Julian Boldt
552c88e425
Release / verify (push) Canceled after 0s
CI / checks (push) Canceled after 0s
CI / frontend (push) Canceled after 0s
CI / backend (push) Canceled after 0s
Release / test (push) Canceled after 0s
Release / publish (backend) (push) Canceled after 0s
Release / publish (frontend) (push) Canceled after 0s
Release / publish (proxy) (push) Canceled after 0s
Release / publish (updater) (push) Canceled after 0s
- **Single Sign-on (OIDC)**: Anmeldung über Authentik, Keycloak, Entra ID, Google u. a. (Authorization Code mit PKCE). Die Rolle kommt bei jeder Anmeldung aus den Gruppen des Anbieters, ohne zugeordnete Gruppe kommt niemand hinein; SSO-Konten werden nie mit lokalen Konten verknüpft; lokale Anmeldung bleibt als Notzugang. ID-Token werden streng geprüft (Signatur nur asymmetrisch, Aussteller, Zielgruppe, Ablauf, Nonce, einmaliger State), gegen einen nachgebauten Anbieter getestet (inkl. Fälschungsversuche). Neue Tabellen `oidc_settings`, `oidc_login_states`, Spalten `admin_users.auth_source/oidc_subject` (Migration `0013`). Neue Abhängigkeit: PyJWT. - **Behoben:** `opnexus backup --full` und `opnexus restore` (Vollsicherung, in 1.19.0 beschrieben) fehlten im 1.19.0-Bundle und -Updater-Image, weil die Änderung am Skript nicht mit eingecheckt war; sie sind erst ab dieser Version enthalten. - **Aufgabentrennung**: Schalter, mit dem nur Admins ausrollen dürfen, Operatoren aber vorbereiten (Migration `0014`).
43 lines
1.1 KiB
Python
43 lines
1.1 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
from enum import Enum
|
|
|
|
from pydantic import BaseModel, ConfigDict, Field
|
|
|
|
|
|
class UserRole(str, Enum):
|
|
admin = "admin"
|
|
# Rolls out and operates (rules, NAT, VPN, maintenance, tokens of its own) but cannot
|
|
# change who may access OPNexus or where it sends data (users, settings, hosts).
|
|
operator = "operator"
|
|
read_only = "read_only"
|
|
|
|
|
|
class UserCreate(BaseModel):
|
|
username: str = Field(min_length=1, max_length=150)
|
|
password: str = Field(min_length=10, max_length=1024)
|
|
# Defaults to the least-privileged role — an admin has to explicitly
|
|
# opt a new account into write access rather than it happening by
|
|
# omission.
|
|
role: UserRole = UserRole.read_only
|
|
|
|
|
|
class UserRoleUpdate(BaseModel):
|
|
role: UserRole
|
|
|
|
|
|
class UserPasswordReset(BaseModel):
|
|
new_password: str = Field(min_length=10, max_length=1024)
|
|
|
|
|
|
class UserRead(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: uuid.UUID
|
|
username: str
|
|
role: UserRole
|
|
created_at: datetime
|
|
last_login_at: datetime | None
|
|
totp_enabled: bool = False
|
|
auth_source: str = "local"
|