Some checks failed
CD / Build and push images (push) Successful in 3m12s
CI / Lint, typecheck, test (push) Failing after 2m29s
CI / Auth e2e pack (push) Successful in 3m32s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 8s
CD / Smoke tests against Test (push) Successful in 1m11s
CD / Promote to Int (push) Successful in 11s
Instance operators get basic user administration for support, abuse handling, and GDPR groundwork (security.md §Privacy). - api `admin/`: Site-Admin-gated `/admin/users` — a searchable, paginated list (username, e-mail, status, role, pond count, last login) plus lifecycle actions: disable/enable (a disabled user is logged out everywhere and login is refused with the distinct `account_disabled`), resend verification, delete, and grant/revoke Site Admin. Guards: you cannot act on your own account (`cannot_modify_self`) and the last Site Admin cannot be dropped (`last_site_admin`). Every action is audit-logged with the actor. - `PseudonymizationService`: account deletion scrubs the PII, removes all login identities + sessions, and trashes the personal pond — the kept row is what authorship references, so shared content the user authored shows as "Deleted user" (no orphaned/cascaded content). - web: the Admin area gains a 'Users' surface — search, pagination, and the actions (destructive ones behind an inline two-step confirm; self-actions hidden). New `users` i18n namespace (de+en). - tests: `user-admin.e2e.db.test.ts` (disable → logout + login blocked; delete → pseudonymized authorship + personal pond trashed + credentials gone; last Site Admin and self protected; Site-Admin gating); a non-destructive browser `admin-users` pack proving disable-in-UI blocks login and enable restores it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
26 lines
889 B
TypeScript
26 lines
889 B
TypeScript
import { Module } from '@nestjs/common';
|
|
import { APP_GUARD } from '@nestjs/core';
|
|
|
|
import { MailModule } from '../mail/mail.module';
|
|
import { PondsModule } from '../ponds/ponds.module';
|
|
import { UsersModule } from '../users/users.module';
|
|
import { AuthController } from './auth.controller';
|
|
import { AuthGuard } from './auth.guard';
|
|
import { AuthService } from './auth.service';
|
|
import { AuthTokensService } from './auth-tokens.service';
|
|
import { SessionsModule } from './sessions.module';
|
|
|
|
@Module({
|
|
imports: [UsersModule, MailModule, SessionsModule, PondsModule],
|
|
controllers: [AuthController],
|
|
providers: [
|
|
AuthService,
|
|
AuthTokensService,
|
|
// Global default-protected: every route needs a session unless it
|
|
// opts out with @Public().
|
|
{ provide: APP_GUARD, useClass: AuthGuard },
|
|
],
|
|
exports: [AuthTokensService, AuthService],
|
|
})
|
|
export class AuthModule {}
|