Add multi-user support with admin user management
- Rewrite auth.py for multi-user schema (users table with roles) - Auto-migrate from single-user admin_user table to new schema - Add @admin_required decorator for protected routes - Admin routes: /admin/users, /admin/users/new, delete, reset-password - New templates: admin/users.html, user_new.html, user_created.html, password_reset.html - Update login.html for username field, base.html and account.html for admin nav - Max 16 users + 1 admin, session invalidation on delete/password reset 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Aaron D. Lee
@@ -12,8 +12,21 @@
|
||||
<div class="card-body">
|
||||
<p class="text-muted mb-4">
|
||||
Logged in as <strong>{{ username }}</strong>
|
||||
{% if is_admin %}
|
||||
<span class="badge bg-warning text-dark ms-2">
|
||||
<i class="bi bi-shield-check me-1"></i>Admin
|
||||
</span>
|
||||
{% endif %}
|
||||
</p>
|
||||
|
||||
{% if is_admin %}
|
||||
<div class="mb-4">
|
||||
<a href="{{ url_for('admin_users') }}" class="btn btn-outline-primary w-100">
|
||||
<i class="bi bi-people me-2"></i>Manage Users
|
||||
</a>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<h6 class="text-muted mb-3">Change Password</h6>
|
||||
|
||||
<form method="POST" action="{{ url_for('account') }}" id="accountForm">
|
||||
|
||||
62
frontends/web/templates/admin/password_reset.html
Normal file
62
frontends/web/templates/admin/password_reset.html
Normal file
@@ -0,0 +1,62 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Password Reset - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-6 col-lg-5">
|
||||
<div class="card border-warning">
|
||||
<div class="card-header bg-warning text-dark">
|
||||
<i class="bi bi-key fs-4 me-2"></i>
|
||||
<span class="fs-5">Password Reset</span>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<div class="alert alert-warning">
|
||||
<i class="bi bi-exclamation-triangle me-2"></i>
|
||||
<strong>Important:</strong> This password will only be shown once.
|
||||
Make sure to share it with <strong>{{ username }}</strong> securely.
|
||||
</div>
|
||||
|
||||
<p class="text-muted">
|
||||
The user's sessions have been invalidated. They will need to log in
|
||||
again with the new password.
|
||||
</p>
|
||||
|
||||
<div class="mb-4">
|
||||
<label class="form-label text-muted small">New Password for {{ username }}</label>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control form-control-lg font-monospace"
|
||||
value="{{ password }}" readonly id="passwordField">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="copyField('passwordField')" title="Copy password">
|
||||
<i class="bi bi-clipboard"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="d-grid">
|
||||
<a href="{{ url_for('admin_users') }}" class="btn btn-primary">
|
||||
<i class="bi bi-arrow-left me-2"></i>Back to Users
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script>
|
||||
function copyField(fieldId) {
|
||||
const field = document.getElementById(fieldId);
|
||||
field.select();
|
||||
document.execCommand('copy');
|
||||
|
||||
// Show brief feedback
|
||||
const btn = field.nextElementSibling;
|
||||
const originalHTML = btn.innerHTML;
|
||||
btn.innerHTML = '<i class="bi bi-check"></i>';
|
||||
setTimeout(() => btn.innerHTML = originalHTML, 1000);
|
||||
}
|
||||
</script>
|
||||
{% endblock %}
|
||||
72
frontends/web/templates/admin/user_created.html
Normal file
72
frontends/web/templates/admin/user_created.html
Normal file
@@ -0,0 +1,72 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}User Created - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-6 col-lg-5">
|
||||
<div class="card border-success">
|
||||
<div class="card-header bg-success text-white">
|
||||
<i class="bi bi-check-circle fs-4 me-2"></i>
|
||||
<span class="fs-5">User Created Successfully</span>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<div class="alert alert-warning">
|
||||
<i class="bi bi-exclamation-triangle me-2"></i>
|
||||
<strong>Important:</strong> This password will only be shown once.
|
||||
Make sure to share it with the user securely.
|
||||
</div>
|
||||
|
||||
<div class="mb-3">
|
||||
<label class="form-label text-muted small">Username</label>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control form-control-lg font-monospace"
|
||||
value="{{ username }}" readonly id="usernameField">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="copyField('usernameField')" title="Copy username">
|
||||
<i class="bi bi-clipboard"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mb-4">
|
||||
<label class="form-label text-muted small">Password</label>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control form-control-lg font-monospace"
|
||||
value="{{ password }}" readonly id="passwordField">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="copyField('passwordField')" title="Copy password">
|
||||
<i class="bi bi-clipboard"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="d-grid gap-2">
|
||||
<a href="{{ url_for('admin_user_new') }}" class="btn btn-primary">
|
||||
<i class="bi bi-person-plus me-2"></i>Add Another User
|
||||
</a>
|
||||
<a href="{{ url_for('admin_users') }}" class="btn btn-outline-secondary">
|
||||
<i class="bi bi-arrow-left me-2"></i>Back to Users
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script>
|
||||
function copyField(fieldId) {
|
||||
const field = document.getElementById(fieldId);
|
||||
field.select();
|
||||
document.execCommand('copy');
|
||||
|
||||
// Show brief feedback
|
||||
const btn = field.nextElementSibling;
|
||||
const originalHTML = btn.innerHTML;
|
||||
btn.innerHTML = '<i class="bi bi-check"></i>';
|
||||
setTimeout(() => btn.innerHTML = originalHTML, 1000);
|
||||
}
|
||||
</script>
|
||||
{% endblock %}
|
||||
73
frontends/web/templates/admin/user_new.html
Normal file
73
frontends/web/templates/admin/user_new.html
Normal file
@@ -0,0 +1,73 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Add User - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-6 col-lg-5">
|
||||
<div class="card">
|
||||
<div class="card-header">
|
||||
<i class="bi bi-person-plus fs-4 me-2"></i>
|
||||
<span class="fs-5">Add New User</span>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<form method="POST" action="{{ url_for('admin_user_new') }}">
|
||||
<div class="mb-3">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-person me-1"></i> Username
|
||||
</label>
|
||||
<input type="text" name="username" class="form-control"
|
||||
placeholder="e.g., john_doe or john@example.com"
|
||||
pattern="[a-zA-Z0-9][a-zA-Z0-9_\-@.]{2,79}"
|
||||
title="3-80 characters, letters/numbers/underscore/hyphen/@/."
|
||||
required autofocus>
|
||||
<div class="form-text">
|
||||
Letters, numbers, underscore, hyphen, @ and . allowed.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-key me-1"></i> Password
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="text" name="password" id="passwordInput"
|
||||
class="form-control" value="{{ temp_password }}"
|
||||
minlength="8" required>
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="regeneratePassword()" title="Generate new password">
|
||||
<i class="bi bi-arrow-repeat"></i>
|
||||
</button>
|
||||
</div>
|
||||
<div class="form-text">
|
||||
Auto-generated password. You can edit or regenerate it.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="d-flex gap-2">
|
||||
<button type="submit" class="btn btn-primary flex-grow-1">
|
||||
<i class="bi bi-person-check me-2"></i>Create User
|
||||
</button>
|
||||
<a href="{{ url_for('admin_users') }}" class="btn btn-outline-secondary">
|
||||
Cancel
|
||||
</a>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script>
|
||||
function regeneratePassword() {
|
||||
const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
|
||||
let password = '';
|
||||
for (let i = 0; i < 8; i++) {
|
||||
password += chars.charAt(Math.floor(Math.random() * chars.length));
|
||||
}
|
||||
document.getElementById('passwordInput').value = password;
|
||||
}
|
||||
</script>
|
||||
{% endblock %}
|
||||
95
frontends/web/templates/admin/users.html
Normal file
95
frontends/web/templates/admin/users.html
Normal file
@@ -0,0 +1,95 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Manage Users - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-10 col-lg-8">
|
||||
<div class="card">
|
||||
<div class="card-header d-flex justify-content-between align-items-center">
|
||||
<div>
|
||||
<i class="bi bi-people fs-4 me-2"></i>
|
||||
<span class="fs-5">User Management</span>
|
||||
</div>
|
||||
<div class="text-muted small">
|
||||
{{ user_count }} / {{ max_users }} users
|
||||
</div>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
{% if can_create %}
|
||||
<div class="mb-4">
|
||||
<a href="{{ url_for('admin_user_new') }}" class="btn btn-primary">
|
||||
<i class="bi bi-person-plus me-2"></i>Add User
|
||||
</a>
|
||||
</div>
|
||||
{% else %}
|
||||
<div class="alert alert-warning mb-4">
|
||||
<i class="bi bi-exclamation-triangle me-2"></i>
|
||||
Maximum of {{ max_users }} users reached.
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<div class="table-responsive">
|
||||
<table class="table table-hover mb-0">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Username</th>
|
||||
<th>Role</th>
|
||||
<th>Created</th>
|
||||
<th class="text-end">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for user in users %}
|
||||
<tr>
|
||||
<td>
|
||||
<i class="bi bi-person me-2"></i>
|
||||
{{ user.username }}
|
||||
{% if user.id == current_user.id %}
|
||||
<span class="badge bg-info ms-2">You</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
{% if user.is_admin %}
|
||||
<span class="badge bg-warning text-dark">
|
||||
<i class="bi bi-shield-check me-1"></i>Admin
|
||||
</span>
|
||||
{% else %}
|
||||
<span class="badge bg-secondary">User</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td class="text-muted small">
|
||||
{{ user.created_at[:10] if user.created_at else 'Unknown' }}
|
||||
</td>
|
||||
<td class="text-end">
|
||||
{% if user.id != current_user.id %}
|
||||
<form method="POST" action="{{ url_for('admin_user_reset_password', user_id=user.id) }}"
|
||||
class="d-inline" onsubmit="return confirm('Reset password for {{ user.username }}?')">
|
||||
<button type="submit" class="btn btn-sm btn-outline-warning" title="Reset Password">
|
||||
<i class="bi bi-key"></i>
|
||||
</button>
|
||||
</form>
|
||||
<form method="POST" action="{{ url_for('admin_user_delete', user_id=user.id) }}"
|
||||
class="d-inline" onsubmit="return confirm('Delete user {{ user.username }}? This cannot be undone.')">
|
||||
<button type="submit" class="btn btn-sm btn-outline-danger" title="Delete User">
|
||||
<i class="bi bi-trash"></i>
|
||||
</button>
|
||||
</form>
|
||||
{% else %}
|
||||
<span class="text-muted small">-</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card-footer text-muted small">
|
||||
<i class="bi bi-info-circle me-1"></i>
|
||||
Admins can add up to {{ max_users }} regular users.
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -46,6 +46,9 @@
|
||||
</a>
|
||||
<ul class="dropdown-menu dropdown-menu-end dropdown-menu-dark">
|
||||
<li><a class="dropdown-item" href="/account"><i class="bi bi-gear me-2"></i>Account</a></li>
|
||||
{% if is_admin %}
|
||||
<li><a class="dropdown-item" href="/admin/users"><i class="bi bi-people me-2"></i>Users</a></li>
|
||||
{% endif %}
|
||||
<li><hr class="dropdown-divider"></li>
|
||||
<li><a class="dropdown-item" href="/logout"><i class="bi bi-box-arrow-left me-2"></i>Logout</a></li>
|
||||
</ul>
|
||||
|
||||
@@ -17,7 +17,7 @@
|
||||
<i class="bi bi-person me-1"></i> Username
|
||||
</label>
|
||||
<input type="text" name="username" class="form-control"
|
||||
value="{{ username }}" readonly>
|
||||
placeholder="Enter your username" required autofocus>
|
||||
</div>
|
||||
|
||||
<div class="mb-4">
|
||||
@@ -26,7 +26,7 @@
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="password" name="password" class="form-control"
|
||||
id="passwordInput" required autofocus>
|
||||
id="passwordInput" required>
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="togglePassword('passwordInput', this)">
|
||||
<i class="bi bi-eye"></i>
|
||||
|
||||
Reference in New Issue
Block a user