kerimatilganandClaude Opus 4.7
e308c1a7b7
Backend - New routes/users.js (admin-only via requireAdmin) with list, create, update (incl. password reset) and delete endpoints. - All user-facing API responses identify users by uuid, not the numeric primary key — usernames can now be renamed without breaking external references. - Protection rules: cannot delete or demote the last admin; cannot delete or demote your own account. Schema / data - users table gained a uuid TEXT column (unique). Existing rows are backfilled with crypto.randomUUID() on startup. Setup endpoint and the create-user CLI both generate a UUID for new users. Frontend - New "Benutzer" tab in nav-tabs, marked admin-only and shown only after /api/auth/me reports isAdmin. - Modal with create / edit forms (password optional on edit = leave unchanged). XSS-safe rendering of the user list using the existing escapeHtml helper and data-* attributes for action buttons. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
59 lines
1.8 KiB
JavaScript
59 lines
1.8 KiB
JavaScript
#!/usr/bin/env node
|
|
// CLI: create-user <username> <password> [--admin]
|
|
// Useful for adding additional users outside the web UI.
|
|
|
|
const bcrypt = require('bcryptjs');
|
|
const { randomUUID } = require('crypto');
|
|
const { initDatabase, getDatabase, closeDatabase } = require('../database');
|
|
|
|
async function main() {
|
|
const args = process.argv.slice(2);
|
|
if (args.length < 2) {
|
|
console.error('Usage: npm run create-user -- <username> <password> [--admin]');
|
|
process.exit(1);
|
|
}
|
|
const username = args[0];
|
|
const password = args[1];
|
|
const isAdmin = args.includes('--admin');
|
|
|
|
if (password.length < 8) {
|
|
console.error('Passwort muss mindestens 8 Zeichen lang sein');
|
|
process.exit(1);
|
|
}
|
|
|
|
initDatabase();
|
|
// Give initDatabase a moment to run its serialized statements.
|
|
await new Promise(r => setTimeout(r, 200));
|
|
|
|
const db = getDatabase();
|
|
const hash = await bcrypt.hash(password, 10);
|
|
|
|
const uuid = randomUUID();
|
|
await new Promise((resolve, reject) => {
|
|
db.run(
|
|
'INSERT INTO users (uuid, username, password_hash, display_name, is_admin) VALUES (?, ?, ?, ?, ?)',
|
|
[uuid, username, hash, username, isAdmin ? 1 : 0],
|
|
function (err) {
|
|
if (err) reject(err);
|
|
else resolve(this.lastID);
|
|
}
|
|
);
|
|
}).then((id) => {
|
|
console.log(`User '${username}' angelegt (id=${id}, uuid=${uuid}, admin=${isAdmin}).`);
|
|
}).catch((err) => {
|
|
if (/UNIQUE/.test(err.message)) {
|
|
console.error(`User '${username}' existiert bereits.`);
|
|
} else {
|
|
console.error('Fehler:', err.message);
|
|
}
|
|
process.exitCode = 1;
|
|
});
|
|
|
|
closeDatabase();
|
|
}
|
|
|
|
main().catch(err => {
|
|
console.error(err);
|
|
process.exit(1);
|
|
});
|