text-sm font-medium text-secondary hover:text-primary" %>
|
||||
<%= form.submit sso_provider.persisted? ? "Update Provider" : "Create Provider",
|
||||
class: "px-4 py-2 bg-primary text-inverse rounded-lg text-sm font-medium hover:bg-primary/90" %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
9
app/views/admin/sso_providers/edit.html.erb
Normal file
9
app/views/admin/sso_providers/edit.html.erb
Normal file
@@ -0,0 +1,9 @@
|
||||
<%= content_for :page_title, "Edit #{@sso_provider.label}" %>
|
||||
|
||||
<div class="space-y-4">
|
||||
<p class="text-secondary">Update configuration for <%= @sso_provider.label %>.</p>
|
||||
|
||||
<%= settings_section title: "Provider Configuration" do %>
|
||||
<%= render "form", sso_provider: @sso_provider %>
|
||||
<% end %>
|
||||
</div>
|
||||
88
app/views/admin/sso_providers/index.html.erb
Normal file
88
app/views/admin/sso_providers/index.html.erb
Normal file
@@ -0,0 +1,88 @@
|
||||
<%= content_for :page_title, "SSO Providers" %>
|
||||
|
||||
<div class="space-y-4">
|
||||
<p class="text-secondary mb-4">
|
||||
Manage single sign-on authentication providers for your instance.
|
||||
<% unless Flipper.enabled?(:db_sso_providers) %>
|
||||
<span class="text-warning">Changes require a server restart to take effect.</span>
|
||||
<% end %>
|
||||
</p>
|
||||
|
||||
<%= settings_section title: "Configured Providers" do %>
|
||||
<% if @sso_providers.any? %>
|
||||
<div class="divide-y divide-primary">
|
||||
<% @sso_providers.each do |provider| %>
|
||||
<div class="flex items-center justify-between py-3 first:pt-0 last:pb-0">
|
||||
<div class="flex items-center gap-3">
|
||||
<% if provider.icon.present? %>
|
||||
<%= icon provider.icon, class: "w-5 h-5 text-secondary" %>
|
||||
<% else %>
|
||||
<%= icon "key", class: "w-5 h-5 text-secondary" %>
|
||||
<% end %>
|
||||
<div>
|
||||
<p class="font-medium text-primary"><%= provider.label %></p>
|
||||
<p class="text-sm text-secondary"><%= provider.strategy.titleize %> · <%= provider.name %></p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="flex items-center gap-2">
|
||||
<% if provider.enabled? %>
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-green-100 text-green-800">
|
||||
Enabled
|
||||
</span>
|
||||
<% else %>
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-secondary">
|
||||
Disabled
|
||||
</span>
|
||||
<% end %>
|
||||
<%= link_to edit_admin_sso_provider_path(provider), class: "p-1 text-secondary hover:text-primary", title: "Edit" do %>
|
||||
<%= icon "pencil", class: "w-4 h-4" %>
|
||||
<% end %>
|
||||
<%= button_to toggle_admin_sso_provider_path(provider), method: :patch, class: "p-1 text-secondary hover:text-primary", title: provider.enabled? ? "Disable" : "Enable", form: { data: { turbo_confirm: "Are you sure you want to #{provider.enabled? ? 'disable' : 'enable'} this provider?" } } do %>
|
||||
<%= icon provider.enabled? ? "toggle-right" : "toggle-left", class: "w-4 h-4" %>
|
||||
<% end %>
|
||||
<%= button_to admin_sso_provider_path(provider), method: :delete, class: "p-1 text-destructive hover:text-destructive", title: "Delete", form: { data: { turbo_confirm: "Are you sure you want to delete this provider? This action cannot be undone." } } do %>
|
||||
<%= icon "trash-2", class: "w-4 h-4" %>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="text-center py-6">
|
||||
<%= icon "key", class: "w-12 h-12 mx-auto text-secondary mb-3" %>
|
||||
<p class="text-secondary">No SSO providers configured yet.</p>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<div class="pt-4 border-t border-primary">
|
||||
<%= link_to new_admin_sso_provider_path, class: "inline-flex items-center gap-2 text-sm font-medium text-primary hover:text-secondary" do %>
|
||||
<%= icon "plus", class: "w-4 h-4" %>
|
||||
Add Provider
|
||||
<% end %>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<%= settings_section title: "Configuration Mode", collapsible: true, open: false do %>
|
||||
<div class="space-y-3">
|
||||
<div class="flex items-center justify-between">
|
||||
<div>
|
||||
<p class="font-medium text-primary">Database-backed providers</p>
|
||||
<p class="text-sm text-secondary">Load providers from database instead of YAML config</p>
|
||||
</div>
|
||||
<% if Flipper.enabled?(:db_sso_providers) %>
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-green-100 text-green-800">
|
||||
Enabled
|
||||
</span>
|
||||
<% else %>
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-secondary">
|
||||
Disabled
|
||||
</span>
|
||||
<% end %>
|
||||
</div>
|
||||
<p class="text-sm text-secondary">
|
||||
Set <code class="bg-surface px-1 py-0.5 rounded text-xs">AUTH_PROVIDERS_SOURCE=db</code> to enable database-backed providers.
|
||||
This allows changes without server restarts.
|
||||
</p>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
9
app/views/admin/sso_providers/new.html.erb
Normal file
9
app/views/admin/sso_providers/new.html.erb
Normal file
@@ -0,0 +1,9 @@
|
||||
<%= content_for :page_title, "Add SSO Provider" %>
|
||||
|
||||
<div class="space-y-4">
|
||||
<p class="text-secondary">Configure a new single sign-on authentication provider.</p>
|
||||
|
||||
<%= settings_section title: "Provider Configuration" do %>
|
||||
<%= render "form", sso_provider: @sso_provider %>
|
||||
<% end %>
|
||||
</div>
|
||||
73
app/views/admin/users/index.html.erb
Normal file
73
app/views/admin/users/index.html.erb
Normal file
@@ -0,0 +1,73 @@
|
||||
<%= content_for :page_title, t(".title") %>
|
||||
|
||||
<div class="space-y-4">
|
||||
<p class="text-secondary"><%= t(".description") %></p>
|
||||
|
||||
<%= settings_section title: t(".section_title") do %>
|
||||
<div class="divide-y divide-primary">
|
||||
<% @users.each do |user| %>
|
||||
<div class="flex items-center justify-between py-3 first:pt-0 last:pb-0">
|
||||
<div class="flex items-center gap-3">
|
||||
<div class="w-8 h-8 rounded-full bg-surface flex items-center justify-center">
|
||||
<span class="text-sm font-medium text-primary"><%= user.initials %></span>
|
||||
</div>
|
||||
<div>
|
||||
<p class="font-medium text-primary"><%= user.display_name %></p>
|
||||
<p class="text-sm text-secondary"><%= user.email %></p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="flex items-center gap-3">
|
||||
<% if user.id == Current.user.id %>
|
||||
<span class="text-sm text-secondary"><%= t(".you") %></span>
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-primary">
|
||||
<%= t(".roles.#{user.role}") %>
|
||||
</span>
|
||||
<% else %>
|
||||
<%= form_with model: [:admin, user], method: :patch, class: "flex items-center gap-2" do |form| %>
|
||||
<%= form.select :role,
|
||||
options_for_select([
|
||||
[t(".roles.member"), "member"],
|
||||
[t(".roles.admin"), "admin"],
|
||||
[t(".roles.super_admin"), "super_admin"]
|
||||
], user.role),
|
||||
{},
|
||||
class: "text-sm rounded-lg border-primary bg-container text-primary px-2 py-1",
|
||||
onchange: "this.form.requestSubmit()" %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
|
||||
<% if @users.empty? %>
|
||||
<div class="text-center py-6">
|
||||
<%= icon "users", class: "w-12 h-12 mx-auto text-secondary mb-3" %>
|
||||
<p class="text-secondary"><%= t(".no_users") %></p>
|
||||
</div>
|
||||
<% end %>
|
||||
<% end %>
|
||||
|
||||
<%= settings_section title: t(".role_descriptions_title"), collapsible: true, open: false do %>
|
||||
<div class="space-y-3 text-sm">
|
||||
<div class="flex items-start gap-3">
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-primary shrink-0">
|
||||
<%= t(".roles.member") %>
|
||||
</span>
|
||||
<p class="text-secondary"><%= t(".role_descriptions.member") %></p>
|
||||
</div>
|
||||
<div class="flex items-start gap-3">
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-surface text-primary shrink-0">
|
||||
<%= t(".roles.admin") %>
|
||||
</span>
|
||||
<p class="text-secondary"><%= t(".role_descriptions.admin") %></p>
|
||||
</div>
|
||||
<div class="flex items-start gap-3">
|
||||
<span class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium bg-green-100 text-green-800 shrink-0">
|
||||
<%= t(".roles.super_admin") %>
|
||||
</span>
|
||||
<p class="text-secondary"><%= t(".role_descriptions.super_admin") %></p>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
@@ -30,7 +30,9 @@ nav_sections = [
|
||||
{ label: t(".api_keys_label"), path: settings_api_key_path, icon: "key" },
|
||||
{ label: t(".self_hosting_label"), path: settings_hosting_path, icon: "database", if: self_hosted? },
|
||||
{ label: "Providers", path: settings_providers_path, icon: "plug" },
|
||||
{ label: t(".imports_label"), path: imports_path, icon: "download" }
|
||||
{ label: t(".imports_label"), path: imports_path, icon: "download" },
|
||||
{ label: "SSO Providers", path: admin_sso_providers_path, icon: "key-round", if: Current.user&.super_admin? },
|
||||
{ label: "Users", path: admin_users_path, icon: "users", if: Current.user&.super_admin? }
|
||||
]
|
||||
} : nil
|
||||
),
|
||||
|
||||
@@ -44,3 +44,58 @@
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<% if @oidc_identities.any? || AuthConfig.sso_providers.any? %>
|
||||
<%= settings_section title: t(".sso_title"), subtitle: t(".sso_subtitle") do %>
|
||||
<% if @oidc_identities.any? %>
|
||||
<div class="space-y-2">
|
||||
<% @oidc_identities.each do |identity| %>
|
||||
<div class="flex items-center justify-between bg-container p-4 shadow-border-xs rounded-lg">
|
||||
<div class="flex items-center gap-3">
|
||||
<div class="w-9 h-9 shrink-0 bg-surface rounded-full flex items-center justify-center">
|
||||
<%= icon identity.provider_config&.dig(:icon) || "key", class: "w-5 h-5 text-secondary" %>
|
||||
</div>
|
||||
<div>
|
||||
<p class="font-medium text-primary"><%= identity.provider_config&.dig(:label) || identity.provider.titleize %></p>
|
||||
<p class="text-sm text-secondary"><%= identity.info&.dig("email") || t(".sso_no_email") %></p>
|
||||
<p class="text-xs text-secondary">
|
||||
<%= t(".sso_last_used") %>:
|
||||
<%= identity.last_authenticated_at&.to_fs(:short) || t(".sso_never") %>
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<% if @oidc_identities.count > 1 || Current.user.password_digest.present? %>
|
||||
<%= render DS::Button.new(
|
||||
text: t(".sso_disconnect"),
|
||||
variant: "outline",
|
||||
size: "sm",
|
||||
href: settings_sso_identity_path(identity),
|
||||
method: :delete,
|
||||
confirm: CustomConfirm.new(
|
||||
title: t(".sso_confirm_title"),
|
||||
body: t(".sso_confirm_body", provider: identity.provider_config&.dig(:label) || identity.provider.titleize),
|
||||
btn_text: t(".sso_confirm_button"),
|
||||
destructive: true
|
||||
)
|
||||
) %>
|
||||
<% end %>
|
||||
</div>
|
||||
<% end %>
|
||||
</div>
|
||||
<% if @oidc_identities.count == 1 && Current.user.password_digest.blank? %>
|
||||
<div class="mt-4 p-3 bg-amber-50 border border-amber-200 rounded-lg">
|
||||
<div class="flex items-start gap-2">
|
||||
<%= icon "alert-triangle", class: "w-5 h-5 text-amber-600 shrink-0 mt-0.5" %>
|
||||
<p class="text-sm text-amber-800"><%= t(".sso_warning_message") %></p>
|
||||
</div>
|
||||
</div>
|
||||
<% end %>
|
||||
<% else %>
|
||||
<div class="text-center py-6">
|
||||
<%= icon "link", class: "w-12 h-12 mx-auto text-secondary mb-3" %>
|
||||
<p class="text-secondary"><%= t(".sso_no_identities") %></p>
|
||||
<p class="text-sm text-secondary mt-2"><%= t(".sso_connect_hint") %></p>
|
||||
</div>
|
||||
<% end %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
|
||||
Reference in New Issue
Block a user