sysopsandClaude Sonnet 5
34bc8f76f9
- TOTP (RFC 6238, stdlib-only) enrollment in profile, login step-up, admin emergency reset. - Admins can grant a user visibility into individual clients (User.ClientIDs) in addition to whole-server access (User.ServerIDs). - New "My Access" page: non-admin users see only their assigned clients (view/QR/download only, no management), reachable from the main nav. - GetUser/GetUsers now redact TOTPSecret before returning JSON. No Go toolchain was available while writing this - not yet build-verified. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PvrfUytqd74H6WcQkRzFM4
25 lines
1.1 KiB
Go
25 lines
1.1 KiB
Go
package model
|
|
|
|
// User model
|
|
type User struct {
|
|
Username string `json:"username"`
|
|
Password string `json:"password"`
|
|
// PasswordHash takes precedence over Password.
|
|
PasswordHash string `json:"password_hash"`
|
|
Admin bool `json:"admin"`
|
|
// ServerIDs restricts a non-admin user to only these servers.
|
|
// Empty/nil means no server access at all (secure by default).
|
|
// Admins always have access to every server regardless of this field.
|
|
ServerIDs []string `json:"server_ids,omitempty"`
|
|
// ClientIDs grants a non-admin user visibility into these individual
|
|
// clients regardless of which server they belong to, in addition to
|
|
// whatever ServerIDs already grants full-server visibility into.
|
|
ClientIDs []string `json:"client_ids,omitempty"`
|
|
// TOTPSecret is the base32-encoded shared secret for this user's TOTP
|
|
// two-factor login (RFC 6238). Empty means 2FA is not enrolled.
|
|
TOTPSecret string `json:"totp_secret,omitempty"`
|
|
// TOTPEnabled gates whether TOTP is actually required at login. A user
|
|
// can have a secret provisioned but not yet confirm/enable it.
|
|
TOTPEnabled bool `json:"totp_enabled,omitempty"`
|
|
}
|